BRIGHTEDGE PRIVACY POLICY

Effective October 5, 2026

BrightEdge Technologies, Inc. (“BrightEdge,” “we” or “us,”) is committed to transparency. This Privacy Policy is intended to help you clearly and easily understand:

Table of Contents

1. What This Privacy Policy Covers
2. Types/Categories of Personal Information We Collect
3. How We Collect Personal Information
4. Aggregate and Non-identifiable Data
5. How We Use and Process the Personal Information We Collect
6. Sharing Your Personal Information with Third Parties
7. International Data Transfers
8. Your Controls and Choices
9. Data Retention, Storage, and Security
10. Children’s Information
11. Third Party Sites
12. Explanation of Cookies and Other Technologies
13. Use of Google Analytics (GA4) Data
14. Terms of Use, Notices, and Revisions
15. Accessibility
16. Contact Information
17. Additional Information for Certain U.S. Residents
18. Supplemental Privacy Notice for Individuals in the EEA, UK, and Switzerland

1. What This Privacy Policy Covers

In this Privacy Policy, we describe how BrightEdge collects, uses, discloses and otherwise processes the personal information described in this Privacy Policy, as well as the rights and choices individuals have regarding such personal information.

For additional information about the privacy choices/rights you have regarding your personal information, please review Section 18.A., Additional Information for Residents of Certain Jurisdictions.

If you are a resident of California: Please refer to Section 18.B. California Notice at Collection and Privacy Rights, which includes additional information about the personal information that we may collect about you, and your rights under California privacy laws.

Our Site and Content. This Privacy Policy applies to the personal information we collect and process: (A) related to our website located at www.brightedge.com (including any mobile or localized version of the website) and the services and features we make available through our website, as well as any other BrightEdge-owned sites or online services that display this Privacy Policy (collectively, the “Site”), and (B) through the content we publish or make available on third-party sites or platforms. Your use of our Site, and any dispute over privacy, is subject to this Privacy Policy, as well as our Terms of Use and all other policies or notices posted by us on the Site (collectively, the “Site Terms”). If you do not agree to the Site Terms or this Policy, you may not use our Site.

Our Services. In addition, BrightEdge provides our enterprise customers an integrated Search Engine Optimization (“SEO”) management technology platform that processes and indexes data to generate actionable insights for our customers to help improve website ranking and performance on search engines, along with associated products and services (collectively, the “Services”). In providing our Services to enterprise customers, BrightEdge may receive or access data from or on behalf of our customers that includes usage and performance data related to customers’ sites and online content and services (“Customer Data”). In most cases, Customer Data includes aggregate and non-identifiable data such as how often certain content was viewed and common search terms. To the extent Customer Data includes any personal information, BrightEdge acts as a ‘processor’ of such data and will only process it on behalf of the relevant customer (the ‘controller’), in accordance with the terms of our agreement with that customer. Our customer agreements may include specific information use provisions that are different from or more restrictive than those described within this Privacy Policy. Please refer to your individual agreement with BrightEdge to check for any specific information privacy terms that may also apply to the information you provide to us by using the Service.

2. Types/Categories of Personal Information We Collect

We collect the following types of information:

• Your username, first and last name, email and/or postal address, telephone number or other information that can be used to identify you that you provide when you create an account or fill out a form on the Site;
• Usage, viewing and technical data automatically collected from your computer or device through cookies and other technologies (described below), such as your device identifier or IP address, browser type, internet service provider (ISP), referring/exit pages, operating system, date/time stamp, and clickstream data;
• Comments or other information you post on the Site or otherwise communicate to us (e.g., when you contact customer support, submit inquiries or requests, etc.);
• Location information when you visit the Site, including location information provided by a computer or device interacting with the Site ; and
• Information we collect when you interact with our content on the Site or on third-party sites or platforms, such as social networking sites. This may include information such as “Likes”, profile information gathered from social networking sites or the fact that you viewed or interacted with our content.
• Your interactions with our Site and the features we provide on our Site and the input or content you communicate or submit through our Site (e.g., in chats and searches).

Customer Data. As noted, we may also access or receive Customer Data that includes content, performance and usage data about our customers’ sites and services. We do not control the collection, use or disclosure of this information, which is subject to the privacy policies of our respective customers. As noted, we will only use Customer Data in accordance with the terms of our customer agreements.

Information from Other Sources. We might receive information about you from other sources and add it to your account information. Such information may include contact information from business information database providers, which we use to update and correct our records, and search term and search result information from internet searches conducted by our data licensors.

Special Categories of Personal Information. We do not collect from users or process (a) the special categories of personal information defined by the European Union (“EU”) General Data Protection Regulation (“GDPR”); or personal information relating to criminal convictions or offenses. The Site and SEO Platform are not meant for the processing of sensitive personal information. Please do not send us, and do not disclose, any sensitive personal information (such as information related to racial or ethnic origin, religion or other beliefs, health, criminal background or trade union membership) on or through the Site or otherwise, as BrightEdge has no intentions of processing such sensitive personal information.

3. How We Collect Personal Information

As further described below, we may collect personal information about you directly, as well as from others. We may also collect or derive information about you and your use of the Site, which may be personal information.

We and our third-party service providers who provide Service functionality, may collect information about you in the following ways:

• When you request products, services, or information from us, fill out a form, or otherwise interact with us through the Site;
• When you contact us separately by email or telephone;
• From third-party sources, to update or supplement the information you provide or that we collect automatically, including utilizing business information databases and platforms for additional updated account information;
• Automatically through technology such as cookies, pixel tags, and other tracking/recording tools on our Site, some of which are provided by third party providers. We may use these to track when you click on a link to visit the Site, interact with our ads or other content on the Site or on third-party sites or platforms, or open the emails we send. By using the Site or interacting with our content on third-party sites, you agree that we and our service providers may set cookies on your computer or device and use other tracking technologies described above. Please see the sections entitled “Explanation of Cookies and Other Technologies” and “Your Controls and Choices” for additional information regarding these tracking technologies and your choices.
• BrightEdge and our service providers may also deliver artificial intelligence (“AI”) and generative AI capabilities to analyze data, determine trends, make predictions and create AI-generated responses or other content; when you interact with these features and content, we may collect and use your input data to further refine and develop our models and tools.

We may also receive or access Customer Data, such as performance and usage metrics, that our customers have collected through their websites and online services. Our customers are responsible for providing notices, obtaining consent and complying with consumer opt out and other choices regarding the performance and usage data that they collect through their respective sites and online services. We only use Customer Data in order to provide our Services to the relevant customer and in accordance with the terms of our customer agreement.

4. Aggregate and Non-identifiable Data

We may also derive, use and disclose aggregate, anonymous, and other non-identifiable data related to our business, our Site and the Services in order to develop and improve our Site, Service and related features and for quality control, analytics, modeling and other purposes. Where we use, disclose or process deidentified data (i.e., data that is no longer reasonably linked or linkable to an identified or identifiable natural person or household) we will maintain and use the information in deidentified form and not attempt to reidentify the information, except in order to determine whether our deidentification processes are reasonable and adequate or where necessary to comply with a legal obligation.

5. How We Use and Process the Personal Information We Collect

We use and process the personal information in the following ways:

• To provide, maintain and improve the Site and our products and services, including operating certain features and functionality of the Site (for example, by remembering your information so that you will not have to re-enter it on subsequent visits, or to verify your identity);
• To diagnose or fix technology problems;
• To control unauthorized use or abuse of the Site and our products and services, or otherwise detect, investigate or prevent activities that may violate our policies or be illegal;
• To analyze trends, administer or optimize the Site, monitor usage or traffic patterns (including tracking users’ movements around the Site) and gather demographic information about our user base as a whole, and for other or internal reporting and business modeling purposes;
• To enhance your experience as a user visiting the Site;
• To allow us to better service you in responding to your customer service needs;
• To communicate directly with you, including sending you newsletters, promotions and special offers or information about new products and services. Your opt-out options for promotional communications are described in “Your Controls and Choices” below; and
• In the manner described to you at the time of collection or as otherwise described in this Privacy Policy or as authorized or required by applicable laws.
• To conduct financial, tax and accounting audits, audits and assessments of our operations, including our privacy, security and financial controls, as well as for risk and compliance purposes. We may also use personal information to maintain appropriate business records and enforce our policies and procedures.
• To assess and implement mergers, acquisitions, reorganizations, bankruptcies, and other business transactions such as financing, and to administer our business, accounting, auditing, compliance, recordkeeping, and legal functions.

6. Sharing Your Personal Information with Third Parties

BrightEdge may share information, including personal information, in the following circumstances:

• With a third party if we have your consent to do so;
• With our vendors and service providers to permit them to provide services that help us with our business activities, which may include assisting us with marketing, advertising our product/service offerings, events, fulfillment of orders/deliverables, data research and analytics, customer support and account management, or providing, maintaining and improving the features and functionality of the Site or use of our Service. For example:
  • We may provide Personal Information to our service providers for direct emailing of our newsletters or notifications of our product/service offerings. We take reasonable steps to require that these service providers agree to process such information on our behalf and in accordance with our written instructions and appropriate security protections. These third parties are authorized to use your personal information only as necessary to provide services to us or as required by law.
  • Our service providers may also provide artificial intelligence and generative artificial intelligence capabilities to analyze data, determine trends, make predictions, and create AI-generated responses or other content for lawful purposes described herein and pursuant to the features and functionality associated with the use of our Site and/or use of our Services.
• With our parent companies, subsidiaries and affiliates (and they may use your information in the same way we can under this Privacy Policy) to the extent such sharing of data is necessary to fulfill a request you have submitted via our Site or for customer support, marketing, technical operations, event registration and account management purposes;
• When we have a good faith belief that access, use, preservation, or disclosure of such information is reasonably necessary to (a) satisfy any applicable law, regulation, legal process or enforceable governmental request, including lawful requests by public authorities, for example to meet national security or law enforcement requirements, (b) enforce our Terms of Use or other applicable policies or agreements governing your use of the Site, including investigation of potential violations thereof, or (c) protect against imminent harm to the rights, property or safety of BrightEdge, its users or the public as required or permitted by law;
• With third parties (including our service providers and government entities) to detect, prevent, or otherwise address fraud, security or technical issues; and
• As we continue to develop our business, we may also sell all or part of our business. In such transactions, Personal Information you have shared with us is generally one of the business assets that will be transferred.

We may also share aggregated information with third parties for other purposes. Such information does not identify you individually, but may include usage, viewing and technical information we collected through our technology. If we are required under applicable law to treat such information as personal information, then we will only disclose it as described above. Otherwise, we may disclose aggregated, non-identifiable information for any reason.

If you post comments on the Site, any Personal Information you post is publicly available, can be read, collected, or used by other visitors to the Site. Please be mindful of the information that you may choose to post in open forums or other similar mechanisms on the Site. See our Terms of Use for more information and the guidelines for posting content on the Site.

7. International Data Transfers

We may from time-to-time transfer or disclose your Personal Information to recipients in other countries outside the United States and make it accessible to our parents, subsidiaries, affiliates and third-party service providers internationally in the circumstances described in “Sharing Your Information with Third Parties” above. By using the Site or otherwise providing Personal Information to us, you are consenting to have your Personal Information transferred to and processed in the United States or any other country in which BrightEdge or its parents, subsidiaries, affiliates and service providers maintain facilities.

EU - U.S. and UK Extension to the EU-U.S. and Swiss-US Data Privacy Framework. BrightEdge participates in and has certified its compliance with the EU-U.S. Data Privacy Framework (the “EU DPF”) and the UK Extension to the EU-U.S. DPF, and Swiss-US Data Privacy Framework (the “Swiss DPF”) (together, the EU DPF and the UK Extension to the EU-U.S. DPF, and the Swiss DPF are the “DPF” or the “Framework”), administered by the U.S. Department of Commerce. Pursuant to its certification (the “DPF Certification”), BrightEdge is committed to handling all personal information that it receives from EU member states and UK and Switzerland in reliance on its DPF Certification, in accordance with the applicable DPF Principles of notice, choice, accountability for onward transfer, security, data integrity and purpose limitation, access, recourse, enforcement and liability (the “Principles”). With respect to personal information received or transferred pursuant to the DP Framework, BrightEdge is subject to the regulatory enforcement powers of the U.S. Federal Trade Commission.

If there is any conflict between this Privacy Policy and the Principles, the Principles shall govern. You can find BrightEdge’s DPF Certification here. You can also learn more about the DP Framework at www.dataprivacyframework.gov.

Transfer and Enforcement Mechanisms for EU - U.S. and the UK Extension to the EU-U.S. DPF, and Swiss – U.S. DPF. BrightEdge may be accountable for the processing of personal information it receives, under the DP Framework, and may subsequently transfer data to a third party acting as an agent on its behalf in the circumstances described in “Sharing Your Information with Third Parties” above. If the agent processes personal information in a manner inconsistent with the DPF Principles, we are responsible if it does so and for the harm caused. BrightEdge complies with the DPF Principles for all onward transfers of personal information from the EU or UK or Switzerland, including the onward transfer liability provisions. With respect to personal information received or transferred pursuant to the DP Framework, BrightEdge is subject to the regulatory enforcement powers of the U.S. Federal Trade Commission.

In compliance with the DPF Principles, BrightEdge commits to resolving complaints about our processing of your personal information. EU, UK and Swiss individuals with inquiries or complaints regarding our DPF policy should first contact BrightEdge as indicated in “Contact Information” below. When you contact us with a complaint, please include contact information and clearly describe your complaint. We will respond to your request or complaint within a reasonable time and will let you know next steps in resolving your complaint.

As part of our participation in the DP Framework, BrightEdge will resolve your dispute regarding our privacy policies and practices through JAMS, an alternative dispute resolution provider located in the United States. If you still have privacy or data use concerns that we have not addressed satisfactorily, please contact JAMS (free of charge) directly at https://www.jamsadr.com/dpf-dispute-resolution for more information or to file a complaint. If your complaint is not resolved through these channels, under certain circumstances a binding arbitration option may be available before a DPF Panel, as described in Annex I to the DPF Principles (please visit: DPF Principles). Additionally, as part of the DP Framework, the U.S. State Department Senior Coordinator serves as the Ombudsperson to facilitate the processing of requests relating to national security access to data transferred from the EU to the U.S. or the UK to the U.S. or Switzerland to the U.S.

BrightEdge complies with the EU-U.S. Data Privacy Framework (EU-U.S. DPF) and the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF) as set forth by the U.S. Department of Commerce. BrightEdge has certified to the U.S. Department of Commerce that it adheres to the EU-U.S. Data Privacy Framework Principles (EU-U.S. DPF Principles) with regard to the processing of personal data received from the European Union and the United Kingdom in reliance on the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF. BrightEdge has certified to the U.S. Department of Commerce that it adheres to the Swiss-U.S. Data Privacy Framework Principles (Swiss-U.S. DPF Principles) with regard to the processing of personal data received from Switzerland in reliance on the Swiss-U.S. DPF. If there is any conflict between the terms in this privacy policy and the EU-U.S. DPF Principles and/or the Swiss-U.S. DPF Principles, the Principles shall govern. To learn more about the Data Privacy Framework (DPF) Program, and to view our certification, please visit https://www.dataprivacyframework.gov/.

8. Your Controls and Choices

Opt-Outs. We may provide you with the opportunity to “opt-out” of (a) disclosing your personal information to third parties, except to a third party that is acting as an agent to perform tasks on our behalf and under our instructions as described in “Sharing Your Information with Third Parties” above; (b) using your personal information for a purpose that is materially different from the purpose for which it was originally collected or that you authorized. If you decide to opt-out, we may not be able to provide certain features of the Site to you.

Communication Preferences. If you no longer wish to receive our newsletter and promotional communications, you may opt-out of receiving them by following the instructions included in such communications or on the Site. Please note, however, that even if you opt-out of promotional communications, we may still send you certain service-related communications.

Blocking Cookies. You can remove or block certain cookies using the settings in your browser but the Site may cease to function properly if you do so.

Controlling Flash Cookies. To manage the Flash cookie settings and preferences for your computer, please click here and you will be directed to the Settings Manager on Adobe’s website. You may also be able to manage Flash cookies from your browser, depending on the version of your browser.

Deleting Other Browser Information. Many Internet browsers allow you to disable HTML5 local storage or delete information contained in HTML5 local storage using browser controls.

9. Data Retention, Storage, and Security

We hold your Personal Information in a combination of hard copy and electronic files for the period necessary to support the Site, comply with our legal obligations, resolve disputes, or otherwise fulfill the purposes outlined in this Privacy Policy. Even after you cancel your account, copies of some information from your account may remain viewable in some circumstances where, for example, you have shared information with social media or other services. We may also retain backup information related to your account on our servers for some time after cancelation for fraud detection or to comply with applicable law or our internal security policies. We do not always remove or delete all of your non-personally identifiable account information for a number of reasons including due to technical and systems constraints, contractual, financial or legal requirements.

We have implemented safeguards that are intended to protect the personal information we collect from loss, misuse, unauthorized access, disclosure, alteration, and destruction. Please be aware that despite our efforts, no data security measures can guarantee security.

10. Children’s Information

This Site is not intended for use by anyone under the age of 18 nor does BrightEdge knowingly collect or solicit Personal Information from anyone under the age of 18. In the event we confirm that we have collected Personal Information from someone under the age of 18, we will delete that information. If you believe we have any information from a child under 18, please contact us using the contact details in “Contact Information” below.

11. Third Party Sites

The Site may also contain links to third party websites. This Privacy Policy applies solely to information collected by BrightEdge. Even if the third party is affiliated with us through a business partnership or otherwise, we are not responsible for the privacy practices of other websites. If you submit Personal Information to any third party site, your information is governed by that site’s privacy policy. We encourage you to familiarize yourself with the privacy policies of such websites to determine how they handle any information separately collected from you. Please be aware that we do not warn you when you have chosen to click through to another website or property when using the Site.

12. Explanation of Cookies and Other Technologies

This section provides more information about some of those technologies used on our Site and how they work.

Cookies A cookie is a small text file stored on a user’s computer or device for record-keeping purposes. Cookies may be used for various purposes, such as to confirm that users are logged in. BrightEdge uses cookies for validating authenticated users and tracking a user’s application session information in order to improve user experience, as well as prevent any unauthorized access and to maintain security.

Pixel Tags and Similar Technologies. Pixel tags, web beacons, and clear gifs can be embedded in web pages, videos, or emails and allow a web server to read certain types of information from your browser, check whether and when you have viewed a particular web page or email message, and determine, among other things, the IP address of your computer and the URL of the web page from which the pixel tag was viewed.

Flash Cookies. A “Flash Cookie” (also known as Local Shared Object) is a data file stored on a computer or device by the websites that you visit (click here for more details). From time to time, the Site may use Flash Cookie(s), for example, to enable or control Flash-based content. Flash Cookies provide similar functionality as the cookies discussed above but are based on different technology.

HTML5 Storage. HTML5 local storage is similar to the cookies discussed above in that it is stored on a computer or device and can be used to store certain information about your activities and preferences. However, these objects are stored in different parts of your computer or device from ordinary browser cookies.

Third Party Analytics Tools and Data

Our Site uses third party analytics tools that may include cookies, pixels and similar tools, including Google Analytics, which is operated by Google, Inc. Google Analytics uses cookies and pixels to collect usage data on our Site in order to provide us with reports and metrics that help us to evaluate usage of our Site and improve performance and user experiences. You may review and control cookies on our Site (including analytics cookies) as discussed below.

BrightEdge customers may also provide us with access to aggregated usage data and site metrics that have been collected by customers through their sites and online services using third party analytics tools. For example, our customers may provide us access aggregate usage and metrics they have collected on their respective sites, and we may access this data using Google API Services. Our customers are responsible for complying with notice, consent and choice requirements related to their collection, use and disclosure of site usage and metrics data; we will only process this data in order to provide our Services to the relevant customer and in accordance with the terms of our customer agreement. Further, BrightEdge will only use and transfer the Customer Data that it receives via Google APIs as permitted by the Google API Services User Data Policy, including the Limited Use requirements.

You can download the Google Analytics Opt-out Browser Add-on to prevent Google Analytics from using your data collected on our Site and on other sites: https://tools.google.com/dlpage/gaoptout.

13. Use of Google Analytics (GA4) Data

BrightEdge may access Google Analytics (GA4) data only after a user explicitly authorizes access through Google OAuth.

This data is used solely to display analytics and performance insights within the BrightEdge application and to support core product functionality.

Google user data is not used for advertising, marketing, profiling, resale, or sharing with third parties, and access is limited to the minimum scopes required for app functionality.

14. Terms of Use, Notices, and Revisions

Please also see our Terms of Use, which describe the restrictions, disclaimers, indemnification and limitation of liability governing the use of the Site.

We reserve the right to revise, modify, or update this Privacy Policy at any time. We encourage you to refer to this Privacy Policy on an ongoing basis so that you understand our current privacy practices. Unless stated otherwise in a separate agreement or privacy statement, this Privacy Policy applies to all information that we have about you. We may also issue specific information collection and/or privacy notices from time-to-time relating to particular products or services.

15. Accessibility

Anyone with a disability and/or accessibility issues impacting their ability to fully access or read this Privacy Policy may contact us at privacy inquiries or by email/mail/fax to our Privacy and Data Protection Officer per the contact information provided in Section 17 below, to request and obtain an alternative format of the Privacy Policy.

16. Contact Information

Our Privacy & Data Protection Officer is available to our customers, business partners, vendors or others who may have questions concerning this Privacy Policy or BrightEdge’s data practices. If you have questions or suggestions about this Privacy Policy, or to make any request described above, please feel free to contact us at privacy inquiries or by email/mail/fax directed to:

Privacy & Data Protection Officer
BrightEdge Technologies, Inc.
3 East Third Avenue, Suite 200
San Mateo, California 94401 USA

Email: privacy@brightedge.com

EU – GDPR Contacts:
BrightEdge Technologies Limited
Company Number 08858492
Fourth Floor St James House
St James’ Square
Cheltenham, England
GL50 3PR
Attention: EU Data Representative, and Attention: Legal Department

17. Additional Information for Certain U.S. Residents

A. Certain U.S. Residents

This section of the privacy policy provides additional information for certain U.S. residents under applicable state privacy laws.

Consumer Rights. Residents of certain U.S. states, including Colorado, Connecticut, Delaware, Iowa, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Tennessee, Texas, Utah, Virginia, Indiana, Kentucky, and Rhode Island receive additional notice and have additional privacy rights under applicable privacy laws, subject to certain limitations, which may include:

• Access. To confirm whether we are processing their personal information and to obtain a copy of their personal information in a portable and, to the extent technically feasible, readily usable format.
• Deletion. To delete their personal information provided to or obtained by us.
• Correction. The right to correct inaccuracies in their personal information, taking into account the nature and purposes of the processing of the personal information.
• Opt-Out. To opt out of certain types of processing, including:
  • to opt out of the “sale” of their personal information;
  • to opt out of targeted advertising by us; and
  • to opt out of any processing of personal information for purposes of making decisions that produce legal or similarly significant effects.
• Revoke Consent. If you have provided your consent in order for us to process your personal information, including your sensitive personal information, you may revoke such consent.

You may submit a request to exercise most of your privacy rights under U.S. state privacy laws online by using our webform here.

To opt out of the use of your online browsing information for purposes of “sales” or targeted advertising by us, you can adjust your cookies settings here. See Section 13. Explanation of Cookies and Other Tracking Technologies and Section 8. Your Controls and Choices for more information. In addition, our website responds to global privacy control—or “GPC”—signals, which means that if we detect that your browser is communicating a GPC signal, we will process that as a request to opt that particular browser and device out of “sale” and/or targeted advertising (i.e., via cookies and tracking tools) on our Site.

We will respond to your request as required under applicable U.S. privacy law(s). When you submit a request, we will take steps to verify your identity and your request by matching the information provided by you with the information we have in our records. In some cases, we may request additional information in order to verify your identity, or where necessary to process your request. If we are unable to verify your identity after a good faith attempt, we may deny the request and, if so, will explain the basis for the denial.

To the extent required under applicable U.S. privacy laws, if we deny your request, you may appeal our decision in accordance with the instructions we provide in our response.

To the extent permitted under applicable U.S. privacy laws, you may also designate someone as an authorized agent to submit requests and act on your behalf. Authorized agents will be required to provide proof of their authorization, and we may also require the relevant consumer to directly verify the identity and authority of the authorized agent.

If you are a resident of Connecticut, Delaware, Maryland, or Minnesota, you may contact us at privacy@brightedge.com to request a list of the third parties with whom we have disclosed your personal information. Please note, the categories of third parties that we disclose personal information to generally are listed in Section 6. Sharing Personal Information with Third Parties above. If you are a resident of Connecticut, you may request a list of the third parties with whom we have “sold” your personal data to. The categories of personal data that we “sell” are listed below.

“Sale” of Personal Data

While we do not disclose personal information to third parties in exchange for monetary compensation, our use of third-party analytics and advertising cookies may be considered “selling” under applicable U.S. privacy laws. We may “sell” the following categories of personal information: identifiers, Internet and network activity information, and commercial information. We may disclose these categories to third-party advertising networks and analytics providers for purposes of marketing and advertising, to improve and measure our ad campaigns, and to better understand user activity on our Sites. You may opt out of the sale of your personal information as further described above.

B. California Privacy Policy and Notice at Collection

This section of the privacy policy provides additional information for California residents and describes our information practices pursuant to applicable privacy laws, including the California Consumer Privacy Act and the regulations issued thereto, each as amended (“CCPA”). To the extent you are a California resident, and we collect “personal information” subject to the CCPA, the following applies. This section does not address or apply to our handling of personal information that is exempt under the CCPA, such as publicly available information or de-identified or aggregated information.

Categories of Personal Information Collected and Disclosed. We may collect (and may have collected in the prior 12 months) the following categories of personal information about you, as defined by the CCPA. We may disclose each category collected to a service provider or contractor for a business or commercial purpose and to other third parties as described in Section 6. Sharing Your Information with Third Parties, and any applicable supplemental notices.

• Identifiers such as name, email address, postal address, telephone number, account username, account credentials, IP address, online identifiers, device identifiers, and other similar identifiers.
• Personal information described in Cal. Civ. Code § 1798.80(e) such as name, signature, address, telephone number, employment-related business contact information, and other information you provide when creating an account, completing forms, or otherwise interacting with us.
• Commercial information such as records relating to your use of our Site or Services, account activity, service requests, event registrations, marketing preferences, and interactions with our products, services, content, or communications.
• Internet or other electronic network activity information such as browsing history, search history, clickstream data, device and browser information, referring and exit pages, operating system information, interactions with our Site, emails, advertisements, chats, searches, and other online services.
• Audio, electronic, visual, thermal, olfactory, or similar information such as information contained in customer support inquiries, communications with us, chat interactions, submitted content, webinar participation information, and similar interactions.
• Professional or employment-related information such as employer name, job title, business contact information, professional affiliations, company information, and information contained in business profiles or business information databases.
• Inferences drawn from the information described above regarding your interests, preferences, engagement with our content, or use of our Site and Services.

Sales and Sharing of Personal Information. California privacy law defines a “sale” as disclosing or making available to a third-party personal information in exchange for monetary or other valuable consideration, and “sharing” as disclosing or making available personal information to a third party for purposes of cross-context behavioral advertising. We may “sell” or “share” the following categories of personal information for advertising purposes: identifiers and internet or other electronic network activity information to third-party advertising networks, analytics providers and social networks for purposes of marketing and advertising products and services we believe may be of interest to you.

We do not sell or share sensitive personal information, nor do we sell or share any personal information about individuals who we know are under sixteen (16) years old.

Purposes for Collecting and Disclosing Personal Information. As more fully described in Section 5. How We Use and Process the Information We Collect, above, we may collect and process the above-listed personal information for the following business or commercial purposes and as otherwise directed or consented to by you: providing, maintaining, operating, and improving our Site, Services, and related functionality; account management and customer support; identity verification and authentication; security, fraud prevention, and protection against unauthorized or illegal activity; troubleshooting, diagnostics, and service optimization; analytics, research, business intelligence, reporting, and product development; personalizing and enhancing user experiences; communicating with you regarding our Services, support requests, updates, newsletters, promotions, and other marketing communications; and complying with legal obligations, enforcing our agreements, and protecting our rights and interests.

Sources of Personal Information. In general, we may collect personal information from the following sources: directly from you when you create an account, complete forms, request information, communicate with us, or otherwise interact with our Site or Services; automatically through cookies, pixels, analytics tools, and similar technologies; from business information database providers and other third-party sources that supplement or update our records; from social media platforms and other third-party services when you interact with our content; from our service providers acting on our behalf; and, in connection with providing our Services, from our customers or through customer-provided performance, usage, and analytics data that we process on their behalf.

Sensitive Personal Information. We use and disclose sensitive personal information only for purposes permitted under applicable law, including providing requested services, maintaining security, preventing fraud, complying with legal obligations, and other purposes authorized by the CCPA.

Retention. Information about our retention practices can be found in Section 10, Data Retention, Storage, and Security, above.

California Residents’ Rights. California residents have the following rights (subject to certain conditions and exceptions):

• Right to Know. The right to know what personal information we have collected about you, including the categories of personal information we collected about you; the categories of sources from which we collected your personal information; the business or commercial purpose for collecting, selling, or sharing your personal information; the categories of third parties to whom we have disclosed your personal information; and the specific pieces of personal information we have collected about you.
• Right to Delete. The right to request deletion of the personal information that we have collected about you, subject to certain exemptions.
• Right to Correct. The right to request that we correct inaccuracies in your personal information, subject to certain conditions and exceptions.
• Right to Opt-out of Sales and Sharing. The right to opt-out of the “sale” and “sharing” of your personal information. To opt-out of sale/sharing please click the Your Privacy Choices link in the footer of our website. We will also honor your right to opt out as signaled by a universal opt out signal or Global Privacy Control (“GPC”). To enable GPC, you can visit the Global Privacy Control page at https://www.globalprivacycontrol.org. If you visit our Site from a different device or from a different browser on the same device, you will need to opt-out or use an opt-out preference signal for that browser and/or device.
• Right to Limit Use of Sensitive Personal Information. We do not engage in uses or disclosures of sensitive personal information that would trigger this right under the CCPA.
• Right to Non-Retaliation and Non-Discrimination. You have the right not to be subject to retaliatory or discriminatory treatment for exercising your rights under the CCPA.

Submitting CCPA Requests. California residents may exercise their CCPA rights through the following methods:

• Sending email to privacy@brightedge.com.
• Filling out our webform here.

Verification. Before responding to your request, we must first verify your identity using the personal information you recently provided to us. We will take steps to verify your request by matching the information provided by you with the information we have in our records. In some cases, we may request additional information in order to verify your identity, or where necessary to process your request. If we are unable to verify your identity after a good faith attempt, we may deny the request and, if so, will explain the basis for the denial.

Authorized Agents. You may designate someone as an authorized agent to submit requests and act on your behalf. Authorized agents will be required to provide proof of their authorization in their first communication with us, and we may also require that the relevant consumer directly verify the identity and authority of the authorized agent.

Your California Privacy Rights under Shine the Light Law. California’s “Shine the Light” law permits California residents who provide us certain personal information to request and obtain from us, free of charge, information about the personal information (if any) we have shared with third parties for their own direct marketing purposes. To make a California Shine the Light request, please email us at privacy@brightedge.com. You must include this Site as the subject line, and your full name, e-mail address, and postal address in your message. Requests may be made once per year.

Contact Us. For more information about our privacy practices, you may e-mail us at privacy@brightedge.com.

18. Supplemental Privacy Notice for Individuals in the EEA, UK, and Switzerland

(a) Scope of This Section

This Section applies to individuals located in the EEA, the UK, and Switzerland. It supplements the main Privacy Policy above and provides additional information required under the EU General Data Protection Regulation (GDPR), the UK GDPR as amended by the UK Data (Use and Access) Act 2025, and the Swiss Federal Data Protection Act. If there is a conflict between this section and the main Privacy Policy, this section prevails for individuals in these jurisdictions.

(b) Data Controller

The data controller is BrightEdge Technologies, Inc., 3 East Third Avenue, Suite 200, San Mateo, CA 94401. For inquiries related to EU/UK data protection, contact privacy@brightedge.com.

(c) Categories of Personal Data Processed

As more fully described above under the Types/Categories of Personal Information We Collect section of the main Privacy Policy, we collect the following categories of personal data:

• Account information
• Usage, device, and browsing information
• Communications, interactions, comments, responses and feedback
• Location information
• Site interactions, preferences, and other requests
• Business development information

(d) Disclosures of Personal Information

As more fully described above under the Sharing Your Personal Information with Third Parties section in the main Privacy Policy, we disclose personal data as described below:

• To third parties based on consent
• To vendors and service providers
• To our parent, affiliates, and subsidiaries
• To third party marketing and analytics providers
• For compliance and obligation purposes
• For security and protection of rights purposes
• In support of business transfers
• As aggregated or deidentified data
• Otherwise as may be disclosed to you or with your consent

(e) Legal Bases for Processing

We process personal data for the following purposes and based on the associated legal bases:

(f) Data Subject Rights

To the extent we are processing personal data as a controller, individuals in the EEA, UK, and Switzerland may have the following rights, subject to applicable conditions and exceptions:

• Right of access (Article 15). You may request a copy of the personal data we hold about you and information about how we process it.
• Right to rectification (Article 16). You may ask us to correct inaccurate or incomplete personal data.
• Right to erasure / right to be forgotten (Article 17). You may ask us to delete your personal data in circumstances provided by law.
• Right to restriction of processing (Article 18). You may ask us to limit how we use your personal data in circumstances provided by law.
• Right to data portability (Article 20). You may request certain personal data in a structured, commonly used, and machine-readable format and ask us to transmit it to another organization where applicable.
• Right to withdraw consent at any time (Article 7(3)). Where we rely on consent, you may withdraw it at any time. Withdrawal does not affect the lawfulness of processing before withdrawal.
• Right not to be subject to solely automated decision-making (Article 22). You may request that decisions based solely on automated processing and that produce legal or similarly significant effects be reviewed as provided by law.
• Right to lodge a complaint with a supervisory authority. You may complain to the data protection authority in the jurisdiction where you live, work, or believe an infringement occurred.
  • EU – A list of Supervisory Authorities is available here: https://edpb.europa.eu/about-edpb/board/members_en
  • UK – You can submit a complaint to the UK Information Commissioner's Office here: https://ico.org.uk/make-a-complaint/
  • Switzerland – You can submit a complaint to the Swiss Federal Data Protection and Information Commissioner here: https://www.edoeb.admin.ch/en/submitting-a-complaint

Under the UK Data (Use and Access) Act 2025, UK data subjects also have a right to complain directly to the data controller about the processing of their personal data. We will acknowledge such complaints within 30 days and respond without undue delay.

To exercise these rights, contact privacy@brightedge.com. We will respond to rights requests within the statutory timeframes required but may need more information to verify your identity.

(g) Data Retention

We retain personal data as described in the Data Retention, Storage, and Security section above.