AI Sub-Processor Disclosure

1. Roles and Relationship

CEO Sightline LLC ("we," "us," or "our") operates SignalScope as a data controller. When you submit financial data to run a diagnostic, we engage Anthropic, PBC ("Anthropic") as a data processor solely to generate the plain-language narrative that accompanies your results.

Anthropic acts as a sub-processor under GDPR Article 28. We remain the data controller and are responsible for the lawful basis on which your data is processed and for the instructions under which Anthropic acts.

2. What Data Is Transmitted to Anthropic

When a diagnostic run is completed, the following data is transmitted to Anthropic's API to generate the narrative explanation:

• The numeric financial figures you submitted for that diagnostic run (revenue, expenses, receivables, payables, cash, and similar inputs).
• The structured output of SignalScope's rules-based scoring engine (dimension scores and pattern classification).
• Contextual metadata about the business (industry, accounting basis, entity type) where provided.

No account credentials, payment information, government identifiers, or sensitive personal data as defined under GDPR Article 9 are transmitted to Anthropic.

3. Purpose of Processing

Data is transmitted to Anthropic for a single, limited purpose: to generate a plain-language narrative that explains the diagnostic output produced by SignalScope's rules-based engine. The AI does not calculate scores, make determinations, or perform independent analysis — it explains what the engine found.

The narrative is returned to SignalScope and displayed in your report. Once generated, the interaction concludes. No further processing by Anthropic occurs in connection with that request.

4. Anthropic's Data Handling Commitments

Anthropic processes API data under commitments that include:

• No model training. Data submitted via the Anthropic API is not used to train or fine-tune Anthropic's AI models.
• Limited retention. Anthropic retains API inputs and outputs for a limited period for trust and safety purposes, after which they are deleted. Retention periods are governed by Anthropic's API usage policies.
• Sub-processor controls. Anthropic maintains its own sub-processor list and security controls governing how data is handled within its infrastructure.
• Data Processing Addendum. CEO Sightline LLC operates under Anthropic's commercial Data Processing Addendum (DPA), which governs the controller-processor relationship and includes standard contractual protections consistent with GDPR Article 28.

Anthropic's privacy practices, DPA, and API usage policies are governed by Anthropic and are available at anthropic.com/legal/privacy.

5. Lawful Basis for This Processing

The transmission of your financial data to Anthropic occurs as part of delivering the service you have requested. The lawful basis for this processing is the performance of a contract (GDPR Article 6(1)(b)) — specifically, to produce the diagnostic report you initiated. This processing is disclosed at the point of account registration and is described in our Privacy Policy.

6. Data Location

Anthropic's infrastructure is primarily located in the United States. Where you are located in the European Economic Area or United Kingdom, transfer of data to Anthropic is governed by Anthropic's Data Processing Addendum, which incorporates Standard Contractual Clauses as a transfer mechanism consistent with GDPR Chapter V.

7. Your Rights

Data processed by Anthropic on our behalf remains subject to your rights as a data subject. Requests to access, correct, delete, or restrict processing of your personal data should be directed to us — not to Anthropic — as we are the data controller. We will coordinate with Anthropic as required to fulfill lawful requests within applicable timeframes.

To exercise your rights, contact us at support@ceosightline.com.

8. Changes to This Disclosure

If we engage a different or additional AI sub-processor, or if the scope of data transmitted to Anthropic materially changes, we will update this page and the effective date above. Material changes will be communicated by direct notice to registered users where required by applicable law.

9. Contact

Questions about this disclosure or about AI data processing may be directed to:

CEO Sightline LLC
support@ceosightline.com