Biometric Data Retention & Destruction Policy

This policy is published in compliance with the Illinois Biometric Information Privacy Act (740 ILCS 14/15(a)) and any other applicable state laws requiring a publicly available written policy establishing a retention schedule and guidelines for permanently destroying biometric data. This policy applies to all biometric identifiers and biometric information (as defined below) collected, stored, or processed by DropHammer™ Technologies LLC (“DropHammer,” “we,” “us,” or “our”) in connection with the DropHammer platform (the “Service”).

1. Definitions

1.1 “Biometric identifier” means a retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry. Biometric identifiers do not include writing samples, written signatures, photographs, human biological samples used for valid scientific testing or screening, demographic data, tattoo descriptions, or physical descriptions such as height, weight, hair color, or eye color. (740 ILCS 14/10)

1.2 “Biometric information” means any information, regardless of how it is captured, converted, stored, or shared, based on an individual’s biometric identifier used to identify an individual. Biometric information does not include information derived from items or procedures excluded under the definition of biometric identifiers. (740 ILCS 14/10)

2. DropHammer’s Position on Biometric Data

2.1 DropHammer does not intentionally collect biometric identifiers or biometric information from Illinois residents. Tier 2 voice recording collection is disabled for Illinois residents and businesses with a principal place of business in Illinois. See our Training Data Privacy Policy and the Illinois Biometric Information section of our Privacy Policy, for details.

2.2 DropHammer processes voice data for the following operational purposes: (a) speech-to-text transcription of voice commands for the purpose of executing user requests; (b) AI Receptionist call handling for the purpose of conducting real-time conversations with callers; and (c) call recording storage for quality assurance and business record-keeping. DropHammer does not extract voiceprints, vocal pattern templates, speaker recognition profiles, or other biometric identifiers from this voice data.

2.3 To the extent that any data processed by DropHammer could be construed as biometric information under applicable law, this policy establishes the retention schedule and destruction guidelines for such data.

3. Retention Schedule

4. Destruction Guidelines

4.1 Trigger for Destruction. Biometric data (to the extent any is held) will be permanently destroyed when the initial purpose for collecting or obtaining such data has been satisfied, or within three (3) years of the individual’s last interaction with the Service, whichever comes first.

4.2 Methods of Destruction. DropHammer uses the following commercially reasonable methods to permanently destroy biometric data:

• Digital files (audio, features, transcripts): Secure deletion from all active storage systems, including primary databases, file storage, and processing queues. Deleted data is overwritten or rendered unrecoverable through standard database deletion procedures with automated garbage collection.
• Backup systems: Biometric data in encrypted backup systems will be destroyed as backups rotate through their normal lifecycle, which does not exceed 90 days. DropHammer does not actively access or use biometric data from backup systems after deletion from active systems.
• Third-party sub-processors: DropHammer’s sub-processors (listed in the Privacy Policy) are contractually required to delete data in accordance with their published retention policies. Our AI processing sub-processors retain API inputs for a maximum of 30 days for abuse monitoring, after which they are deleted.

4.3 Verification. DropHammer maintains automated processes to verify that destruction has occurred in accordance with this policy.

5. Collection Restrictions for Illinois

• DropHammer does not offer Tier 2 voice recording collection to Illinois residents or businesses with a principal place of business in Illinois.
• DropHammer does not offer the training data incentive program to Illinois residents or Illinois-based businesses.
• DropHammer does not extract biometric identifiers from AI Receptionist calls involving Illinois residents.
• These restrictions are enforced through account-level geofencing based on the address provided during registration and onboarding.

6. Disclosure and Consent

6.1 Before collecting any data that could constitute biometric information (for non-Illinois users who opt in to Tier 2), DropHammer provides a standalone written disclosure that includes: (a) the specific purpose and length of term for which the biometric data is being collected, stored, and used; and (b) this retention and destruction policy.

6.2 DropHammer obtains an informed written release from the individual (or the individual’s legally authorized representative) before collecting biometric data for Tier 2 training purposes.

6.3 These consent requirements do not apply to Illinois residents because Tier 2 collection is not available to Illinois residents.

7. Prohibited Conduct

7.1 DropHammer does not sell, lease, trade, or otherwise profit from biometric identifiers or biometric information.

7.2 DropHammer does not disclose, redisclose, or otherwise disseminate biometric identifiers or biometric information except: (a) with consent of the individual; (b) as required by law or legal process; or (c) as disclosed in this policy and the Privacy Policy.

8. Contact

Questions about this policy may be directed to:

Version 1.0 — March 20, 2026. Patent-pending technology. DropHammer is a trademark of DropHammer Technologies LLC.