This Cookie Policy explains how Sweven, LLC. ("Sweven," "we," "our," or "us") uses cookies and similar tracking technologies when you access or use the Sweven Facilities Maintenance platform, including our web application, mobile application, and related services (collectively, the "Services"). This policy should be read alongside our Privacy Policy, which provides additional context on how we collect and process personal data. By using our Services, you consent to our use of cookies as described in this policy.

2. What Are Cookies?

Cookies are small text files placed on your device (computer, tablet, or mobile) when you visit a website or use a web application. They allow the site to recognize your device and store certain information about your preferences or past actions. Similar technologies include: • Local storage: data stored directly in your browser that persists after the session ends. • Session storage: data stored in your browser that is cleared when the tab or window is closed. • Pixels and web beacons: tiny invisible images embedded in pages or emails that signal when content has been loaded or viewed. • Device fingerprinting: a technique that identifies a device based on its configuration, browser settings, and other attributes. For simplicity, we refer to all of these as "cookies" throughout this policy.

3. Cookies We Use

3.1 Strictly Necessary Cookies

These cookies are essential for the platform to function. Without them, core features such as authentication, session management, and security cannot operate. They cannot be disabled. Examples: • Authentication tokens — keep you securely signed in across page navigations. • CSRF protection tokens — prevent cross-site request forgery attacks. • Session identifiers — maintain your active session state. • Load balancer cookies — route your requests to the correct server instance.

3.2 Functional Cookies

These cookies remember your preferences and settings so you do not have to re-configure them on every visit. Disabling them may reduce the quality of your experience. Examples: • UI preferences — sidebar state, theme selection, table column order. • Notification settings — in-app alert configuration per device. • Language and locale — preferred date, time, and currency formats. • Recently visited sites and assets — quick-access history within the dashboard.

3.3 Analytics Cookies

These cookies help us understand how users interact with the platform so we can improve performance, usability, and feature prioritization. All analytics data is aggregated and anonymized — we never use it to identify individuals. Examples: • Page view tracking — which screens and features are used most frequently. • Session duration — how long users engage with specific workflows. • Error reporting — anonymous crash and exception data to support reliability improvements. • Feature adoption metrics — how quickly new features are discovered and used. You may opt out of analytics cookies via the cookie preference center accessible from your account settings.

3.4 Performance Cookies

These cookies collect technical data that helps us monitor platform performance and detect degradation before it affects your operations. Examples: • Response time sampling — anonymized latency measurements per API endpoint. • CDN performance — asset delivery metrics to optimize load times by region. • Real user monitoring (RUM) — aggregated frontend rendering performance data. Performance cookies do not track individual user behavior and cannot be used to identify you.

4. Third-Party Cookies

Some features of our platform involve third-party services that may set their own cookies on your device. Sweven does not control these cookies and is not responsible for third-party cookie practices. Third-party services that may set cookies include: • Stripe — payment processing. Stripe sets cookies necessary to detect fraud and maintain payment session security. See Stripe's Cookie Policy for details. • Intercom — in-app support chat widget. Intercom uses cookies to maintain chat session continuity and analyze support interactions. • Google Analytics — aggregated, anonymized usage analytics. Configured in anonymization mode; IP addresses are never stored. • Sentry — error monitoring and crash reporting. Cookies support session replay for debugging purposes; all data is anonymized. • Cloudflare — security and DDoS protection. Cookies are used to distinguish humans from automated traffic. We only integrate with third parties who meet our data protection standards and are bound by appropriate data processing agreements.

5. Cookie Duration

Cookies vary by how long they persist on your device: • Session cookies expire when you close your browser or end your session. They are not stored permanently on your device. • Persistent cookies remain on your device for a defined period or until manually deleted. The retention periods we apply are: — Authentication tokens: 30 days (renewed on each active session) — Functional preference cookies: 12 months — Analytics cookies: 13 months (industry standard for year-over-year comparison) — Performance cookies: 30 days You can delete cookies at any time through your browser settings. Note that deleting strictly necessary cookies will require you to sign in again.

6. Managing Your Cookies

You have several options for controlling cookies: 6.1 Platform preference center. Facility Manager accounts can manage non-essential cookie categories directly from Settings → Privacy → Cookie Preferences. Changes take effect immediately. 6.2 Browser settings. All modern browsers allow you to view, block, or delete cookies. Instructions vary by browser: • Chrome: Settings → Privacy and security → Cookies and other site data • Firefox: Settings → Privacy & Security → Cookies and Site Data • Safari: Preferences → Privacy → Manage Website Data • Edge: Settings → Cookies and site permissions 6.3 Opt-out tools. For Google Analytics specifically, you can use the Google Analytics Opt-out Browser Add-on available at tools.google.com/dlpage/gaoptout. 6.4 Do Not Track. Some browsers send a "Do Not Track" (DNT) signal. We currently honor DNT signals by disabling non-essential analytics and performance cookies for sessions where DNT is enabled. Please note that blocking strictly necessary cookies will prevent you from using the platform. Blocking functional cookies may result in reduced personalization. Blocking analytics and performance cookies has no impact on core platform functionality.

7. Cookies and Mobile Applications

Our mobile applications for iOS and Android use equivalent technologies to cookies, including: • Secure local storage — for authentication tokens and session state. • Device identifiers — anonymized identifiers used for push notification routing and fraud prevention. • Mobile analytics SDKs — configured in anonymized mode to collect aggregated usage data. Mobile analytics can be disabled in your device's privacy settings or within the Sweven mobile app under Settings → Privacy. Push notification routing identifiers cannot be disabled without disabling push notifications entirely.

8. Consent

When you first access the Sweven platform as a new user, you will be presented with a cookie consent notice that: • Explains the categories of cookies we use. • Allows you to accept all cookies, accept only strictly necessary cookies, or customize your preferences by category. • Links to this Cookie Policy and our Privacy Policy. For existing users, consent was obtained at the time of account creation under our previous cookie notice. You may update your consent at any time via Settings → Privacy → Cookie Preferences. We record consent decisions — including the timestamp, the categories accepted, and the method of consent — in compliance with applicable data protection regulations including GDPR and CCPA. Where applicable law requires it, we will not place non-essential cookies until affirmative consent is provided.

9. Changes to This Policy

We may update this Cookie Policy from time to time as our technology, legal obligations, or business practices change. When we make material changes, we will: • Notify you by email (to the address on your account) at least 14 days before the change takes effect. • Display a notice in the platform directing you to review the updated policy. • Update the "Last Updated" date at the top of this page. Continued use of the Services after the effective date of any changes constitutes your acceptance of the updated policy. If you do not agree with the changes, you may discontinue use of the Services.

10. Contact Us

If you have questions or concerns about our use of cookies or this Cookie Policy, please contact: Sweven, LLC. Data Protection Officer Email: contact@swevenbpm.com Support: contact@swevenbpm.com For requests related to your personal data more broadly, please refer to our Privacy Policy for the full scope of your rights and how to exercise them.

Questions about cookies? Contact our Data Protection Officer at contact@swevenbpm.com