COPLEY SOFTWARE, INC. PRIVACY NOTICE

Last Updated: June 11, 2026

This Privacy Notice describes how Copley Software, Inc. ("we", "us," "our" or "Copley") collects, uses and discloses information about individuals who use our website (www.copley.com), applications, services, tools and features, or otherwise interact with us (collectively, the "Services").

If you are a customer of Copley, this Privacy Notice does not apply to personal information or other data and information that we process on your behalf as your service provider (collectively, "Customer Data"). Our use of your Customer Data shall instead be governed by the terms and conditions of the separate customer agreement or terms of service that you have agreed to with Copley. In addition, we will only share Customer Data with our service providers as necessary to provide our customer with the Services, and our service providers will only use Customer Data in their capacity as a service provider to Copley.

If you are using the Services as an employee, contractor or other representative of one of our customers and you have any questions about our privacy practices or would like to exercise any rights with respect to your personal information that we process on behalf of our customers, please contact the corresponding customer as we only process your personal information in our capacity as a service provider to our customer.

In addition, our Services are designed for businesses and are not intended for personal, family, or household use. Accordingly, we treat all personal information covered by this Privacy Policy as pertaining to individuals acting as business representatives, rather than in their personal capacity.

CHANGES TO THIS PRIVACY NOTICE

We may modify this Privacy Notice from time to time, in which case we will update the "Last Updated" date at the top of this Privacy Notice. If we make material changes to the way in which we use or disclose information we collect, we will use reasonable efforts to notify you (such as by emailing you at the last email address you provided us, by posting notice of such changes on the Services, or by other means consistent with applicable law) and will take additional steps as required by applicable law. If you do not agree to any updates to this Privacy Notice, please do not continue using or accessing the Services.

COLLECTION OF INFORMATION

When you use or access the Services, we collect certain categories of information about you from a variety of sources.

Information You Provide to Us

Some features of the Services may require you to directly provide us with certain information about yourself. You may elect not to provide this information, but doing so may prevent you from using or accessing these features. Information that you directly submit through our Services includes:

• Basic contact details, such as name, address, phone number, and email. We use this information to create and maintain your account and provide the Services, and to communicate with you (including to tell you about products or services that may be of interest to you).
• Account information, such as username, and password. We use this information to provide the Services and to maintain and secure your account with us. If you choose to register an account, you are responsible for keeping your account credentials safe. We recommend you do not share your access details with anyone else. If you believe your account has been compromised, please contact us immediately.
• Usage information, such as information about how you use the Services and interact with us.
• Payment information, such as bank account, credit or debit card information, and billing address, which we collect using a third party payment processor. We use this information to process your payment and provide the Services.
• Any other information you choose to include in communications with us, for example, when sending a message through the Services.

Information We Collect Automatically

We also automatically collect certain information about your interaction with the Services ("Usage Data"). To do this, we may use cookies, web beacons/clear gifs, other geolocation tracking technologies, etc. ("Tracking Technologies"). Usage Data includes:

• Device information, such as device type, operating system, unique device identifier, and internet protocol (IP) address.
• Location information, such as approximate location, if you choose to provide it.
• Other information regarding your interaction with the Services, such as browser type, log data, date and time stamps, clickstream data, interactions with marketing emails, and ad impressions.

We use Usage Data to tailor features and content to you, market to you, provide you with offers or promotions, run analytics and better understand user interaction with the Services. For more information on how we use Tracking Technologies and your choices, see the section below, Cookies and Other Tracking Technologies.

Information Collected From Other Sources

We may obtain information about you from outside sources, including information that we collect directly from third parties and information from third parties that you choose to share with us. Such information includes:

• Analytics data from providers such as Google Analytics.
• Data from optional third-party integrations that our customers connect to the Services, including customer relationship management (CRM) systems, advertising platforms, asset libraries, e-commerce platforms, and meeting transcription services. The categories and content of such data depend on which integrations the customer connects.
• Data about individuals who are not Copley account holders, such as a customer's contacts, leads, or meeting participants, as represented in the third-party systems described above.

Information obtained from outside sources that constitutes "Customer Data" under our customer agreement is processed by us on behalf of our customer (acting as a controller or business under applicable law) and is governed by the terms of that agreement and our Data Processing Addendum, available at https://www.copley.com/dpa. If your data is included in a customer's integration and you wish to exercise privacy rights, please direct your request to the customer organization that connected the integration.

Use of Google Analytics Data: If you connect your Google Analytics account to our Service, we will access certain analytics data (e.g. website traffic and performance metrics) from your Google account with your permission. We use this data solely to provide you with insights and improve features in our app that analyze your content's performance. We do not use data obtained through Google's APIs for any purposes outside of our app's functionality - for example, we do not use your Google Analytics data to train broad machine-learning models or for advertising purposes. We do not sell your Google Analytics information to any third parties. We do not share your Google Analytics information to any third parties, except as needed to operate and support the Service (and in those cases, data is only shared under strict confidentiality and security standards). The Services use of Google Analytics data complies with Google's limited use of user data requirement.

Any information we receive from outside sources will be treated in accordance with this Privacy Notice. We are not responsible for the accuracy of the information provided to us by third parties and are not responsible for any third party's policies or practices. For more information, see the section below, Third Party Websites and Links.

USE OF YOUR INFORMATION

We use personal information for the following purposes or as otherwise described at the time of collection:

To provide our Services. This includes:

• Administering, hosting, and operating our Services;
• Communicating with you and responding to any inquiries you may have; and
• Analyzing your use of our Services to allow us to evaluate and improve the Services.

For research, development, benchmarking, and improving our Services. We may use personal information to analyze and improve the Services, identify trends, and operate and expand our business activities. We may also create aggregated, anonymized, or other de-identified statistics, which we may use for lawful business purposes, including for analytics, forecasting, and strategic planning.

For marketing and advertising. We and our advertising partners may collect and use your personal information for marketing and advertising purposes, including:

• Email. We or our advertising partners may from time-to-time send you direct marketing emails as permitted by law, including, but not limited to, notifying you of special promotions, offers and events via email. You may opt out of our marketing emails as described in the "Opt out of marketing communications" section below.
• Interest-based advertising. We engage our advertising partners, including third party advertising companies and social media companies, to display ads around the web. These companies may use cookies and similar technologies to collect information about your interaction over time across our Services, our communications, and other online services, and use that information to serve online ads that they think will interest you. We may also share information about our users with these companies to facilitate interest-based advertising to those or similar users on other online platforms. You can learn more about your choices for limiting interest-based advertising in the "Online tracking opt-out" section below.

For compliance and protection. We may use personal information to comply with legal obligations, including to enforce any applicable terms and conditions, defend against legal claims or disputes, protect the security and integrity of our Services, and identify and investigate fraudulent, harmful, unauthorized, unethical or illegal activity.

DISCLOSURE OF YOUR INFORMATION

We may disclose your information to third parties for legitimate purposes subject to this Privacy Notice, including the following categories of third parties:

• Our affiliates or others within our corporate group.
• Vendors or other service providers who help us provide the Services, including for system administration, cloud storage, security, customer relationship management, marketing communications, web analytics, payment networks, AI service providers, and payment processing. A current list of the service providers and subprocessors we use is available at https://www.copley.com/subprocessor-list.
• Third parties for marketing purposes.
• Third parties to whom you request or direct us to disclose information, such as through your use of social media widgets or login integration.
• Professional advisors, such as auditors, law firms, or accounting firms.
• Third parties in connection with or anticipation of an asset sale, merger, or other business transaction, including in the context of a bankruptcy.

We may also disclose your information as needed to comply with applicable law or any obligations thereunder or to cooperate with law enforcement, judicial orders, and regulatory inquiries, to enforce any applicable terms of service, and to ensure the safety and security of our business, employees, and users.

INTERNATIONAL DATA TRANSFERS

Copley is headquartered and primarily operates in the United States. When you use the Services or interact with us, your personal information may be transferred to, stored in, and processed in the United States and other countries where our service providers maintain facilities.

These countries may have data protection laws that differ from the laws of your country. Where we transfer personal information from the European Economic Area, the United Kingdom, or Switzerland to a country that has not received an adequacy determination from the relevant authority, we rely on appropriate transfer mechanisms.

THIRD PARTY WEBSITES AND LINKS

We may provide links to third-party websites or platforms. If you follow links to sites or platforms that we do not control and are not affiliated with us, you should review the applicable privacy notice, policies and other terms. We are not responsible for the privacy or security of, or information found on, these sites or platforms. Information you provide on public or semi-public venues, such as third-party social networking platforms, may also be viewable by other users of the Services and/or users of those third-party platforms without limitation as to its use. Our inclusion of such links does not, by itself, imply any endorsement of the content on such platforms or of their owners or operators.

CHILDREN'S PRIVACY

Children under the age of 13 are not permitted to use the Services, and we do not seek or knowingly collect any personal information about children under 13 years of age. If we become aware that we have unknowingly collected information about a child under 13 years of age, we will make commercially reasonable efforts to delete such information. If you are the parent or guardian of a child under 13 years of age who has provided us with their personal information, you may contact us using the below information to request that it be deleted.

DATA SECURITY AND RETENTION

Despite our reasonable efforts to protect your information, no security measures are impenetrable, and we cannot guarantee "perfect security." Any information you send to us electronically, while using the Services or otherwise interacting with us, may not be secure while in transit. We recommend that you do not use unsecure channels to send us sensitive or confidential information.

We retain your information for as long as is reasonably necessary for the purposes specified in this Privacy Notice. When determining the length of time to retain your information, we consider various criteria, including whether we need the information to continue to provide you the Services, resolve a dispute, enforce our contractual agreements, prevent harm, promote safety, security and integrity, or protect ourselves, including our rights, property or products. If you remove certain access or if it's no longer needed, we will delete the data, such as that from Google Analytics, from our systems within a reasonable timeframe. You can also contact us to request deletion of any Customer Data we've obtained from you, and we will honor such requests in accordance with applicable law and our policy.

We understand that certain data, such as from your Google account, may be sensitive. We have security measures in place to protect your data at all times. For example, any data we retrieve from Google is transmitted over encrypted connections, and we store it using encryption at rest. Access to this data is limited to authorized systems and personnel, and we regularly review our practices to ensure your information is handled safely.

YOUR RIGHTS

This section describes your rights regarding your personal information. The specific rights available to you depend on where you reside.

Residents of the European Economic Area, the United Kingdom, and Switzerland

If you are located in the European Economic Area ("EEA"), the United Kingdom, or Switzerland, the General Data Protection Regulation ("GDPR"), the UK GDPR, or the Swiss Federal Act on Data Protection ("FADP") may apply to our processing of your personal information.

Our legal bases for processing. We process your personal information based on:

• Performance of a contract, including providing the Services you have requested.
• Legitimate interests in operating, improving, and securing the Services, including analytics, fraud prevention, and direct communications about the Services.
• Consent, where required by law (for example, for certain marketing communications). You may withdraw consent at any time without affecting prior processing.
• Legal obligations, such as compliance with applicable law.

Your rights. Subject to applicable exceptions, you have the right to:

• Request access to a copy of the personal information we hold about you.
• Request rectification of inaccurate or incomplete personal information.
• Request erasure of your personal information.
• Request restriction of our processing of your personal information.
• Request portability of your personal information in a structured, commonly used, machine-readable format.
• Object to our processing of your personal information based on legitimate interests, including for direct marketing.
• Withdraw consent where we rely on it.

Lodging a complaint. You have the right to lodge a complaint with a supervisory authority in the EEA, the UK, or Switzerland, including in your country of residence, place of work, or where the alleged infringement occurred.

US Residents

For US residents, depending on the location where you reside, privacy laws may provide you with the following rights regarding your personal information:

• Right to know. You may request that we disclose the categories and specific pieces of personal information we have collected about you, the sources of that information, the purposes for collecting it, and the categories of third parties with whom we have shared it.
• Right to delete. You may request that we delete personal information we have collected from you, subject to certain exceptions.
• Right to correct. You may request that we correct inaccurate personal information we maintain about you.
• Right to opt out of sale or sharing. We do not "sell" personal information for money. However, we use advertising and analytics technologies that may be considered "sharing" for cross-context behavioral advertising purposes under the California Consumer Privacy Act or "targeted advertising" under other state laws. You may opt out by clicking the "Do Not Sell or Share My Personal Information" link in the footer of our website.
• Right to limit use of sensitive personal information. We use sensitive personal information only as reasonably necessary to provide the Services you have requested and for other purposes permitted under the CCPA without triggering the right to limit.
• Right to non-discrimination. We will not discriminate against you for exercising any of your rights.
• Right to opt out of automated decision making. By default, we do not engage in automated processes to make decisions that produce legal effects concerning you or that similarly significantly affect you.

Authorized agents. You may designate an authorized agent to make a request on your behalf. We may require the agent to provide proof of authorization and may require you to verify your identity directly.

Residents of other US states

If you reside in a US state with a comprehensive privacy law, you may have rights similar to those described above. To exercise such rights, contact privacy@copley.com.

How to exercise your rights

To exercise any of the rights described above, please contact us at privacy@copley.com. We will respond within the timeframes required by applicable law. We may need to verify your identity before fulfilling your request and may decline requests where permitted or required by law. If we decline your request, we will explain why.

YOUR CHOICES

Opt out of online tracking. There are a number of ways to opt out of having your online activity and device data collected through our Services, which we have summarized below:

• Blocking cookies in your browser. Most browsers let you remove or reject cookies, including cookies used for interest-based advertising. To do this, follow the instructions in your browser settings. Many browsers accept cookies by default until you change your settings. For more information about cookies, including how to see what cookies have been set on your device and how to manage and delete them, visit http://www.allaboutcookies.org.
• Blocking advertising ID use in your mobile settings. Your mobile device settings may provide functionality to limit use of the advertising ID associated with your mobile device for interest-based advertising purposes.
• Using privacy plug-ins or browsers. You can block our Services from setting cookies by using a browser with privacy features, like Brave, or installing browser plugins like Privacy Badger, DuckDuckGo, Ghostery or uBlock Origin, and configuring them to block cookies/trackers.
• Google Analytics. We use Google Analytics to help us better understand how people engage with our Services by collecting information and creating reports about how users use our Services. For more information on Google Analytics, click here. For more information about Google's privacy practices, click here. You can opt out of Google Analytics by downloading and installing the browser plug-in available at: https://tools.google.com/dlpage/gaoptout.
• Platform opt-outs. The following advertising partners offer opt-out features that let you opt out of use of your information for interest-based advertising: Google, Facebook, LinkedIn, Microsoft.
• Advertising industry opt-out tools. You can also use these opt-out options to limit use of your information for interest-based advertising by participating companies: Digital Advertising Alliance, Network Advertising Initiative.

Note that because these opt-out mechanisms are specific to the device or browser on which they are exercised, you will need to opt out on every browser and device that you use.

Do Not Track. Some Internet browsers may be configured to send "Do Not Track" signals to the online services that you visit. We currently do not respond to "Do Not Track" or similar signals. To find out more about "Do Not Track," please visit http://www.allaboutdnt.com.

HOW TO CONTACT US

Should you have any questions about our privacy practices or this Privacy Notice, please email us at privacy@copley.com or contact us at Copley Software, Inc., 200 State St, Boston, MA 02109.