Privacy
policy.

This Privacy Policy applies to the following entities, which together constitute Buxton Helmsley for purposes of this Policy:

• Buxton Helmsley, Inc., a holding company;
• Buxton Helmsley USA, Inc., an exempt reporting adviser;
• Buxton Helmsley Fund Management, LLC, which serves as manager of the fund; and
• Buxton Helmsley Fund GP, LLC, which serves as the general partner of the fund.

The entity responsible for the Site and for the processing described in this Policy is Buxton Helmsley, Inc., 1185 Avenue of the Americas, Floor 3, New York, NY 10036-2600.

3.1 · Information You Provide to Us

Depending on how you interact with us, we may collect the following personal information that you provide:

• Identifiers and contact information, such as your name, postal address, email address, telephone number, employer, and title.
• Investor onboarding and verification information, which we collect from persons who inquire about or subscribe for our securities or interests in a fund we manage. This may include date of birth, citizenship or nationality, government-issued identification (such as a driver’s license or passport number), and a taxpayer identification number or Social Security number, together with supporting identity-verification documentation. For an entity investor, it may include the same information about its authorized signatories, beneficial owners, and controlling persons.
• Financial and suitability information, such as income, net worth, source of funds, investment experience and objectives, and information necessary to verify accredited-investor or qualified-purchaser status under applicable securities laws, including in connection with offerings conducted under Rule 506(c) of Regulation D, and details of the bank accounts used for payments to or from you.
• Subscription and holdings information, such as the amount and status of a subscription, your electronic signature and the record of how and when it was given, and your holdings and transactions in our securities or fund interests.
• Account and authentication information, such as the username, password, and verification codes you use to access the investor portal. We store passwords only in a form that cannot be read back. If you sign in with a passkey, we receive only a public key that your device creates; any fingerprint, face, or other biometric data used to unlock the passkey stays on your device and is never sent to us.
• Placement agent information, such as a firm’s legal name, registration numbers, regulatory status, and certifications regarding disqualifying events, and the names and contact details of its representatives.
• Communications and requests, including the contents of inquiries you submit through forms on the Site, correspondence, calls, and text messages, details of meetings you schedule through our booking pages, and your choices about the communications you receive from us.

If you give us personal information about another person, such as a joint investor, a beneficial owner, or a colleague, you confirm that you are permitted to do so and, where the law requires it, that you have told that person about this Privacy Policy.

3.2 · Information We Collect Automatically

When you use the Site, we and our service providers may collect certain information by automated means, including:

• your IP address and approximate location derived from it;
• your device type, operating system, and browser type;
• referring and exit pages, the pages and content you view, and the links you click;
• the dates and times of your visits;
• for the investor portal, a record of each sign-in and of failed sign-in attempts, including the time, IP address, approximate location, and browser;
• a record of each time a document is opened or downloaded through the Site, as described in Section 10; and
• whether the emails we send you are opened and whether you follow the links in them, as described in Section 4.

3.3 · Information From Our Communications Systems

When you email, call, text, or meet with members of our staff, our systems record that communication. These records may include email messages and their details, calendar invitations and meeting details, the telephone numbers, times, and durations of calls, and the content of text messages. We file these records, together with your contact details, in our relationship-management system, and your contact details may be copied into the address books of our staff. Section 8 describes these records further.

3.4 · Information From Other Sources

We may also collect personal information from:

• service providers that perform identity verification, accredited-investor verification, and sanctions and politically-exposed-person screening on our behalf;
• a business-information provider, from which we may obtain professional details such as your title, employer, business contact information, and professional profile;
• placement agents that introduce you to us, and your representatives, such as your advisers, your employer, or a co-investor; and
• publicly available sources, such as filings with the U.S. Securities and Exchange Commission and other regulators, company websites, court records, news reports, and professional networking profiles.

3.5 · Sensitive Information

Some of the information described in Section 3.1, including government identification numbers, taxpayer identification numbers, dates of birth, citizenship or nationality, bank account details, and other financial information, is treated as sensitive under certain laws. We collect it when it is provided to us in connection with investor onboarding, and we use it only to verify identity and eligibility, to screen against sanctions and similar lists, to meet our legal, regulatory, and tax obligations, and to administer your investment. We limit access to it within our organization.

3.6 · If You Do Not Provide Information

The provision of personal information is voluntary. However, if you decline to provide certain information, we may be unable to respond to your inquiry, to provide you with access to the investor portal, or to evaluate or process your interest in our securities or fund interests.

We use cookies and similar technologies on the Site. Cookies are small text files placed on your device. We use both session cookies, which expire when you close your browser, and persistent cookies, which remain until they expire or you delete them. We also store small items in your browser’s local storage, which works in a similar way.

We categorize the technologies we use as follows:

• Essential technologies, which are necessary for the Site to function and to protect it. They keep you signed in to the investor portal and secure your session, end or lock your session after a period of inactivity, support the sign-in methods we offer, and remember choices you make, such as dismissing a notice. Local storage records your acknowledgment of our website disclaimer and your analytics choice. These are always active and do not require your consent.
• Analytics and performance technologies, which help us understand how visitors use the Site. We use Google Analytics and Vercel Analytics for this purpose. Google Analytics uses cookies, and we load it only after you have consented through the notice presented when you first visit the Site. Vercel Analytics is designed to measure Site usage without using cookies and without collecting information that identifies you individually. We do not run analytics on the investor portal or on pages reached through a private link.

You may give, withdraw, or change your consent at any time using the cookie choices control in this Section of the Privacy Policy page, which is also linked from the foot of every page of the Site. Withdrawing consent stops analytics and removes the analytics cookies already set. You may also block or delete cookies through your browser settings. If you disable essential cookies, some features of the Site may not function properly.

For more information about how these providers process information, please review the Google Analytics and Vercel privacy disclosures available on their respective websites.

Global Privacy Control. If your browser sends a Global Privacy Control signal, we treat it as a refusal of analytics cookies and do not load Google Analytics, even if you previously consented.

Do Not Track. Because there is no commonly accepted industry standard for responding to browser “Do Not Track” signals, the Site does not respond to those signals. We instead manage non-essential cookies through the consent mechanism and the Global Privacy Control signal described above.

Email measurement. When we send you certain emails—our Insights and press-release notices, and campaign mailings sent from our relationship-management system—we measure whether they were opened and, for a notice that links to one of our articles, whether you followed the link. Other messages, such as sign-in codes and notices about your account, are not measured. An open is measured by a small, invisible image that your email program loads from our servers when it displays the message; a link to one of our articles is routed through an address on our own domain, which records the click and sends you straight on. Both are tied to the address we sent the message to, so we can see engagement by recipient and not only in total, and we record the kind of email program or browser that made the request. We use this to understand which subjects our readers find useful and how often to write.

These measurements are imperfect and we treat them as such. Some email programs and corporate security systems load images and follow links automatically, which can record an open or a click that no person made; others block images, so a message you did read may not register at all.

You can prevent open measurement by setting your email program not to load remote images, and click measurement by going to buxtonhelmsley.com directly rather than following the link. You can stop receiving these messages altogether using the unsubscribe link at the foot of every one, which also ends any measurement of them. We retain these records as described in Section 12.

We use personal information for the following purposes:

• to respond to your inquiries and provide information you request;
• to operate, maintain, secure, and authenticate access to the Site and the investor portal;
• to evaluate and process expressions of interest in, and subscriptions for, our securities and fund interests, and to administer investments, including reporting to investors;
• to verify identity and accredited-investor or qualified-purchaser status, and to conduct sanctions and other screening, where required or appropriate;
• to comply with applicable legal, regulatory, recordkeeping, and tax obligations;
• to manage our relationships, including by keeping records of our communications and meetings;
• to administer our arrangements with placement agents, including attributing investments to them and calculating their compensation;
• to research the companies we follow or engage, and the people connected with them;
• to detect, prevent, investigate, and respond to fraud, security incidents, unauthorized access, and the unauthorized distribution of our documents;
• to operate, evaluate, and improve our business, the Site, and our services;
• to send you our publications and other communications about our business and offerings, where permitted by law, from which you may opt out at any time; and
• to pursue our legitimate business interests in a manner consistent with applicable law and your rights.

6.1 · Categories of Recipients

We do not disclose personal information except as described in this Policy. We may share personal information with:

• Service providers that process information on our behalf, as described in Section 6.2.
• Professional advisers and fund service providers, including our fund administrator, IQ EQ Fund Services LLC; our auditor, UHY LLP; and our legal counsel and accountants.
• Placement agents. If a placement agent introduced you to one of our offerings, or is compensated in connection with your investment, we share with that placement agent information about you and your investment, such as your name and contact details, the status and amount of your subscription, and the compensation arising from it.
• Affiliated entities within Buxton Helmsley, as identified in Section 2, for the purposes described in this Policy.
• Regulators, governmental authorities, courts, and law enforcement, where we believe disclosure is required by applicable law or legal process, or is necessary to establish, exercise, or defend legal claims, or to protect the rights, property, or safety of Buxton Helmsley or others.
• Counterparties to a corporate transaction, such as a financing, reorganization, merger, or sale or transfer of assets, subject to appropriate confidentiality protections.
• Other parties with your consent or at your direction, such as a person to whom you ask us to send a document.

6.2 · Service Providers

We use service providers under their own terms of service, which govern how they may use and protect the information they process for us. The service providers we use for these purposes include the following, some of which receive personal information only when we use the feature they support:

• Vercel, which hosts the Site and the investor portal, stores files, and provides cookieless analytics;
• Neon, which hosts our databases;
• Microsoft, which provides our email, calendar, contacts, and staff sign-in services;
• GitHub, which hosts our software and runs our automated backups;
• Box, which provides document storage, electronic signature, and backup storage;
• GoTo, which provides our telephone and text-messaging services;
• Google, which provides Google Analytics, subject to your consent as described in Section 4;
• Anthropic, which provides artificial-intelligence models, as described in Section 9;
• Apollo.io, which provides business contact and company information;
• OpenSanctions, which provides sanctions and politically-exposed-person screening; and
• an IP-geolocation service, which estimates the approximate location of the IP addresses in our security records.

We may change the providers we use, and we will update this list from time to time.

We do not sell your personal information. We also do not share or otherwise use your personal information for cross-context behavioral advertising or other targeted advertising, and we do not disclose your personal information to third parties for their own marketing purposes. If we ever intend to change these practices, we will update this Policy and, where required, obtain your consent before doing so.

We monitor, record, and retain electronic communications that you exchange with us, including email, calendar invitations, records of telephone calls, and text messages, for compliance, recordkeeping, security, relationship-management, and quality-assurance purposes, to the extent permitted by applicable law. We keep an archive copy of the emails our systems send. We do not currently record the audio of telephone calls, other than voicemail messages that callers choose to leave for us. As described in Section 3.3, we file records of our communications and meetings in our relationship-management system, where they are available to our staff according to their roles and the settings that govern each record.

We use artificial-intelligence tools, including models provided by Anthropic, to help our staff research companies, analyze documents and data, and draft and organize their work. When our staff use these tools, the information they are working with, which may include personal information in our records, is sent to the provider for processing on our behalf. These tools assist our staff; they do not make decisions about you that produce legal or similarly significant effects.

To deter and trace the unauthorized distribution of confidential documents, documents delivered through the Site may be marked, visibly and within the file, with the name and email address of the person to whom they are delivered and a unique reference code. We record each time a document is opened or downloaded, including the time, the account or link used, and the IP address and browser from which it was accessed. We use these records to administer access to our documents and to investigate suspected misuse.

The Site may contain links to websites operated by others. We do not control those websites and are not responsible for their content or privacy practices. We encourage you to review the privacy policy of any website you visit before providing personal information.

We retain personal information for as long as we have a business, legal, regulatory, tax, or recordkeeping reason to do so, including to establish, exercise, or defend legal claims. We do not currently delete records on a fixed schedule. In general:

• Investor, subscription, and holdings records, communications records, records in our relationship-management system, and security and access records are retained indefinitely, and in any event for at least the periods required by applicable law.
• Google Analytics data at the level of individual visitors and events is retained for no longer than fourteen months; aggregated reports, which do not identify you, may be kept longer. Vercel retains its cookieless analytics data under its own practices.
• Subscription and marketing information. If you unsubscribe from our communications, we stop sending them, and we keep your email address on a suppression list so that we do not contact you again.
• Backups. Our records are copied into encrypted backups, which are retained indefinitely.

Where the law gives you the right to request deletion, Section 15 or Section 16 describes how we handle that request.

We maintain administrative, technical, and physical safeguards designed to protect personal information against loss, misuse, unauthorized access, disclosure, alteration, and destruction. Our measures include:

• encrypted connections (HTTPS/TLS) for information transmitted between your browser and the Site;
• additional encryption for the most sensitive identifiers we hold, such as taxpayer identification numbers and dates of birth;
• multi-factor authentication for access to the investor portal, using a verification code sent to you or a passkey;
• locking an account after repeated unsuccessful sign-in attempts, and limiting the rate at which requests are accepted from a single source;
• access to records limited according to staff roles, and logs of access to and changes in our systems; and
• regular reviews of our systems for security vulnerabilities, currently each month, with remediation of issues identified.

No method of transmission over the internet, and no method of electronic storage, is completely secure. While we work to protect your personal information, we cannot guarantee its absolute security.

In the event of a security incident affecting your personal information, we will notify you, and any applicable regulators, as and to the extent required by applicable law.

We are based in the United States, and the information we collect is processed and stored in the United States and in other jurisdictions where our service providers operate. If you are located outside the United States, your personal information may be transferred to, and processed in, the United States and other jurisdictions whose data-protection laws may differ from those of your jurisdiction. Where we transfer personal information across borders, we do so in accordance with applicable law and, where required, subject to appropriate safeguards, as described in Section 15.

This Section applies to individuals located in the European Economic Area (“EEA”) or the United Kingdom (“UK”) whose personal data we process, including in connection with the marketing of our corporate securities (such as common stock and convertible notes) in those regions. For the purposes of the EU General Data Protection Regulation and the UK General Data Protection Regulation (together, “GDPR”), the controller of your personal data is Buxton Helmsley, Inc. Where we did not obtain your personal data from you, Sections 3.3 and 3.4 describe its sources and Section 3 describes the categories we hold.

15.1 · Legal Bases for Processing

We process personal data of individuals in the EEA and the UK on the following legal bases:

• Performance of a contract, or steps taken at your request prior to entering into a contract, where we process information to evaluate and process your interest in, or subscription for, our securities, and to administer your investment;
• Compliance with a legal obligation, where we process information to meet identity-verification, sanctions-screening, tax, recordkeeping, or other legal requirements;
• Your consent, on which we rely to set analytics cookies and, where the law requires consent, to send you marketing communications, and which you may withdraw at any time; and
• Our legitimate interests, where we process information to operate and secure the Site, to prevent fraud and the misuse of our documents, to manage our relationships and keep records of our communications, to research companies and the people connected with them, and to operate and improve our business, provided those interests are not overridden by your interests or fundamental rights.

15.2 · Your Rights

Subject to the conditions and exceptions in applicable law, you have the right to request access to your personal data; to request correction of inaccurate data; to request erasure of your data; to request restriction of, or to object to, our processing, including processing based on our legitimate interests and any processing for direct marketing; to request portability of data you provided to us; and, where we rely on consent, to withdraw that consent at any time without affecting the lawfulness of prior processing. To exercise these rights, contact us using the details in Section 18. You also have the right to lodge a complaint with your local supervisory authority.

15.3 · International Transfers

When we transfer personal data of individuals in the EEA or the UK to the United States or to other jurisdictions that have not received an adequacy decision, and GDPR requires a safeguard for that transfer, we rely on the mechanisms our service providers make available, which may include the European Commission’s Standard Contractual Clauses, the UK International Data Transfer Addendum, or a provider’s certification under the EU-U.S. Data Privacy Framework and its UK extension. You may contact us for more information about the safeguard that applies to a particular transfer.

15.4 · Automated Decision-Making

We do not make decisions producing legal effects concerning you, or similarly significant effects, based solely on automated processing.

Several U.S. states have enacted consumer privacy laws. Whether or not a particular law applies to us, we offer the following choices to all U.S. residents, subject to verification of identity and to the exceptions permitted by law, including information we are required or entitled to retain:

• to confirm whether we process your personal information, and to access it;
• to correct inaccurate personal information;
• to delete personal information, except where we are required or entitled to keep it, and with the understanding that copies may remain in our encrypted backups, which we do not alter;
• to obtain a copy of personal information you provided to us in a portable format; and
• to opt out of the sale of personal information, of targeted advertising, and of profiling in furtherance of decisions that produce legal or similarly significant effects, none of which we engage in.

To make a request, contact us using the details in Section 18. You may also authorize an agent to make a request on your behalf; we may ask the agent for proof of authorization and ask you to verify your identity directly. We will take reasonable steps to verify your identity by matching the information you provide with information we hold. We aim to respond within 45 days, and we will tell you if we need up to 45 additional days. We will not discriminate against you for exercising any of these choices.

If we decline your request, you may appeal by replying to our decision or by emailing privacy@buxtonhelmsley.com with “Appeal” in the subject line. We will respond to an appeal within 60 days. If you are not satisfied with the outcome, you may contact the attorney general of your state.

Sensitive personal information, such as the identifiers described in Section 3.5, is used only for the purposes described in that Section. We do not disclose personal information to third parties for their own direct-marketing purposes. As stated in Section 7, we do not sell or share personal information for targeted advertising, and we honor the Global Privacy Control signal as described in Section 4.

The Site and our services are intended for adults who are at least 18 years of age. We do not knowingly collect personal information from anyone under 18, and we do not knowingly collect personal information from children under 13 in violation of the Children’s Online Privacy Protection Act. If we learn that we have collected personal information from a child under 13, we will delete it. If you believe a minor has provided us with personal information, please contact us using the details in Section 18.

If you have any questions about this Privacy Policy, or if you wish to exercise any of the rights described above, please contact us at:

We may update this Privacy Policy from time to time. When we do, we will revise the “Last Updated” date shown on the Privacy Policy page and post the updated Policy on the Site. If we make material changes, we will provide additional notice as appropriate, which may include asking you to acknowledge the updated Policy when you next visit the Site or, for investors and account holders, providing notice through the investor portal or by email. We encourage you to review this Policy periodically.