Privacy Policy

This Privacy Policy (this “Policy”) describes how Valuepath, Inc., a Delaware corporation (“valuepath,” “we,” “us” or “our”), collects, uses, discloses and otherwise processes personal information in connection with our website located at www.valuepath.io (the “Site”), our web application located at app.valuepath.io and the related AI-native financial planning and analysis platform, features, integrations and support services (collectively, the “Services”). This Policy also describes the rights and choices available to you with respect to your personal information.

“Personal information” means any information that identifies, relates to, describes, or is reasonably capable of being associated with an identified or identifiable natural person, and includes “personal data” and equivalent terms as defined under applicable data protection laws.

Please read this Policy carefully. By accessing or using the Site or the Services, you acknowledge that you have read and understood this Policy. If you do not agree with this Policy, please do not access or use the Site or the Services.

1. Scope of this Policy

1.1 Information Covered by this Policy

This Policy applies to personal information that valuepath processes as a controller (or “business,” as that term is used under certain U.S. state privacy laws), including personal information relating to:

• visitors to the Site, including individuals who join our waitlist or request a demonstration;
• individuals who register for, log in to, or administer accounts on the Services (“Users”), to the extent we process their account, usage, billing and communications information for our own business purposes;
• representatives of our current and prospective customers, vendors and business partners; and
• individuals who otherwise communicate with us, such as by email or at events.

1.2 Customer Data Processed on Behalf of Our Customers

The Services are provided to businesses and other organizations (each, a “Customer”). In the course of providing the Services, Customers and their Users upload, connect, submit or generate spreadsheets, files, financial and operational data, prompts, instructions and other content, together with the outputs the Services produce from them, such as analyses, financial models, presentations, reports and workflow results (collectively, “Customer Data”). Customer Data may contain personal information.

With respect to Customer Data, valuepath acts as a service provider, processor or contractor (as those terms are defined under applicable law) on behalf of the relevant Customer, which acts as the business or controller. Our processing of Customer Data is governed by our Subscription Agreement or other written agreement with the applicable Customer (including any data processing addendum forming part of it), and not by this Policy. We process Customer Data only in accordance with the Customer's instructions, as set out in that agreement.

If your personal information is contained in Customer Data and you wish to exercise any rights you may have with respect to it, or if you have questions about how it is processed, please contact the Customer (for example, your employer or the organization that provided you with access to the Services) directly. We will assist our Customers in responding to such requests as required by our agreements with them and by applicable law. Where we receive a request concerning Customer Data directly, we will generally refer the request to the relevant Customer.

1.3 Information Not Covered by this Policy

This Policy does not apply to the privacy practices of third parties that we do not own or control, including third-party services that a Customer or User elects to connect to the Services, or to information processed by our Customers in their own capacity as controllers. Those practices are governed by the relevant third party's or Customer's own privacy notices.

2. Information We Collect

The categories of personal information we collect depend on how you interact with us and the Services. We collect personal information from the following sources.

2.1 Information You Provide to Us

• Waitlist and demonstration requests. When you join our waitlist or request a demonstration through the Site, we collect your name and email address and any other information you choose to include. These submissions are collected through a form hosted by Google LLC (“Google”) on our behalf.
• Account and profile information. When you register for or log in to the Services, we collect your name, email address, and the organization, workspace or project with which your account is associated, together with your role and permissions within it.
• Customer Data. Content you upload, connect, submit or generate through the Services, including files, spreadsheets, data, prompts, messages to AI agents, and instructions for scheduled workflows. As described in Section 1.2, Customer Data is processed on behalf of the applicable Customer.
• Billing and transaction information. When a Customer purchases a subscription, we collect billing contact details, billing address, and transaction and subscription history. Payment card details are collected and processed directly by our third-party payment processor; we do not store full payment card numbers.
• Communications. When you contact us for support or otherwise correspond with us, we collect the contents of your communications, your contact details, and any other information you choose to provide, including any feedback you submit regarding the Services.
• Invitations. If a User invites a colleague to the Services, we collect the invitee's email address and the context of the invitation in order to send and administer the invitation.

2.2 Information We Collect Automatically

When you access or use the Services, we and our service providers automatically collect certain information, including:

• Device and connection information, such as your Internet Protocol (IP) address, browser type and version, operating system, device identifiers, time zone, and general location inferred from your IP address.
• Usage and activity information, such as the features you use, the pages and screens you view, the actions you take, the dates and times of your activity, and referring and exit pages.
• Agent activity and consumption information, such as records of the tasks performed by AI agents on your behalf, the tools they invoke, errors encountered, and the volume of model tokens and credits consumed, which we use for operation, billing, security and service improvement.
• Log information, such as server, application and security logs generated when you interact with the Services, including authentication events and API requests.

We do not currently use analytics, advertising or tracking technologies on the Site. Our use of cookies and similar technologies in the Services is described in Section 6.

2.3 Information We Receive from Third Parties and Integrations

• Single sign-on providers. If you sign in to the Services using a Google or Microsoft account, we receive from that provider, through our authentication service, your name, email address, profile information (such as a profile photograph, where made available) and the identifiers the provider associates with your account. The information we receive depends on the provider and your settings with it.
• Connected integrations. If you choose to connect a third-party service to the Services, such as Google Drive, Slack, Microsoft services, QuickBooks Online, NetSuite or Salesforce, we access information from that service, including files, folders, messages, accounting and financial records (such as general ledger, transaction, vendor and customer records), and associated account information, only to the extent you authorize through that service's OAuth or equivalent permission process, and only to provide the features you have enabled. Information obtained through integrations forms part of Customer Data and is subject to Section 4.5.
• Customers and Users. We receive information about Users from the Customer that administers their account, and about invitees from the Users who invite them.
• Service providers. We receive information from our service providers, such as confirmation of payment status from our payment processor.

3. How We Use Information

We use personal information for the following purposes:

• To provide and operate the Services, including to authenticate Users, create and maintain accounts, process Customer Data as instructed, enable AI agents to analyze data and produce models, decks and reports, run scheduled workflows, and operate connected integrations.
• To respond to inquiries and provide support, including responding to waitlist and demonstration requests and resolving technical issues.
• To process transactions and administer billing, including metering token and credit consumption, invoicing, and collecting payment.
• To communicate with you, including sending transactional and service-related messages (such as account confirmations, security alerts, notifications that a workflow has completed, and updates to our terms or policies) and, where permitted by law, marketing communications about our products and services, from which you may opt out at any time.
• To maintain the safety and security of the Services, including to monitor for, investigate, prevent and respond to fraud, abuse, security incidents and other harmful or unlawful activity, and to enforce usage limits.
• To maintain and improve the Services, including to diagnose and repair errors, measure performance, understand how the Services are used, and develop new features. We do not use Customer Data to train or fine-tune AI models, as described in Section 4.
• To comply with legal obligations, including responding to lawful requests from public authorities, maintaining records required by tax and accounting laws, and complying with applicable regulations.
• To establish, exercise or defend legal claims, and to enforce our agreements, including our Subscription Agreement.
• With your consent or at your direction, for any other purpose disclosed to you at the time we collect your information.

We may also create de-identified or aggregated information that cannot reasonably be used to identify you. We will maintain and use de-identified information only in de-identified form and will not attempt to re-identify it, except as permitted by applicable law.

4. AI and Your Data

The Services use large language models and related artificial intelligence technologies to analyze Customer Data and generate outputs at the direction of Users. This Section describes how Customer Data is handled in that process.

4.1 AI Model Providers

To generate responses and perform tasks, the Services transmit relevant portions of Customer Data, including prompts and the content of files and data necessary for the task, to AI model providers acting as our subprocessors. We may add or change AI model providers from time to time, and a current list is available on request at [email protected].

4.2 No Training on Customer Data

We do not use Customer Data to train or fine-tune artificial intelligence or machine learning models. Our AI model providers are contractually prohibited from using Customer Data to train or improve their models.

We may process Customer Data to provide, support, secure, troubleshoot and maintain the Services, including to evaluate and improve the quality, accuracy and reliability of the Services and their outputs, for example by diagnosing errors and refining the instructions, configurations and tests that govern how the Services behave. This processing does not involve training or fine-tuning any model on Customer Data, it is subject to the confidentiality and security obligations in our Subscription Agreement, and for Connected Data it is further limited as described in Section 4.5.

4.3 Outputs

Outputs generated by the Services from Customer Data form part of Customer Data and are processed in accordance with Section 1.2. Outputs produced by AI technologies may be inaccurate or incomplete, and Users should review them before relying on them. The allocation of rights and responsibilities with respect to outputs is set out in our Subscription Agreement.

4.4 No Solely Automated Decisions with Legal Effects

We do not use personal information to make decisions based solely on automated processing that produce legal or similarly significant effects concerning you.

4.5 Data from Connected Business Systems

When a Customer connects an accounting, enterprise resource planning, customer relationship management, collaboration or file storage system to the Services (a “Connected System”), the following commitments apply to the data we receive from it (“Connected Data”), in addition to the rest of this Policy:

• Purpose limitation. We access only the data the Customer authorizes, and we use it only to provide the Services to that Customer. We do not process Connected Data on behalf of the provider of the Connected System, and we do not share one Customer's Connected Data with another Customer.
• No sale or advertising. We do not sell or rent Connected Data, and we do not use it for advertising.
• No AI training. We do not use or retain Connected Data to develop, improve, train or fine-tune any artificial intelligence or machine learning model, including generalized or non-personalized models. Relevant portions of Connected Data are sent to our AI model providers described in Section 4.1 solely to generate the outputs you request, under terms that prohibit those providers from training on it.
• Limited disclosure. We disclose Connected Data only to subprocessors acting on our behalf under written obligations of confidentiality and data protection, or as required by law.

5. How We Disclose Information

We disclose personal information in the following circumstances:

• Service providers and subprocessors. We disclose personal information to vendors that perform services on our behalf, subject to contractual obligations of confidentiality and data protection that restrict their use of personal information to the provision of services to us. The categories of such providers are described in the table below.
• Customers and other Users. If you use the Services under an account administered by a Customer, information about your account and activity, and content you create or share, may be visible to the Customer's administrators and to other Users with whom you collaborate or to whom access has been granted within the relevant workspace or project.
• Integrations you direct. When you connect a third-party service or instruct the Services to deliver content to it (for example, posting a notification to Slack or saving a file to Google Drive), we disclose information to that service at your direction.
• Professional advisors. We disclose information to our lawyers, accountants, auditors and insurers where necessary in the course of the professional services they render to us.
• Legal requirements and protection of rights. We disclose information where we believe in good faith that disclosure is necessary to comply with applicable law, regulation, legal process or an enforceable governmental request; to enforce our agreements; or to protect the rights, property or safety of valuepath, our Users, Customers or the public.
• Corporate transactions. We may disclose or transfer information in connection with, or during negotiations of, any merger, financing, acquisition, reorganization, sale of all or a portion of our assets, or bankruptcy or similar proceeding, subject to customary confidentiality protections. Any successor will remain bound by the commitments in this Policy with respect to previously collected information unless you are notified otherwise.
• With your consent. We disclose information to other parties when you direct or consent to the disclosure.

5.1 Categories of Service Providers and Subprocessors

Category	Function	Location of Processing
Cloud infrastructure and hosting (Google Cloud Platform)	Hosting, compute, storage, databases and networking for the Services	United States
Authentication (Google Firebase Authentication / Identity Platform)	User sign-in, identity federation with Google and Microsoft, session management	United States
AI model providers	Processing prompts and Customer Data to generate AI outputs	United States and other countries where the provider operates
Form processing (Google Forms)	Collecting waitlist and demonstration requests submitted through the Site	As determined by the provider
Payment processing	Processing subscription payments and storing payment card details	As determined by the provider
Email and communications	Delivering transactional, service and marketing communications	As determined by the provider

5.2 No Sale or Sharing of Personal Information

We do not sell personal information, and we do not share personal information with third parties for cross-context behavioral advertising or targeted advertising, as those terms are defined under applicable law.

6. Cookies and Similar Technologies

6.1 The Site

The Site does not currently use analytics, advertising, or tracking cookies or similar technologies. If you submit a waitlist or demonstration request, the form is provided by Google, and Google may set cookies or collect information in accordance with its own privacy policy when you interact with that form.

6.2 The Services

The Services use cookies, browser local storage and similar technologies that are strictly necessary to provide the Services, such as to authenticate you, maintain your signed-in session, protect against fraudulent and unauthorized access, and remember preferences you select. Because these technologies are essential to the operation of the Services, they cannot be disabled through the Services; you may be able to block them through your browser settings, but parts of the Services may not function properly as a result.

6.3 Changes to Our Practices

If we introduce analytics or other non-essential cookies or similar technologies on the Site or in the Services, we will update this Policy and, where required by applicable law, obtain your consent before doing so.

6.4 Do Not Track and Global Privacy Control

We do not track Users across third-party websites or online services over time, and we do not permit third parties to do so through the Site or the Services. Because there is not yet a common industry standard for interpreting “Do Not Track” browser signals, we do not respond to them. We honor Global Privacy Control (“GPC”) signals as a valid request to opt out of the sale of personal information and the sharing of personal information for cross-context behavioral advertising, as applicable to the browser or device transmitting the signal. As described in Section 5.2, we do not engage in such sales or sharing.

7. Data Retention

We retain personal information for as long as reasonably necessary to fulfill the purposes for which it was collected, as described in this Policy, unless a longer retention period is required or permitted by law. In determining appropriate retention periods, we consider the amount, nature and sensitivity of the information, the potential risk of harm from unauthorized use or disclosure, the purposes for which we process it, and applicable legal, tax, accounting and regulatory requirements. In particular:

• Account information is retained for the life of the relevant account and thereafter for as long as necessary to comply with our legal obligations, resolve disputes, administer billing, and enforce our agreements.
• Customer Data is retained in accordance with our agreement with the applicable Customer. Under our Subscription Agreement, following termination or expiration of a subscription, Customer Data remains available for export for thirty (30) days, after which it is deleted from our active systems in accordance with the applicable Customer agreement and our retention practices.
• Backups containing personal information are retained for a limited period and are deleted on a rolling schedule. Information in backups remains subject to the protections of this Policy until deleted.
• Usage, log and billing records are retained for as long as reasonably necessary for security, billing, financial reporting and service improvement purposes, and as required by law.
• Waitlist and demonstration requests are retained for as long as necessary to respond to your request and maintain our relationship with you, or until you ask us to delete them.

8. Data Security

We maintain reasonable administrative, technical and physical safeguards designed to protect personal information against accidental, unlawful or unauthorized access, use, alteration, disclosure, loss and destruction. These safeguards are designed to include, as appropriate, encryption of data in transit and at rest, role-based access controls, logical separation of customer data, logging and monitoring of access to our systems, and contractual obligations on our service providers.

No method of transmission over the Internet or method of electronic storage is completely secure, and we cannot guarantee the absolute security of personal information. You are responsible for maintaining the confidentiality of your account credentials and for the security of the third-party accounts you connect to the Services. If you believe that your interaction with us is no longer secure, please contact us immediately at [email protected]. We will notify affected individuals, Customers and regulators of a security incident affecting personal information where and as required by applicable law and our agreements.

9. International Data Transfers

valuepath is headquartered in the United States, and the Services are hosted on infrastructure located in the United States. If you access the Site or the Services from outside the United States, your personal information will be transferred to, stored and processed in the United States and in other countries where our service providers operate. The data protection laws of those countries may differ from, and may be less protective than, the laws of your country of residence.

Where we transfer personal information from the European Economic Area, the United Kingdom or Switzerland to a country that has not been recognized as providing an adequate level of protection, we rely on appropriate safeguards, as further described in Section 12.6.

10. Your Rights and Choices

10.1 Account Information

You may review and update certain account information through the Services. Customer administrators may manage Users, permissions and certain data within their organization's account.

10.2 Marketing Communications

You may opt out of receiving marketing emails from us at any time by following the unsubscribe instructions in those emails or by contacting us at [email protected]. If you opt out, we will continue to send you transactional and service-related communications, such as messages concerning your account, security, billing, or changes to our terms or policies.

10.3 Notifications

You may manage certain in-app and email notifications generated by the Services, such as workflow completion notices, through your account settings, subject to any settings established by your Customer administrator.

10.4 Connected Integrations

You may disconnect a third-party integration at any time through the Services, and you may also revoke our access through the security or connected-applications settings of the relevant third-party service, for example at Google Account permissions, Microsoft My Apps or Microsoft account consents, or in the connected-apps settings of your accounting or CRM system. When access is revoked, we promptly stop accessing that service and delete the associated access credentials. Revoking access does not automatically delete information previously obtained, which will be handled in accordance with Section 7 and our agreement with the applicable Customer; you or your Customer administrator may request that we securely delete it by contacting [email protected].

10.5 Privacy Rights

Depending on where you reside, you may have rights under applicable law with respect to your personal information, including rights to access, correct, delete, or obtain a portable copy of it, and to object to or restrict certain processing. Sections 11 and 12 describe additional rights available to residents of certain jurisdictions. To exercise any of these rights, please contact us as described in Section 16. If your request relates to Customer Data, please direct it to the applicable Customer, as described in Section 1.2.

11. Additional Information for California and Other U.S. State Residents

This Section supplements this Policy and applies to residents of California and of other U.S. states with comprehensive consumer privacy laws that grant similar rights (collectively, “U.S. State Privacy Laws”). For California residents, this Section is provided pursuant to the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020, and its implementing regulations (the “CCPA”). Terms used in this Section have the meanings given to them in the applicable U.S. State Privacy Law. This Section does not apply to Customer Data that we process as a service provider or processor on behalf of a Customer.

11.1 Notice at Collection; Categories of Personal Information

The table below describes the categories of personal information we have collected in the preceding twelve (12) months, the sources from which we collected it, the business or commercial purposes for which we collected it, and the categories of recipients to which we disclosed it for a business purpose. Retention periods for each category are described in Section 7.

Category of Personal Information	Sources	Business or Commercial Purposes	Categories of Recipients
Identifiers, such as name, email address, account username, IdP account identifiers and IP address	You; single sign-on providers; Customers and inviting Users; automatic collection	Providing the Services; authentication; support; communications; security; billing; legal compliance	Service providers; Customers and collaborating Users; professional advisors; legal authorities where required
Customer records (Cal. Civ. Code § 1798.80(e)), such as name, billing contact details and billing address	You; Customers; payment processor	Billing and transaction processing; support; legal compliance	Service providers (including payment processor); professional advisors
Commercial information, such as subscription plan, purchase and transaction history, and token and credit consumption	You; Customers; automatic collection; payment processor	Billing; providing and improving the Services; legal compliance	Service providers; Customers; professional advisors
Internet or other electronic network activity information, such as browser and device information, usage data, agent activity and logs	Automatic collection	Providing, securing, maintaining and improving the Services; billing; debugging	Service providers; Customers (with respect to activity within their accounts)
Geolocation data (general location inferred from IP address only)	Automatic collection	Security and fraud prevention; legal compliance	Service providers
Professional or employment-related information, such as employer, organization and role	You; Customers; single sign-on providers	Providing the Services; account administration; communications	Service providers; Customers and collaborating Users
Audio, electronic, visual or similar information, such as a profile photograph made available by a single sign-on provider, and the contents of support communications	You; single sign-on providers	Providing the Services; support	Service providers; Customers and collaborating Users
Sensitive personal information, limited to account log-in credentials in combination with credentials or tokens permitting access to an account	You; single sign-on providers; connected integrations	Authentication; providing connected integrations; security	Service providers
Inferences	We do not draw inferences from personal information to create a profile about a consumer.

11.2 No Sale or Sharing; Sensitive Personal Information

We do not sell personal information and do not share personal information for cross-context behavioral advertising, and we have not done so in the preceding twelve (12) months. We have no actual knowledge of selling or sharing the personal information of consumers under sixteen (16) years of age. We do not process personal information for targeted advertising or for profiling in furtherance of decisions that produce legal or similarly significant effects.

We use and disclose sensitive personal information only for purposes that are permitted without offering a right to limit under the CCPA, such as providing the Services you request and ensuring security and integrity. We do not use or disclose sensitive personal information for the purpose of inferring characteristics about you.

11.3 Your Rights

Subject to certain exceptions and limitations under applicable law, and depending on your state of residence, you have the following rights:

• Right to know and access. The right to request that we disclose the categories of personal information we have collected about you, the categories of sources, the business or commercial purposes for collecting it, the categories of third parties to which we have disclosed it, and the specific pieces of personal information we have collected about you, including, where applicable, in a portable format.
• Right to delete. The right to request that we delete personal information we have collected from you.
• Right to correct. The right to request that we correct inaccurate personal information we maintain about you.
• Right to opt out. The right to opt out of the sale of personal information, the sharing of personal information for cross-context behavioral advertising, targeted advertising, and certain profiling. As noted above, we do not engage in these activities. You may also exercise this right by enabling GPC in your browser, as described in Section 6.4.
• Right to limit. The right to limit the use and disclosure of sensitive personal information to purposes permitted by law. As noted above, we use sensitive personal information only for such permitted purposes.
• Right to non-discrimination. The right not to receive discriminatory treatment for exercising any of the rights described in this Section. We will not deny you goods or services, charge you different prices, or provide you with a different level or quality of services because you exercised your rights.

11.4 Exercising Your Rights; Verification

To exercise any of the rights described above, please email us at [email protected] with the subject line “Privacy Rights Request” and a description of your request. To protect your personal information, we will take reasonable steps to verify your identity before fulfilling your request, which may include asking you to confirm the email address associated with your account, to respond from that address, or to provide additional information that allows us to match your request with the information we maintain. The verification required will depend on the nature of the request and the sensitivity of the information concerned. We will not use information provided for verification for any other purpose.

We will respond to your request within the period required by applicable law, and if we need to extend that period as permitted by law, we will notify you of the extension and the reason for it.

11.5 Authorized Agents

You may designate an authorized agent to submit a request on your behalf. Unless the agent holds a valid power of attorney under applicable law, we will require the agent to provide written permission signed by you authorizing the agent to act on your behalf, and we may require you to verify your own identity directly with us or to confirm directly with us that you provided the agent with permission to submit the request.

11.6 Appeals

If you reside in a state that provides a right to appeal and we decline to take action on your request, you may appeal our decision by replying to our response or by emailing [email protected] with the subject line “Privacy Request Appeal.” We will respond to your appeal within the period required by applicable law. If your appeal is denied, you may contact the attorney general of your state of residence.

11.7 California “Shine the Light”

California Civil Code Section 1798.83 permits California residents to request certain information regarding our disclosure of personal information to third parties for their direct marketing purposes. We do not disclose personal information to third parties for their own direct marketing purposes.

12. Additional Information for Individuals in the EEA, UK and Switzerland

This Section supplements this Policy and applies to individuals located in the European Economic Area (“EEA”), the United Kingdom (“UK”) and Switzerland, whose personal information is subject to the EU General Data Protection Regulation (Regulation (EU) 2016/679), the UK General Data Protection Regulation and UK Data Protection Act 2018, or the Swiss Federal Act on Data Protection, as applicable (collectively, “European Data Protection Laws”).

12.1 Controller

Valuepath, Inc., a Delaware corporation, is the controller of personal information processed under this Policy. With respect to Customer Data, valuepath is a processor acting on behalf of the applicable Customer, which is the controller, as described in Section 1.2. You may contact us regarding our processing of your personal information at [email protected].

12.2 Legal Bases for Processing

We process personal information on the following legal bases:

Purpose of Processing	Legal Basis
Creating and administering accounts; authenticating Users; providing the Services and integrations	Performance of a contract with you or, where you use the Services on behalf of a Customer, our legitimate interest in providing the Services the Customer has purchased
Responding to waitlist, demonstration and support requests	Steps taken at your request prior to entering into a contract; our legitimate interest in responding to inquiries
Billing, payment and metering of consumption	Performance of a contract; compliance with legal obligations (including tax and accounting)
Transactional and service communications	Performance of a contract; our legitimate interest in operating the Services
Marketing communications	Our legitimate interest in promoting our products and services, or your consent where required by applicable law
Security, fraud prevention and abuse monitoring	Our legitimate interest in protecting the Services, our Customers and Users; compliance with legal obligations
Maintaining, debugging and improving the Services	Our legitimate interest in operating and improving the Services
Compliance with law; establishing, exercising or defending legal claims	Compliance with legal obligations; our legitimate interest in protecting our rights
Any processing for which we request your consent	Consent, which you may withdraw at any time without affecting the lawfulness of prior processing

Where we rely on legitimate interests, we have balanced those interests against your rights and freedoms. You may obtain further information about that balancing by contacting us. Where we require personal information to perform a contract or comply with a legal obligation, failure to provide it may prevent us from providing the Services to you.

12.3 Your Rights

Subject to the conditions and exceptions set out in European Data Protection Laws, you have the right to:

• access the personal information we hold about you and obtain a copy of it;
• request rectification of inaccurate or incomplete personal information;
• request erasure of your personal information;
• request that we restrict the processing of your personal information;
• receive personal information you have provided to us in a structured, commonly used and machine-readable format, and to transmit it to another controller (data portability);
• object to processing based on our legitimate interests, and object at any time to processing for direct marketing purposes;
• withdraw your consent at any time, where processing is based on consent; and
• not be subject to a decision based solely on automated processing that produces legal or similarly significant effects concerning you.

To exercise these rights, please contact us at [email protected]. We may need to verify your identity before responding. We will respond within one (1) month of receipt of your request, which may be extended by up to two (2) further months where necessary, taking into account the complexity and number of requests, in which case we will inform you of the extension.

12.4 Complaints

If you have concerns about our processing of your personal information, we encourage you to contact us first so that we may attempt to resolve them. You also have the right to lodge a complaint with the supervisory authority in the EEA member state of your habitual residence, place of work or place of the alleged infringement, with the UK Information Commissioner's Office, or with the Swiss Federal Data Protection and Information Commissioner, as applicable.

12.5 Customer Data

If your personal information is contained in Customer Data, the applicable Customer is the controller and you should direct requests to exercise your rights to that Customer. We will assist the Customer in responding to such requests in accordance with our agreement with it.

12.6 International Transfers

Personal information we collect is transferred to and processed in the United States, as described in Section 9. Where such transfers are made to a country that has not received an adequacy decision under European Data Protection Laws, we implement appropriate safeguards, which may include the Standard Contractual Clauses approved by the European Commission, the UK International Data Transfer Addendum to those clauses, and their Swiss equivalents, or reliance on a recipient's certification under the EU-U.S. Data Privacy Framework, the UK Extension to the EU-U.S. Data Privacy Framework, or the Swiss-U.S. Data Privacy Framework, where applicable. In other cases, we may rely on derogations available under European Data Protection Laws, such as where a transfer is necessary for the performance of a contract with you. You may request further information about the safeguards we use by contacting us at [email protected].

13. Children's Privacy

The Site and the Services are intended for businesses and are not directed to individuals under the age of eighteen (18). We do not knowingly collect personal information from children under the age of sixteen (16). If we learn that we have collected personal information from a child under sixteen (16) without verifiable parental consent where required by law, we will take steps to delete that information promptly. If you believe that a child has provided personal information to us, please contact us at [email protected].

14. Third-Party Services and Links

The Site and the Services may contain links to, or allow you to connect with, websites, applications and services operated by third parties, including Google Drive, Slack, Microsoft services, QuickBooks Online, NetSuite and Salesforce. We do not control and are not responsible for the privacy practices of those third parties, and this Policy does not apply to them. Information you provide to or that is collected by a third party is governed by that third party's privacy policy, which we encourage you to review.

valuepath's use and transfer to any other application of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Consistent with those requirements, we use Google user data only to provide and improve user-facing features of the Services that are visible and prominent in the user interface; we do not transfer Google user data to others except as necessary to provide or improve those features, to comply with applicable law, or as part of a merger, acquisition or sale of assets; we do not use or transfer Google user data for serving advertisements; we do not use Google user data to develop, improve or train generalized artificial intelligence or machine learning models; and we do not allow humans to read Google user data unless we have your affirmative agreement for specific data, it is necessary for security purposes, it is necessary to comply with applicable law, or the data has been aggregated and anonymized for internal operations.

Where you sign in with, or connect, a Microsoft account or Microsoft 365 service (such as SharePoint, OneDrive or Excel), we access information through Microsoft's interfaces only within the permissions you or your organization grant, and we use it only to provide the Services. We do not sell, resell or redistribute information received from Microsoft, and we do not use it, including in aggregated, anonymized or derived form, for advertising or marketing. You can review and revoke our access at any time as described in Section 10.4.

15. Changes to this Policy

We may update this Policy from time to time to reflect changes in our practices, the Services or applicable law. When we do, we will post the updated Policy on this page and revise the “Last Updated” date above. If we make material changes, we will provide notice by email to the address associated with your account or through a notice in the Services prior to the change becoming effective, and, where required by applicable law, obtain your consent. We encourage you to review this Policy periodically. Your continued use of the Site or the Services after an updated Policy becomes effective constitutes your acknowledgement of the updated Policy.

16. Contact Us

If you have any questions, comments or requests regarding this Policy or our privacy practices, or wish to exercise any of your rights, please contact us at:

• Privacy inquiries and requests: [email protected]
• Legal notices: [email protected]

Valuepath, Inc. is a Delaware corporation. Our postal address is available on request by email to either of the addresses above. We will respond to privacy requests within the time periods required by applicable law.