1. Who we are and what this covers

Retirement Plan Specialists, Inc., a Florida corporation doing business as Turner Pension Solutions ("TPS," "we," "us"), operates Perl, a web-based research and prospecting service for retirement-plan professionals at app.tps5500.com.

This Policy explains what personal information we collect from and about the people who use Perl, how we use and share it, how long we keep it, and the choices you have. It also explains, in Section 4, an important distinction: the retirement-plan filing data inside Perl is public government record, and we are not its source.

This Policy does not apply to TPS's separate third-party administration business.

---

2. The short version

• We collect the business-contact information you give us to request and hold an account, plus a limited record of how you use the Service.
• We do not store the text of your conversations with Perl.
• We do not sell your personal information, and we do not use it for targeted advertising.
• Our AI provider is contractually prohibited from training its models on your content.
• Public Form 5500 filing data is in the Service because it is public record. If you believe a filing about you or your company is wrong, the correction has to happen at the filing, not in our copy — see Section 4.
• You can ask us to access, correct, or delete your account information at any time (Section 9).

---

3. Information we collect about you

3.1 Information you give us

Access-request and registration information. When you request access, we collect your first and last name, business email address, firm or company name, and — where the form asks — your telephone number, professional role or position, business street address, city, state, ZIP code, and any message you write to us. We also record our own internal review status, review date, reviewer, and review notes.

Account profile. Once provisioned, we hold the same identity and contact fields on your user profile, along with your account status, your plan tier, and your billing status.

Support and other correspondence. Emails and messages you send us, and our replies.

Payment information. Payments are processed by Stripe, Inc., which collects your payment-card or bank information directly. We do not receive or store your full payment-card number. We receive and store only a billing status, plan tier, and transaction records.

3.2 Information generated by your use of the Service

Authentication records. Because sign-in uses a single-use link emailed to you, we store authentication records including your email address, sign-in tokens and their expiry, and active session records.

Saved work. Searches you save and prospect lists you save (including the snapshot of plan records in the list), each associated with your email address.

Generated reports. When you have Perl build a plan report or dossier, we store the full text of that report along with your email address as the person it was generated for. A stored report cannot be altered once it is written — it is the record of what we actually showed you — and it is deleted along with everything else when you delete your account.

Usage record. A running count of the messages you have sent, the date and time you were last active, and operational logs of each request. Those logs record metrics about a request — which model handled it, how many processing steps it took, token counts, and our cost — rather than the content of it. We never log what you typed, the queries Perl writes, or her answers.

What they do record, associated with your email address, is: the page addresses you opened — which includes the plan pages you looked at — and which filing documents you retrieved or downloaded. Plans that Perl researches inside a conversation are recorded without your name against them. We use all of this for troubleshooting, cost management, and abuse detection, and it is kept for about seven days.

Security record. Separately from those operational logs, we keep a lasting record of security-relevant events on your account: signing in, a refused sign-in, a sign-in link being sent, a request we refused, and any change an administrator makes to your account. Each entry holds the date and time, what happened, the email address involved and the source IP address — never the content of anything you did. We keep these for up to 24 months (see Section 7), because being able to reconstruct who did what is how we would answer your questions if something ever went wrong.

Profile signals — please read this one. Perl maintains a profile of what you research and how you write, so that she can be more useful and can match your register. It works like this: on approximately every tenth message you send (counted over the life of your account), the text of that single message, truncated to about 1,200 characters, is sent to a separate, smaller AI model. That model returns up to four short topic tags describing what you were researching — for example "401k prospecting" or "schedule h" — and a short note about your communication style, for example whether you write formally or casually and at what technical depth.

We store those tags and that note. We do not store the message itself. The tags accumulate into a running tally over time, so a long-standing account may hold a substantial list of the subjects it has researched. The style note is replaced each time and may be up to a few hundred words. We instruct the model not to include personal data or the raw text of your message in what it returns, and we have no reason to believe it does, but we do not independently filter its output before storing it.

Assistant personalization settings. We store, per account, a relationship label, a preferred form of address, and personalization notes used to shape Perl's tone.

Who at TPS can see this. Our administrators can view, for each account, the profile and contact information, message count, last-active time, the most frequent inferred topic tags, and the stored style note. This access is limited to authorized TPS personnel and is used for support, account management, and improving the Service.

Voice dictation — a third party is involved. The chat interface includes an optional microphone button. If you use it, your browser sends the audio from your microphone to its own vendor's cloud speech-recognition service — Google for Chrome, Microsoft for Edge — which returns a text transcript that becomes your message. This happens in your browser, between you and your browser's vendor, before it reaches us. We do not receive or store the audio, and we receive only the resulting text as if you had typed it. That processing is governed by your browser vendor's privacy policy, not ours. If you would rather no third party process your voice, type instead of dictating.

Technical and security information. Our network provider and our hosting platform automatically process information including your IP address, browser user-agent, request timestamps, and pages requested, for delivery, performance, abuse prevention, and security. Our access-request form additionally processes your IP address to rate-limit submissions, and uses a bot-detection service that receives similar technical signals.

A note about our own email. When you submit an access request, the contents of that request are also emailed to us so that we see it promptly. That means a copy of what you submitted exists in our business mailbox independently of our database, and is retained under our ordinary business email retention rather than the database schedule in Section 7.

3.3 What we do not collect

We do not knowingly collect, and ask you not to submit, Social Security numbers, financial-account numbers, health information, government-identification numbers, participant-level retirement-plan data, or information about anyone under 18. The Service is not designed for and must not be used for these.

3.4 We do not keep a transcript of your conversations

The questions you ask Perl and the answers she gives are not written to a conversation or transcript table in our database. They are transmitted to our AI provider for processing (Section 6) and are held in your browser for the duration of your session; when that session ends they are gone.

Two honest qualifications, so this statement is not read for more than it says:

1. Reports are an exception. If you ask Perl to build a plan report or dossier, that output is saved — see "Generated reports" in Section 3.2. It is a document you asked for, not a transcript, but it is assistant-written text we keep and associate with you.
2. We keep facts derived from your conversations. The usage record and profile signals in Section 3.2 are generated from what you ask. We do not keep the questions; we do keep counts, topic tags, the plans you researched, and a note on your writing style.

---

4. Public Form 5500 filing data — an important distinction

The retirement-plan information in Perl comes from Form 5500 and Form 5500-SF annual reports, their schedules, and their attachments, filed by plan sponsors and administrators with the U.S. Department of Labor and published by the Department as public records, along with related public datasets. We also retrieve individual filing documents from Department of Labor systems.

Those public filings contain some information about individuals — for example the names of plan sponsors' and administrators' signing officials, business addresses, and the names of service providers and their compensation. That information is in the Service because the U.S. government publishes it as public record. We are not its source, we did not collect it from the individuals concerned, and we cannot change what a filing says.

If you believe a filing about you or your organization is inaccurate: the correction must be made at the source, by the plan's filer, through an amended filing with the Department of Labor. We refresh our copy from the Department's published data on a recurring basis, so a corrected or amended filing will appear in the Service after the Department publishes it. If you believe our copy misstates what a filing actually says, write to us at perl@wehelppeopleretire.com and we will investigate.

Public filing data is also, by its nature, historical. Filings describe a plan year that has already closed, and are published on a delay. See the Data and AI Usage Disclosure for detail.

---

5. How we use information

We use the information described in Section 3 to:

We do not use your information to make decisions about you that produce legal or similarly significant effects without human involvement, and we do not engage in profiling for that purpose. The profile signals in Section 3.2 affect only how Perl writes to you and what she anticipates you are interested in.

---

6. How we share information

We do not sell personal information. We do not share it for cross-context behavioral advertising. We disclose it only as follows.

6.1 Service providers. We use the following providers to operate the Service. Each processes information only as needed to provide its service to us, under contract.

We may add or change providers. We will keep this table current and will update the Last Updated date when we do.

6.2 Our AI provider does not train on your content. Our agreement with our AI provider prohibits it from training its models on content submitted through its API. As of the date of this Policy, its commercial terms state: "Anthropic may not train models on Customer Content from Services." That provider retains submitted content for a limited period for abuse detection and legal compliance under its own policies.

6.3 Within TPS. Our own personnel and contractors may access information as needed to run the Service and support you, subject to confidentiality obligations. If you participate in the Referral Credit Program, information about a referral you make will be used by TPS's third-party administration business to evaluate and service that referral.

6.4 Legal and safety. We may disclose information where we reasonably believe it is required by law, subpoena, or other lawful process, or is necessary to enforce our terms, protect our or others' rights, safety, or property, or investigate suspected fraud or abuse. Where lawfully permitted, we will make reasonable efforts to notify you first.

6.5 Business transfers. If we are involved in a merger, acquisition, financing, reorganization, or sale of assets, information may be transferred as part of that transaction, subject to this Policy or a successor policy with comparable commitments. We will notify you of a material change in the controller of your information.

---

7. How long we keep information

We may retain information longer where necessary to comply with law, resolve a dispute, or enforce our agreements.

---

8. Security

We protect information with measures including: transport encryption (TLS) for all traffic; a managed database with encryption at rest, provider-managed patching, and automated backups; bot detection on our public registration form; denial-of-service protection provided by our hosting platform at its own network edge; an enforcing Content-Security-Policy; a read-only database role, read-only transactions, and a query guard, so that the queries the assistant writes against the Form 5500 data cannot modify it; separate least-privilege credentials, each confined to its own area, for the small number of operations that do write; parameterized statements for all writes, so that no assistant-written query is ever executed as a write; secrets held in the hosting platform's encrypted store rather than in code; and access limited to personnel who need it.

No system is perfectly secure, and we cannot guarantee absolute security. If we become aware of a breach affecting your personal information, we will notify you and any required regulator as and when the law requires.

---

9. Your choices and rights

9.1 Rights we offer everyone. Regardless of where you live, and regardless of whether a particular privacy law applies to us, you may ask us to:

• Confirm and access — tell you whether we hold personal information about you, and give you a copy in a portable format;
• Correct — fix inaccurate information in your account;
• Delete — delete your account and the personal information associated with it;
• Export — provide a one-time export of your saved work. We produce this as a single file covering everything listed in Section 7 that is held against your address, and tell you what is held by our providers rather than by us;
• Opt out of marketing — stop sending you non-essential email (you cannot opt out of service, security, and billing notices while you have an account); and
• See and withdraw personalization — ask us what topic tags and style note we hold about you, and ask us to turn the personalization off. There is currently no self-service control for this in the Service; it is done by request to us, and we will honor it. 9.2 How to exercise them. Email perl@wehelppeopleretire.com from the address on your account, or write to the postal address in Section 13. We will respond within 45 days and may extend once by another 45 days with notice. We may need to verify your identity, which we will normally do by confirming control of the account email address. There is no charge unless a request is excessive or repetitive.

9.3 Appeals. If we decline a request, we will tell you why. You may appeal by replying to our decision or writing to perl@wehelppeopleretire.com within 30 days. We will respond to an appeal within 45 days. If we deny the appeal, we will tell you how to contact your state attorney general or other applicable authority.

9.4 What we will and will not delete.

Deleting your account removes: your profile and contact information, your personalization settings and the style note Perl held about you, your usage counters and topic tags, your saved searches, your saved prospect lists, the reports and dossiers Perl generated for you, your access-request record, and your sign-in sessions and tokens. It also cancels your subscription and deletes your customer record at our payment processor. It runs as a single operation: either all of it happens or none of it does.

It does not remove:

a. Records we must keep for legal, tax, accounting, security, or dispute-resolution purposes. b. Files you previously exported and downloaded — those are yours to keep. c. Copies of correspondence in our business email. d. Public Form 5500 filing data, which is public record and is not personal information we collected from you — see Section 4. e. Operational logs, until they age out on their normal schedule — about seven days. f. The security record described in Section 3.2, including the entry recording that your account was deleted and when. These hold your email address, the event and the source IP address, never the content of anything you did, and they are kept for up to 24 months. We keep them for two reasons: they are the evidence we would need to answer a security question about your account after you have gone, and they are what tells us to re-apply your deletion if we ever have to restore from a backup. g. Backup copies. Our backups are taken as whole-database snapshots and are not edited, so a deleted account persists in them until they age out on the schedule in Section 7 — 3 days for our hosting provider's automated backups and point-in-time recovery, and generally no more than about 3 weeks for our off-site archives. We do not use a backup to bring a deleted account back, and if we ever restore one for any other reason we re-apply every deletion we have recorded since it was taken, using the record in (f).

If you have asked us to delete something and are not sure it has happened, ask at perl@wehelppeopleretire.com and we will tell you exactly what we hold rather than let the question sit.

9.5 No sale, no targeted advertising, no significant automated decisions. We do not sell personal information, do not share it for cross-context behavioral advertising, and do not use it for profiling in furtherance of decisions producing legal or similarly significant effects. There is therefore nothing to opt out of in those categories.

9.6 No discrimination. We will not deny you service, charge you a different price, or provide a different quality of service because you exercised a privacy right.

---

10. Children

The Service is for business use by adults. We do not direct it to anyone under 18 and do not knowingly collect personal information from anyone under 18. If we learn we have, we will delete it. Contact perl@wehelppeopleretire.com.

---

11. Location of processing

We operate in the United States, and information is stored and processed in the United States by us and by the providers in Section 6.1. If you access the Service from outside the United States, you understand that your information will be transferred to and processed in the United States, where privacy laws differ from those where you live.

---

12. Changes to this Policy

We may update this Policy. If we make a material change, we will notify you by email to your registered address or by a conspicuous notice in the Service before it takes effect, and we will update the Last Updated date. We encourage you to review it periodically.

---

13. Contact us

Privacy questions, requests, and appeals: Email: perl@wehelppeopleretire.com Mail: Retirement Plan Specialists, Inc., d/b/a Turner Pension Solutions, 1517 W Broadway St., Oviedo, Florida 32765 Telephone: 407-365-3490

---

Cookie and Tracking Notice

Effective date: August 16, 2026

What we use

Perl uses a small number of technologies that store or read information on your device. As of the date of this Notice, all of them are strictly necessary to deliver the Service you have asked for.

What we do not use

We do not use advertising cookies, cross-site tracking, advertising pixels, social-media trackers, or session-recording tools. We do not sell information collected by these technologies and we do not use them to build advertising profiles.

Your choices

Because all current technologies are strictly necessary, we do not present a cookie consent banner. You can block or delete cookies in your browser settings, but the Service will not be able to keep you signed in if you block ours. Most browsers also offer a "Do Not Track" or Global Privacy Control signal; we do not currently respond to Do Not Track, and because we do not sell data or serve targeted advertising, there is nothing for a Global Privacy Control signal to opt out of.

Questions

perl@wehelppeopleretire.com