articles of incorporation

(a) "CPA" means the Colorado Privacy Act, C.R.S. § 6-1-1301 et seq., as amended, and any successor Colorado statute of similar scope and purpose.

(b) "Customer" means an individual who uses, purchases, subscribes to, accesses, or is the subject of the Corporation's products, services, software, communications, or data-processing activities, whether or not the individual pays the Corporation directly.

(c) "Customer Data" means any data, information, content, record, output, or inference concerning a Customer or derived from data, information, content, records, outputs, or inferences concerning a Customer, whether or not Personal Data and whether or not de-identified, anonymized, aggregated, pseudonymized, encrypted, or otherwise transformed. Customer Data excludes only Publicly Available Information, provided that records, metadata, inferences, or associations showing that a Customer accessed, viewed, generated, saved, collected, or interacted with Publicly Available Information remain Customer Data.

(d) "Founder" means Jeremie Miller.

(e) "Founder Consent" means a prior written instrument signed and dated personally by the Founder that specifically identifies the action approved and expressly states that it is given under this Article 8. Founder Consent may not be given by any agent, attorney-in-fact, personal representative, conservator, guardian, fiduciary, or other person acting for or on behalf of the Founder.

(f) "Founder Stewardship Period" means any period during which the Founder is serving as a director of the Corporation.

(g) "Fundamental Transaction" means any merger, conversion, domestication, share exchange, dissolution, liquidation, winding up, sale or other disposition of all or substantially all assets, transfer of control, or other transaction or series of related transactions that has substantially similar effect.

(h) "Mandatory Law" means an applicable statute, regulation, court order, judgment, subpoena, governmental demand, or other legal obligation that the Corporation cannot lawfully waive, vary, or avoid.

(i) "Personal Data" and "Targeted Advertising" have the meanings given to those terms in the CPA, as amended. "Publicly Available Information" means information excluded from "Personal Data" under the CPA because it is publicly available.

(j) "Provide" or "Provision" means any sale, license, sublicense, lease, disclosure, transfer, provision of access, making available, or other provision of Customer Data to any person or entity outside the Corporation.

(k) "Service Provider" means any person or entity engaged by the Corporation under a written agreement to process Customer Data solely on behalf of the Corporation or at the specific direction of the Customer, solely to the extent necessary to provide, maintain, secure, or support the product or service requested by the Customer. The agreement must prohibit independent use or disclosure of Customer Data, require processing only as instructed by the Corporation, impose confidentiality and security obligations no less protective than the Customer Privacy Covenant in Section 8.3, require return or deletion of Customer Data upon termination unless retention is required by Mandatory Law, and require any subcontractor to be bound by equivalent obligations. No engagement of a Service Provider under this Section 8.1(k) shall be construed as a "license" or "sublicense" for purposes of Section 8.3(a)(1).

(l) "Successor Designator" means the person from time to time serving in the role described in Section 8.4. The initial Successor Designator is identified in Section 8.4(c).

(a) The specific public benefit purpose of the Corporation is to advance digital self-determination by providing open-source, privacy-respecting tools and services that enable individuals to directly collect and gain insight from their personal data.

(b) The Customer Privacy Covenant in Section 8.3 is adopted to protect and operationalize the Corporation's specific public benefit purpose and is fundamental to the Corporation's status as a Colorado public benefit corporation.

(c) This Article 8 shall be construed to provide the greatest customer privacy protection permitted by applicable law. No bylaw, policy, resolution, agreement, course of dealing, failure to enforce, or corporate action may waive, narrow, or avoid this Article 8 except in accordance with Section 8.6.

(a) The Corporation's Provision of Customer Data to any person or entity outside the Corporation is restricted as follows:

(1) Absolute Prohibition. The Corporation shall not, under any circumstances, sell, license, sublicense, or lease Customer Data, whether or not for monetary or other valuable consideration. The exceptions in Section 8.3(a)(2) shall not be read to permit any sale, license, sublicense, or lease of Customer Data.

(2) Conditional Prohibition. The Corporation shall not Provide Customer Data to any person or entity outside the Corporation, whether or not for monetary or other valuable consideration, except solely as follows:

(i) to a Service Provider, solely to the extent strictly necessary to provide, maintain, secure, or support the product or service requested by the Customer;

(ii) as required by Mandatory Law, provided that the Corporation shall use reasonable efforts to limit the Provision to the minimum required and to notify the affected Customer unless notice is legally prohibited;

(iii) at the Customer's specific, informed, affirmative direction for the particular Provision or integration, and not by implied consent, bundled consent, broad terms of service, failure to opt out, or dark pattern.

(b) The Corporation shall not process Customer Data for Targeted Advertising. In addition, and without limiting the foregoing, the Corporation shall not engage in, or permit any other person or entity to engage in on its behalf, behavioral advertising or behavioral profiling using Customer Data, including first-party behavioral advertising, first-party behavioral profiling, cross-context behavioral advertising, or the creation, augmentation, or sale of behavioral profiles, regardless of whether such activity would be excluded from the definition of "Targeted Advertising" under the CPA (including by reason of any first-party, contextual, measurement, frequency-capping, or analogous exclusion). For purposes of this Section 8.3(b), the prohibitions in this paragraph apply as if all Customer Data were Personal Data.

(c) The Corporation shall not use a Fundamental Transaction, bankruptcy, reorganization, assignment, asset sale, data transfer, affiliate transfer, service-provider arrangement, or similar transaction to avoid this Section 8.3. Any Provision of Customer Data in connection with any such transaction must comply with this Section 8.3 and Section 8.5.

(d) The Corporation shall maintain a reasonable means for each Customer to access and export, in a standard, portable, machine-readable, and readily usable format, Customer Data stored by the Corporation that is reasonably capable of being associated with that Customer without re-identifying de-identified, anonymized, aggregated, or pseudonymized data and without compromising another Customer's privacy. To the extent reasonably technically practicable, this access and export capability shall be self-service and shall not require case-by-case discretionary approval by the Corporation. If self-service export is not reasonably technically practicable, the Corporation shall provide a direct export mechanism.

(a) Except as expressly provided in this Section 8.4, the number, election, qualification, term, and removal of directors shall be governed by the Colorado Business Corporation Act, these Articles, and the bylaws. Directors may be removed by shareholders only for cause. Cumulative voting shall not be permitted in the election of directors.

(b) Any vacancy on the board of directors resulting from the Founder ceasing to serve as a director for any reason may be filled only by written designation of the Successor Designator, to the fullest extent permitted by C.R.S. § 7-108-110. If no Successor Designator is then willing and able to serve, the vacancy may be filled as otherwise provided by the Colorado Business Corporation Act, these Articles, and the bylaws.

(c) The initial Successor Designator is Ramon Rhymes.

(d) During the Founder Stewardship Period, the Founder may replace the Successor Designator by written instrument signed and dated personally by the Founder and delivered to the Corporation. This right is personal to the Founder and may not be exercised by any agent, attorney-in-fact, personal representative, conservator, guardian, fiduciary, or other person acting for or on behalf of the Founder.

(e) A then-serving Successor Designator may designate a successor Successor Designator by written instrument signed and dated by the then-serving Successor Designator and delivered to the Corporation. The designation becomes effective when the then-serving Successor Designator ceases to serve, resigns, becomes unable or unwilling to serve, or declines to act.

(f) The Successor Designator's role is appointive only. The Successor Designator has no operational, managerial, supervisory, or oversight authority over the Corporation and, solely by serving in that role, is not a director, officer, shareholder, agent, or fiduciary of the Corporation or its shareholders. The Successor Designator shall select a director whom the Successor Designator reasonably believes is committed to the Corporation's specific public benefit purpose and to this Article 8.

(a) The Corporation shall not enter into or effect any Fundamental Transaction unless:

(i) the transaction complies with Section 8.3;

(ii) the transaction does not waive, narrow, avoid, or materially impair this Article 8;

(iii) if any Customer Data, product, service, or business line involving Customer Data is transferred to, assumed by, or made available to any surviving, resulting, acquiring, successor, or transferee entity, that entity assumes obligations no less protective than this Article 8 in its governing documents or in a written instrument enforceable by the Corporation and by its shareholders and former shareholders, who shall be express third-party beneficiaries of such written instrument with the right to enforce it directly, and such obligations shall survive the consummation of the transaction;

(iv) in any merger, conversion, domestication, share exchange, transfer of control, or other transaction in which the Corporation or its business continues in another entity, the surviving, resulting, acquiring, or successor entity is a Colorado public benefit corporation or an entity that, under its governing law and governing documents, is required to preserve a substantially equivalent specific public benefit and to manage in a manner substantially equivalent to the balancing obligations imposed on a Colorado public benefit corporation; and

(v) the transaction receives all approvals required by applicable law, these Articles, and Section 8.6.

(b) The Corporation shall not abandon, revoke, remove, or materially weaken its status as a Colorado public benefit corporation or its specific public benefit purpose except in accordance with Section 8.6.

(a) No amendment, restatement, repeal, waiver, adoption of an inconsistent provision, or other action having the effect of amending, repealing, waiving, narrowing, or avoiding this Article 8 shall be effective unless approved as required by applicable law and this Section 8.6.

(b) During the Founder Stewardship Period, any action described in Section 8.6(a) also requires Founder Consent.

(c) Outside the Founder Stewardship Period, any action described in Section 8.6(a) may be taken only if approved as required by applicable law and only:

(i) to strengthen the protections set forth in Section 8.3, the Customer's rights of access, export, or control over Customer Data, the restrictions set forth in Section 8.5, or the Corporation's status and obligations as a Colorado public benefit corporation; or

(ii) to the minimum extent strictly required by Mandatory Law, while preserving the substance and protections of this Article 8 to the maximum extent permitted by law.

(d) The Corporation shall not accomplish indirectly by bylaw, resolution, policy, agreement, restatement, merger, conversion, domestication, share exchange, dissolution, asset sale, transfer, recapitalization, course of dealing, failure to enforce, or otherwise any action that would be prohibited if taken directly under this Article 8.

If any provision of this Article 8 or its application to any person, entity, or circumstance is held invalid or unenforceable, the provision shall be enforced to the fullest extent permitted by law and reformed to the minimum extent necessary to make it valid and enforceable. The invalidity or unenforceability of one provision shall not affect the validity or enforceability of the remainder of this Article 8.