PRIVACY POLICY

This Privacy Policy describes how the review management platform (“Platform”) collects, uses, stores, shares, and protects your personal information. It applies to all users who access the Platform through an authorized Provider. Your Provider is the company or individual that has made the Platform available to you. For questions about this Privacy Policy, contact your Provider.

1.INFORMATION WE COLLECT

When you register for or use the Platform, we collect:

• name, email address, and phone number
• business name, address, and website URL
• username and account credentials
• billing contact details (processed by your Provider)

We collect data about how you use the Platform, including:

• login events, feature usage, and interaction data
• API activity and request logs
• settings and preferences you configure
• support and communication records

In providing review management services, the Platform collects:

• review content, ratings, and metadata from third-party review sites on your behalf
• review responses created by or for you through the Platform
• solicitation message content and delivery records
• review content submitted directly by users through first-party review collection features (such as the Platform’s Comment feature), rather than sourced from a third-party review site

For review content sourced from third-party review sites: this content is publicly available information originally published by the reviewer on that site, not information provided to us directly. We cannot guarantee that our copy remains complete, current, or available if the underlying content changes or is removed independently of the Platform. Supported review sites (such as Google, Facebook, Yelp, and others) maintain their own separate privacy policies governing how they collect and handle personal information, and this Privacy Policy does not apply to any such site’s own practices.

When you access the Platform, we automatically collect:

• IP address, browser type, and operating system
• pages visited and time spent on pages
• referring URLs and session data
• cookie data as described in Section 7

If you opt in to receive SMS messages, we collect your mobile phone number and a record of your consent. This data is used solely to deliver SMS messages you have requested and will not be shared, sold, rented, or transferred to any third party for their own marketing purposes.

We do not knowingly collect:

• payment card numbers (handled by your Provider’s payment processor)
• government-issued identification numbers
• sensitive personal information such as health data or biometric data
• personal information from children under 13 years of age

2.HOW WE USE YOUR INFORMATION

We use your personal information only for the purposes for which it was collected. We never sell personal information to third parties, and we never use personal information for automated decision-making that produces legal or similarly significant effects on individuals without human review.

3.HOW WE SHARE YOUR INFORMATION

We share your account information and usage data with the Provider through whom you access the Platform, as necessary to manage your account and deliver services.

The Platform engages trusted third-party service providers to assist in delivering services, including cloud infrastructure, SMS delivery, monitoring, and AI response generation providers. All sub-processors are bound by data protection agreements and are required to protect your information to the same standard as the Platform.

We may disclose your information if required to do so by law, court order, or governmental authority, or if we believe in good faith that disclosure is necessary to protect rights, protect safety, or investigate fraud.

In the event of a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. You will be notified prior to any such transfer.

We do not sell, rent, or lease your personal information to any third party for their own marketing or commercial purposes.

We may create aggregated or de-identified information from personal information we process, from which individuals can no longer reasonably be identified. We may use and share this information at our discretion, including with your Provider and for our own analytics and product development, since it is no longer personal information.

At your Provider’s direction, review content collected through the Platform may be publicly displayed via embeddable widgets on websites operated by your Provider or your Provider’s own end customers. The underlying data remains hosted on the Platform’s infrastructure; the widget only displays it within that website.

4.DATA RETENTION

We retain your personal information for as long as necessary to fulfill the purposes for which it was collected and to satisfy legal, regulatory, and contractual requirements.

When personal information is deleted from active systems, we work to remove it as quickly as reasonably possible. Some information may continue to exist for a limited period in encrypted backup copies before being permanently purged in the ordinary course of the backup rotation schedule.

5.DATA SECURITY

The Platform maintains appropriate technical and organizational security measures to protect your personal information, including:

• encryption of data in transit using TLS 1.2 or higher
• encryption of data at rest using industry-standard methods
• role-based access controls and least-privilege principles
• multi-factor authentication for system access
• continuous monitoring and logging of system activity

Despite these measures, no internet-based system is completely secure. In the event of a security incident affecting your personal information, affected parties will be notified in accordance with applicable law.

6.SMS/TEXT MESSAGING AND OPT-IN DATA

Program Name: ORM

If you have opted in to receive SMS messages from the Platform, the following applies:

No Sharing of Opt-In Data: No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. All of the above categories exclude text messaging originator opt-in data and consent. This information will not be shared with any third parties.

Collection: We collect your mobile phone number and record your opt-in consent when you register for SMS communications through your account settings or registration process. SMS opt-in is voluntary and separate from account registration.

Use: Your phone number is used exclusively to deliver SMS messages you have opted to receive, including review solicitation requests, account alerts, and service updates. It is not used for advertising or shared with advertising partners.

Storage and Protection: Phone numbers are stored securely within the Platform infrastructure and protected by the security controls described in Section 5. SMS messages are delivered via Bandwidth Inc., our carrier service provider, which is bound by a Data Processing Agreement.

Carrier Liability: SMS delivery is dependent on effective transmission by mobile network operators and upstream telecommunications carriers. Neither the Platform nor its carrier partners are liable for delayed, undelivered, or blocked messages. Delivery is not guaranteed.

Communications Metadata: To route SMS messages, the Platform shares transaction data with telecommunications carriers including source and destination phone numbers, IP addresses, message timestamps, and delivery logs. This sharing is required for message delivery and does not constitute a sale of personal information.

Opt-Out: You may opt out of SMS communications at any time by replying STOP to any message or contacting your Provider. After opting out, you will receive one final confirmation message.

Help: Reply HELP to any SMS message or contact your Provider for assistance.

Supported Carriers: Major US carriers including AT&T, Verizon, T-Mobile, and others. Carrier support may vary.

7.COOKIES AND TRACKING TECHNOLOGIES

The Platform uses cookies and similar technologies to support login sessions, remember your preferences, and improve platform performance.

We do not use cookies for cross-site advertising or behavioral tracking.

8.YOUR PRIVACY RIGHTS

Depending on your location and applicable law, you may have rights regarding your personal information, including the right to access, correct, delete, or restrict processing of your data. To exercise any of these rights, contact your Provider. EEA and UK residents will receive a response within one month of a verified request, extendable to three months for complex requests. California residents will receive a response within 45 days of a verified request, extendable by an additional 45 days where necessary.

If you are a California resident, you have the right to know, delete, correct, and opt out of the sale or sharing of your personal information. We do not sell or share personal information for cross-context behavioral advertising, and we honor Global Privacy Control (GPC) signals as a valid opt-out preference signal where applicable. You may exercise your rights free of discrimination.

If you are located in the EEA or UK, you have the right to access, rectify, erase, restrict, and port your personal information, and to object to processing. You may lodge a complaint with your local supervisory authority.

If you are located in Australia, you have the right to access and correct personal information we hold about you, and to lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au.

9.INTERNATIONAL DATA TRANSFERS

The Platform is hosted in the United States. If you are located outside the United States, your personal information will be transferred to and processed in the United States. Appropriate safeguards are in place to protect cross-border transfers of personal information in accordance with applicable law.

EU/UK Representative. Shout About Us, Inc. has not appointed an Article 27 representative under the GDPR or UK GDPR, as it does not currently process EEA, UK, or Swiss personal information at a scale that requires one. This will be addressed prior to any engagement that changes that.

10.CHANGES TO THIS POLICY

This Privacy Policy may be updated from time to time. Material changes will be communicated through the Platform or by your Provider. Your continued use of the Platform after the effective date of any update constitutes acceptance of the revised Policy.

11.CONTACT

For questions about this Privacy Policy or to exercise your privacy rights, contact your Provider first.

Data Protection Contact. Shout About Us, Inc. Privacy Team — privacy@shoutaboutus.com — (858) 429-5745.