Effective date: July 10, 2026

This Privacy Policy explains how Magellan Contracting Services ("Magellan," "we," "us," or "our") collects, uses, stores, protects, and shares information in connection with our website, business operations, Microsoft 365 workflows, LinkedIn-related workflows, document management, relationship management, and MagellanOS / MAGS ("MAGS" or "Mags").

MAGS is the internal operating system and executive intelligence layer used by Magellan Contracting Services to organize business records, documents, relationships, projects, vendors, investors, tasks, communications, and approved executive workflows.

This policy is intended for publication on the Magellan Contracting Services website and may also be used as the privacy policy for LinkedIn Developer, Microsoft 365, and other approved integration review processes.

This policy applies to information relating to:

• Website visitors.
• Business contacts, clients, prospects, suppliers, subcontractors, investors, vendors, professional advisors, and partners.
• Employees, contractors, applicants, and internal team members, where applicable.
• LinkedIn contacts and company-page interactions handled through approved workflows.
• Microsoft 365 content connected to Magellan workflows, including Outlook, Teams, OneDrive, SharePoint, calendar, contacts, and documents.
• Personal or sensitive files intentionally placed into a separate private MAGS vault for owner-approved review and memory.

This policy does not replace any separate contract, employee handbook, investor agreement, vendor agreement, nondisclosure agreement, or legally required notice that may apply to a specific relationship or jurisdiction.

Depending on how you interact with Magellan and MAGS, we collect or process the following categories of information.

We collect names, company names, titles, roles, phone numbers, email addresses, physical addresses, country, sector, relationship type, tags, notes, status, follow-up dates, linked projects, meeting notes, and related documents.

We collect project names, client details, site addresses, project types, budgets, costs, schedules, milestones, permits, tasks, notes, subcontractor and supplier records, insurance or compliance documents, pricing notes, payment terms, lead times, and related communications.

We collect investor names, company or entity names, contact details, investor type, investment interests, committed capital, deployed capital, target returns, projects invested in, follow-up dates, documents, meeting notes, tags, and status.

We collect document names, document types, related modules, linked contacts or entities, upload dates, expiration dates, status, version, owner, notes, tags, file attachments, document previews, review notes, file metadata, and extraction results.

Where applicable, we collect employee or contractor names, roles, contact information, employment records, wage or compensation records, policy acknowledgments, tax records, payroll-related records, HR files, compliance documents, and related notes. This information is handled as sensitive business and personal information and is access-controlled.

We collect EV part names, part numbers or SKUs, categories, manufacturers, suppliers, compatibility information, specifications, costs, sale prices, stock quantities, reorder points, lead times, warranty information, certifications, documents, notes, tags, and status.

If authorized by Magellan, MAGS may connect to Microsoft 365 services such as Outlook, Teams, OneDrive, SharePoint, Calendar, and Contacts. Depending on approved permissions, MAGS may process email content or metadata, calendar events, Teams messages or channel information, files, folders, document metadata, contacts, and collaboration records.

Microsoft 365 data is used only for authorized business workflow, synchronization, document management, executive briefing, record organization, task tracking, and backup or retrieval functions. We do not use Microsoft API data for advertising or ad targeting.

MAGS supports two LinkedIn operating modes.

Relationship Intelligence Mode allows authorized users to manually enter or upload LinkedIn-related business relationship records, including profile URLs, names, companies, titles, countries, sectors, relationship status, last contact, next follow-up, opportunity notes, documents sent, copied message text, screenshots, strategic priority, and internal notes.

Official API Mode may be enabled only if LinkedIn approves the required products, permissions, and scopes. If enabled, MAGS will use only LinkedIn-approved permissions for authorized workflows such as sign-in, company-page publishing preparation, comment review or management, engagement tracking, and analytics, where LinkedIn permits those functions.

MAGS does not use LinkedIn scraping, cookie-based login, credential collection, fake user activity, auto-connections, mass messaging, browser automation, automated posting, automated commenting, automated liking, or unauthorized collection of LinkedIn content.

MAGS may process prompts, instructions, uploaded documents, notes, records, summaries, task requests, drafts, recommendations, executive briefings, workflow logs, model outputs, and human approval decisions.

MAGS may use approved AI systems or service providers to help summarize, classify, draft, compare, search, reason over, or organize information. MAGS is designed so that external business actions require human approval before execution.

Our website or hosting provider may collect IP address, browser type, device information, pages viewed, timestamps, referral information, cookies, contact form submissions, and basic analytics or security logs. GoDaddy or other website hosting providers may process technical information according to their own terms and privacy practices.

We collect information when:

• You provide it directly to us.
• We create records during business operations.
• You send email, documents, messages, proposals, contracts, invoices, or other business communications.
• We receive information from clients, vendors, suppliers, subcontractors, investors, professional advisors, or public business sources.
• An authorized user enters information into MAGS.
• An authorized user connects Microsoft 365 or another approved service.
• LinkedIn information is manually entered, uploaded, or received through an approved LinkedIn API permission.
• Our website or service providers collect technical information needed to operate and secure the site.

We use information to:

• Operate Magellan Contracting Services.
• Manage contacts, projects, suppliers, subcontractors, investors, documents, EV parts, and business workflows.
• Prepare executive briefings, task lists, follow-ups, draft communications, and decision support.
• Manage Microsoft 365 workflows, including Outlook, Teams, OneDrive, SharePoint, calendars, files, and contacts.
• Maintain LinkedIn relationship intelligence and approved company-page workflows.
• Prepare human-reviewed outreach, proposals, reports, presentations, summaries, and internal notes.
• Track compliance, permits, policies, HR records, compensation records, tax records, and audit trails.
• Improve internal organization, search, document review, knowledge management, and institutional memory.
• Protect systems, detect errors, prevent unauthorized access, and maintain security.
• Comply with legal, tax, accounting, employment, regulatory, contractual, and reporting obligations.
• Enforce agreements and protect the rights, safety, and property of Magellan, its personnel, and its business partners.

Where privacy laws require a legal basis for processing, we rely on one or more of the following:

• Consent.
• Performance of a contract or steps taken before entering a contract.
• Compliance with legal obligations.
• Legitimate business interests, including operating the business, managing relationships, maintaining records, securing systems, and improving internal workflows.
• Protection of vital interests, where applicable.
• Establishment, exercise, or defense of legal claims.

MAGS may use AI-assisted processing to organize information, summarize documents, draft text, recommend follow-ups, identify missing records, prepare executive briefings, classify files, and support business analysis.

MAGS does not independently approve contracts, make legal commitments, make employment decisions, make credit or investment eligibility decisions, post to LinkedIn, send LinkedIn messages, send mass communications, or take external actions without human approval.

AI outputs are drafts or recommendations unless expressly reviewed and approved by an authorized human decision-maker.

For LinkedIn-related data and workflows, Magellan and MAGS will:

• Use only approved LinkedIn API permissions and scopes.
• Respect LinkedIn rate limits, permission boundaries, developer documentation, and applicable terms.
• Keep LinkedIn access credentials, secrets, and tokens confidential.
• Request only the information needed for approved workflows.
• Avoid scraping, crawling, spidering, cookie-based login, credential collection, and unauthorized browser automation.
• Avoid fake engagement, auto-connection behavior, auto-messaging, and mass messaging.
• Avoid automated posting, commenting, liking, or replying without human approval and without LinkedIn-approved functionality.
• Avoid selling, renting, leasing, disclosing, or transferring LinkedIn content except as permitted by LinkedIn and applicable law.
• Delete LinkedIn API-derived data, tokens, or profile data when required by LinkedIn terms, applicable law, or a valid user request, unless retention is legally required.

Manual Relationship Intelligence records that an authorized user enters into MAGS are internal business records and are handled under this policy. If LinkedIn later grants API access, API-derived data will be segregated and handled according to LinkedIn requirements.

For Microsoft 365 and Microsoft API data, Magellan and MAGS will:

• Use Microsoft data only within permissions granted by the authorized user or organization.
• Use email, calendar, contact, file, Teams, OneDrive, and SharePoint data only for authorized business workflows.
• Not use Microsoft API data for advertising, ad targeting, or resale.
• Not redistribute, resell, or sublicense Microsoft APIs or Microsoft API data.
• Store credentials and tokens securely.
• Allow access only to authorized users and systems.
• Disconnect or remove Microsoft 365 access when no longer needed or when requested by an authorized administrator.

We do not sell personal information.

We share information only as needed for legitimate business, legal, operational, security, or approved integration purposes. Categories of recipients may include:

• Authorized personnel and approved contractors.
• Microsoft 365 and related Microsoft services.
• Website hosting providers such as GoDaddy.
• LinkedIn, when an approved LinkedIn workflow is used.
• Approved AI, document processing, database, security, backup, or workflow service providers.
• Professional advisors, including lawyers, accountants, tax advisors, auditors, and consultants.
• Clients, suppliers, subcontractors, investors, or partners where needed for a business transaction or project.
• Government, regulatory, tax, law enforcement, or court authorities when legally required.
• Successors or counterparties in a merger, acquisition, financing, restructuring, or sale of business assets.

Service providers are expected to process information only for authorized purposes and to protect it appropriately.

Magellan may operate or support work involving the United States, Rwanda, Kenya, Uganda, Tanzania, Ghana, and other jurisdictions. Information may be processed in the United States or other countries where Magellan, its service providers, or approved technology providers operate.

Where required, Magellan will use appropriate safeguards for international transfers and will consider applicable data protection obligations in the relevant jurisdictions.

We retain information only as long as reasonably necessary for the purposes described in this policy, unless a longer period is required or permitted by law, contract, tax, accounting, employment, audit, regulatory, insurance, security, dispute-resolution, or legitimate business needs.

Typical retention factors include:

• The nature and sensitivity of the information.
• The purpose for which it was collected.
• Legal, tax, employment, regulatory, and contractual requirements.
• Whether a project, relationship, dispute, audit, or investigation remains active.
• Whether the information is needed for institutional memory, records management, security, or compliance.

LinkedIn API-derived data and tokens will be deleted when required by LinkedIn terms, applicable law, termination of API access, closure of the relevant account, or a valid deletion request, unless retention is legally required.

We use reasonable administrative, technical, and organizational safeguards designed to protect information against unauthorized access, loss, misuse, alteration, or disclosure.

Current and planned safeguards may include:

• Local-first storage where appropriate.
• Access controls and role-based permissions.
• Secure local environment variables for credentials and secrets.
• Password protection, MFA where available, and least-privilege access.
• Audit logs and activity records.
• Segregation of sensitive records, including HR, compensation, tax, legal, investor, and personal vault materials.
• Secure backups and controlled restoration procedures.
• Encryption where supported by the applicable platform or storage layer.
• Vendor review before connecting major technology providers.

No system is perfectly secure. We continue to improve security as MAGS evolves.

Our website may use cookies or similar technologies for:

• Basic website functionality.
• Security.
• Performance.
• Contact forms.
• Analytics.
• Remembering preferences.

You can usually control cookies through your browser settings. Some website features may not work correctly if cookies are disabled.

GoDaddy or other website hosting tools may use their own cookies or analytics technologies. Their use of information is governed by their own policies.

If we send marketing or business development communications, you may opt out by following the unsubscribe instructions in the message or by contacting us. We will still send transactional, legal, security, project, contract, or relationship-related communications when appropriate.

We do not use Microsoft API data or LinkedIn API data for advertising or ad targeting.

Depending on where you live and your relationship with Magellan, you may have rights to:

• Request access to personal information we hold about you.
• Request correction of inaccurate or incomplete information.
• Request deletion of personal information, subject to legal and business retention requirements.
• Request restriction of processing.
• Object to certain processing.
• Withdraw consent where processing is based on consent.
• Request portability of certain information.
• Opt out of marketing communications.
• Opt out of sale or sharing of personal information where applicable. Magellan does not sell personal information.
• Lodge a complaint with a relevant data protection authority, where applicable.

To make a privacy request, use the contact form or contact details published on the Magellan Contracting Services website and mark the request "Privacy Request - MAGS." We may need to verify your identity before responding.

Some U.S. state privacy laws provide residents with additional rights, including rights to know, access, correct, delete, obtain a copy of, and opt out of certain uses of personal information.

Magellan does not sell personal information and does not share personal information for cross-context behavioral advertising as those terms are commonly used in U.S. state privacy laws. If that practice changes, this policy will be updated and any required opt-out mechanism will be provided.

We will not discriminate against you for exercising privacy rights.

Magellan and MAGS are not directed to children. We do not knowingly collect personal information from children under 13, or under a higher age where applicable law requires parental consent. If you believe a child has provided personal information to us, contact us so we can review and delete it where required.

Our website, documents, or workflows may link to third-party websites or services, including Microsoft, LinkedIn, GoDaddy, AI providers, data providers, and other business tools. Their privacy practices are governed by their own privacy policies and terms. We are not responsible for the privacy practices of third-party websites or services.

We may update this Privacy Policy from time to time as Magellan, MAGS, our integrations, or applicable laws change. The updated policy will show a new effective date. Material changes will be posted on the website or communicated where appropriate.

For privacy questions, requests, or concerns, contact Magellan Contracting Services using the contact form or contact details published on the Magellan Contracting Services website.

Please mark privacy-related requests: Privacy Request - MAGS