The Retirement Atlas — Privacy Policy

Version 3.2.1 (Annuity-Only Scope, Option B Two-Checkbox Consent) Effective date: 2026-06-02 Operator: The Retirement Atlas LLC, an Indiana limited liability company ("The Retirement Atlas," "TRA," "we," "us," "our") Contact: privacy@theretirementatlas.com

*Changes vs Version 3.0 (live): operator description switched from Wyoming to Indiana; match auto-release extended from 30 to 90 days; Texas mini-TCPA explicitly referenced where state-specific rights are discussed; expanded state privacy law catalog to all currently-effective state comprehensive privacy laws; scope narrowed to insurance and annuity referrals only; specialist disclosure obligations updated to drop SEC Marketing Rule references.*

The short version

You can use most of TRA without giving us anything. Your inputs save in your browser, not on our servers. If you decide you want a state-licensed annuity specialist in our reviewed network to follow up with you, you give us your email and (optionally) phone, you check a consent box, and we share an anonymized version of your plan on a specialist-facing marketplace. One specialist can purchase the right to contact you. At that point your name, email, the contents of your plan, and (if you separately consented) your phone go to that one specialist. We do not sell your information to anyone outside our reviewed network. We do not match you with registered investment advisers in their advisory capacity through this marketplace. We honor California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Iowa, Delaware, New Hampshire, Tennessee, Indiana, Minnesota, New Jersey, Kentucky, Nebraska, Maryland, Rhode Island, and other state privacy rights below. We honor the Global Privacy Control browser signal.

1. Who this Privacy Policy covers

This Privacy Policy applies to the The Retirement Atlas website, mobile-formatted views, planning tools, plan reports, emails, and any other TRA service. It does not cover any matched annuity specialist's handling of your information after we release it to that specialist; the specialist's own privacy notice governs there. We name in Section 7 what we hold the specialist to contractually.

2. The two paths through TRA

Anonymous path. You can run the educational journey and the planning tools without giving us your name, email, phone, or any other direct identifier. Your inputs save in your browser using local storage. We do not see them. We do not list you with any specialist. Site analytics, described in 4(d), are the only data flowing back to us.

Matched path. If you want a state-licensed annuity specialist to follow up with you about your plan and discuss annuity-based retirement income solutions, you provide your email address (and optionally phone) and you check the consent box described in Section 1 of the Terms of Use. From that point forward, the additional collection and sharing described below apply.

3. TRA is an educational tool, not a financial professional

The Retirement Atlas provides educational tools and content. It is not a registered investment adviser, broker-dealer, insurance agent or insurance producer, Certified Financial Planner, accountant, or attorney. The tools and content on this site are not personalized financial, tax, or insurance advice. Consult your own licensed financial professional before making any financial decision. See the full educational disclaimer at /disclaimer.

4. What we collect

(a) Anonymous inputs (browser-local). Your retirement-planning inputs save to your browser using local storage. We do not receive them, we do not see them, and we cannot recover them if you clear your browser. If you switch to the matched path, the inputs are sent to our servers as part of the lead record.

(b) Contact information (matched path). Email is required to be matched. Phone is optional. Both are encrypted at rest and in transit.

(c) Plan and demographic information (matched path). Your age, household state, spending estimate, savings totals (by tax treatment band), Social Security and pension estimates, dream descriptions in your own words, and any other information you entered to build your plan.

(d) Technical and analytics information. Browser type, device type, language, approximate IP-based geography (city/state level), pages viewed, time on page, and referring URL. We use a privacy-respecting analytics tool that does not collect direct identifiers. Site analytics fire only after you accept the cookie banner, or do not fire at all if your browser sends a Global Privacy Control signal.

(e) Email and message logs. When we email you, we log the send, the open (if our provider reports it), and any reply. When you receive SMS from us (only if you separately and affirmatively consented to SMS), we log the send, the delivery status, and any STOP/HELP/UNSUBSCRIBE reply.

SMS consent is layered, separate, and revocable. Your SMS consent is captured by a separate checkbox from your acceptance of the Terms of Use; you can use TRA's matching service without ever consenting to SMS. Consent is not a condition of purchase or of using TRA. Your mobile number and SMS consent record are not shared with any third party for marketing purposes, are not bundled with any third-party marketing consent, and are subject to the CTIA Messaging Principles and Best Practices and the 10DLC (Application-to-Person) carrier registration requirements that apply to all commercial SMS sending in the United States. When you consent to SMS, we capture and retain the timestamp, IP address, user agent, and the exact version of the consent disclosure language you agreed to, in an immutable consent audit log retained for at least seven (7) years. You can revoke SMS consent at any time by replying STOP to any text message; that revocation is honored within one (1) business day and is logged.

(f) Support and rights requests. When you contact privacy@ or help@, we receive the contents of your message and any attachments, plus your reply-to email.

(g) Consent records. When you check any consent box on TRA, we log a timestamped, immutable record of the consent event, including the version of the disclosure language you consented to, the source URL, your IP, and your user agent. We retain consent records for at least seven (7) years.

(h) We do not collect. Social Security numbers, bank account numbers, credit card numbers, driver's license numbers, biometric identifiers, geolocation precise to your home address, health information, or any information about anyone under 18.

5. How we use what we collect

1. To run the educational tools and produce your plan.
2. To match you with one state-licensed annuity specialist (an insurance producer holding annuity-line authority in your state) in our reviewed network if you have asked us to.
3. To send you the report and any educational follow-ups you have not opted out of.
4. To respond to your support, privacy, or rights requests.
5. To detect, prevent, and respond to fraud, security incidents, and abuse.
6. To comply with our legal obligations (subpoena, court order, regulatory request).
7. To improve the tools (in aggregate, never reading your individual plan to do so).

6. How we share — the marketplace mechanic

When you check the consent box on the matched path, two distinct data flows happen.

(a) Anonymized listing on the specialist marketplace. TRA posts an anonymized version of your plan to Advisor Atlas Leads ("AAL"), a specialist-facing marketplace operated as a separate property under the same parent entity. The anonymized listing contains things like your age, your household state, approximate asset bands, the goal you selected, and a short headline. It does not contain your name, email, phone number, or any other direct identifier. Insurance specialists in our reviewed network can see this anonymized listing and decide whether to purchase the right to be matched with you. Specialists outside our reviewed network do not have access to the marketplace at all.

(b) Contact release to one annuity specialist, permanently. When one annuity specialist purchases the match, TRA releases to that specialist only: your name, your email, the contents of your plan, and (only if you separately consented to phone or SMS contact on the form where you entered a phone number) your phone number. Only the one purchasing specialist receives any of this. No other specialist sees it. The specialist may discuss retirement income strategies with you, including annuity products. The specialist sells insurance and annuity products on commission. From that point forward, the specialist's own privacy notice governs how they handle that information; we hold the specialist contractually to (i) only contact you about retirement income and annuity solutions and the financial-planning context for those, (ii) honor STOP and unsubscribe immediately, (iii) delete the contact information we shared with them if you ask us to, (iv) not resell the information, (v) not use the contact information to solicit fee-based investment advisory services from you outside the scope of the insurance and annuity introduction.

(c) One buyer per lead, no resale or re-match. A purchased lead is permanently released to the one purchasing specialist. AAL does not, at any time and under any circumstances, resell, re-match, re-list, or otherwise transfer your information to any other specialist. If the matched specialist does not contact you, your remedy is to revoke the match under Section 7(f); your information is not returned to inventory. If your listing is never purchased within the ninety (90) day listing window described in our Terms of Use, the listing is removed from the marketplace and no specialist receives your information.

(d) What we do not do. We do not sell your information to firms outside our reviewed network. We do not list you with multiple specialists at the same time. We do not rank specialists by what they pay us. We do not share your information with brokers, data aggregators, or anyone other than the one matched specialist and our own service providers as described in 6(e). We do not match you with registered investment advisers in their advisory capacity, broker-dealers, general financial planners, or non-annuity insurance producers through this marketplace.

(e) Service providers. We use third-party processors to operate the site (hosting, email delivery, SMS delivery, analytics, error reporting, payment processing for specialists). Each is contractually limited to the purposes for which we engaged them and bound by confidentiality, data-protection, and security obligations equivalent to ours. We do not authorize them to use your information for their own purposes.

(f) Legal requirements. We may share information when required by law, when responding to a subpoena, court order, or regulatory request, or when necessary to protect the rights, safety, or property of TRA, our users, or others. Where lawful, we will give you notice before doing so.

(g) Business transfers. If we are acquired or merged, your information may transfer as part of that transaction, subject to the same restrictions in this Privacy Policy. If the buyer materially changes the policy, we will notify you and give you the option to delete your data first.

7. What we require of matched annuity specialists

Each annuity specialist participating in our reviewed network signs an onboarding agreement. The agreement obligates the specialist to:

• Only contact you about retirement income and annuity solutions and the financial-planning context for those.
• Use email as the default channel. Use phone or SMS only if you separately consented to phone/SMS contact at the moment you submitted the lead.
• Honor STOP, HELP, and unsubscribe requests immediately (within one business day).
• Disclose, in their first communication with you, that they are a state-licensed insurance producer, that TRA was paid a referral fee for the introduction, that the specialist's firm sells insurance and annuity products on commission, and that there is no obligation.
• Comply with all laws applicable to their own conduct, including TCPA, state mini-TCPAs (including the Texas Mini-TCPA Tex. Bus. & Com. Code §§ 301–305 as amended by SB 140 effective September 1, 2025), GLBA Safeguards Rule, state insurance-licensing rules, state annuity advertising and illustration rules, the NAIC Suitability in Annuity Transactions Model Regulation, and applicable state best-interest standards.
• Use the lead exclusively in their insurance producer capacity, and not to solicit fee-based investment advisory services or securities-related services from you.
• Delete the contact information we shared with them if you ask us to revoke the match.
• Not resell or further share the information we provided.

The specialist is solely responsible for their own compliance with each of the above. TRA does not supervise the specialist's communications, does not control what products the specialist offers, and does not earn a portion of any commissions you later pay the specialist.

8. Cookies and similar technology

We use a small number of cookies. None of them collect direct identifiers.

• Strictly necessary. Required for the site to work (session, security). We use these without consent.
• Functional. Remember your interface choices. We use these only with consent.
• Analytics. Aggregate usage measurement. We use these only with consent and only when GPC is not detected.

We do not use advertising or retargeting cookies.

Global Privacy Control (GPC). If your browser sends the Sec-GPC signal or the navigator.globalPrivacyControl property, we treat that as a valid opt-out of the "sale" or "share" of your information under California law and similar state laws. The cookie banner still appears for transparency. Honoring the signal does not require the banner.

9. Your privacy rights

The rights below apply to you regardless of where you live. State-specific rights are summarized in Section 10.

(a) Right to know. You can ask us what information we hold about you.

(b) Right to access. You can ask us for a copy of the information we hold about you.

(c) Right to delete. You can ask us to delete the information we hold about you. We will delete it from our active systems within 30 days and from backups on our next backup rotation cycle.

(d) Right to correct. You can ask us to correct inaccurate information about you. The fastest path is to log into TRA and update it yourself.

(e) Right to opt out of marketing. You can opt out of any marketing email or SMS at any time. Reply STOP to text messages. Click unsubscribe in any marketing email. Transactional messages required to operate the service are not subject to opt-out.

(f) Right to revoke a match. You can revoke a pending match before or after contact begins. We will notify the matched specialist to stop contact and to delete the information we shared with them.

(g) Right to opt out of the marketplace listing. You can stop being listed in the specialist marketplace at any time. Existing listings are removed promptly. If a specialist has already purchased the match, the revocation flow in (f) applies.

(h) Right to appeal. If we deny a privacy rights request, you may appeal by replying to the denial email or writing to privacy@theretirementatlas.com with the word APPEAL in the subject line.

To exercise any of the above, email privacy@theretirementatlas.com or use the page at /privacy-choices. We will respond within 45 days. We will verify your identity before fulfilling sensitive requests, in proportion to the sensitivity (we will not ask for more than necessary).

10. State-specific rights

(a) California (CCPA / CPRA). California residents have, in addition to the rights above, the right to opt out of the "sale" or "sharing" of personal information and the right to limit the use of sensitive personal information. California treats TRA's sharing of your plan and contact information with an annuity specialist in the marketplace as a "sale" or "share" under California law, even though no money flows from you to TRA. You can opt out at /privacy-choices, by replying to any TRA email, or by sending the Global Privacy Control signal from your browser. We do not use or disclose sensitive personal information for purposes other than the ones permitted under CPRA Regulation §7027(m).

(b) Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Iowa, Delaware, New Hampshire, Tennessee, Indiana, Minnesota, New Jersey, Kentucky, Nebraska, Maryland, Rhode Island, and other states with comprehensive privacy laws (the list grows). Residents have rights to access, correct, delete, opt out of "sale" or "targeted advertising," and opt out of "profiling in furtherance of decisions that produce legal or similarly significant effects." TRA does not engage in targeted advertising and does not profile users for decisions that produce legal or similarly significant effects. The matchmaking decision is initiated by you, not by an automated decision system; you choose whether to be listed and whether to engage a matched specialist.

(c) Florida. Florida residents who provided their phone number for specialist contact should also see Section 11C of the Terms of Use and the FL TCPA addendum on the consent screen.

(d) Texas. Texas residents who provided their phone number for specialist contact should also see Section 11C of the Terms of Use, the TX TCPA addendum on the consent screen, and note the Texas Business and Commerce Code §§ 301–305 (Texas Mini-TCPA) as amended by SB 140 effective September 1, 2025, which provides additional consumer remedies for telemarketing violations.

(e) Oklahoma. Oklahoma residents who provided their phone number for specialist contact should also see Section 11D of the Terms of Use and the OK TCPA addendum on the consent screen.

(f) Other states. If your state law gives you a right we have not addressed, we will honor it. Contact us.

11. Children

TRA is not intended for use by anyone under 18. We do not knowingly collect personal information from children. If you believe a child has provided personal information to us, contact privacy@theretirementatlas.com and we will delete it.

12. Data retention

(a) Anonymous browser-local data. Lives on your device for as long as you keep it. We never see it.

(b) Contact information for active matches. Held until you revoke the match or until 30 days after the specialist reports an outcome, whichever is earlier.

(c) Lead records (matched users). Held for 7 years from the date of the match, then deleted from active systems. This retention period supports our own audit obligations and any regulatory inquiry that may follow.

(d) Anonymized plan data. Held indefinitely for product and engine improvement, with no link back to your identity once contact information is deleted.

(e) Email and message logs. 18 months for delivery and abuse-prevention purposes.

(f) Support correspondence. 3 years for service-quality and dispute purposes.

(g) Consent records. 7 years from the consent event, to support GLBA compliance, TCPA defense, and regulatory inquiry.

(h) On deletion request. We delete from active systems within 30 days and from backups on the next backup rotation cycle. Some records may be retained longer where required by law (e.g., tax records, fraud investigation, regulatory hold).

13. Security

We use industry-standard administrative, technical, and physical safeguards to protect your information, including encryption in transit and at rest, role-based access control, audit logging, vendor due diligence, and a written information security program (WISP) maintained in accordance with the GLBA Safeguards Rule (16 C.F.R. Part 314). No system is perfectly secure. If we learn of a security incident affecting your information, we will notify you and any regulator required to be notified, in the time and form required by applicable law.

14. International users

TRA operates from the United States and the information we collect is processed in the United States. If you are accessing the site from outside the United States, you understand and consent to that processing. We do not currently offer the matching service to users outside the United States.

15. Changes to this Privacy Policy

We may update this Privacy Policy. If a change is material, we will give you at least 30 days' notice by email or in-product notice before it takes effect, and we will update the "Effective date" line at the top. Your continued use after the effective date means you accept the updated Policy. If you do not accept it, you can stop using TRA and delete your data.

16. Contact

Privacy questions and rights requests: privacy@theretirementatlas.com

Security incidents: security@theretirementatlas.com

General contact: hello@theretirementatlas.com

Mail: The Retirement Atlas LLC, [registered address]

*End of Privacy Policy v3.1. Effective 2026-06-02 for publication.*