Privacy Policy

1. About Exact Match and Our Services

Exact Match is a B2B consumer data, audience, identity-resolution, and marketing-enablement platform offered to U.S. business customers. The Services enable customers to build, enrich, and activate audiences for marketing, advertising, lead-generation, and analytics purposes through the platform interface, downloads, exports, APIs, Model Context Protocol (MCP) connections, and authorized integrations.

The Services are intended solely for business users. The Services are not directed to consumers, are not designed for personal or household use, and are not directed to children. Use of the Services is governed by our Terms of Service, our Acceptable Use Policy, applicable data-provider restrictions, and applicable law.

2. Scope of This Privacy Policy

This Privacy Policy applies to personal information that Exact Match processes in connection with the Services, the websites identified above, our customer accounts, our APIs and MCP connections, our marketing and communications, our suppression and do-not-serve operations, and our business operations.

This Privacy Policy does not apply to (a) personal information processed by our customers, advertising partners, data partners, integrations, or third-party platforms acting in their independent capacity; (b) personal information governed exclusively by a separate written agreement (such as a data processing addendum) with respect to processing covered by that agreement; or (c) information that is not personal information under applicable law (such as deidentified, aggregated, or publicly available information, to the extent permitted by law).

Where state privacy law or another applicable law provides additional rights, disclosures, definitions, or procedures, that law controls to the extent of any conflict with this Privacy Policy. State-specific information is set out in our Consumer Privacy Rights Notice.

3. Categories of Personal Information We Collect

Depending on how you interact with Exact Match and the Services, we may collect the following categories of personal information. Not every category applies to every individual.

• Identifiers such as name, postal address, email address, telephone number, account username, customer or organization identifier, IP address, device identifier, mobile advertising identifier, online identifier, cookie or pixel identifier, persistent person or household identifier, address identifier, and government-issued identifiers where necessary for verification or authorized use.
• Personal information categories under Cal. Civ. Code § 1798.80(e) such as name, contact information, employment-related information, and similar identifying information.
• Commercial information such as records of products or services purchased, credits or subscription information, billing data, transaction history, customer-uploaded list metadata, and other commercial activity related to the Services.
• Internet or other electronic network activity information such as browsing history on our websites, interactions with our content or ads, search queries within the platform, API and MCP request metadata, log data, device or browser information, referring URLs, and analytics signals.
• Geolocation data such as IP-derived city, region, or country, postal address-derived geography, and other coarse or, where lawfully available and permitted, precise geolocation indicators.
• Audio, electronic, visual, or similar information such as call recordings or transcripts where required by law and disclosed at the time of collection, and similar communications-related information.
• Professional or employment-related information such as company name, job title, industry, professional role, business contact information, and B2B firmographic data.
• Education information where lawfully obtained from third-party data providers in non-FCRA-regulated contexts.
• Inferences drawn from the categories above, including audience segments, interest categories, intent indicators, propensity indicators, lookalike-audience attributes, demographic predictions, household attributes, and ideal-customer-profile attributes.
• Sensitive personal information may be processed only in the limited circumstances described in Section 7 and subject to product, contractual, and operational controls. Categories may include precise geolocation, racial or ethnic origin, religious beliefs, health-related indicators, financial-status indicators, household or child indicators, and similar regulated categories, in each case to the extent permitted by applicable law and not restricted by our data partners.

4. Information You Provide to Us

We collect personal information that you provide directly to us, including:

• Account registration details (name, business email address, company name, role, phone number, password).
• Billing and payment information (processed by our payment processor; we do not store full payment card numbers on our systems).
• Communications you send to us (support requests, sales inquiries, feedback, demo requests, privacy requests, appeal submissions).
• Audience criteria, queries, configuration choices, prompts, and other inputs you submit to the platform, API, or MCP.
• Customer lists and other files you upload to the Services for matching, enrichment, lookalike generation, suppression, or other authorized transactions.
• Marketing-preference information, including consent or opt-out indications, newsletter subscriptions, and event registrations.

5. Information We Collect Automatically

When you use our websites or the Services, we and our service providers may automatically collect:

• Device and browser information (IP address, browser type, operating system, device type, language).
• Usage data (pages visited, features used, queries run, exports performed, session duration, click and scroll events).
• Cookies, pixels, tags, local storage, server logs, and similar tracking technologies (see Section 24).
• Diagnostic, performance, and security telemetry from our infrastructure, APIs, and MCP connections.

The Services may also receive personal information that originates with third-party data providers, customers, advertising partners, identity-resolution partners, public databases, and other lawful sources, as described in Section 8. Some of these categories may include sensitive personal information, sensitive data, protected-class information, or otherwise regulated data under certain laws or in certain use cases. See Section 7 (Sensitive Personal Information and Restricted Data).

6. Customer-Uploaded Data

Customers may upload customer lists or other files to the Services for purposes such as generating lookalike audiences, enriching records, identifying matching audience segments, narrowing a data pull, or performing other customer-requested operations on the uploaded data.

Unless a separate written agreement, product setting, or saved-list feature expressly provides otherwise, Exact Match uses customer-uploaded data solely to perform the transaction or provide the Service requested by the customer. Exact Match does not use customer-uploaded lists to supplement, enhance, build, or augment its own consumer database, and does not make customer-uploaded records available to other customers.

Under the current product architecture, customer-uploaded lists are intended to be processed in memory or through designated processing vendors for the requested transaction and deleted following completion of that transaction. Only limited metadata is retained thereafter, and solely as reasonably necessary for account administration, billing, security, audit, compliance, fraud prevention, and usage-tracking purposes.

Customers are responsible for ensuring that they have all rights, permissions, consents, and lawful bases necessary to upload personal information to the Services and for ensuring that their use of the Services with respect to such data complies with applicable law, the Terms of Service, the Acceptable Use Policy, and any applicable data-provider restrictions.

If Exact Match later offers product features that allow customers to save uploaded lists, retain uploaded lists for future use, or otherwise persist customer-uploaded data beyond the requested transaction, the platform interface, product documentation, or applicable agreement will describe that functionality and any associated processing terms.

7. Sensitive Personal Information and Restricted Data

Depending on the data source, jurisdiction, and use case, certain categories of data available through or processed by the Services may be considered sensitive personal information, sensitive data, protected-class information, or otherwise regulated data under applicable law. These categories may include, without limitation, race, ethnicity, ancestry, language, religion, political affiliation or political contributions, union-related indicators, age, gender, marital status, household composition, presence or age ranges of children, precise geolocation, health-related interests or purchases, health-related content or search signals, financial indicators, credit range or credit-capacity indicators, income, net worth, mortgage information, veteran status, disability-related property exemption indicators, and similar information.

Exact Match's intent is to restrict, filter, suppress, or prohibit uses of these data categories where required by applicable law, by our data providers, or by our internal product rules. We may apply technical, contractual, and operational controls to filter, block, suppress, or restrict sensitive or high-risk data categories by state, configuration, access method, industry, customer type, intended use, or audience criteria. Where applicable law requires consent, authorization, or another legally required basis before processing sensitive or regulated data, we will obtain the required consent or authorization, rely on appropriate customer or data-provider commitments, restrict the category, or make the category unavailable. The availability of any specific category may vary, and Exact Match reserves the right to add, remove, modify, or condition access to any category at any time.

The Services are not intended for, and customers may not use the Services for, unlawful discrimination, eligibility determinations, consumer reports, credit decisions, employment decisions, housing decisions, tenant screening, insurance underwriting, health-care decisions, education admissions, government-benefit decisions, or any other decisions that produce legal or similarly significant effects about individuals, except where Exact Match has expressly authorized the use in a separate written agreement and the use complies with all applicable laws, including, where applicable, the Fair Credit Reporting Act and analogous state laws.

If we determine that we have received, processed, or made available information that we do not permit or cannot lawfully process, we may delete, suppress, restrict, de-identify, aggregate, or exclude that information, in our sole discretion and without liability to any customer or other party.

8. Sources of Personal Information

We collect personal information from the following sources:

• You, when you visit our website, create an account, use the Services, contact us, submit a privacy request, or purchase Services.
• Our customers, when customers provide account information, business information, audience criteria, uploaded lists, website URLs, or campaign inputs.
• Third-party data providers, including data brokers, data aggregators, identity graph providers, commercial data providers, advertising partners, public databases, property records, transaction data providers, and other lawful data sources.
• Automatic collection technologies, including cookies, pixels, tags, logs, analytics tools, APIs, MCP connections, and similar technologies.
• Service providers and business partners, including payment processors, cloud infrastructure providers, communications providers, fraud prevention vendors, analytics vendors, identity-resolution vendors, data enrichment vendors, and customer support tools.

9. How We Use Personal Information

We use personal information for the purposes set forth in the table below, in each case as permitted by applicable law and consistent with the disclosures in this Privacy Policy.

We may also use personal information for any other purpose disclosed to you at the time of collection or for which you have provided consent, and we may use de-identified, aggregated, or anonymized information for any lawful purpose.

10. Profiling, Inferences, and Automated Processing

The Services use automated processing, including profiling and inference generation, to create audience segments, ideal customer profiles, interest categories, intent indicators, lookalike audiences, identity matches, household matches, device or channel linkages, and other marketing-related outputs.

These tools may evaluate or predict interests, preferences, behaviors, characteristics, propensities, purchase intent, content interests, financial intent, household attributes, likely marketing responsiveness, or likelihood of interest in products or services. Customers use these outputs for marketing, advertising, audience creation, enrichment, and related business purposes.

The Services are not intended to be used for decisions that produce legal or similarly significant effects about individuals, including decisions about housing, employment, credit, education, insurance, health care, criminal justice, government benefits, or access to essential goods or services. Our Terms of Service and Acceptable Use Policy restrict those uses.

11. How We Disclose Personal Information

We may disclose personal information to the categories of recipients described in this Section, in each case subject to applicable law, our contractual obligations, data-provider restrictions, our Acceptable Use Policy, and the privacy choices you have communicated to us. The subsections below describe the principal categories of recipients and the purposes of those disclosures.

11.1 Customers and Platform Users

When customers use the Services to generate, purchase, export, download, access, or otherwise receive audience records, leads, contact data, enrichment outputs, or other data outputs, we may disclose personal information about individuals matching the customer's selected criteria, audience definition, or input list. The personal information disclosed in this manner may include identifiers, contact information, postal and digital channel identifiers, demographic indicators, household attributes, commercial information, professional and employment-related information, property information, automotive information, financial or economic indicators, behavioral, interest, intent, or lifestyle indicators, transactional indicators, inferences, audience segments, and other attributes available through the Services.

Customers and platform users access these outputs through the platform interface, downloads, exports, APIs, MCP connections, integrations, or similar delivery mechanisms. The categories and volume of personal information disclosed depend on the customer's subscription, credits, audience criteria, product configuration, intended use, geography, and any restrictions imposed by Exact Match, our data providers, or applicable law.

These disclosures may constitute a "sale" of personal information for monetary or other valuable consideration under the California Consumer Privacy Act, as amended, and under other state privacy laws that define "sale" similarly. These disclosures may also constitute "sharing" of personal information for cross-context behavioral advertising under California law or processing for "targeted advertising" under other state privacy laws, depending on the customer's intended use of the data.

Consumers have the right to opt out of such sales, sharing, and targeted advertising as described in Section 12 (Sales, Sharing, Targeted Advertising, and Opt-Out Rights) and Section 16 (Your Privacy Rights). Customers receiving personal information through the Services are subject to the obligations described in Section 11.4 (Business Customers Acting as Independent Controllers) and must comply with our Terms of Service, Acceptable Use Policy, applicable data-provider restrictions, and all applicable laws.

11.2 Service Providers and Contractors

We disclose personal information to service providers, contractors, and vendors that perform functions on our behalf in connection with the operation, delivery, security, and improvement of the Services. Such parties are authorized to process personal information only as necessary to perform services for Exact Match and in accordance with written agreements that impose confidentiality, security, and use-limitation obligations consistent with applicable law.

The categories of service providers, contractors, and vendors to which we disclose personal information include the following:

• Cloud hosting and infrastructure providers that host, store, process, and transmit data supporting the Services;
• Payment processors that handle subscription payments, credit purchases, billing, invoicing, and related financial transactions;
• Security and fraud prevention providers that support authentication, access control, threat detection, abuse prevention, and incident response;
• Analytics providers that measure website and platform usage, evaluate performance, and assist in product improvement;
• Email, messaging, and communications providers that deliver service notices, transactional messages, marketing communications, and support correspondence;
• Customer support providers, including help-desk, ticketing, and live-chat tools used to respond to inquiries and assist users;
• Data processing, identity-resolution, and enrichment vendors that support matching, linking, validation, hygiene, suppression, and enhancement of records;
• Verification and privacy-request vendors that assist in intake, identity verification, processing, documentation, and tracking of consumer privacy requests;
• API, MCP, integration, and automation vendors that enable connectivity, orchestration, and data exchange between the Services and authorized systems; and
• Professional services providers, including auditors, accountants, consultants, and legal advisors engaged in connection with the operation of our business.

Service providers and contractors are contractually prohibited from selling or sharing personal information disclosed to them by Exact Match and from retaining, using, or disclosing such information for any purpose other than the specific business purpose for which it was provided, except as otherwise permitted by applicable law.

11.3 Data Partners and Advertising Partners

We may disclose personal information to advertising networks, data partners, analytics partners, marketing partners, identity-resolution partners, enrichment partners, measurement partners, audience partners, and similar third parties for marketing, advertising, measurement, attribution, enrichment, identity resolution, audience creation, lookalike modeling, segmentation, and related commercial purposes.

Personal information disclosed to these partners may include identifiers, hashed identifiers, contact information, online identifiers, device identifiers, geographic information, demographic attributes, household attributes, business and professional information, behavioral and interest indicators, intent signals, transactional indicators, and inferences derived from the foregoing.

Depending on the nature of the disclosure and the law that applies, these disclosures may constitute a "sale" of personal information, "sharing" of personal information for cross-context behavioral advertising, or processing of personal information for "targeted advertising" under applicable state privacy laws. Consumers may exercise opt-out rights with respect to these activities as described in Section 12 (Sales, Sharing, Targeted Advertising, and Opt-Out Rights) and Section 14 (Universal Opt-Out Signals and Global Privacy Control).

Where required by law, contract, or data-provider restriction, we apply technical, contractual, and operational controls to limit the categories of personal information disclosed to data partners and advertising partners, to suppress sensitive or restricted categories, and to honor consumer opt-outs and suppression-list entries before further disclosure.

11.4 Business Customers Acting as Independent Controllers

Certain customers use the Services as independent businesses for their own marketing, advertising, audience development, enrichment, identity-resolution, and related commercial purposes. Once a customer exports, downloads, accesses, receives, transmits, or otherwise obtains personal information from the Services, that customer independently determines the means and purposes of any further processing of such personal information and acts as a separate and independent controller, business, or equivalent under applicable privacy law.

As an independent controller or business, each customer is solely responsible for its own compliance with all applicable laws, regulations, and contractual obligations governing its receipt, use, disclosure, retention, and onward transfer of personal information obtained through the Services. Without limiting the foregoing, each customer is responsible for:

• Complying with all applicable federal, state, local, and international privacy, data protection, marketing, advertising, telecommunications, anti-spam, consumer protection, and anti-discrimination laws;
• Adhering to our Terms of Service, Acceptable Use Policy, product rules, platform rules, and any other policies or restrictions made available by Exact Match;
• Honoring all data-provider restrictions, source-specific limitations, channel-specific limitations, suppression requirements, and use-case restrictions communicated by Exact Match or applicable to the data made available through the Services;
• Providing all legally required notices and obtaining all legally required consents from individuals before processing personal information for the customer's own purposes, including for marketing, advertising, profiling, or cross-context behavioral advertising activities;
• Maintaining appropriate administrative, technical, and physical safeguards to protect personal information against unauthorized access, use, disclosure, alteration, or destruction;
• Honoring consumer privacy rights requests directed to the customer, including requests for access, deletion, correction, opt-out of sale or sharing, opt-out of targeted advertising, and limitation of sensitive personal information, and propagating suppression and opt-out signals as required by law; and
• Refraining from using personal information obtained through the Services for any purpose prohibited by this Privacy Policy, our Terms of Service, our Acceptable Use Policy, applicable data-provider restrictions, or applicable law, including for unlawful discrimination or for decisions producing legal or similarly significant effects, except where Exact Match has expressly authorized the use in a separate written agreement.

Exact Match is not responsible for the independent acts or omissions of customers acting as independent controllers, including a customer's compliance or non-compliance with applicable law, its own privacy notices, or its agreements with third parties. Customers are required to enter into all agreements and provide all disclosures necessary to lawfully process personal information for their own purposes following receipt of such information from the Services.

11.5 Legal, Safety, and Compliance Disclosures

We may disclose personal information if we believe, in our sole discretion, that disclosure is necessary or appropriate to:

• Comply with any applicable law, regulation, rule, subpoena, court order, warrant, discovery request, or other legal process;
• Respond to lawful requests, inquiries, or investigations from government authorities, regulators, or law enforcement;
• Establish, exercise, defend, or protect our legal rights, privacy, safety, property, systems, products, customers, employees, or others;
• Investigate, prevent, detect, mitigate, or address fraud, misuse, abuse, security incidents, technical issues, or other illegal, unauthorized, or harmful activity; and
• Enforce or apply our Terms of Service, Acceptable Use Policy, this Privacy Policy, data-provider restrictions, customer agreements, and other applicable agreements or policies.

Where permitted by law, we may notify affected individuals or customers of legal process directed at their information, and we may challenge legal process that we believe to be overbroad, unlawful, or improper.

11.6 Business Transfers

We may disclose, transfer, assign, or otherwise convey personal information to a third party in connection with any actual or proposed merger, acquisition, consolidation, reorganization, restructuring, financing, investment, joint venture, divestiture, sale of equity, sale of assets, change of control, bankruptcy, insolvency, receivership, dissolution, or other similar corporate transaction involving all or any portion of Exact Match's business, equity, or assets (each, a "Business Transaction").

We may also disclose personal information to prospective purchasers, investors, lenders, acquirers, successors, advisors, and their respective representatives in connection with due diligence, negotiation, or evaluation of a potential Business Transaction, subject to appropriate confidentiality obligations.

In the event personal information is transferred as part of a completed Business Transaction, the successor entity will assume the rights and obligations relating to the personal information described in this Privacy Policy, subject to applicable law. We will provide notice of any such transfer where required by law, including where the successor entity intends to materially change the manner in which personal information is processed.

11.7 With Consent or Direction

In addition to the disclosures described in Sections 11.1 through 11.6, we may disclose personal information to third parties with your consent or at your direction. Where you instruct us to share, transfer, or otherwise make available your personal information to a designated recipient—including, without limitation, an integration partner, third-party platform, advertising platform, customer relationship management system, MCP client, API consumer, authorized agent, or other person or entity—we may rely on that consent or direction as the basis for the disclosure.

Once personal information is disclosed to a recipient at your direction or with your consent, the recipient's collection, use, retention, and further disclosure of that information is governed by the recipient's own terms, privacy policy, and applicable law, and is not subject to this Privacy Policy. You may withdraw your consent or revoke your direction at any time on a prospective basis by contacting us using the methods described in Section 31, although withdrawal will not affect disclosures already made in reliance on your prior consent or direction.

Connected Google Ads and Google Analytics Accounts

Scope of this section. This section applies only to data that EM VIP accesses from Google accounts you connect to your own EM VIP workspace. It does not describe the consumer personal information that Exact Match obtains from data providers and other sources and makes available through its data services, which is described in Sections 11, 12, and 13.

What we access. When you connect your Google Ads and Google Analytics accounts, EM VIP requests the https://www.googleapis.com/auth/adwords and https://www.googleapis.com/auth/analytics.readonly scopes to access your own advertising-campaign performance and spend data (Google Ads) and your Google Analytics 4 property report metrics, on a read-only basis. We do not access any consumer or end-user Google account data, Gmail, Drive, Photos, or contacts.

How we use it. Solely to display advertising performance and return-on-ad-spend reporting in your dashboard, and to create and manage a single conversion action in your own Google Ads account for attribution. It is not used for any other purpose.

We do not sell it or transfer it. Your connected Google Ads and Google Analytics data is not sold. It is not used for advertising, for building consumer profiles, or for any purpose other than the features described above. We do not transfer it to third parties, except to the service providers described in Section 11.2 that host and secure our platform under written contract, except to Google itself, where we return your own account and conversion-action identifiers to your Google Ads account in order to deliver conversion attribution, and except where required by law. It is never added to, joined with, or made available through the data services described in Sections 11, 12, and 13.

How we protect it. Your Google OAuth refresh token is encrypted at rest with AES-256-GCM under a server-only key, with a fresh initialisation vector per token; all access is over TLS and access tokens are short-lived.

Retention and deletion. We do not store your Google Ads or Analytics reporting metrics—they are retrieved and displayed for each dashboard view, not saved. We retain the connection only while you keep it connected. When you disconnect, we delete the stored token from our systems, send a revocation request to Google, and delete the Google Ads account id, conversion action id, and any related account identifiers we hold for that connection. Conversion uploads to that account stop, and conversion attribution for it will no longer work. Those uploads run under an Exact Match service account rather than under your Google credentials, so it is our deletion of those identifiers—not the ending of your Google authorization—that stops them. You can also ask us to stop this processing at any time by contacting us using the methods in Section 31.

12. Sales, Sharing, Targeted Advertising, and Opt-Out Rights

Exact Match sells personal information and may share personal information for cross-context behavioral advertising or process personal information for targeted advertising, in each case as those terms are defined under applicable state privacy laws.

Depending on your state of residence, you may have the right to opt out of one or more of the following processing activities:

• The sale of your personal information;
• The sharing of your personal information for cross-context behavioral advertising;
• The processing of your personal information for targeted advertising; and
• Profiling in furtherance of decisions that produce legal or similarly significant effects concerning you.

You may exercise the opt-out rights described above by any of the following methods:

• Submitting a request through our Data Privacy Request Form;
• Clicking the "Do Not Sell or Share My Personal Information" link on our website;
• Enabling a recognized universal opt-out preference signal, such as Global Privacy Control (GPC), in your browser or device, as described in Section 14; or
• Contacting us using the methods set forth in Section 31 of this Privacy Policy.

We will process verified opt-out requests in accordance with applicable law. Because the scope of opt-out rights and the methods of exercising them vary by jurisdiction, the manner in which we honor a request may depend on your state of residence, the identifiers reasonably available to us, and our ability to match your request to records in our systems. Additional information about how we honor opt-out requests, including through our suppression or do-not-serve list, is provided in Section 15.

13. Data Broker Disclosure

Exact Match operates as a data broker as that term is defined under applicable state law. A data broker is generally a business that knowingly collects and sells or licenses personal information of consumers with whom the business does not have a direct relationship.

Exact Match is registered in applicable data broker registries where required by law, including California, Vermont, Texas, and Oregon. We will update this Privacy Policy or our consumer rights page as our registration obligations change.

Consumers may use the privacy request methods described in Sections 16 (Your Privacy Rights) and 17 (How to Submit a Privacy Request) to exercise rights available under applicable law. State-specific data broker request procedures are described in our Consumer Privacy Rights Notice.

14. Universal Opt-Out Signals and Global Privacy Control

We recognize applicable universal opt-out mechanisms, including the Global Privacy Control ("GPC"), where required by law.

If we detect a GPC signal or other legally recognized opt-out preference signal, we will treat it as a request to opt out of sale, sharing, and targeted advertising, as applicable, for the browser or device transmitting the signal.

Because browser-based and device-based signals are limited in scope, an opt-out signal may not apply across all devices, browsers, accounts, offline records, or data held by Exact Match or its data sources.

To request a broader opt-out, you may submit a privacy request using the methods described in Section 17. Providing identifying information such as name, email address, postal address, or phone number helps us apply the opt-out more broadly where we can reasonably match your request to our records, subject to verification and applicable law.

15. Do-Not-Serve Suppression List

When we receive and verify an opt-out, deletion, suppression, or similar privacy request, we may add relevant identifiers to a suppression list, sometimes referred to as a "do-not-serve" list, to honor the request on an ongoing basis.

The suppression list is designed to prevent Exact Match from selling, sharing, disclosing, or serving the applicable individual's personal information through the Services in the future, even if Exact Match later receives the same or updated information from another source.

To operate the suppression list, Exact Match retains identifiers reasonably necessary to match incoming records against the suppression list and honor the request, such as:

• Hashed email addresses and, where necessary, plaintext email addresses;
• Names, including first name, last name, and name variants;
• Postal addresses, including current and prior addresses;
• Telephone numbers, including mobile and landline numbers;
• Persistent person identifiers, household identifiers, and address identifiers used within the Services or by our data providers;
• Record identifiers, internal reference numbers, and request tracking identifiers; and
• Other identifiers reasonably needed to match the request to records that may appear in our systems or in data received from third-party sources.

Exact Match retains suppression-list information for as long as reasonably necessary to honor the request, prevent re-processing of suppressed information, comply with legal obligations, document our response, and support compliance. Suppression-list records are used for suppression, compliance, audit, and recordkeeping purposes.

Retention of suppression-list identifiers is used to honor privacy requests, not for marketing, advertising, audience generation, enrichment, identity resolution, or other commercial purposes.

16. Your Privacy Rights

Depending on your state of residence and the law that applies, you may have rights to access, delete, correct, or obtain a copy of your personal information; opt out of sale, sharing, targeted advertising, or certain profiling; limit certain uses of sensitive personal information; appeal certain decisions; and avoid unlawful discrimination for exercising your rights. For full state-specific rights, limitations, exceptions, appeal rights, and data broker request procedures, please see our Consumer Privacy Rights Notice.

We will honor verified privacy requests to the extent required by the law that applies to you.

17. How to Submit a Privacy Request

You may submit a privacy request using any method below. Please include enough information for us to identify you, locate relevant records, and understand your request.

• Data Privacy Request Form: https://exactmatch.io/legal/opt-out
• Email: support@exactmatch.io
• Phone: (888) 555-0199

When submitting a request, please provide your full name, email address, telephone number, postal address, state of residence, the right you wish to exercise, and any information reasonably necessary to verify your identity or authority. Additional request and verification information is available in our Consumer Privacy Rights Notice.

If you are submitting a request through an authorized agent, please also provide the information described in Section 20 (Authorized Agents).

18. Verification of Privacy Requests

We verify privacy requests before fulfilling them. Verification steps vary based on the request type, sensitivity of the information, our relationship with the requester, and risk of unauthorized access, disclosure, or alteration. More information is available in our Consumer Privacy Rights Notice.

19. Response Timing

We will respond to privacy requests within the period required by applicable law.

20. Authorized Agents

You may use an authorized agent to submit a privacy request on your behalf where permitted by applicable law. We may require proof of authorization, verification of your identity or the agent's authority, or direct confirmation that you authorized the agent, unless an exception applies under applicable law.

21. Appeals

If we deny your privacy request and applicable law provides a right to appeal, you may appeal by following the instructions in our response or in our Consumer Privacy Rights Notice. If we deny your appeal, we will provide complaint information where required by applicable law or as described in the Consumer Privacy Rights Notice.

22. California Notice at Collection

This section provides the notice at collection required under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (collectively, the "CCPA"), for California residents. The following table identifies the categories of personal information, as defined under the CCPA, that Exact Match collects, the categories that we sell or share, the sources from which the information is collected, and the business or commercial purposes for which the information is processed.

The retention periods applicable to each category of personal information are described in Section 26 (Data Retention). The categories of third parties to whom personal information may be disclosed are described in Section 11 (How We Disclose Personal Information). The categories of personal information disclosed to service providers and contractors for business purposes, and the categories of service providers and contractors receiving such information, are described in Section 11.2 (Service Providers and Contractors).

Sensitive personal information is processed by Exact Match for the purposes permitted under the CCPA, including providing the Services requested, performing services on behalf of customers, ensuring security and integrity, detecting and preventing fraud, and other purposes permitted under California Civil Code § 1798.121 and applicable regulations. Use of sensitive personal information for purposes beyond those permitted purposes is subject to filtering, suppression, and other controls described in Section 7.

We do not knowingly sell or share personal information of individuals under 16 years of age.

California residents may exercise the rights described in Section 16 (Your Privacy Rights) by following the procedures described in Section 17 (How to Submit a Privacy Request). Exact Match will not discriminate against any consumer for exercising rights under the CCPA.

23. Financial Incentives

Exact Match may offer promotions, free credits, discounts, trials, referrals, loyalty benefits, volume-based pricing, or other pricing or service differences in connection with the Services. Some programs may involve the processing of personal information.

To the extent any such program constitutes a "financial incentive," "price or service difference," or bona fide loyalty program under applicable privacy law, Exact Match will provide required notices, material terms, and consent mechanisms before enrollment.

Participation in any financial incentive program is voluntary. You may withdraw from any such program at any time by following the instructions in the program terms, in the platform interface, or by contacting us using the methods in Section 31.

Exact Match will not use financial incentive programs in a manner prohibited by applicable law.

24. Cookies and Tracking Technologies

We use cookies, pixels, tags, scripts, local storage, log files, and similar technologies to operate the website and Services, remember preferences, authenticate users, analyze traffic, measure performance, detect fraud, and support advertising where permitted.

The types of cookies and tracking technologies we use may include strictly necessary, functional, analytics, and advertising technologies.

You can manage cookies through your browser settings, including by blocking, deleting, or restricting cookies, although doing so may affect website or Services functionality.

You may also opt out of certain interest-based advertising through industry opt-out tools, including the Network Advertising Initiative (optout.networkadvertising.org) and the Digital Advertising Alliance (optout.aboutads.info). These tools may not opt you out of all advertising or all sales, sharing, or targeted advertising under applicable law.

Where required by law, we honor recognized universal opt-out mechanisms, including Global Privacy Control, as described in Section 14 of this Privacy Policy.

25. Third-Party Services and Integrations

The Services may contain links to, or integrate with, third-party websites, platforms, applications, advertising networks, payment processors, analytics providers, identity-resolution providers, data enrichment vendors, MCP clients, automation tools, CRM systems, marketing platforms, and other third-party services (collectively, "Third-Party Services"). Links to Third-Party Services do not constitute an endorsement by Exact Match.

Exact Match does not own, operate, or control Third-Party Services and is not responsible for their content, functionality, availability, security, or privacy practices. Personal information processed by a Third-Party Service is governed by that third party's terms, privacy policy, and applicable law.

If you connect, link, authenticate, or otherwise integrate the Services with a Third-Party Service, API, MCP connection, software development kit, plug-in, connector, or similar integration (each, an "Integration"), you authorize Exact Match to transmit, receive, and process personal information and other data as reasonably necessary to operate the Integration.

You are responsible for your use of any Third-Party Service or Integration, including for ensuring that your processing of personal information through it complies with applicable law, our Terms of Service and Acceptable Use Policy, applicable data-provider restrictions, third-party platform rules, and applicable consumer choices.

Exact Match disclaims liability, to the fullest extent permitted by law, for any Third-Party Service and for any loss or damage arising from your access to, use of, or reliance on any Third-Party Service or Integration.

26. Data Retention

We retain personal information for as long as reasonably necessary for the purposes described in this Privacy Policy, including to provide the Services, comply with legal obligations, resolve disputes, enforce agreements, protect our systems, and honor privacy requests and suppression obligations.

In determining retention periods, we consider the nature, sensitivity, and volume of personal information; processing purposes; risk of harm; data-provider restrictions; and applicable legal, accounting, audit, tax, contractual, and regulatory requirements.

Typical retention periods vary by category, purpose, and processing context, as described below. Actual retention periods may be longer or shorter where required or permitted by law or reasonably necessary for legitimate business purposes.

When personal information is no longer needed, we will delete, de-identify, aggregate, anonymize, or suppress it, as appropriate, except where retention is required or permitted by applicable law.

27. Security

Exact Match maintains reasonable administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, use, disclosure, alteration, loss, or destruction.

No method of transmission, electronic storage, or security control is completely secure. Exact Match cannot guarantee the absolute security of personal information processed in connection with the Services. You are responsible for maintaining the confidentiality of your account credentials and promptly notifying Exact Match of any suspected unauthorized access to or use of your account.

28. Children's Privacy

The Services are intended for business users and are not directed to children or to individuals under 18 years of age. Exact Match does not design, market, or make the Services available for use by minors.

We do not knowingly collect personal information directly from children under 18 through the website or the Services. Consistent with applicable law, we do not knowingly sell or share personal information of individuals under 16 years of age, and we do not knowingly engage in targeted advertising directed at such individuals.

Certain third-party data sources made available through the Services may contain household-level indicators relating to the presence, number, or age ranges of children residing in a household. These indicators are household attributes derived from third-party data and are not intended to identify, profile, or target any specific child. Exact Match applies filtering, suppression, and product controls to restrict the use of such indicators where required by applicable law, data-provider restrictions, or our internal product rules.

Customers are prohibited from using the Services to market to, profile, target, or otherwise make decisions about children, or to use household-level child indicators in any manner that violates applicable law, including the Children's Online Privacy Protection Act ("COPPA") and analogous state laws, except where such use is expressly permitted by law and authorized under our Terms of Service, Acceptable Use Policy, and any applicable product rules.

If we become aware that we have collected personal information directly from a child under 18 in a manner inconsistent with this Privacy Policy or applicable law, we will take reasonable steps to delete, suppress, or de-identify that information. If you are a parent or legal guardian and believe that a child has provided personal information to us, or if you have any other concerns regarding children's information processed through the Services, please contact us using the information provided in Section 31 (Contact Us).

29. International Users

The Services are intended for use in the United States and are designed, hosted, and operated for users located within the United States. Exact Match does not direct the Services to individuals located outside the United States and does not represent that the Services are appropriate or available for use in other jurisdictions.

If you access or use the Services from outside the United States, you acknowledge and agree that your personal information may be transferred to, stored in, and processed in the United States or in other jurisdictions where Exact Match, its affiliates, or its service providers maintain operations or infrastructure. The data protection laws of the United States and these other jurisdictions may differ from, and may provide less protection than, the laws of your country or region of residence.

By accessing or using the Services, or by otherwise providing personal information to us, you consent to the transfer, storage, and processing of your personal information in the United States and in other jurisdictions in which we or our service providers operate, subject to this Privacy Policy and applicable law.

Exact Match does not offer the Services to individuals in the European Economic Area, the United Kingdom, or Switzerland, and this Privacy Policy is not intended to address rights or obligations that may arise under the laws of those jurisdictions.

30. Changes to This Privacy Policy

Exact Match may update this Privacy Policy from time to time to reflect changes in our business practices, the Services, applicable legal or regulatory requirements, or industry standards.

When we make changes to this Privacy Policy, we will post the revised Privacy Policy on the website located at https://exactmatch.io and update the "Last Updated" date at the top of the Privacy Policy. The revised Privacy Policy will be effective as of the Last Updated date, unless a different effective date is specified.

If we make material changes to this Privacy Policy, or where additional notice is required by law, we may provide notice by email, in-platform notice, website notice, or other legally required means. Where applicable law requires consent to a material change, we will obtain it in the required manner.

You are responsible for periodically reviewing this Privacy Policy to remain informed of our current privacy practices. Your continued use of the Services after the effective date of any updated Privacy Policy constitutes your acknowledgment of the updated Privacy Policy, to the extent permitted by applicable law.

31. Contact Us

If you have questions, concerns, or comments about this Privacy Policy or our privacy practices, you may contact Exact Match Marketing, Inc. using the information set forth below. Privacy rights requests should be submitted using the methods described in Section 17 (How to Submit a Privacy Request).

To help us respond efficiently, please include your full name, email address, postal address, state of residence, the nature of your inquiry, and, if you are submitting a privacy rights request, the specific right you wish to exercise. Privacy rights requests should be submitted using the methods described in Section 17 (How to Submit a Privacy Request) of this Privacy Policy.