enso Privacy Policy

Enso Technologies LTD, an Israeli company trading as enso, with its published contact address at Kaf Gimel Yordei HaSira 1, Tel Aviv, Israel ("enso", "we", "us" or "our"), provides AI agents, go-to-market services and related technology. This Privacy Policy explains how we collect, use, disclose, retain and protect information relating to identifiable individuals ("personal data") and how individuals may exercise their rights.

For privacy questions, requests, objections or appeals, contact Liat, Chief Operating Officer (COO), at liat@enso.bot, with "Privacy" in the subject line. You may also write to Enso Technologies LTD at the address above, marked for the attention of Liat, COO, or contact us by telephone at +1 (415) 873-5259. General support remains available at support@enso.bot. You do not need to use a particular subject line for your request to be valid.

This Policy applies to enso.bot, associated enso websites and applications that link to it, and our business communications, demonstrations, events and related services (the "Services"). The Services include Agentic SEO and GEO, Agentic SDR, Agentic Community, Agentic Newsletter, Agentic Social, and related custom AI workflows. It covers website visitors, prospective and existing customer contacts, account users, business partners and individuals whose personal data we process for our own purposes. Separate notices may apply to recruitment, employment or particular features.

We act as a controller when we determine why and how personal data is processed for our own business. This includes managing our website, accounts, billing, customer relationships, our own marketing, security and legal compliance. We may also act as a controller for business contact research or enrichment where we independently determine its purposes and essential means. Our role depends on the actual processing, not merely on how a contract describes us.

When a customer determines the purposes of processing and we operate its agents, campaigns, websites, CRM workflows, communications or other systems on its instructions, we generally act as a processor or service provider. Personal data processed in that capacity is "Customer Personal Data". The customer's privacy notice and our agreement with that customer, including any data processing agreement ("DPA"), govern that processing. This Policy does not expand our rights to use Customer Personal Data beyond those instructions and agreements.

If you interact with a customer through an enso-powered website, agent, campaign or widget, that customer will normally be the controller for the interaction. Direct requests about its processing to that customer. If you contact us, we will assist with identifying the responsible customer and route or support your request as required by law and our agreement. We remain responsible for obligations that apply directly to us.

This Policy is a privacy notice. It does not replace a DPA or itself grant permission for every processing activity described. Where consent is required, we obtain it through the relevant consent mechanism. Visiting a website or continuing to use a service does not by itself constitute consent to optional tracking or unrelated uses of personal data.

Contact and business information includes names, business email addresses, telephone numbers, employer and company details, job titles, professional profiles, business locations and information supplied when requesting a demonstration, proposal, newsletter or support. Account information includes user identifiers, authentication information, roles, permissions, preferences, subscription details and records of account administration.

Transaction information includes billing contacts, invoicing details, business tax information, payment status, purchases, credits and contractual records. Where your engagement identifies Enso AI Tech, Inc., a Delaware corporation, as the billing entity, that entity administers billing and payment collection and processes the information necessary for that function. Payment providers may collect payment credentials directly under their own notices. We receive the payment information necessary to administer the commercial relationship; the information available to us depends on the payment method and provider.

Information submitted through the Services can include messages, attachments, uploaded documents, website content, knowledge bases, prompts, instructions, feedback and generated outputs. Customer workflows may involve CRM records, prospect lists, contact histories, campaign audiences, engagement information, suppression lists and information about customers, employees, contractors or other individuals included in those materials.

Connected services can supply data within the permissions granted to the relevant integration. Depending on the enabled feature, this can include email content and metadata, contacts, calendar entries, files, CRM activity, website analytics, advertising data and social media content or interactions. Composio manages authentication and authorization for integrations that use its connection infrastructure. Connection records can include connection identifiers, permission scopes and integration settings, while the integration provider may handle authorization tokens. Revoking a connection stops future access through that authorization, subject to processing already in progress, but does not automatically erase information previously processed lawfully.

Technical and activity information includes IP addresses, device and browser characteristics, operating system, language, referring pages, approximate location inferred from network information, page visits, timestamps, interactions, cookie identifiers and diagnostics. Agent records can include execution history, tool calls, approval events, errors, usage, cost information and audit logs. These records may contain personal data present in inputs, outputs or connected systems.

Business research and inferred information may include publicly available professional information, business contact details from permitted third-party sources, company relationships, role relevance, engagement indicators, audience segments and estimates of business interest. An inference is an assessment, not a verified fact. Information accessible online can still be protected personal data.

Where a meeting, call or demonstration is recorded or transcribed, we process participants' voices, images, contributions and related metadata after providing the required notice and obtaining consent where necessary. We do not treat attendance alone as consent where affirmative consent is required.

We obtain personal data directly from individuals, from their employers or account administrators, and from customers using the Services. We also obtain it through authorized integrations, service interactions, publicly accessible business sources, referrals, event organizers and permitted business information providers. The source and permitted use depend on the particular activity. A provider's description of data as "public" or "compliant" does not remove our own obligations.

Where we obtain personal data indirectly and must provide an individual notice, we do so within the applicable period, including at first communication or disclosure when that is required. You may ask us for available information about the source of your personal data, subject to applicable limitations and other individuals' rights.

Providing personal data is generally voluntary unless we identify a legal requirement. However, we may be unable to create an account, respond to a request, deliver a requested feature, authenticate access or complete a transaction without the information needed for that purpose. Declining optional marketing or optional tracking does not prevent access to unrelated core features.

We use account, contact, transaction and submitted information to evaluate requests, prepare proposals, enter into and perform agreements, provision access, configure agents, operate workflows, deliver outputs, provide support, administer billing and communicate about the Services. Customer Personal Data is used for the customer's authorized purposes under the applicable agreement.

We use technical information, execution records and relevant submitted information to diagnose errors, monitor reliability, investigate incidents, prevent fraud and unauthorized access, control abusive activity, verify permissions and enforce applicable agreements. When reasonably necessary for these purposes, authorized personnel may review relevant inputs, outputs, communications and logs. Access must be proportionate to the issue and subject to applicable confidentiality and data protection requirements.

We use service feedback, performance information and permitted analytics to understand feature use, evaluate agent quality and improve functionality, reliability and user experience. This does not authorize unrestricted reuse of Customer Personal Data, confidential customer content or connected account information. The AI and customer processing provisions below apply to those uses.

We use business contact details and relevant engagement information to communicate about enso, assess potential business relationships, provide requested content and conduct our own lawful marketing. For a customer's campaign, processing is governed by that customer's instructions, applicable agreements and the rules for the communication channel and location.

We also process relevant information to meet tax, accounting and other legal obligations; respond to lawful requests; investigate complaints; establish, exercise or defend legal claims; obtain professional advice; and carry out corporate transactions under the safeguards described below. We do not rely on this paragraph to retain all information indefinitely or to repurpose it without an applicable legal basis.

Where the GDPR, UK GDPR or another law requiring a specified legal basis applies, we rely on the basis appropriate to the particular purpose. We use contractual necessity for processing objectively necessary to perform a contract with the individual or take requested steps before entering one. Where the customer is a company, managing its representatives' details will ordinarily rely on legitimate interests rather than treating each representative as a contracting party.

Our legitimate interests, where available under applicable law, include operating and improving a secure service, maintaining business relationships, preventing fraud and misuse, handling disputes, and conducting proportionate business marketing. We assess necessity and balance those interests against individuals' interests and rights. Legitimate interests do not override an applicable consent requirement or an unconditional right to object to direct marketing.

We rely on legal obligations for processing required by applicable law, such as mandatory accounting records and legally binding disclosure requirements. We rely on consent for activities that require it, including relevant tracking, recordings and electronic marketing. Where sensitive data requires an additional legal condition, a general legitimate interest alone is insufficient. Legal bases recognized in one jurisdiction are not automatically available in another.

The Services may use AI models and automated tools to analyze content, retrieve information, classify and prioritize business contacts, draft communications, generate media, propose actions and execute authorized workflows. Depending on configuration, model providers may include OpenAI, Anthropic (Claude) and Google (Gemini). Processing can involve sending relevant prompts, context, attachments, retrieved material, outputs and technical metadata to model or infrastructure providers. The information sent depends on the feature, configuration and customer instructions. Once enabled, some agents may act continuously or without approval of each individual action, within the permissions and workflow settings selected for the engagement.

We may retain relevant inputs, outputs and execution records to deliver the requested service, support troubleshooting, evaluate quality, investigate misuse and comply with applicable obligations. Authorized employees, contractors and service providers may review relevant information for those purposes, subject to access restrictions and applicable agreements. A customer selecting automation should not assume that processing occurs only on its own systems or that no human can access service records.

Processing information to generate a response, maintain a customer knowledge base or configure an agent does not itself authorize training a general-purpose model on that information. We do not use Customer Personal Data or nonpublic connected account content to train models for unrelated customers or general use unless a separate, explicit arrangement lawfully authorizes the particular use, identifies the relevant data and purpose, and is consistent with our existing obligations. Customer authorization alone does not replace consent or another legal basis required from the affected individuals.

Model providers processing information on our behalf are subject to the applicable contractual restrictions. Their retention and permitted uses depend on the contracted service and configuration. A customer-directed connection to an independent AI service may instead be governed by that provider's terms and privacy notice. We do not promise zero retention, universal exclusion from provider training or any particular geographic processing location unless expressly confirmed in the applicable agreement or feature notice.

We may develop and improve the Services using lawfully created anonymous or deidentified information, generalized technical learning and other information that we are permitted to use. Data remains subject to this Policy where it can reasonably be linked to a person. Removing names, using hashes or replacing identifiers does not automatically make data anonymous. We do not attempt to reidentify data maintained as deidentified, except where applicable law permits limited testing of the deidentification process.

AI outputs can be inaccurate or contain personal data that was not supplied directly by the individual. Customers must review outputs and configure approval requirements appropriate to the use. Our marketing Services are not designed to make decisions about an individual's employment, credit, insurance, housing, healthcare or similarly significant eligibility solely through automated processing. Where a use triggers special automated-decision obligations, the necessary notices, assessments and rights must be established before that use begins.

Customers and users must have authority to connect accounts, upload information and direct processing. They must provide required privacy notices, establish appropriate legal grounds, obtain necessary permissions, respect objections and suppression requests, and comply with the laws applicable to their communications and campaigns. The presence of information in a CRM, purchased list, social profile or public source does not by itself establish permission to use it for every purpose.

Do not submit information unrelated to the requested service. Unless expressly agreed in writing and supported by appropriate safeguards, the Services must not be used to process children's information, medical or genetic records, biometric identifiers used to identify individuals, government identity documents, highly sensitive financial information, criminal records or other data requiring special protection. Business contact details, authorized account credentials and incidental communications are handled according to the relevant feature and applicable legal classification.

Account administrators control their organization's permissions, configurations, integrations and publication settings. Users must safeguard credentials, avoid exposing secrets in prompts or uploads, grant only necessary permissions and report suspected misuse promptly. Customers are responsible for their own lawful instructions and settings; these responsibilities do not transfer to them obligations that the law places on enso.

We may seek evidence of authority or consent, restrict access, suspend an integration or workflow, or remove material where reasonably necessary to investigate suspected unauthorized processing, protect the Services or comply with law and the applicable agreement. We may preserve relevant evidence where a lawful need exists. Such action is not a determination that every other customer activity has been reviewed or approved.

When a customer directs an agent to send a message, publish a page, post content, update a CRM or transmit information through an integration, the specified recipients and platforms receive the data necessary for that action. Workspace administrators and authorized collaborators may also access information associated with the organization's account, including work content, activity and audit records, according to permissions and the customer agreement.

Content intentionally published to the open internet may be copied, indexed, cached, redistributed or incorporated into third-party search and AI systems. Removing content from a system we control may not remove independent copies. We will fulfill applicable deletion and notification duties, but cannot guarantee erasure from every recipient, search result, archive or model controlled by another organization.

Independent platforms determine their own processing under their privacy notices. A link, integration or customer-selected tool does not make that platform an enso service provider in every circumstance. Customers should review the recipient, permissions and information before authorizing a connection or publication. Our responsibilities for selecting and overseeing providers acting on our behalf continue to apply.

We disclose relevant personal data to providers that support hosting, storage, authentication, communications, AI processing, analytics, payments, customer support, security and other necessary business operations. Providers acting on our behalf receive information appropriate to their function under contractual confidentiality, security and processing restrictions. Subprocessors handling Customer Personal Data are engaged under the applicable DPA and its authorization and notification procedures. Information about relevant subprocessors can be requested through our privacy contact.

We disclose information within the customer's organization and to recipients selected by the customer as described above. If we independently supply business contact information to another organization, that is assessed separately from processing solely on a customer's instructions and may require additional notices, rights and disclosures. A paid marketing engagement does not automatically make every transfer a legally exempt service-provider disclosure.

Affiliates and authorized professional advisers may receive information necessary to support administration, financing, compliance, insurance, audits or legal claims, subject to appropriate confidentiality and other applicable restrictions. We may disclose information to authorities, courts or other parties where legally required, or where lawfully necessary to protect rights, safety or security. We assess the scope and legal basis of requests and do not treat every informal request as compulsory.

If we consider or complete a merger, acquisition, investment, reorganization, sale of assets, insolvency proceeding or similar transaction, relevant personal data may be disclosed to prospective or actual counterparties and their advisers subject to appropriate safeguards. A transaction does not remove applicable purpose restrictions or automatically permit materially different uses of previously collected information. Required notices, choices and consents will continue to apply.

We may disclose information at an individual's direction or with valid consent. We may also disclose anonymous or properly deidentified information where permitted by law and our agreements, subject to safeguards against reidentification. Sale, sharing and targeted advertising disclosures are addressed in the United States section below.

We use cookies and similar storage or access technologies for essential session functions, authentication and aggregate website analytics. The website also uses Google Tag Manager to manage tags. A tag-management tool can deploy other technologies; its presence alone does not identify the individual tags, their purposes or the information they receive. Session cookies generally expire when the browser session ends, while persistent cookies remain until their stated expiry or deletion. For information about technologies affecting your use of the Services, their providers and retention, contact liat@enso.bot.

Where applicable law requires consent, we obtain it before using optional technologies. You can restrict or delete cookies through your browser settings and change any consent choices through the relevant control where provided. You can also contact liat@enso.bot to withdraw consent or request assistance. Strictly necessary technologies may remain active where the law permits their use without consent. Blocking necessary cookies may prevent some features from working. Browser controls do not necessarily block server-side disclosures or every non-cookie technology.

If we use advertising pixels, cross-site measurement, audience matching, visitor identification or session replay, the relevant notice identifies the activity and its actual purpose, and the required consent or opt-out controls apply. We do not expose private form entries or communications to those tools without an appropriate, specifically disclosed lawful basis. This Policy does not itself activate or authorize optional advertising tracking.

Where legally required, we honor recognized opt-out preference signals, including Global Privacy Control, for covered sale, sharing and targeted advertising. A signal normally applies to the browser or device transmitting it and, where required and reasonably associated, the relevant account. Traditional "Do Not Track" signals are not necessarily equivalent to those legally recognized signals. Clearing cookies or using a different browser can affect stored preferences but does not cancel a statutory opt-out we must continue to honor.

We send enso marketing communications only where permitted by the rules applicable to the recipient and channel. Subscription, an existing business relationship or an appropriate business interest may support some communications; other communications require prior consent. We identify the sender and provide the required means to unsubscribe. This Policy is not consent to receive automated calls, texts or other messages for which separate consent is required.

You may unsubscribe using the message's mechanism, reply requesting that marketing stop where replies are supported, or contact liat@enso.bot. We process requests within the applicable legal timeframe. Where you have an unconditional right to object to direct marketing, we stop the related processing, including associated profiling. We may retain the minimum suppression information needed to avoid contacting you again. Essential service, billing, security and legal notices may continue while relevant to your relationship with us.

For a campaign run on behalf of a customer, the customer determines the audience and lawful communication basis and must maintain effective suppression controls. Contacting us about such a campaign will not be ignored merely because the customer is the controller; we will handle or route the request within our role. Unsubscribing from enso's own newsletter may not unsubscribe you from a separate organization's communications, and we will explain the distinction when relevant.

We retain personal data for the period reasonably necessary for the specific purpose for which it was collected, subject to applicable law and contractual obligations. Retention is determined by the data category, whether the account or relationship remains active, the nature of the service, security needs, statutory recordkeeping periods, applicable limitation periods and any substantiated dispute or legal hold.

Account and relationship records are retained while needed to administer the account and resolve relevant post-termination matters. Billing and contract records follow applicable tax, accounting and claims requirements. Prospect and marketing records are kept while there is a lawful, relevant basis for contact, with review of stale records and objections. Suppression records are limited to the information necessary to respect the objection and demonstrate compliance.

Operational logs and AI execution records are retained for the periods needed for service delivery, troubleshooting, security and accountability, with shorter retention where the purpose permits. Recordings are retained for the disclosed purpose and period. Cookie and similar identifier lifetimes are stated in the relevant cookie information. Customer Personal Data follows the return, export and deletion arrangements in the customer agreement and DPA, subject to legally required retention.

Deletion from active systems may occur before deletion from restricted backup or recovery copies. Those copies are removed through the applicable backup cycle and are not used for unrelated business purposes. If restored for recovery, applicable deletion and suppression requirements are reapplied. Legal holds and other permitted exceptions are limited to relevant data and reviewed when the need ends; they do not justify preserving unrelated information indefinitely.

Where data is no longer required, we delete it or render it genuinely anonymous in accordance with applicable law. Termination, disconnection or a deletion request does not automatically require destruction of records that must or may lawfully be retained. Nor does a customer's export relieve us of a deletion obligation. You can ask for information about the retention period or criteria applicable to your data.

We maintain technical and organizational measures appropriate to the nature of the information and processing risks, including access controls and measures to protect service operation. The applicable agreement may specify additional controls. Security measures evolve with the Services and threat environment. No internet transmission, storage system or AI service can be guaranteed completely secure, and this Policy does not create an absolute security warranty.

We may restrict access, preserve relevant logs and investigate suspected incidents. Where an incident triggers notification duties, we notify the relevant customer, regulator or individual as required by law and the applicable agreement. Report suspected unauthorized access or disclosure promptly to liat@enso.bot. Avoid sending passwords, full payment credentials or unnecessary sensitive information in a report. These provisions do not exclude duties or liability that cannot lawfully be excluded.

Depending on the service and providers involved, personal data may be processed in Israel, the United States and other countries where authorized personnel or providers operate. Laws and government access rules may differ from those in the individual's country. We do not promise a particular hosting region or local-only access unless expressly agreed.

Where a restricted international transfer requires safeguards, we use the applicable lawful mechanism. Depending on the transfer, this may include a relevant adequacy decision, the European Commission's Standard Contractual Clauses, the UK International Data Transfer Agreement or UK Addendum, or another legally available mechanism, together with required assessments and supplementary measures. Swiss requirements are addressed where applicable. Transfers subject to Israeli law must meet the applicable Israeli transfer requirements.

You can request information about relevant safeguards and a copy where the law provides that right, with lawful redactions to protect confidential information and other individuals. Using the Services is not treated as blanket consent to transfers that require separate safeguards or specific consent.

Depending on the applicable law and our role, you may be entitled to obtain confirmation of processing and access to your personal data; correct inaccuracies; request deletion or restriction; receive a portable copy; withdraw consent; or object to particular processing. Additional rights may apply to targeted advertising, sale or sharing, sensitive data and certain automated decisions. These rights have different conditions and exceptions in different jurisdictions.

Contact liat@enso.bot or use an applicable account or privacy control. Describe the request and provide enough information for us to locate the relevant record. We may proportionately verify identity and an authorized agent's authority where necessary and permitted, but do not require identity verification for opt-outs where the law prohibits it. We do not require unnecessary sensitive information or creation of an account merely to submit a rights request.

We may limit or refuse a request only on an applicable legal ground, such as protecting another person's rights, preserving legally required records, maintaining legal privilege, or addressing requests that meet the applicable standard for being manifestly unfounded or excessive. Where required, we explain the reason and available challenge or complaint route. Any permitted fee must comply with applicable law and be disclosed. We do not charge for or obstruct ordinary requests to discourage use of privacy rights.

We generally respond to GDPR and UK GDPR rights requests within one month and to covered United States access, correction and deletion requests within 45 days, subject to any shorter applicable deadline. Where an extension is legally available, we explain it within the required initial period. Opt-outs and other time-sensitive requests follow their separate deadlines. We do not unlawfully discriminate or retaliate against individuals for exercising rights.

Where applicable European, UK or Swiss law governs our processing, the rights above apply according to that law. Under the GDPR and UK GDPR, you may object to processing based on legitimate interests on grounds relating to your particular situation. We then stop unless the applicable legal test permits continuation. An objection to direct marketing, including related profiling, does not require that balancing exercise. Withdrawing consent does not affect lawful processing that occurred before withdrawal.

Where legally applicable, individuals have protections concerning decisions based solely on automated processing that produce legal or similarly significant effects, including rights to human intervention and to contest a decision in relevant circumstances. We provide any additional required information for such processing before it begins.

You may complain directly to the competent supervisory authority, including the authority in your EEA country of habitual residence, workplace or alleged infringement, the UK Information Commissioner's Office, or the Swiss Federal Data Protection and Information Commissioner, as applicable. You do not have to contact enso first. Our privacy contact can assist with identifying the appropriate point of contact for your request.

This section applies to the extent a state privacy law covers the relevant individual, information and processing. California protections can apply to business contacts as well as consumers; a business email address is not automatically exempt. Other state laws may have different business-contact exclusions and applicability thresholds.

For our own website, account and commercial administration, relevant categories include identifiers and contact details, customer records, commercial information, internet or network activity, and sensitive account information where applicable. Contact information comes from submissions and business communications; account information comes from registration and authentication; commercial records arise from purchases and billing; and activity information comes from use of the Services. These categories support the purposes described above and are disclosed as necessary to the relevant hosting, authentication, communications, payment, analytics and security providers. Customer workflow data is described separately in this Policy.

We do not sell personal data. For legal purposes, a "sale" can include a transfer for valuable consideration other than money, and California "sharing" includes transfers for cross-context behavioral advertising. A customer-directed transfer, provider arrangement or advertising disclosure must be assessed under the applicable statutory definitions.

To exercise an applicable right to opt out of sale, sharing, targeted advertising or qualifying profiling, contact Liat, COO, at liat@enso.bot. Where legally required, we also honor recognized opt-out preference signals as described above. We do not require an account or identity verification for an opt-out where the law prohibits those requirements. We do not knowingly sell or share personal information of individuals under 16. Where the law requires consent before processing sensitive data, we obtain it. You may also contact Liat to exercise any applicable right to limit the use or disclosure of sensitive personal information.

California residents may request the categories and specific pieces of personal information collected about them, the categories of sources, purposes and recipients, and information about sale, sharing and business-purpose disclosures. They may request correction and deletion, subject to applicable exceptions, and exercise available opt-out and limitation rights. Retention criteria are described above and apply by data category. We do not offer a financial incentive for providing personal data unless a separate required notice explains its terms and valuation.

Other covered state residents may have rights of access, correction, deletion and portability, and rights to opt out of sale, targeted advertising or qualifying profiling. Where provided by law, they may also obtain information about third-party recipients or other specified processing. If we deny a request and an appeal right applies, reply to the decision or email liat@enso.bot requesting a privacy appeal. We respond within the applicable state deadline, which can differ by state, explain the outcome and provide the appropriate regulator complaint route when required.

You may use an authorized agent where applicable law permits. We verify authority only to the extent allowed and do not use that process to obstruct opt-outs. Requests can be sent to liat@enso.bot, by post to Enso Technologies LTD, Attention Liat, COO, Kaf Gimel Yordei HaSira 1, Tel Aviv, Israel, or by contacting +1 (415) 873-5259. You may request this Policy in an accessible alternative format through the same contact.

Where the Israeli Protection of Privacy Law, 5741-1981, as amended, applies, the entity identified above is the controller for the activities described as our own processing. Unless a specific legal duty is identified, providing information is voluntary. The purposes, recipient categories and consequences of not providing necessary information are described above and, where required, in a notice at the point of collection.

Subject to applicable conditions and exceptions, you may inspect personal information held about you and request correction of information that is inaccurate, incomplete, unclear or outdated, including correction or deletion where the statutory conditions are met. Additional rights can apply to information processed for direct mailing or received from the European Economic Area. Where the direct-mailing provisions apply, you may request the applicable removal from the relevant direct-mailing database and cessation of covered disclosure.

We provide the sender, source, database and removal information required for communications governed by those provisions. You can submit a request through our privacy contact and may raise concerns with the Israeli Privacy Protection Authority. This Policy does not treat European legitimate interests as a substitute for any consent or other authorization required under Israeli law.

The Services are intended for business use by adults and are not directed to children under 18. We do not knowingly collect children's personal data for our own business purposes or authorize customers to use the Services for child-directed processing without a separate lawful arrangement. If you believe a child has provided personal data contrary to this Policy, contact us so we can investigate and take the action required by applicable law, including deletion where appropriate.

We may update this Policy to reflect changes in the Services, processing practices or legal requirements. The updated version states its effective date. Where changes are material, we provide the additional notice required by law, which may include a prominent website notice or direct communication. Where new consent or another legal step is required, we complete that step before commencing the affected processing.

An update does not retroactively authorize materially incompatible use of previously collected data or override a binding confidentiality or processing commitment. The applicable customer agreement governs contractual matters, and the DPA governs processing carried out on a customer's behalf to the extent applicable. Nothing in this Policy waives mandatory privacy rights, enlarges a contractual liability limitation beyond what the law allows, or prevents an individual from contacting a regulator or using a legally available remedy.