FERTILITYFORGE™ LEGAL STUDIO PRIVACY POLICY Copyright © 2026 by Ferguson Reproductive Law Effective Date: July 25, 2026 Last Updated: July 28, 2026 This Privacy Policy (this "Policy") describes how Heresy Werks, LLC, a California limited liability company ("Heresy Werks," "we," "us," or "our"), collects, uses, stores, and discloses information in connection with the FertilityForge platform, including FertilityForge™ Legal Studio, together with the related websites, applications, features, and functionality (collectively, the "Platform"). Heresy Werks operates the Platform as software. Heresy Werks is not a law firm and does not provide legal services. The Platform is the technology through which Ferguson Reproductive Law (the "Firm"), a law firm, delivers certain legal services. Information you share in the course of the Firm's legal services is also protected by the attorney-client privilege, the Firm's professional duty of confidentiality, and the California Rules of Professional Conduct. Those professional obligations govern the Firm's handling of your information alongside this Policy, and nothing in this Policy waives them. This Policy is incorporated into the FertilityForge Terms of Use (the "Terms of Use"), and terms not defined here have the meanings given in the Terms of Use. 1. Who We Are 1.01 The Software Operator. Heresy Werks provides and administers the Platform as software. For the information processed through the Platform, Heresy Werks determines the purposes and means of processing and is the entity responsible for this Policy. Where a data-protection law uses a term such as "business," "controller," or "regulated entity," Heresy Werks is that entity for the Platform's data processing, except where this Policy states that the Firm's professional obligations govern. 1.02 The Firm. Ferguson Reproductive Law is a law firm, and not a corporation. The Firm delivers legal services through the Platform under a separate written retainer agreement (the "Retainer"). Client-matter information collected in the course of the Firm's legal services is confidential client information, and the Firm's professional obligations govern its handling of that information alongside this Policy. 1.03 The Two Roles. Heresy Werks provides software. The Firm provides legal services. Heresy Werks does not direct or control the Firm's professional judgment and does not share in the Firm's legal fees. 2. Scope 2.01 What This Policy Covers. This Policy covers information processed through the Platform, whether you use the Platform as a Prospective Client or as a Retained Client, as those terms are defined in the Terms of Use. This Policy also covers information the Platform processes about people who do not use the Platform themselves, as described in Section 4.04. 2.02 Relationship to the Retainer. This Policy does not govern the legal services the Firm provides to you. Those services, and the attorney-client relationship, are governed by the Retainer and by the law and rules of professional conduct applicable to the Firm. 2.03 Washington Consumer Health Data. If you are a Washington consumer, additional disclosures required by the Washington My Health My Data Act appear in the Washington Consumer Health Data Privacy Policy issued jointly by Heresy Werks and the Firm, which is linked on the homepage of the FertilityForge website and on the homepage of the Firm's website. That policy governs consumer health data as defined by that Act, whether collected through the Platform or through the Firm's website. 2.04 Marketing Website. The FertilityForge marketing pages are hosted on Squarespace. Squarespace collects limited technical information from visitors to those pages as described in Section 8, and Squarespace's own privacy and cookie policies govern that collection. 3. Information We Collect We collect the following categories of information, most of which you provide through the guided intake and walkthrough, and some of which is generated or captured automatically. 3.01 Identity and Contact Information. For each named party (Intended Parents, Gestational Carriers, known donors, and spouses or partners), we collect legal name, email address, phone number, mailing address (including international addresses), gender or gender identity, and relationship to the counterparty. 3.02 Reproductive and Fertility Information. This is sensitive information. It includes the agreement type (gestational carrier, egg donation, sperm donation, or embryo donation) and matched status, a Gestational Carrier's prior-birth history and cohabitation intent, the genetic origin and gamete sourcing of embryos, the method of conception (including whether conception is non-clinical), donor anonymity status, and the involvement, name, state, and contact of any clinic or agency. Where a party is anonymous, identity fields are intentionally not collected. 3.03 Health-Adjacent Information. We collect the medical clearance status and the psychological clearance status recorded for a carrier or donor. 3.04 Financial Information. For gestational carrier matters, we collect compensation and expense information, which may be uploaded as a document or selected from a menu, and the dollar amounts and payment schedules extracted from those materials. 3.05 Legal-Document Contents. We collect the full text of the agreement prepared for your matter, your walkthrough answers, questions, and change requests, and attorney redlines, notes, and any content flagged for review. 3.06 Account and Access Information. Attorney users of the Platform have accounts with an email address and a password, which we store only in hashed form. Clients do not have accounts and access their matter through a secure link, as described in Section 9. 3.07 Communications. We collect the communications you send through the Platform or by email in connection with your matter. 3.08 Payment Information. When you pay a retainer fee, payment is processed by Stripe, Inc. ("Stripe"). Stripe handles your payment-card information. Neither Heresy Werks nor the Firm stores your full payment-card number. 3.09 Technical Information. We capture your Internet Protocol (IP) address when you accept the Terms of Use and related disclaimers, together with the acceptance timestamp and a hash of the text you accepted, and we use your IP address transiently to limit the rate of intake requests. For gestational carrier matters, we collect the Intended Parents' answer to a background-check completion question. 3.10 Information We Do Not Collect. We do not set advertising identifiers, and we do not use analytics, telemetry, or tracking pixels in the Platform. We do not collect biometric information. 4. Sources of Information 4.01 From You. Most information comes from you, through the guided intake and walkthrough, through documents you upload, and through your acceptance of the Terms of Use and related disclaimers. 4.02 Generated Automatically. Some information, such as your IP address and acceptance records, is captured automatically when you use the Platform. 4.03 From Others in Your Matter. In the course of the Firm's legal services, information may come from the counterparty, from counsel, or from a clinic or agency involved in your matter. 4.04 Information About People Who Do Not Use the Platform. A Referring Agency may submit information to the Platform about people who do not use the Platform themselves, including a gestational carrier, a donor, or the spouse or partner of a party. That information may include identity and contact details, reproductive and fertility information, and health-adjacent information such as medical or psychological clearance status, and it may reach us in documents the agency uploads, such as a match sheet or a compensation package. We require a Referring Agency to hold the authority and the consent necessary to send us that information before it does so. We do not sell or share this information, and we use it only to prepare and deliver the legal services described in this Policy. Information about a person who is or becomes a client of the Firm is also protected by the attorney-client privilege and the Firm's professional duty of confidentiality. Where we notify such a person about our handling of their information, we do so through that person's attorney if they are represented in the matter, and directly if they are not. A person who believes we hold information about them may contact us at the address in Section 17. 5. How We Use Information We use the information we collect for the following purposes. 5.01 Provide the Platform and the Services. We use your information to prepare and tailor the reproductive-law agreement for your matter, to explain sections and answer your questions during the walkthrough, to extract and organize compensation terms, and to support the Firm's review, clearance, and management of your matter. 5.02 Communicate With You. We use your contact information to send you communications about your matter, including the secure link to your walkthrough. 5.03 Process Payments. We use payment information, through Stripe, to process retainer fees. 5.04 Secure the Platform. We use technical information, including your IP address, to protect the Platform, to limit the rate of requests, and to detect and prevent misuse. 5.05 Comply With Law and Professional Obligations. We use and retain information as necessary to comply with applicable law and, for the Firm, with its professional obligations. 6. Artificial-Intelligence Processing and the Sanitization Boundary 6.01 Local-First Processing. The Platform is designed to process your information within infrastructure controlled by the Firm and Heresy Werks. Local models and tools, including entity recognition, embeddings, classification, optical character recognition, and text-to-speech, run on that infrastructure and do not transmit your information to a third-party artificial-intelligence provider. 6.02 Sanitized Transmission to Anthropic. Certain quality-sensitive, client-facing features transmit inputs to Anthropic, PBC ("Anthropic"), the provider of the Claude application programming interface, to generate plain-language explanations, answer questions, prepare draft language, and extract compensation terms. Before any such transmission, the Platform applies a process intended to remove or substitute personally identifying information, consistent with Section 7.03 of the Terms of Use. 6.03 What This Process Does and Does Not Do. The sanitization process substitutes known identifiers, such as names, addresses, clinics, and physicians, and screens new free text for unrecognized identifiers before transmission. If the process cannot complete, the request fails rather than transmitting unsanitized text. This process reduces, but does not eliminate, the information transmitted. Even after sanitization, the substance of the reproductive-law content, such as agreement structure and clause text, is transmitted to Anthropic without direct identifiers. 6.04 Anthropic's Handling. Anthropic processes these inputs under its commercial terms. Under those terms, Anthropic does not use the inputs or outputs to train its models unless the customer chooses to provide the data for that purpose, and Anthropic deletes the inputs and outputs on its systems within thirty (30) days by default. You can review Anthropic's commercial terms and data-handling practices on Anthropic's website. 6.05 Attorney Review. The Platform's artificial-intelligence features support the Firm's work and do not replace the attorney. The Firm reviews drafts and agreements, and the Platform does not make final legal decisions about you through automated processing alone. 6.06 Consent. By using the artificial-intelligence features of the Platform, you consent to the processing described in this Section. 7. Third Parties That Process Information We disclose information to the following categories of service providers, each of which processes information on our behalf or to deliver a service you request. We do not disclose your information to advertisers, data brokers, or analytics vendors. 7.01 Artificial-Intelligence Provider. We transmit sanitized inputs to Anthropic, as described in Section 6. 7.02 Payment Processor. We transmit payment information to Stripe to process retainer fees. 7.03 Email Provider. We send transactional email through Proton (Proton Business Mail). Client email is addressed to the first Intended Parent and contains limited content, such as first names, the matter number, and the secure walkthrough link. Internal notices are sent to the Firm. 7.04 Website Host. The FertilityForge marketing pages are hosted on Squarespace, which collects limited technical information from visitors as described in Section 8. 7.05 Disclosures in Legal Representation. Ordinary disclosures made in the course of the Firm's legal services, such as to a counterparty, counsel, clinic, or court, occur through the Firm's practice and are governed by the Retainer and the Firm's professional obligations, not by this Policy. Status information the Platform makes available to a Referring Agency is a function of the Platform and is governed by Section 7.07. 7.06 Disclosures Required by Law. We may disclose information where required by law or valid legal process, or to protect rights, safety, or the integrity of the Platform. 7.07 Status Information to a Referring Agency. Where you have authorized a Referring Agency to receive status information about your matter, the Platform makes available to that agency a limited, fixed set of milestones showing the stage your matter has reached. The Platform does not make available to a Referring Agency the content of your agreement, the questions you ask, the changes you request, the sections or questions you send to the Firm for review, or any other substance of your matter. Your authorization, and the scope of what is shared, are set out in your Retainer, and you may withdraw that authorization as provided there. 8. The Marketing Website and Cookies 8.01 Cookie-Minimal Design. The FertilityForge marketing pages place only essential cookies unless you affirmatively allow more. Optional analytics cookies are off by default and are placed only if you accept them through the cookie banner. We use no advertising, marketing, or retargeting trackers, and we have connected no third-party analytics service to those pages. The cookie manager displays an advertising category as a platform default. We have connected no advertising service, so no advertising cookies are placed whether or not that category is enabled. Visitor activity logging is disabled, so visitor IP addresses are not collected into site analytics. A banner at the foot of the site describes this setting, offers a decline control in the first layer, and provides a persistent preferences control so that you may change your choice at any time. 8.02 Squarespace's Role. Squarespace hosts the marketing pages and, as an independent controller for its own security and integrity purposes, collects limited technical information from visitors, such as IP address and device and browser information. Squarespace's own privacy policy and cookie policy govern that collection. 8.03 The Platform Itself. The guided walkthrough does not set advertising or analytics cookies. It stores two local audio-interface preferences on your device, which contain no identifiers. For attorney users, we set a secure, HTTP-only session cookie to keep the attorney signed in. 9. Security 9.01 Attorney Authentication. Attorney users sign in with an email address and a password. We store passwords only in hashed form. We maintain server-side sessions with a limited lifetime and secure, HTTP-only cookies, and we apply role-based access so that only authorized roles can reach attorney functions. Signing out invalidates the session. 9.02 Client Access. Clients do not have accounts. Each client reaches the client's own matter through a cryptographically signed link that the Platform validates on every request. A link is specific to one matter and cannot be used to reach a different matter. Because access depends on the link, you should keep your link private and share it only with people you authorize. 9.03 In Transit. Information transmitted to Anthropic travels over an encrypted connection, and email to Proton travels over an encrypted connection. At go-live on our hosting provider, connections to the Platform are secured with transport-layer encryption. 9.04 At Rest. Information the Platform stores for local processing is masked so that direct identifiers are removed. Other stored information, including the primary database and generated documents and email logs, is currently stored without encryption at rest. Encryption at rest is planned and not yet in place. We describe this honestly so you can make an informed decision. 9.05 A Known Limitation. Certain internal administrative maintenance functions are not yet protected by authentication. This is acceptable only while the Firm is the sole operator, and these functions will require authentication before any shared or multi-user deployment. 9.06 No Perfect Security. No system is completely secure. We cannot guarantee the security of information, and you provide information with that understanding. 10. Data Retention and Deletion 10.01 How Long We Keep Information. We keep client-matter files for five (5) years after the matter closes, consistent with the Firm's professional file-retention obligations, and then we delete them. We keep information that is not part of a client matter for no longer than twelve (12) months, or until it is no longer needed for the purpose for which it was collected, whichever is shorter. 10.02 How We Handle a Deletion Request. If you ask us to delete your information, we remove it from the active Platform and stop further processing. For information that is part of a client matter, we retain the underlying file in secured storage for the professional-retention period in Section 10.01, and then we delete it. We honor deletion requests through a process the Firm carries out, not through an automated self-service function. 10.03 Limits on Deletion. We may retain information where retention is required by law, by the Firm's professional obligations, or by a legal hold or pending dispute. Where a professional-retention obligation applies, that obligation governs the timing of deletion. 11. Your Rights 11.01 Rights We Provide. As a matter of policy, and whether or not a particular threshold under the California Consumer Privacy Act applies to us, we provide you the rights to know what information we hold about you, to access it, to correct it, to delete it (subject to Section 10), and to limit our use of sensitive personal information. Reproductive and health information is sensitive personal information under California law, and we treat it accordingly. 11.02 Washington Consumers. If you are a Washington consumer, your rights under the Washington My Health My Data Act, including the rights to access, delete, and withdraw consent with respect to consumer health data, are described in the joint Consumer Health Data Privacy Policy. 11.03 European Economic Area and United Kingdom. If you are in the European Economic Area or the United Kingdom, you have the rights to access, correct, delete, restrict, object to, and port your information, and to withdraw consent. The lawful bases on which we rely are the performance of a contract with you, your consent (for the artificial-intelligence processing described in Section 6), our legitimate interests in operating and securing the Platform, and compliance with law. You may lodge a complaint with your supervisory authority. 11.04 Other United States States. If you reside in a United States state with an applicable consumer privacy law, you have the rights that law provides. Michigan has not enacted a comprehensive consumer privacy law as of the date of this Policy. We monitor developments and, in the meantime, apply the baseline described here together with Michigan's breach-notification law. 11.05 We Do Not Sell or Share. We do not sell your personal information, and we do not share it for cross-context behavioral advertising. 11.06 No Retaliation. We will not deny you services or otherwise treat you unfairly for exercising your rights. 12. How to Exercise Your Rights 12.01 How to Submit a Request. To exercise a right, contact us at info@heresywerks.com and describe the right you wish to exercise. 12.02 Verification. Because clients do not have accounts, the Firm verifies your identity directly before acting on a request that concerns client-matter information. We may ask you for information sufficient to confirm that you are the person whose information is the subject of the request, or that you are authorized to act on that person's behalf. 12.03 Timing. We respond within forty-five (45) days. Where reasonably necessary, we may extend our response by an additional forty-five (45) days and will tell you if we do. If we deny a request, you may appeal by replying to our response and stating that you are appealing. 13. Children The Platform is for adults. You must be at least eighteen (18) years old to use the Platform. We do not knowingly collect information from anyone under eighteen (18). Some information relates to donor-conceived persons, including genetic origin and donor anonymity. We treat that information as sensitive and lasting, and we handle it consistent with this Policy and the Firm's professional obligations. 14. International Data Transfers 14.01 Where We Process. At go-live, the Platform is hosted on infrastructure located in the European Union. Information you provide is processed there and on the Firm's infrastructure. 14.02 Transfers to the United States. Certain service providers are located in the United States. Sanitized inputs are transmitted to Anthropic, and payment information is transmitted to Stripe. Where these transfers involve information subject to European Economic Area or United Kingdom data-protection law, we rely on the standard contractual clauses and data-processing terms offered by each provider. We do not certify our participation in any data privacy framework. 15. Attorney-Client Privilege and Professional Confidentiality Separate from, and in addition to, this Policy, information you share with the Firm, whether as a Prospective Client or a Retained Client, is subject to the attorney-client privilege and the Firm's professional duty of confidentiality. Those obligations are independent of this Policy, and in many respects are stricter than it. Nothing in this Policy waives, or is intended to waive, the privilege or the Firm's duty of confidentiality. 16. Changes to This Policy We may update this Policy from time to time. If we make a material change, we will post the updated Policy with a revised "Last Updated" date and, where appropriate, provide additional notice. Your continued use of the Platform after an update takes effect constitutes your acceptance of the updated Policy. 17. Contact Questions about this Policy or our privacy practices, and requests to exercise your rights, may be directed to Heresy Werks, LLC at info@heresywerks.com. Questions about your legal matter, the Retainer, or the Firm's services should be directed to Ferguson Reproductive Law at consult@fergusonrlaw.com.