PRIVACY POLICY

Cyberlink Software Solutions, Inc.
Effective Date: September 15, 2026
Last Updated: September 15, 2026

Cyberlink Software Solutions, Inc. (“Cyberlink,” “we,” “us,” or “our”) respects the privacy and security of our customers, website visitors, learners, and users of our software and services.

This Privacy Policy explains what information Cyberlink collects, processes, uses, and stores, how that information is protected, and the choices and privacy rights that may be available to you.

This Privacy Policy applies to Cyberlink-operated websites, including www.oncyberlink.com, and to Cyberlink products and services, including eRAMP, eRAMP Connect, MINGenerator, Cyberlink University, training, consulting, customer support, and related services.

1. Our Privacy Approach

Cyberlink follows a data-minimization approach. We seek to collect and retain only the information reasonably necessary to operate our business, provide our products and services, maintain security, process payments, provide training and customer support, and comply with applicable law. Because Cyberlink provides both on-premise software and cloud-based SaaS applications, the manner in which information is processed differs by product.

eRAMP — On-Premise Software

eRAMP is software installed and operated on the customer’s own computers, servers, and network environment. Depending upon the version licensed by the customer, eRAMP uses either a Microsoft Access database or Microsoft SQL Server database maintained within the customer’s environment. eRAMP processes and stores information necessary to perform MERS® transactions, including consumer or mortgage-borrower Personally Identifiable Information (“PII”). Because eRAMP is installed and operated within the customer’s environment, the information contained in the eRAMP database remains under the customer’s possession and control. Cyberlink does not receive, collect, or store the consumer or borrower PII contained in a customer’s on-premise eRAMP database as part of the normal operation of the software.

Customers are responsible for maintaining the security, access controls, backups, retention practices, and regulatory compliance applicable to their locally installed eRAMP database and computing environment.

eRAMP Connect — SaaS Application

eRAMP Connect is Cyberlink’s cloud-based Software-as-a-Service (“SaaS”) application designed to facilitate authorized transactions and communications between customer-controlled systems and MERS and other authorized third-party systems. To perform an authorized MERS transaction, eRAMP Connect temporarily processes consumer or mortgage-borrower PII required for the applicable transaction. This information is not intended to be permanently stored in an eRAMP Connect application database. Consumer or borrower PII required for transaction processing is temporarily held in volatile system memory (RAM) for the purpose of preparing, transmitting, and completing the authorized transaction. After the applicable submission and processing activity has been completed, the consumer or borrower PII temporarily maintained in volatile memory is removed from that memory as part of the application’s processing lifecycle. Cyberlink does not use eRAMP Connect to create a permanent database or system of record containing consumer or borrower PII, and Cyberlink personnel do not receive or retain such PII as part of the normal operation of the service.

The purpose of this architecture is to allow eRAMP Connect to perform authorized transactions while minimizing the retention of sensitive consumer information.

Cyberlink University and Training Services

Cyberlink owns and operates Cyberlink University, which provides online and instructor-led training programs, including training relating to MeridianLink Mortgage and other mortgage technology products and services. Cyberlink University uses Zoho TrainerCentral and other Zoho services to provide course enrollment, learner management, training content, course access, communications, and payment processing.

When a learner enrolls in or participates in a Cyberlink University course, Cyberlink and/or Zoho TrainerCentral may collect information necessary to administer the training program, including:

• Learner name.
• Company or organization.
• Business or personal email address provided by the learner.
• Telephone number when provided.
• Course enrollment information.
• Course participation and completion information.
• Training attendance.
• Assessment, survey, or course feedback information.
• Certificates and training records.
• Payment and transaction information when a paid course is purchased.

Information submitted through Zoho TrainerCentral may be processed and stored within Zoho’s systems in accordance with Zoho’s applicable privacy, security, and data-processing practices.

Payment information associated with Cyberlink University purchases is handled as described in Section 4 — Payment Information.

2. Information We May Collect

The information Cyberlink collects or processes depends upon the product or service being used.

As described in Section 1:

• eRAMP may collect and store consumer or borrower PII within the customer’s
  locally controlled Microsoft Access or SQL Server database. Cyberlink does not
  receive or store that information during normal operation of the software.
• eRAMP Connect temporarily processes consumer or borrower PII in volatile
  memory when necessary to complete an authorized transaction, but is not
  designed to permanently store that PII in an application database.
• Cyberlink University and Cyberlink’s training services collect and maintain
  learner and enrollment information necessary to administer training programs.
  Cyberlink may also collect limited information concerning our business customers,
  learners, their employees and representatives, and visitors to our websites.
  Depending on how you interact with Cyberlink, this information may include:
• Name and business contact name.
• Company or organization name.
• Business or personal email address voluntarily provided by the user.
• Business telephone number.
• Business mailing or billing address.
• Username, account identifier, and authentication-related information.
• Product subscription and licensing information.
• Training enrollment, participation, and completion information.
• Customer service and technical support communications.
• Purchase, invoice, subscription, and transaction records.
• IP address, browser type, device information, access dates and times, and
  similar technical information used for website operation and security.
• Communications and information voluntarily provided to Cyberlink.

Cyberlink does not intentionally request Social Security numbers, driver’s license numbers, consumer financial account credentials, medical information, biometric information, or similar sensitive consumer information for Cyberlink’s own business or marketing purposes.

Customers and users should not provide Cyberlink personnel with consumer PII unless specifically requested and necessary for an authorized support or service purpose.

3. eRAMP and eRAMP Connect — Consumer and Borrower
Information

eRAMP and eRAMP Connect are designed for use by mortgage lenders, financial institutions, mortgage industry participants, and other businesses.

Both products may process consumer or borrower information required to complete authorized mortgage-related transactions. However, the manner in which that information is handled differs significantly. eRAMP is an on-premise product. Consumer and borrower information is maintained in the customer’s locally installed Microsoft Access or SQL Server database and remains under the customer’s control. eRAMP Connect is a SaaS application. It may temporarily process consumer or borrower PII required to complete authorized transactions between customer controlled systems and MERS or other authorized systems. Such PII is temporarily maintained in volatile memory during transaction processing and is not intended to be permanently stored in an eRAMP Connect application database. Cyberlink does not sell consumer or borrower information processed through eRAMP or eRAMP Connect. Cyberlink does not use consumer or borrower information processed through these products for advertising, consumer profiling, data brokerage, cross-context behavioral advertising, or unrelated marketing purposes. Cyberlink does not intend for eRAMP Connect to function as a permanent repository or system of record for consumer or borrower PII. Customers remain responsible for determining that their use of Cyberlink products, and the information they process or transmit through those products, complies with applicable laws, regulations, contractual requirements, investor requirements, MERS requirements, and their own privacy and information-security policies.

4. Payment Information

Cyberlink accepts payment for software subscriptions, licenses, consulting, training, Cyberlink University courses, and other products and services. Payments may be processed through secure third-party services and payment gateways, including services provided by Zoho, Authorize.Net, Clerk, Stripe, or other payment processors selected by Cyberlink.

Online Payments

When a customer or learner enters credit-card, debit-card, bank-account, ACH, or similar payment information directly into a third-party hosted online payment form, that payment information is transmitted to and processed by the applicable payment provider or payment processor.

Cyberlink does not intend to store complete credit-card numbers, card security codes, online banking credentials, or complete ACH banking credentials in Cyberlink’s own business databases when payments are submitted through these third-party online payment systems.

Payments Provided Directly to Cyberlink

Cyberlink may also accept credit-card or bank-account information directly from a customer when the customer requests that Cyberlink manually process a payment. In those circumstances, an authorized Cyberlink representative may receive the payment information from the customer and manually enter it into an authorized Zoho payment system or other approved payment-processing service.

Payment credentials provided for manual processing are used for the purpose authorized by the customer. Cyberlink does not intend to retain complete credit-card numbers, card security codes, or complete bank-account credentials in its general business records after the information has been entered into the applicable payment-processing system, except to the extent information is securely retained by the payment provider for authorized recurring payments or as otherwise permitted or required by applicable law.

Customers should provide payment information only through Cyberlink-authorized payment methods.

Cyberlink may retain transaction-related information that does not include complete payment credentials, such as:

• Customer or company name.
• Learner name when applicable.
• Invoice or order number.
• Amount charged.
• Payment date.
• Payment status.
• Subscription status.
• Transaction or payment reference number.
• Limited payment-method information provided by the processor, such as card
  type or last four digits.
• Accounting and tax records required for legitimate business purposes.

Payment information processed by third-party providers is also subject to the privacy, security, and payment-processing terms of the applicable provider.

5. How We Use Information

Cyberlink may use information we collect for legitimate business purposes, including to:

• Establish and administer customer and learner accounts.
• Provide and maintain Cyberlink software and services.
• Authenticate authorized users.
• Enroll learners in Cyberlink University and other training programs.
• Administer courses, training sessions, assessments, certificates, and training
  records.
• Process subscriptions, purchases, invoices, and payments.
• Provide technical support and customer service.
• Communicate regarding products, services, training, account activity,
  maintenance, and support.
• Provide consulting and professional services.
• Improve the operation, reliability, usability, and security of our products and
  services.
• Detect, investigate, and prevent unauthorized access, fraud, abuse, or security
  incidents.
• Maintain business and accounting records.
• Comply with legal, regulatory, contractual, and tax requirements.
• Protect Cyberlink, our customers, learners, users, and systems.

We may also send existing customers, learners, and individuals who have requested information communications regarding Cyberlink products, services, training, or other relevant business information. Recipients may opt out of promotional email communications using the unsubscribe mechanism included in applicable marketing messages.

6. Sale or Sharing of Personal Information

Cyberlink does not sell personal information. Cyberlink does not sell consumer or borrower information processed through eRAMP, eRAMP Connect, or other Cyberlink products. Cyberlink does not share personal information for cross-context behavioral advertising as those terms are defined under applicable California law.

Cyberlink may disclose or make limited information available to service providers and contractors when reasonably necessary for them to provide services to Cyberlink, such as hosting, software development, authentication, payment processing, email delivery, training delivery, customer support, accounting, security, and other business operations.

These service providers are permitted to process information only as appropriate to perform the services for which they have been engaged, subject to applicable contractual and legal requirements.

7. Categories of Third-Party Service Providers

Cyberlink may use third parties to provide technology, infrastructure, development, payment, training, and other services necessary to operate Cyberlink’s business and products.

These third parties may include providers of:

• Website and application hosting.
• Cloud infrastructure and data storage.
• Website, software, and application development, maintenance, testing, and technical support.
• Authentication and account management.
• Payment processing.
• Email and business communications.
• Customer support.
• Training, learning-management, and meeting services.
• Accounting and invoicing.
• Security and system monitoring.
• Business productivity services.

Third-party software developers, website developers, application developers, consultants, and technical support providers may be given access to Cyberlink systems when reasonably necessary to develop, test, maintain, troubleshoot, secure, or support Cyberlink products and services. Cyberlink seeks to limit such access to what is reasonably necessary for the work being performed and to use appropriate contractual, confidentiality, security, and access-control protections.

Use of third-party services may result in information being processed by those providers in accordance with applicable agreements, privacy policies, and security practices. Cyberlink does not authorize its service providers to use consumer or borrower information processed through eRAMP or eRAMP Connect for their own independent advertising, marketing, or data-brokerage purposes.

8. Website Information, Cookies, and Similar Technologies

When you visit a Cyberlink website, certain information may be collected automatically, such as your IP address, browser type, device type, referring website, pages visited, and date and time of access.

Cyberlink may use cookies and similar technologies that are reasonably necessary to:

• Operate the website.
• Maintain user sessions.
• Authenticate users.
• Remember preferences.
• Maintain security.
• Understand website performance and usage.

Cyberlink does not use cookies to store complete payment credentials or consumer mortgage-loan PII.

Your browser may allow you to block or delete cookies. Disabling certain cookies may affect the functionality of portions of our websites or online services.

9. Do Not Track and Global Privacy Control

Some browsers provide “Do Not Track” signals. Because there is not a universally accepted technical standard governing all Do Not Track signals, Cyberlink’s websites may not respond to traditional browser Do Not Track signals. Where required by applicable law, Cyberlink will recognize legally applicable browser-based opt-out preference signals, such as Global Privacy Control (“GPC”), for activities to which such signals legally apply.

Because Cyberlink does not sell personal information or share personal information for cross-context behavioral advertising, an opt-out signal generally should not change Cyberlink’s normal information practices.

10. Data Retention

Cyberlink retains information only for as long as reasonably necessary for the purpose for which it was collected or as required for legitimate business, contractual, accounting, security, tax, dispute-resolution, or legal purposes.

Retention periods vary depending upon the type of information and the reason it is maintained.

In determining an appropriate retention period, Cyberlink considers:

• The amount and nature of the information.
• The purpose for which it was collected.
• Whether the information remains necessary to provide a product or service.
• Contractual obligations.
• Accounting and tax requirements.
• Security requirements.
• Applicable statutes of limitation.
• Legal and regulatory requirements.

Consumer and borrower PII temporarily processed by eRAMP Connect is treated differently from Cyberlink’s ordinary business records. Such information is intended to exist only temporarily in volatile memory as necessary to complete the applicable transaction and is not intended to be retained as a permanent eRAMP Connect business record.

Cyberlink’s goal is not to retain sensitive information when there is no legitimate operational, business, contractual, or legal reason to do so.

11. Information Security

Cyberlink uses reasonable administrative, technical, and organizational safeguards designed to protect information against unauthorized access, disclosure, alteration, misuse, or destruction. Depending upon the system and information involved, safeguards may include access controls, authentication controls, encryption, secure communications, system monitoring, restricted administrative access, and use of security-focused third-party infrastructure and service providers.

Cyberlink also seeks to reduce security risk through data minimization and, in the case of eRAMP Connect, by avoiding permanent database storage of consumer or borrower PII processed during MERS transactions.

For on-premise eRAMP installations, customers are responsible for securing the computers, servers, databases, networks, user accounts, backups, and other infrastructure under their control.

No Internet transmission, cloud service, computer network, or information-storage system can be guaranteed to be completely secure. Cyberlink therefore cannot guarantee absolute security.

12. California Privacy Rights

California residents may have rights concerning their personal information under the California Consumer Privacy Act (“CCPA”), as amended by the California Privacy Rights Act (“CPRA”), and other California privacy laws, to the extent those laws apply to Cyberlink and the particular information involved. Depending upon applicable law, these rights may include the right to:

• Request information regarding categories and specific pieces of personal
  information collected.
• Request information regarding the sources and purposes for which personal
  information is collected.
• Request information regarding categories of third parties to whom information is disclosed.
• Request deletion of certain personal information.
• Request correction of inaccurate personal information.
• Opt out of the sale or sharing of personal information.
• Limit certain uses or disclosures of sensitive personal information where
  applicable.
• Exercise applicable privacy rights without unlawful discrimination or retaliation.

Because Cyberlink does not sell personal information or share it for cross-context behavioral advertising, Cyberlink does not ordinarily have personal information subject to a sale/sharing opt-out.

Certain information may also be exempt from some privacy requests under applicable law, including information Cyberlink must retain to comply with contractual, accounting, security, tax, regulatory, or legal requirements.

To submit a privacy request, contact Cyberlink using the information provided in the Contact Us section below. Cyberlink may take reasonable steps to verify the identity and authority of the person making a privacy request before fulfilling the request.

13. California Notice at Collection

For California residents, the categories of personal information Cyberlink may collect directly through its website, Cyberlink University, or business relationships generally include:

Identifiers and contact information: such as name, company, business or personal email address, business telephone number, IP address, username, and account identifiers.

Commercial information: such as products, courses, or services purchased; subscription information; invoices; payment status; and transaction history. Internet or electronic activity: such as browser type, device information, access times, website activity, and system activity used for operation and security.

Professional or employment-related information: such as company name, title, department, or business role when provided as part of a business or training relationship.

Training and educational information: such as course enrollment, attendance, course progress, assessments, completion status, certificates, and learner feedback maintained in connection with Cyberlink University or other Cyberlink training services.

Cyberlink uses these categories for the purposes described in this Privacy Policy, including providing services, maintaining accounts, administering training, processing payments, providing support, maintaining security, communicating with customers and learners, and complying with legal obligations.

Cyberlink retains these categories only for the periods reasonably necessary for the purposes described in the Data Retention section of this Privacy Policy.

Cyberlink does not sell these categories of personal information and does not share them for cross-context behavioral advertising.

14. Children

Cyberlink’s websites, software, Cyberlink University, and other services are business and professional-training oriented and are not directed to children. Cyberlink does not knowingly collect personal information from children under 13 through its websites, products, training programs, or services. If Cyberlink becomes aware that information from a child has been collected in circumstances subject to the Children’s Online Privacy Protection Act (“COPPA”) or other applicable law, Cyberlink will take appropriate steps consistent with applicable legal requirements.

15. Customer-Controlled Information

Cyberlink customers are responsible for information they enter into, transmit through, or make available to Cyberlink products and services.

For locally installed eRAMP software, the customer controls the eRAMP database and
the information stored within its own environment. For eRAMP Connect, customers determine the business purpose and authorization for consumer or borrower information transmitted for processing through the service.

Cyberlink’s processing is intended to be limited to providing the applicable authorized transaction or service.

When Cyberlink processes information on behalf of a business customer, the customer remains responsible for establishing the lawful basis and authority for providing and processing that information.

Individuals seeking to exercise privacy rights concerning information controlled by a Cyberlink customer may need to contact that customer directly.

16. Legal Disclosures

Cyberlink may disclose information when reasonably necessary to:

• Comply with applicable law, regulation, subpoena, court order, or lawful
  government request.
• Investigate fraud or unlawful activity.
• Protect the security or integrity of Cyberlink systems.
• Enforce Cyberlink agreements and legal rights.
• Protect the rights, property, or safety of Cyberlink, our customers, learners,
  users, or others.
• Complete a merger, acquisition, financing, reorganization, sale of assets, or
  similar corporate transaction, subject to applicable privacy obligations.

17. Links and Third-Party Services

Cyberlink websites, Cyberlink University, and Cyberlink products may contain links to or integrations with websites, products, and services operated by third parties.

These services may include payment processors, authentication providers, learning- management systems, loan-origination systems, MERS, and other technology platforms used in connection with Cyberlink products and services.

Cyberlink does not control the independent privacy practices of third parties. Information provided directly to a third party is subject to that third party’s applicable privacy policy, terms, and security practices.

We encourage users to review the privacy and security policies of third-party services before providing information to them.

18. Changes to This Privacy Policy

Cyberlink may update this Privacy Policy periodically to reflect changes in our products, services, technology, business practices, or applicable legal requirements.

When the Privacy Policy is updated, Cyberlink will revise the Last Updated date displayed at the beginning of the policy. Material changes may also be communicated through the Cyberlink website, customer communications, or other appropriate methods when required by applicable law. We encourage users to review this Privacy Policy periodically.

19. Contact Us

Questions, concerns, or requests concerning this Privacy Policy or Cyberlink’s privacy practices may be submitted to:

Cyberlink Software Solutions, Inc.
1014 S. Westlake Blvd., Suite 14-125
Westlake Village, CA 91361
Email: support@oncyberlink.com
Telephone: 818-706-0264
Website: www.oncyberlink.com

For privacy-related requests, please include sufficient information for Cyberlink to identify the applicable account, training enrollment, or business relationship and understand the nature of your request.

Please do not send Social Security numbers, complete credit-card numbers, bank-account credentials, or consumer mortgage-loan PII by email.