California Privacy Notice

This California Privacy Notice supplements our general Privacy Policy and provides additional disclosures required by the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (collectively, the "CCPA"). Capitalized terms not defined here have the meanings given in the CCPA. This Notice does not apply to personal information collected from Kontracks employees, applicants, or independent contractors acting in their employment-context capacity, nor to business-to-business communications between Kontracks and Customer representatives — those are subject to separate notices.

1. Categories of personal information we collect

In the past twelve months, we have collected the following categories of personal information from California residents (Cal. Civ. Code § 1798.140):

• Identifiers: name, postal address, email address, phone number, IP address, account login, device identifiers.
• Personal information categories listed in the California Customer Records statute (Cal. Civ. Code § 1798.80(e)): name, address, telephone number, financial information limited to invoice and payment metadata (no card numbers).
• Commercial information: records of services purchased, considered, or used; consumer histories or tendencies.
• Internet or other network activity: browsing history within Kontracks, interaction information about emails and SMS messages routed through Kontracks (opens, clicks, replies, opt-outs).
• Geolocation data: approximate location derived from property addresses (precise GPS coordinates are not collected by Kontracks, although Customers may upload GPS-tagged photos taken on their own devices).
• Audio, electronic, visual, or similar information: photographs uploaded by Customers or End Customers; SMS message content; email content; voice-note transcripts if Customer uses voice features.
• Professional or employment-related information: for Customer's Authorized Users (job title, employment relationship to Customer).
• Inferences: dormant-lead scores, predicted optimal send times, response-likelihood inferences, generated to help Customers prioritize outreach.

We do not intentionally collect: government-issued identification numbers other than business EINs, full Social Security Numbers, biometric identifiers, precise geolocation data, contents of customers' mail/email/text messages where Kontracks is not the intended recipient, education information, or genetic data. We do not knowingly process the sensitive personal information of children under 16.

2. Sources of personal information

• Directly from you when you sign up, complete a form, send a message, sign a proposal, or pay an invoice;
• From Customers who upload, import, or sync your information (e.g., from prior CRM systems, from QuickBooks Online, or from connected email accounts);
• From Customer's End Customers when they reply to messages, sign proposals, upload photos, or pay invoices issued by a Customer;
• From Service Providers processing on Customer's behalf (payment processors, address geocoders, AI providers);
• Automatically through cookies, log files, and similar technologies described in the Cookie Policy.

3. Business or commercial purposes for collection

• Providing the Kontracks Service to Customers;
• Authenticating users and securing the Service;
• Processing payments and managing subscriptions;
• Communicating with Customers and End Customers about transactions, support requests, and security incidents;
• Delivering Customer-initiated communications (emails, SMS) to recipients;
• Detecting and preventing fraud, abuse, and security incidents;
• Complying with legal obligations, including TCPA / CCPA / CPRA / 10DLC carrier compliance, anti-fraud rules, and tax record-keeping;
• Operating and improving the Service, including aggregated benchmarking and product analytics in a manner that does not personally identify any consumer.

4. Categories of third parties to whom we disclose personal information

We disclose personal information to the following categories of third parties for the business purposes above:

• Service Providers as listed in the Sub-processor List;
• Customers when the information was provided to them through the platform;
• Regulators and law enforcement when required by law or to protect rights, safety, or property;
• Professional advisors (lawyers, accountants, auditors) bound by confidentiality;
• Successors in interest in the event of a merger, acquisition, or asset sale, bound by this Notice.

5. Retention

We retain personal information for as long as needed to provide the Service to the relevant Customer and to satisfy our legal obligations (including TCPA consent record retention, invoice and tax records, and carrier audit records). Specific retention periods are described in the Privacy Policy.

6. Your CCPA rights

If you are a California resident, you have the following rights with respect to personal information about you that we have collected:

• Right to know. Request that we disclose what categories and specific pieces of personal information we have collected, the categories of sources, the business or commercial purposes, and the categories of third parties to whom we disclosed the information.
• Right to delete. Request deletion of personal information we collected from you, subject to exceptions (e.g., to comply with law, complete the transaction for which the information was collected, detect security incidents, exercise free speech).
• Right to correct. Request correction of inaccurate personal information.
• Right to opt out of sale or sharing. Because Kontracks does not sell or share personal information, there is nothing to opt out of. You may submit a request at the link below confirming our practice.
• Right to limit use of sensitive personal information. Kontracks does not use sensitive personal information for purposes that trigger the limitation right under the CPRA.
• Right to non-discrimination. We will not deny goods or services, charge different prices, or provide a different level of quality because you exercised your rights.

7. How to exercise your rights

You may submit a request to know, delete, correct, or opt out by one of the following methods:

• Email privacy@kontracks.com with the subject line "California Privacy Request"; or
• Mail a written request to: LWR Technologies, Inc., Attn: Privacy, 390 NE 191st St STE 32488, Miami, FL 33179.

To protect your privacy, we will verify your identity before responding. The verification standard depends on the sensitivity of the personal information involved and the type of request. For most requests we will ask you to confirm two or three of the data points we already have on file (e.g., the email address or phone number associated with the record). We will not require you to create an account to submit a request.

We will respond to verifiable consumer requests within forty-five (45) days of receipt. If we need more time (up to an additional 45 days), we will notify you in writing of the reason and extension period.

8. Authorized agents

You may use an authorized agent to submit a request on your behalf. The agent must provide written permission signed by you, and we will independently verify your identity and confirm with you that the agent is authorized. For requests submitted by an agent who has been granted power of attorney pursuant to Cal. Probate Code § 4000 et seq., proof of the power of attorney is sufficient.

9. Global Privacy Control

The Kontracks marketing website honors Global Privacy Control ("GPC") signals where applicable law requires us to treat them as a do-not-sell-or-share signal. Because Kontracks does not sell or share personal information, the GPC signal has no operational effect on us — but we record receipt of the signal for audit purposes.

10. Information for Customers acting as Businesses

When Customer collects personal information from California residents through the Kontracks Service in Customer's own role as a "Business" under the CCPA, Customer is responsible for providing the at-collection notices required by the CCPA on Customer's own intake forms and for honoring Data Subject requests directed to Customer. Kontracks assists Customer with these obligations through the in-product self-service tools described in our Data Processing Addendum.

11. Annual metrics

For the calendar year 2025, Kontracks received fewer than ten (10) consumer requests under the CCPA, and the median response time was under fourteen (14) days. We publish updated metrics in this section annually within the first quarter.

12. Contact

California privacy questions: privacy@kontracks.com (subject "California Privacy Request")
Toll-free: We do not maintain a toll-free phone line; we offer email and U.S. mail as alternative submission methods
Mailing address: LWR Technologies, Inc., Attn: Privacy, 390 NE 191st St STE 32488, Miami, FL 33179