Privacy Policy

1. Who We Are

Counterpoint Labs, Inc. is the data controller (or, where we process data on behalf of our customers as described in Section 3.2, the data processor) responsible for the personal data described in this Policy. Our registered address is:

Counterpoint Labs, Inc. — 6135 Park South Drive, Suite 508, Charlotte, NC 28210

For any privacy-related question, request, or concern, contact our Data Protection Officer / Security Lead at privacy@counterpointlabs.ai.

2. Scope

This Policy applies to personal data we collect through:

• The Site (counterpointlabs.ai), including pages, forms, and embedded content;
• Our SaaS product and related applications (the "Platform"), including customer and end-user accounts;
• Customer support, sales, and marketing interactions; and
• Any other channel where this Policy is referenced or posted.

This Policy does not apply to information processed by third parties outside our control, including third-party websites or services you may access through links on our Site.

3. Personal Data We Collect

3.1 Data You Provide Directly

We collect personal data that you voluntarily provide to us, including when you:

• Fill out a contact, demo request, or "Contact Us" form (e.g., name, work email, company, phone number, message content);
• Subscribe to our newsletter or marketing communications (e.g., email address, communication preferences);
• Create an account or are provisioned access to our Platform (e.g., name, email, username, password/authentication credentials, role, organization);
• Communicate with us for support, sales, or partnership inquiries (e.g., correspondence content, attachments);
• Apply for a position with us (e.g., resume and application materials, handled under a separate candidate privacy notice where applicable).

3.2 Data Processed on Behalf of Customers

When organizations use our Platform, they (as our customer and the data controller) may submit personal data about their own end users, employees, or contacts into the Platform ("Customer Data"). We process Customer Data solely as a data processor / service provider, in accordance with our customer agreements and any applicable Data Processing Addendum ("DPA"), and strictly on the customer's documented instructions. If you are an end user of one of our customers and have questions about data submitted to our Platform, please contact that organization directly; we will support them in responding to your request.

3.3 Data Collected Automatically

When you visit the Site or use the Platform, we and our service providers automatically collect certain technical and usage data, including:

• Device and connection information (IP address, browser type, operating system, device identifiers);
• Usage data (pages viewed, features used, referring/exit pages, timestamps, clickstream data);
• Approximate location derived from IP address; and
• Cookies, pixels, and similar tracking technologies, as described in Section 4.

3.4 Data from Third Parties

We may receive personal data about you from third parties, such as:

• Analytics and product usage providers (e.g., Google Analytics);
• Business contact and enrichment providers used for sales outreach;
• Single sign-on (SSO) or identity providers, if you access the Platform through them; and
• Publicly available sources.

We do not knowingly collect special categories of personal data (e.g., health, biometric, racial or ethnic origin, religious beliefs) through the Site, and ask that you not submit such information to us unless specifically requested.

4. Cookies and Similar Technologies

We use cookies, web beacons, and similar technologies to operate the Site, remember preferences, understand how visitors use the Site, and measure the effectiveness of our communications. We use the following categories:

• Strictly necessary — required for core Site functionality and security; cannot be disabled.
• Functional — remember preferences and settings.
• Analytics — help us understand aggregate usage (e.g., Google Analytics) so we can improve the Site.

We do not use cookies or tracking technologies for cross-context behavioral advertising, and we do not sell or "share" (as defined under the CCPA/CPRA) personal data with third parties for targeted advertising purposes. Where required by law, we will present a cookie consent banner allowing you to accept or reject non-essential cookies, and you can manage cookie preferences at any time through your browser settings or, where available, our cookie preference tool.

5. How We Use Personal Data

We use personal data for the following purposes, and we identify the applicable GDPR legal basis where relevant:

• Providing, operating, maintaining, and securing the Site and Platform (performance of a contract / legitimate interests);
• Creating and managing accounts, and authenticating users (performance of a contract);
• Responding to inquiries, providing customer support, and fulfilling requests (performance of a contract / legitimate interests);
• Sending administrative communications, such as service updates, security notices, and policy changes (legitimate interests / legal obligation);
• Sending marketing communications and newsletters, where you have opted in or as otherwise permitted by law (consent / legitimate interests), with an option to opt out at any time;
• Analyzing usage trends to improve the Site, Platform, and user experience (legitimate interests);
• Detecting, investigating, and preventing fraud, abuse, and security incidents (legitimate interests / legal obligation);
• Complying with legal, regulatory, tax, and audit obligations, including obligations under our SOC 2 and information security program (legal obligation / legitimate interests); and
• Establishing, exercising, or defending legal claims (legitimate interests).

We do not use personal data for any purpose incompatible with the purposes described above without providing notice and, where required, obtaining consent.

6. Data Protection Principles

Consistent with our internal Privacy Compliance Policy, we process personal data in accordance with the following principles:

• Lawfulness, fairness, and transparency — data is processed lawfully, fairly, and transparently.
• Purpose limitation — data is collected for specified, explicit, legitimate purposes and not further processed incompatibly with those purposes.
• Data minimization — we collect only what is adequate, relevant, and necessary.
• Accuracy — we take reasonable steps to keep data accurate and up to date.
• Storage limitation — we retain data only as long as necessary (see Section 9).
• Integrity and confidentiality — we use appropriate technical and organizational measures to protect data (see Section 8).

7. How We Share Personal Data

We do not sell personal data. We disclose personal data only in the following circumstances:

• Service providers and subprocessors — vendors who perform services on our behalf, such as cloud hosting, analytics, email delivery, customer support tooling, and payment processing. These vendors are contractually bound by data protection and confidentiality obligations, including Data Processing Addendums and, where applicable, Standard Contractual Clauses.
• Business customers — where you interact with the Platform as an end user of one of our customers, relevant data is made available to that customer as data controller.
• Corporate transactions — in connection with a merger, acquisition, financing, or sale of assets, personal data may be transferred as part of that transaction, subject to standard confidentiality safeguards.
• Legal and safety — where required to comply with a legal obligation, protect our rights or property, or protect the safety of any person.
• With your consent — where you have directed or authorized us to share data with a specific third party.

Before sharing personal data with any third party, we assess the vendor's security and privacy controls and execute a formal agreement containing required data protection terms.

8. Data Security

We maintain administrative, technical, and organizational safeguards designed to protect personal data against unauthorized access, disclosure, alteration, and destruction, consistent with SOC 2 and ISO 27001-aligned control frameworks. These measures include encryption in transit and at rest, access controls and least-privilege provisioning, network and endpoint monitoring, vendor security review, and periodic risk assessments. No system can be guaranteed 100% secure, and we cannot warrant the absolute security of information transmitted to or from the Site or Platform.

9. Data Retention

We retain personal data only for as long as necessary to fulfill the purposes described in this Policy, including to provide the Services, comply with legal, accounting, or reporting obligations, resolve disputes, and enforce our agreements. Retention periods vary depending on the type of data and the purpose of processing; Customer Data is retained in accordance with the terms of the applicable customer agreement and deleted or returned upon request or contract termination, subject to legally required retention. When personal data is no longer needed, we securely delete, anonymize, or destroy it.

10. International Data Transfers

We are headquartered in the United States and may process personal data in the United States and other countries where we or our service providers operate. Where we transfer personal data originating in the European Economic Area, United Kingdom, or Switzerland to a country that has not been deemed to provide an adequate level of protection, we rely on appropriate safeguards, such as the European Commission's Standard Contractual Clauses (and the UK International Data Transfer Addendum, as applicable), together with supplementary technical and organizational measures where required.

11. Your Privacy Rights

11.1 Rights for Individuals in the EEA, UK, and Similar Jurisdictions

If GDPR or an equivalent law applies to you, you have the right to:

• Access — request confirmation of, and a copy of, the personal data we hold about you;
• Rectification — request correction of inaccurate or incomplete personal data;
• Erasure — request deletion of your personal data where legal conditions are met ("right to be forgotten");
• Restriction — request that we limit how we use your personal data;
• Objection — object to processing based on legitimate interests or for direct marketing;
• Portability — receive your personal data in a structured, commonly used, machine-readable format, and have it transmitted to another controller;
• Withdraw consent — where processing is based on consent, withdraw it at any time without affecting prior processing; and
• Lodge a complaint — with your local data protection supervisory authority.

11.2 Rights for California Residents (CCPA/CPRA)

If you are a California resident, you have the right to:

• Know — request disclosure of the categories and specific pieces of personal information we collect, use, disclose, and the sources and purposes for doing so;
• Delete — request deletion of personal information we have collected from you, subject to certain exceptions;
• Correct — request correction of inaccurate personal information;
• Opt out of sale/sharing — we do not sell personal information or share it for cross-context behavioral advertising, so no opt-out action is currently required; if this changes, we will provide a "Do Not Sell or Share My Personal Information" mechanism;
• Limit use of sensitive personal information — where applicable; and
• Non-discrimination — we will not discriminate against you for exercising your privacy rights.

In the 12 months preceding the effective date of this Policy, we have collected the categories of personal information described in Section 3, from the sources described in Section 3, for the business purposes described in Section 5. We disclose these categories to the types of service providers described in Section 7 for a business purpose; we do not sell or share personal information as those terms are defined under the CPRA.

11.3 Other Jurisdictions

Depending on where you live, you may have similar rights under other applicable privacy laws (e.g., other U.S. state privacy laws, Canada's PIPEDA, or Brazil's LGPD). We will honor valid requests consistent with applicable law.

11.4 How to Exercise Your Rights

To submit a Data Subject Request ("DSR"), contact our privacy team at privacy@counterpointlabs.ai. We may need to verify your identity before fulfilling your request. You may also designate an authorized agent to submit a request on your behalf, subject to verification. We will respond within the timeframe required by applicable law (e.g., generally within 30 days under GDPR and 45 days under CCPA/CPRA, each subject to permitted extensions).

12. Children's Privacy

The Site and Services are not directed to, and are not intended for use by, children under the age of 16 (or the applicable age of consent in your jurisdiction). We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us at privacy@counterpointlabs.ai so we can take appropriate action.

13. Incident Management and Breach Notification

We maintain an Incident Response Plan governing the identification, containment, investigation, and remediation of security incidents. In the event of a confirmed breach of personal data, we will notify affected individuals and applicable regulatory authorities in accordance with the timelines and requirements of applicable law.

14. Third-Party Links and Services

The Site or Platform may contain links to third-party websites or integrations with third-party services that are not operated by us. This Policy does not apply to those third parties, and we encourage you to review their respective privacy policies.

15. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. We will post the revised Policy on this page with an updated effective date, and, where changes are material, we will provide additional notice as required by law.

16. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact:

• Counterpoint Labs, Inc.
• Attn: Data Protection Officer / Security Lead
• 6135 Park South Drive, Suite 508, Charlotte, NC 28210
• Email: privacy@counterpointlabs.ai