SCAMCAM PRIVACY POLICY

Last Modified: October 15, 2026

Patrol Technologies Ltd. and its affiliated companies (collectively, “Patrol”, “we”, “our” or “us”) are the developers and owners of the ScamCam mobile application (the “App”), which is designed to enhance users’ security and safety by helping them detect fraud and scam operations directed against them.

The purpose of this privacy policy (“Policy” or "Privacy Policy") is to provide you with important information and explanations about how and why we process Personal Data related to you when you ("you", “your” or “Users”) browse on our website, landing pages, marketing campaigns, engaging with ads and campaigns promoting our services, install, access and use any of Apps and web services features (collectively “Services”).

We encourage you to read this Policy carefully and reach out to us if you have any further questions.

The App uses a third-party AI system to analyze the Input, currently OpenAI. The Input (as defined below) is sent to the AI system provider without any User or device identifier, solely to provide the services (as further explained under our Terms of Use). The AI system provider does not train its models on such data. We, and the third-party AI system provider, may further process Non-User Personal Data (as defined and described in the section below), in the event your Inputs include any third party’s information.

IPPL Disclosure: The information you provide will be stored in Patrol’s databases and used only as described in this Privacy Policy. We will not transfer your information to third parties except as described in this Privacy Policy or as required to comply with applicable legal obligations. You are not legally required to provide Personal Data; however, if you do not provide certain Personal Data, we might be unable to provide certain services or respond to your inquiries. You have the right to review and request correction of your information in accordance with the Protection of Privacy Law, 5741-1981 (Israel) (“IPPL”). To the extent that the Protection of Privacy Law, 5741 – 1981 (“IPPL”)) apply to the processing of Personal Data by us; by using the Services, you agree to the collection, disclosure, storage and use of Personal Data as described in this Policy. If you do not agree to Patrol collecting, storing, using, or sharing Personal Data relating to you as described in this Policy, please refrain from using or otherwise engaging with our Services.

US State Privacy Specifications: see Annex A- “Additional notice for United States residents”, to learn more about our privacy practices and your rights under US jurisdiction, including, to the extent that the California Privacy Rights Act, as amended by the California Privacy Rights Act (“CCPA”) apply to the processing of Personal Data, the “Additional notice for United States residents” shall serves as a Notice at Collection and Privacy Policy as required under the CCPA.

1. UPDATES AND AMENDMENTS

We may update and amend this Policy from time to time, at our sole discretion. The most recent version of the Policy will always be accessible from our website and Apps. The updated date of the Policy will be reflected in the “last modified” heading. In case of a material change, or if required by law, we will provide notice reflecting these changes and any such material amendments to our privacy practices described under this Policy will become effective within the period noted in such notice. Unless otherwise notified, any changes will become effective when we publish the modified Policy.

2. DATA CONTROLLER CONTACT INFORMATION

Patrol Technologies Ltd. is the “data controller” (as such term, or equivalent, is defined under applicable data protections legislation) that decides upon the purpose and means of processing Personal Data. you may contact us:

By Email: [email protected]

By Mail: [____________]

3. PERSONAL DATA WE PROCESS & PURPOSE OF COLLECTION AND USE

“Personal Data” means information that identifies an individual or that can reasonably be used to identify an individual, either directly or indirectly, as further defined under applicable laws (including equivalent terms such as “personal information” or “personally identifiable information”). Anonymous or aggregated information that does not include Personal Data and cannot reasonably be used to identify, or be attributed to, a specific individual (“Non-Personal Data”) is not considered Personal Data and shall not be subject to this Policy. For example, where a check involving a link results in a scam verdict, we keep the address of the website, the verdict, category and day, without any device identifier. If Non-Personal Data is combined or linked with Personal Data, we will treat it as Personal Data for as long as it remains combined.

The App and Service are not intended to collect or process (and to the best of our knowledge do not) “Sensitive Data” as defined under applicable laws (including equivalent terms such as “highly sensitive information”, “special categories of personal data”, or “sensitive personal information”). Users are therefore requested not to submit or upload any such Sensitive Data through the Service, which includes, depending on the jurisdiction and applicable laws, racial or ethnic origin, religious or philosophical beliefs, sexual orientation, health related information, certain financial information, etc.

We may collect different categories of Personal Data and Non-Personal Data from you, depending on the nature of your interaction with the Services provided through the website, Apps, web-services, as detailed above. We have detailed below, the Personal Data processed, the purpose and operation and the lawful basis. In addition, we may use certain Personal Data to prevent potentially prohibited or illegal activities, fraud, misappropriation, infringements, identity thefts, and any other misuse of the Services and to enforce the Terms, as well as to protect the security or integrity of our databases and the Services, and to take precautions against legal liability. Such processing is based on our legitimate interests.

Detailed information on the Personal Data processed, the purpose and the lawful basis:

(a) Unique Identifiers: When you use the App (including tools and features made available through the Apps, we identify unique identifiers associated with your device, mobile identifiers, IP address etc. (“Unique Identifiers”). Unique Identifiers are used for authentication, analytics and operational purposes, correcting errors and bugs, to secure our Services and related systems, to enable you to use the Services and to provide you with its functionalities and are processed subject to our legitimate interest in ensuring the security of our Services, authentication, understanding how our Services are used, correcting errors and enhancing experience.

(b) Usage Data: We further process, directly or indirectly through our third-party service providers, usage data, including information regarding your interaction with the App and Services, features used, time stamp and duration of use, click stream data, errors that occurred, inputs including the posture, landscape, non-identifying characteristics of items and faces detected in Inputs, instructions, prompts (however excluding Face Data, defined above) (collectively “Usage Data”). We will use Usage Data and inferred data for statistical, analytical purposes and internal development. Usage Data and inferred data and other metadata as well as Inputs used for internal development, services improvement and personalization are processed subject to our legitimate interest to improve our Services and technology. Where required, for example, when using the Usage Data, Inputs and outputs to train AI model we will do so solely subject to your request

(c) Support: When you contact us for customer support, we will process your contact information, as well as any information you choose to provide as part of our communications and correspondence. We will use contact information to provide customer support and communicate with you. We will retain such communications to have records of the support that was provided, for any future needs as well as to further improve our Services and support. We process such information, for the purpose of providing the support services and performing our contract with you. We will further retain our communications for record keeping and services improvement, including training our customer support team, based on our legitimate interest.

(d) Personal Data Included in the Inputs: We process the data you choose to submit, such as screenshots and photos, pasted text, links, QR codes, and any information extracted from them (“Input”), in order to analyze them, provide an assessment as to whether such content appears to be a scam, including a verdict, category, short explanation, and markings on the submitted screenshot and perform our contract with you, all as detailed in the Terms of Use. Input may contain Personal Data related to other individuals, such as names, telephone numbers, and faces (such individuals are referred to herein as “Non-User(s)”). Non-User data is treated as content, is not used by us to identify any individual, and is processed and deleted as described above. If you are not authorized to do so or do not have the necessary consent, please do not upload Personal Data of Non-Users beyond what is necessary for the check. Non-User data is processed based on our legitimate interest in providing the Services to our Users.

Inputs are transmitted from your device to our servers over an encrypted connection using the encryption key stored on your device. Accordingly, while your Input is stored on our servers, it is stored in encrypted form only and cannot be accessed by us in readable form. Your Input is processed in readable form only in server memory, for the time needed to perform the check and to send it to the third-party AI system provider, and is cleared when the check ends. The stored copy of your Input is deleted from our servers immediately once your device confirms that the result was saved, and in any event no later than 24 hours from the start of the session. Limited technical records of a check that contain no content (such as IDs, sizes, and times) may remain in our hosting provider’s backups for up to 30 days. We will retain a readable copy of an Input beyond that period only if you actively choose to send it to us by reporting a scam, by sending feedback together with the check.

(e) Permissions: Depending on the App used or the features you wish to enjoy, you will be asked to grant us access permissions such as access to photo gallery, microphone or audio files, tracking tools, push notification, access to your social accounts, etc. (“App Permissions”). We will use these permissions to process the information needed to provide the Service or enhance the Service. Such permissions include access to photos, access to camera, push notifications and App Tracking Transparency. To access these App Permissions, you will need to actively and explicitly enable them through an in-app permission or mobile settings.

4. HOW WE COLLECT YOUR INFORMATION

Depending on the nature of your interaction with us, we may collect the above detailed Personal Data from you, as follows: (i) Automatically, when you visit our website or interact with our App and Services, including through the use of cookies, SDKs and similar tracking technologies, as well as, where applicable; and (ii) Directly from you, when you voluntarily choose to provide us with information, such as when you upload Inputs that contain Personal Data.

5. COOKIES AND SIMILAR TECHNOLOGIES

We may use cookies, tracking pixels (also known as clear GIFs and web beacons), third party software development kits (SDKs) as detailed below, and other technologies in order to maintain, provide, and improve our Services. These technologies provide necessary operations (remembering your preferences), and analytic performance information (your use of the Apps).

6. DATA SHARING – CATEGORIES OF RECIPIENTS WE SHARE PERSONAL DATA WITH

We share Personal Data relating to you with third parties, including our partners or service providers that help us provide our Services. When we share data with service providers and partners, we ensure they only have access to such information that is strictly necessary for us to provide the Services. These parties are required to secure the data they receive and to use the data for pre-agreed purposes only while ensuring compliance with all applicable data protection regulations (such service providers may use other Non-Personal Data for their own benefit).

You can find here information about the categories of such third-party recipients:

(a) Service Providers: service providers process Personal Data on Patrol’s behalf and are limited to using such Personal Data solely for the purpose of providing the services, specifically-

• General Service Providers: Process all Personal Data listed above, except for the Outputs or Inputs stored locally on your device, including, cloud hosting providers, CRM, internet service providers, operating systems and platforms, data and cyber security services, fraud detection services, Apple Store, etc.
• Third party AI System Providers: process the Input for the purpose of generating the Output and performing the Services.
• Trackers and Analytic Providers, Marketing Providers: process the Unique Identifiers and Usage Data to provide us with analytic information, crashes and errors, as well as information on our marketing campaigns promoting Apps and Services.

(b) Subsidiaries and Affiliated Companies: We may share Personal Data, internally within our group or in the event of a corporate transaction (e.g., sale of a substantial part of our business, merger, consolidation or asset sale). In the event of the above, our affiliated companies or acquiring company will assume the rights and obligations as described in this Policy. Such recipients process all Personal Data except for data which is stored locally on your device.

(c) Authorities, Security Providers, Governmental Agencies: For protecting rights and safety of our Services and Apps, we may share Personal Data with others if we believe in good faith that this will help protect the rights, property or personal safety of users or individuals, or any members of the public. This will include legal and law enforcement purposes, meaning, in response to a verified request relating to terror acts, criminal investigations or alleged illegal activity or any other activity that may expose us, you, or any other user to legal liability, and solely to the extent necessary to comply with such purpose. Such disclosure or access may occur if we believe in good faith that: (a) we are legally compelled to do so; (b) disclosure is appropriate in connection with efforts to investigate, prevent, or take action regarding actual or suspected illegal activity, fraud, or other wrongdoing; or (c) such disclosure is required to protect our legitimate business interests, including the security or integrity of our services. The Personal Data could include any Personal Data except for data which is stored locally on your device, depending on the purpose and needs.

7. YOUR RIGHTS

Our goal is to be clear about what information we collect so that you can make meaningful choices about how it is used. We allow you to exercise certain choices and controls in connection with your information. Depending on your relationship with us, your jurisdiction and the data protection laws that apply to you, you may have certain rights with respect to your personal information.

In the table below you can review your choices depending on your interaction with us, how you can exercise them, and appeal a decision we take in this regard. Any specification per geo-location or territory are available below the table:

We will investigate and attempt to resolve complaints and disputes and will make every reasonable effort to respect your wish to exercise your rights as quickly as possible and in any event, within the timescales provided by data protection laws.

8. DATA RETENTION

In general, unless a different retention period is described above, we retain the Personal Data we collect for as long as it remains necessary for the purposes set forth above, when permissible by law or regulation, or until you request to delete your information, where applicable.

Other circumstances in which we may retain Personal Data relating to you for longer periods of time when permissible by law or regulation include: (i) where we are required to do so in accordance with legal, regulatory, tax, or accounting requirements; (ii) for us to have an accurate record of your dealings with us in the event of any complaints or challenges; or (iii) if we reasonably believe there is a prospect of litigation relating to Personal Data relating to you.

Please note that except as required by applicable law or our specific agreements with you, we will not be obliged to retain Personal Data relating to you for any particular period, and we are free to securely delete it or restrict access to it for any reason and at any time, with or without notice to you.

9. SECURITY MEASURES

We implement appropriate and industry-standard technical, organizational, and security measures to reduce the risks of damage to (or loss of) information, or any unauthorized access or use of information. This includes a protocol for responding to a data security incident that may compromise the security of Personal Data. However, these measures do not provide absolute information security. Therefore, although efforts are made to secure Personal Data relating to you, it is not guaranteed, and you cannot expect that the Services will be immune to information security risks or attacks. Also, as the security of information depends in part on the security of the computer, device or network you use to communicate with us, the security of Personal Data relating to you depends on you as well. Please make sure to take appropriate measures including the use of secure networks and devices and the protection of your access credentials.

Please contact us if you become aware of a third party's attempt to gain unauthorized access to any of Personal Data relating to you. We will make a reasonable effort to notify you and the appropriate authorities (if required by applicable law) in the event that we discover a security incident related to Personal Data relating to you.

10. INTERNATIONAL DATA TRANSFER

Actual processing operation per each purpose of use and lawful basis detailed above may differ, it usually includes a set of operations made by automated means, such as collection, storage, use, disclosure by transmission, erasure, or destruction. Transfer of Personal Data to third-party countries is based on the same lawful basis as stipulated above. Our data servers in which we host and store the information are located globally including in the US and EU. The headquarters are based in Israel where we may access the information stored on local servers, cloud-hosting servers or other systems and platforms used. In the event that we need to transfer Personal Data relating to you out of your jurisdiction, we will take appropriate measures to ensure that Personal Data relating to you receives an adequate level of protection as required under applicable law. Furthermore, when Personal Data that is collected within the European Economic Area ("EEA"), United Kingdoms or Swiss, is transferred outside of such jurisdiction, to a country that has not received an adequacy decision from the European Commission or the ICO, we will take necessary steps in order to ensure that sufficient safeguards are provided during the transferring of such Personal Data, in accordance with the provision of the EU, UK or Swiss Standard Contractual Clauses or, as applicable the EU/UK -US Data Privacy Framework. Thus, we will obtain contractual commitments or assurances from the data importer to protect Personal Data relating to you, using contractual protections that regulators have pre-approved to ensure Personal Data relating to you is protected.

11. ELIGIBILITY AND CHILDREN’S PRIVACY

The Services are not intended for use by children under the age of 16 and we do not knowingly process children's information. We will discard any information we receive from a User that is considered a child immediately upon discovering that such a User shared information with us. Please contact us and let us know if you have reason to believe that a child has shared any information with us.

ANNEX A- ADDITIONAL NOTICE FOR UNITED STATES RESIDENTS

Information provided below supplements the information contained in this Privacy Policy and applies to residents of such states. These additional disclosures are intended to provide you with additional information with regard to our handling of Personal Data relating to you and certain consumer rights.

Residents of certain U.S. states (depending on the applicable state law, acting as an individual or in the household context only and not in a commercial or employment context, as a job applicant or as a beneficiary of someone acting in an employment context or as representative of a business), may have additional rights under applicable privacy laws and be entitled to additional disclosures.

“Personal Data” under applicable US privacy laws, generally means any information that is linked or reasonably linkable to an identified or identifiable individual (and usually does not include publicly available information that is lawfully made available from government records, or that a consumer has otherwise made available to the public; de-identified or aggregated consumer information; or information excluded from the states laws scope.

“Sensitive Data” includes data revealing racial, ethnic or national origin; religious beliefs; information regarding an individual’s medical history, mental or physical health condition, diagnosis or medical treatment; neural data; status as transgender or non-binary; sex life or sexual orientation; status as a victim of a crime; citizenship or immigration status; genetic or biometric data; Personal Data collected from a known child; and precise geolocation data.

We are required to provide you with a clear and accessible privacy notice that includes the categories of Personal Data processed, the purpose of processing, the categories of Personal Data shared with third parties, the categories of third parties with whom Personal Data is shared, the categories of Personal Data that is sold or used for targeted advertising, if any, the categories of third parties to whom the Personal Data is sold, if any, a list of your data rights and instructions for exercising those rights and appealing decisions, and out contact information. This information is detailed under this Privacy Policy and further below.

1. Categories of Personal Data & Categories of Third Parties with Whom Personal Data is Shared:

Under Section 3 of the Privacy Policy “Personal Data Sets We Process & Purpose of Collection and Use”, we describe our collection and processing of Personal Data, the categories of Personal Data that are collected or processed, and the purposes for which Personal Data is processed, stored or used. We will not collect additional categories of Personal Data or use the Personal Data we collected for materially different, unrelated, or incompatible purposes without obtaining your consent, unless we are otherwise entitled, required or permitted under applicable laws.

Additionally, under Section 6 of the Privacy Policy “Data Sharing – Categories of Recipients We Share Data with” we detail and disclose the categories of third parties we share Personal Data with for a business purposes.

Additional Disclosures:

• “Sale” of Personal Data: Under US privacy laws, in principle, the term “sale” refers to disclosing or making available Personal Data to a third-party in exchange for monetary or other valuable consideration, including for targeted advertising purposes. We do not “sell” information as this term is commonly understood, meaning - we do not, and will not, disclose Personal Data relating to you in direct exchange for money or some other form of payment. However, subject to the definition of the term “sale” under applicable US privacy laws, our practice of using “cookies or other third-party advertising services and sharing Personal Data for such purpose to third party advertising and marketing providers (e.g., providers of marketing tools and analytic tools, advertising networks, social media networks, media buying, search platforms) is considered a “sale”. Such practice includes the following Personal Data categories shared with these third parties: Unique Identifiers (device ID, IP), Internet and electronic network activity information (engagement with our App and ads promoting our App), and Geolocation data derived from IP.

2. Consumer Rights Related to Their Personal Data:

Section 7 under this Privacy Policy “Your Rights” provides additional information regarding your principal rights. Residents of certain U.S. states may have additional rights under applicable privacy laws, subject to certain limitations, which may include:

• Access – the right to confirm whether we are processing their Personal Data and to obtain a copy of their Personal Data in a portable and, to the extent technically feasible, readily usable format.
• List of Third Parties – the right to receive a list of the specific third parties to which we have disclosed either Personal Data relating to you or any Personal Data.
• Delete – the right to request us to delete their Personal Data provided to or obtained by us.
• Correct – the right to request us to correct inaccuracies in their Personal Data, taking into account the nature and purposes of the processing of the Personal Data.
• Opt-Out – the right to opt out of certain types of processing, including: (i) to opt out of the “sale” of their Personal Data; (ii) to opt out of targeted advertising by us; and (iii) to opt out of any processing of Personal Data for profiling in furtherance of making decisions that produce legal or similarly significant effects. However, as noted above, we do not engage in profiling in furtherance of legal or similarly significant decisions.
• Appeal – the right to appeal if we decline to take action in response to your exercise of a privacy right.
• Non-Discrimination – the right to not be discriminated against for exercising your privacy rights.

For more information about rights for US residents, please see: https://oag.ca.gov/privacy/ccpa

Exercising Consumer Privacy Rights: You may submit a request to exercise most of your privacy rights under US state privacy laws by contacting us at: [email protected].

Authorized agents may initiate a request on behalf of another individual, provided that they provide proof of their authorization, and we may also require that the individual directly verify his/her identity and the authority of the authorized agent.

We will respond to your request within the timeframe required under applicable law, and we reserve the right to extend the response time subject to applicable law requirements. If we refuse to take action on a request, we will notify you and our notification will include a justification for declining to take action and instructions on how you may appeal. Within the timeframe set out under applicable law on our receipt of your appeal, we will inform you in writing of any action taken or not taken in response to the appeal, including a written explanation of the reasons for the decisions. If the appeal is denied, you may submit a complaint to the applicable authority or Attorney General of your jurisdiction.