bylaws

Section 1.1 — Name. The name of the corporation is sol pbc.

Section 1.2 — State of Incorporation. sol pbc is incorporated in the State of Colorado as a public benefit corporation under the Colorado Business Corporation Act (C.R.S. Title 7, Articles 101 through 117). The articles of incorporation are filed with the Colorado Secretary of State and are published at solpbc.org.

Section 1.3 — Public Benefit Purpose. The corporation's specific public benefit purpose is set forth in Article 8, Section 8.2 of the articles of incorporation. These bylaws are subordinate to that purpose and to the covenants in Article 8.

Section 2.1 — Board Size. The number of directors is one (1) as of the date of these bylaws. The number may be increased or decreased by resolution of the board of directors or by action of the shareholders, subject to Article 8 of the articles of incorporation. The initial sole director is the Founder, Jeremie Miller.

Section 2.2 — Election of Directors. Directors are elected by the shareholders, except as provided by Article 8, Section 8.4 of the articles of incorporation regarding vacancies arising from the Founder ceasing to serve as a director. Cumulative voting is not permitted, as provided by Article 8, Section 8.4(a) of the articles of incorporation.

Section 2.3 — Removal of Directors. Directors may be removed by shareholders only for cause, as provided by Article 8, Section 8.4(a) of the articles of incorporation.

Section 2.4 — Vacancies. Vacancies on the board of directors are filled in accordance with the Colorado Business Corporation Act and Article 8, Section 8.4 of the articles of incorporation. A vacancy resulting from the Founder ceasing to serve as a director is filled exclusively by the Successor Designator pursuant to Article 8, Section 8.4(b) of the articles of incorporation.

Section 2.5 — Term. Each director holds office until the next annual meeting of shareholders or until a successor is elected and qualified, or until the director's earlier death, resignation, or removal in accordance with these bylaws and the articles of incorporation.

Section 2.6 — Meetings; Quorum; Voting. The board of directors may meet, take action by written consent, and conduct business in accordance with the Colorado Business Corporation Act. A majority of directors then in office constitutes a quorum. Action of the board requires the affirmative vote of a majority of directors present at a meeting at which a quorum is present, except as otherwise provided in the articles of incorporation, these bylaws, or the Colorado Business Corporation Act.

Section 2.7 — Officers. The corporation has such officers as the board of directors determines from time to time. The Founder is the initial President and Secretary of the corporation. The board may appoint additional or replacement officers, who serve at the pleasure of the board, subject to any written employment or service agreements.

Section 2.8 — Employees and Service Providers. The corporation may engage employees and Service Providers as needed to fulfill its mission. All such persons must comply with the data governance covenants in Article 8 of the articles of incorporation and Article III of these bylaws. Any written agreement with an employee or Service Provider that involves access to or processing of Customer Data must include terms consistent with those covenants.

As used in this Article III, "Customer," "Customer Data," and "Service Provider" have the meanings given to those terms in Article 8 of the articles of incorporation.

Section 3.1 — Encryption and Access Controls. The corporation shall maintain reasonable technical, administrative, and physical safeguards for Customer Data, including encryption of Customer Data in transit and at rest, least-privilege access controls, and access logging. The corporation shall use the most protective processing architecture reasonably practicable for each system and shall design and improve its systems toward architectures — including end-to-end encryption, customer-held keys, secure enclaves, and confidential computing — that minimize and, where reasonably practicable, eliminate operator access to plaintext Customer Data.

Section 3.2 — Government Compulsion. In the event of government compulsion to disclose Customer Data, the corporation shall (a) resist disclosure to the maximum extent permitted by law, (b) notify the affected Customer if legally permitted, and (c) pursue technical architectures, such as Customer-held encryption keys, that make compelled disclosure technically infeasible.

Section 3.3 — Behavioral Profiling, Tracking, and Analytics. This Section 3.3 operationalizes Section 8.3(b) of the articles of incorporation and is subordinate to it. Nothing in this Section 3.3 limits, narrows, or qualifies Section 8.3(b); to the extent of any conflict, Section 8.3(b) and Section 6.2 of these bylaws control.

(a) Behavioral tracking. The corporation shall not engage in, and shall not permit any other person or entity to engage in on its behalf, behavioral tracking of Customers across sessions, devices, applications, websites, or other contexts. For purposes of this Section 3.3, "behavioral tracking" means the collection, correlation, or persistence of records of a Customer's interactions, navigation, attention, presence, or activity for the purpose of, or in a manner reasonably capable of, identifying or characterizing that Customer's behavior over time, across contexts, or across distinct interactions with the corporation's products or services.

(b) Behavioral analytics and profiling. The corporation shall not engage in, and shall not permit any other person or entity to engage in on its behalf, behavioral analytics that profile Customer behavior or that build, augment, infer, score, or maintain interest, affinity, attention, intent, or similar behavioral models of a Customer. The terms "behavioral profile" and "behavioral profiling" in this Section 3.3 have the same meaning as in Section 8.3(b), and the prohibitions in this Section 3.3 apply as if all Customer Data were Personal Data, on the same terms as Section 8.3(b).

(c) Third-party analytics, tracking pixels, and telemetry. The corporation shall not engage, integrate, embed, deploy, or otherwise enable any third-party analytics vendor, tracking pixel, web beacon, software development kit, telemetry endpoint, attribution service, measurement service, or comparable service that receives, would receive, or is configured to receive Customer Data or behavioral signals derived from Customer interactions. A service is not converted into a permitted Service Provider under Section 8.1(k) of the articles of incorporation by virtue of being labeled "analytics," "telemetry," "measurement," "diagnostics," "performance," "engagement," "attribution," or by any similar label; the Service Provider definition controls.

(d) Cross-context behavioral measurement. The corporation shall not engage in, and shall not permit any other person or entity to engage in on its behalf, cross-context behavioral measurement of Customers — including measurement that combines, correlates, or otherwise relates a Customer's activity in one context (such as a product, surface, session, device, or property) with that Customer's activity in any other context — except solely to the minimum extent strictly necessary to deliver the specific product or service requested by that Customer, and only for so long as strictly necessary for that delivery.

(e) No exclusions, no rebrands. The prohibitions in this Section 3.3 apply regardless of whether the activity in question would be excluded from the definition of "Targeted Advertising" under the CPA (including by reason of any first-party, contextual, measurement, frequency-capping, or analogous exclusion), and regardless of whether the activity is characterized as first-party, contextual, anonymized, aggregated, de-identified, pseudonymized, hashed, encrypted, "essential," "necessary," "functional," "performance," "diagnostic," or by any similar label. No relabeling, technical transformation, or characterization may be used to bring otherwise-prohibited activity within an exception.

(f) Permitted operational activity. Nothing in this Section 3.3 prohibits operational activity that does not involve behavioral tracking, behavioral analytics, behavioral profiling, or cross-context behavioral measurement, including: (i) ephemeral session state strictly necessary to deliver the Customer-requested service and not retained beyond what that delivery requires; (ii) security, fraud-prevention, abuse-detection, integrity, and incident-response activity strictly necessary to protect Customers, the corporation, or the corporation's systems; (iii) error logs and crash reports that do not contain Customer Data or behavioral signals reasonably capable of being associated with a Customer; (iv) aggregate operational counters that are not reasonably capable of being associated with a Customer and do not derive from behavioral profiles; and (v) any other activity expressly permitted by Section 8.3 of the articles of incorporation. This Section 3.3(f) is a clarification of scope, not an authorization for any activity prohibited by Section 8.3.

Section 3.4 — Operational Only; Article 8 Controls. This Article III is operational only. The substantive prohibitions on the sale, license, transfer, disclosure, or other provision of Customer Data are set forth in Article 8, Section 8.3 of the articles of incorporation. Nothing in this Article III may be construed to permit any action prohibited by Article 8.

Section 4.1 — Funding. The corporation may raise capital through SAFE agreements, equity rounds, or other instruments that do not conflict with Article 8 of the articles of incorporation or the corporation's specific public benefit purpose.

Section 4.2 — Revenue Constraints. The corporation may earn revenue only through activities that comply with Article 8 of the articles of incorporation. Revenue shall not be derived from any sale, license, lease, disclosure, transfer, Targeted Advertising use, or other provision of Customer Data prohibited by Article 8.

Section 4.3 — No Investor Data or Intellectual Property Rights by Status. No investor, shareholder, SAFE holder, or similar financing counterparty obtains any right to access Customer Data or corporation intellectual property solely by virtue of that status. Any separate contractual right remains subject to Article 8 of the articles of incorporation.

Section 5.1 — Annual Benefit Report. As required by Colorado public benefit corporation law (C.R.S. § 7-101-507), the corporation shall prepare an annual benefit report that includes (a) a narrative description of the ways in which the corporation promoted its specific public benefit purpose during the preceding year and the best interests of those materially affected by the corporation's conduct; (b) any circumstances that have hindered the corporation's promotion of its specific public benefit purpose; (c) an assessment of the corporation's overall social and environmental performance during the preceding year, evaluated against a recognized third-party standard selected by the board of directors; (d) the process and rationale for the board's selection of, or any change in, the third-party standard; and (e) any other information required by applicable law.

Section 5.2 — Delivery and Posting. The corporation shall deliver the annual benefit report to each shareholder and shall post the report on the public-facing portion of the corporation's website if the corporation maintains a website. The corporation may omit financial or proprietary information from the publicly posted version to the extent permitted by applicable law.

Section 6.1 — Bylaw Amendment Process. These bylaws may be amended by the board of directors or by the shareholders, in accordance with the Colorado Business Corporation Act, except that no amendment to these bylaws may amend, waive, narrow, or avoid Article 8 of the articles of incorporation.

Section 6.2 — Article 8 Controls. If any provision of these bylaws conflicts with Article 8 of the articles of incorporation, Article 8 controls. No bylaw, amendment, policy, resolution, officer action, director action, shareholder action, or course of dealing may amend, waive, narrow, or avoid Article 8 except as expressly permitted by Article 8 and applicable law.

Section 7.1 — Exclusive Forum for Internal Corporate Claims. Unless the corporation consents in writing to the selection of an alternative forum, the state courts of Colorado shall be the exclusive forum for any internal corporate claim, as defined in C.R.S. § 7-102-108, to the fullest extent permitted by law. If no Colorado state court has personal and subject-matter jurisdiction over such claim, the United States District Court for the District of Colorado shall be the exclusive forum, if it has personal and subject-matter jurisdiction. If neither such court has personal and subject-matter jurisdiction, the claim shall be brought in another court located in Colorado with personal and subject-matter jurisdiction. This Section 7.1 shall not be construed to confer jurisdiction on any court, to prohibit a Colorado court from hearing a claim, or to require arbitration of any internal corporate claim.

Section 7.2 — Indemnification. The corporation shall indemnify its directors and officers to the maximum extent permitted by the Colorado Business Corporation Act, and may, by written agreement, board resolution, or insurance, provide indemnification to other agents and persons acting on behalf of the corporation.

Section 7.3 — Fiscal Year. The fiscal year of the corporation shall be the calendar year, unless changed by resolution of the board of directors.