AccuSights Privacy Policy

AccuSights, Inc. and AccuSights LLC Supersedes all prior versions of the AccuSights Privacy Policy. Prior versions are archived at accusights.com/legal/archive.

At a glance

• Who we are. "AccuSights" means AccuSights, Inc. (a Delaware corporation) and its wholly owned subsidiary AccuSights LLC (an Illinois limited liability company), both at 2058 N. Western Ave, Chicago, IL 60647. Each entity is the controller of the personal information it collects for its own services. Our UAE affiliate, AccuSights Technology Consultants LLC (Dubai) doing business as AccuSights UAE, is a separate legal entity and a separate controller for accusights.ae — see Section 16.
• Two roles. For our website, marketing, sales, billing and the Empower Partner Program (our "Business Engagements") we decide how your information is used — we are a controller/business. Inside the AccuSights platform and in Assess, Comply, Protect and vCISO engagements, we handle information on behalf of our Customers — we are a processor/service provider, and the Customer's own privacy notice governs.
• We do not sell personal information. We use advertising cookies (Meta Pixel, LinkedIn Insight Tag, Google Ads conversion tag, Reddit Pixel) on our public website, which California law treats as "sharing." You can opt out at accusights.com/do-not-share or by sending a Global Privacy Control signal from your browser, which we honor.
• Health data. We do not want you to send us protected health information through our website. The platform may process PHI only under a signed Business Associate Agreement in Protect or Comply engagements, where we act as a business associate of the Customer.
• Texts. We only text you if you ticked a separate SMS box. Transactional and marketing texts have separate consent. Reply STOP to stop.
• Your rights. Access, correction, deletion, portability, opt-out and appeal — see Sections 12–14. Write to [email protected] with subject "ATTN: Privacy Request" or use accusights.com/privacy-request.
• Under 18? Our services are for businesses and adults. We do not knowingly collect information from anyone under 18.

1. Introduction and scope

This Privacy Policy explains how AccuSights, Inc. and AccuSights LLC (together, "AccuSights," "we," "us") collect, use, store, disclose and protect personal information when you:

• visit accusights.com or any site, page, portal or application that links to this Policy (the "Sites") (accusights.ae is operated by our separate UAE affiliate — see Section 16);
• interact with our advertising, content, newsletters, webinars, events, sales and marketing channels, or communicate with us by email, phone, text or web form;
• sign up for, register for or participate in the AccuSights Empower Partner Program through the Empower Partner Portal;
• apply for a job with us; or
• use the AccuSights platform, portal and AI tools (the "Platform") or receive AccuSights Assess, AccuSights Comply, CMMC Accelerator, AI Governance, Secure Office (each offered by AccuSights, Inc.), or AccuSights Protect (SOC-as-a-Service / MDR) and vCISO services (each offered by AccuSights LLC) (together, the "Services").

Everything in the first four bullets is a "Business Engagement." AccuSights decides why and how personal information is used in Business Engagements and is the controller (under the GDPR and UK GDPR) or business (under the California Consumer Privacy Act as amended by the California Privacy Rights Act, "CCPA").

For the Platform and the Services, our business customers ("Customers") decide why and how personal information is used. There, AccuSights is a processor / service provider and processes personal information only on the Customer's documented instructions under our Data Processing Addendum (the "DPA") and, where applicable, a Business Associate Agreement ("BAA"). If you are an employee, contractor or end-user of a Customer and want to exercise rights over information the Customer has placed in the Platform, please contact the Customer directly. We will help the Customer respond, as the DPA requires. Section 5 explains this in more detail.

This Policy is incorporated by reference into the AccuSights Terms of Service (accusights.com/legal/terms), the AccuSights Protect Services Agreement, and the Empower Partner Agreement. Capitalized terms not defined here have the meaning given in those documents.

Which entity is responsible? AccuSights, Inc. is the controller for the Sites, all marketing, the Empower Partner Program, recruiting, and Assess/Comply/CMMC Accelerator/AI Governance/Secure Office billing and account data. AccuSights LLC is the controller for Protect and vCISO billing, account and contact data. AccuSights, Inc. may act as billing and collection agent for AccuSights LLC, so invoices and payment records for Protect may be held by AccuSights, Inc. on the LLC's behalf. The two entities share systems and staff under an intra-group data-sharing arrangement, and either can answer a request that concerns both. Neither entity is liable for the other's obligations.

2. What personal information is

"Personal information" (also called "personal data") means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular individual or household. It includes persistent identifiers such as a cookie ID, device ID or IP address when they can be linked to a person. It does not include information that has been de-identified or aggregated so that it can no longer reasonably be linked to an individual, and we commit to maintaining de-identified data in that form and not to attempt to re-identify it except to test that it stays de-identified.

3. Personal information we collect in Business Engagements, by type of person

We collect the following information in Business Engagements. Sources are: directly from you; automatically from your device and browser; from Customers and Partners who provide your details; and from third parties (LinkedIn, business-data providers, our CRM, public records, event organizers).

3.1 Website visitors

• Automatically collected: IP address, approximate location derived from IP (city/region level), device type, operating system, browser type and version, language, referring URL and UTM parameters, pages viewed, clicks, scroll depth, time on page, session identifiers, and cookie and pixel identifiers described in our Cookie Notice (accusights.com/legal/cookies).
• Free tools you use: answers you give to the Cyber Hygiene Test, the Compliance Scoping Tool, the Framework Finder, the email breach checker (the email address you enter and the breach-check result), and any free score or "Lite" assessment you request. If you ask for the result by email, we collect the email address you give.

3.2 Prospects and leads

Name, job title, company, work email, work phone, mobile number (if you provide it), country, the frameworks or services you are interested in, the free-text description of your needs, your communications with us (email, chat, call notes, meeting recordings where you have been told a call is recorded), your SMS consent choices and timestamps, marketing engagement (email opens, link clicks, webinar attendance, content downloads), and CRM notes created by our staff. Our CRM is GoHighLevel.

3.3 Customer representatives

For the person who signs up, signs an Order Form or Protect Services Agreement, administers the account, or is a billing or technical contact: name, title, company, work email, phone, login credentials and authentication data (including MFA identifiers and SSO identifiers such as a Google or Microsoft account ID), acceptance records (document version, hash of the text accepted, timestamp, IP address, user agent), invoices and payment status, payment card type and last four digits (full card numbers are held by our payment processor, Stripe, not by us), support tickets, and communications.

3.4 Empower Partners and partner representatives

For partners who register in the Empower Partner Portal and their personnel: name, company, title, email, phone, partner tier, website and social handles, tax identifiers (W-9 / W-8 forms, including SSN or EIN, held encrypted and used only for tax reporting), payout details (bank account information collected and held by our payout provider, Stripe Connect, not by us), referral link and click data, deal registrations, commission statements, portal activity logs, certification records, and communications.

Referral registrations and third-party contact data. When a Partner registers a referral or submits a contact, the Partner gives us the name, company, email and phone of a third person. We hold that information as a controller to attribute the referral and to contact the prospect. The Partner is responsible for having a lawful basis and any required notice or consent to give us that person's details. If you have been referred to us by a Partner, you can ask us who referred you and can ask us to delete your details (Section 12).

3.5 Event, webinar and newsletter participants

Name, email, company, title, registration and attendance records, questions asked, poll responses, and (for in-person events) badge scans and photos where notice is given at the event.

3.6 Job applicants

Name, contact details, résumé/CV, work history, education, qualifications, links you provide (for example LinkedIn or GitHub), interview notes, assessment results, references, work-authorization status where lawfully required, and any information you choose to include. We do not ask for and do not want race, religion, health or other sensitive information in applications unless the law requires us to collect it for equal-opportunity reporting, in which case it is voluntary and kept separate. Applicant information is used only for recruiting and, if you are hired, for employment.

3.7 Vendors, suppliers and their personnel

Business contact details, contract and payment records, and security due-diligence information.

3.8 Callers and people who communicate with us

If you call +1 (773) 747-7490 or message us, we keep call logs, voicemails, and the content of messages. Calls may be recorded for training and quality where you are told at the start of the call.

4. Personal information we process inside the Platform and Services (as a processor)

When a Customer uses the Platform or receives Services, we process "Customer Data" on the Customer's behalf. Depending on what the Customer orders and configures, Customer Data may include personal information about:

• Customer administrators and users: name, work email, role, login and MFA data, IP address, activity and audit logs inside the Platform.
• Customer personnel and end-users (Assess, Comply, CMMC Accelerator, AI Governance): names and roles listed in policies, org charts, access reviews, training records and evidence files the Customer uploads; device and account inventories; results of security-awareness or phishing simulations the Customer chooses to run; screenshots and documents supplied as evidence.
• Customer endpoints, networks and cloud accounts (Protect): telemetry from endpoint agents and log sources the Customer connects — device identifiers, usernames, IP addresses, process and file activity, network connections, email headers and metadata (and message content where the Customer enables email security features), authentication events, alerts and incident records.
• Third parties whose data appears in Customer systems: the Customer's own customers, patients, clients, suppliers and others, to the extent their information appears in logs, emails, evidence or files.

The Customer controls what it connects and uploads. Under the Terms of Service, Customers must not upload Controlled Unclassified Information (CUI) unless they have ordered a CUI-capable enclave, and must not upload protected health information unless a BAA is in place (Section 8).

Our DPA governs this processing. It includes CCPA service-provider terms, GDPR Article 28 terms, our subprocessor list (accusights.com/legal/subprocessors), security measures, breach notification, and deletion/return at end of service.

5. How we use personal information and our legal bases

We use personal information collected in Business Engagements for the purposes below. Where the GDPR or UK GDPR applies, the legal basis is shown in parentheses at the end of each item.

1. To provide the Sites, free tools and Services, create and administer accounts, authenticate users, process orders and payments, and deliver what you asked for. (Legal basis: Performance of a contract; steps at your request before a contract)
2. To respond to inquiries, demo requests, support tickets and calls, and to schedule and hold meetings. (Legal basis: Performance of a contract; legitimate interests in responding to you)
3. To run the Empower Partner Program: register partners, attribute referrals, track clicks and conversions, calculate and pay commissions, issue tax forms, and monitor partner marketing for compliance with the Empower Partner Agreement and FTC rules. (Legal basis: Performance of a contract; legal obligation (tax); legitimate interests)
4. To send service and administrative messages — invoices, renewal reminders, security notices, changes to terms or policies, incident notifications. You cannot opt out of these while you have an account or an active engagement. (Legal basis: Performance of a contract; legal obligation; legitimate interests)
5. To send marketing — newsletters, product updates, event invitations, offers — by email, and by SMS only where you gave separate SMS marketing consent. You can opt out at any time. (Legal basis: Consent where required by law (for example EU/UK B2C marketing and all SMS marketing); otherwise legitimate interests in marketing to business contacts, with opt-out)
6. To measure and improve our marketing and Sites — analytics, A/B testing, attribution of leads to campaigns and partners, and (with your consent or opt-out rights as required) advertising on Meta, LinkedIn, Google Ads and Reddit, including audience matching and retargeting. (Legal basis: Consent for non-essential cookies where required; otherwise legitimate interests)
7. To improve and develop our products and Services, including training and tuning our own models and rules on de-identified or aggregated data. Customer Data and your personal information are not used to train AccuSights' or any third party's foundation models. See Section 9. (Legal basis: Legitimate interests)
8. To keep the Sites, Platform and our business secure — detect, investigate and prevent fraud, abuse, unauthorized access, security incidents and violations of our Acceptable Use Policy. (Legal basis: Legitimate interests; legal obligation)
9. To comply with law — tax, accounting, export control, sanctions screening, responding to lawful requests, and enforcing our agreements. (Legal basis: Legal obligation; legitimate interests)
10. To recruit and hire. (Legal basis: Steps at your request before a contract; legitimate interests; legal obligation)
11. For corporate transactions — due diligence, and transfer in a merger, acquisition, financing or sale of assets. (Legal basis: Legitimate interests)
12. With your consent for any other purpose we describe when we collect the information. You may withdraw consent at any time without affecting processing that already happened.

We do not use personal information for automated decisions that produce legal or similarly significant effects on you without human involvement. Lead-scoring and partner-fraud checks are used to prioritize work by our staff, not to decide whether to deal with you.

6. How we disclose personal information

We disclose personal information only as follows. We do not sell personal information for money and have not done so in the preceding 12 months.

6.1 Service providers and processors. Companies that process information on our behalf under written contracts limiting use to our instructions. Current categories and named providers:

The full and current subprocessor list for Customer Data is at accusights.com/legal/subprocessors, where Customers can subscribe to change notices.

6.2 Advertising and analytics partners ("sharing"). On our public Sites we use the Meta Pixel, the LinkedIn Insight Tag, the Google Ads conversion tag and the Reddit Pixel, which collect identifiers and browsing activity for cross-context behavioral advertising. Under the CCPA this is "sharing." It does not occur inside the authenticated Platform. You can opt out as described in Section 13.4, and we honor Global Privacy Control signals. Meta, LinkedIn, Google and Reddit act as independent controllers for the data they collect through these tools; their notices are at facebook.com/privacy/policy, linkedin.com/legal/privacy-policy, policies.google.com/privacy and reddit.com/policies/privacy-policy.

6.3 Empower Partners. If you were referred to us by a Partner, we disclose to that Partner the status of the referral (for example: registered, quoted, closed, active, churned), the month's commissionable revenue, and the name of your company. We do not give Partners your login, Customer Data, or your payment details. If you do not want a Partner to see your status, tell us (Section 12) and we will disassociate the tag.

6.4 Customers (in our processor role). Activity logs and account information about Customer users are available to the Customer's administrators. If you use an account provided by your employer, your employer can see what you do in it.

6.5 Affiliates. AccuSights, Inc. and AccuSights LLC share personal information with each other for the purposes in Section 5.

6.6 Legal, safety and enforcement. To comply with law, subpoenas, court orders or lawful requests from public authorities; to protect our rights, property and safety and those of our Customers, Partners, users or the public; to enforce our agreements and policies; and to detect and address fraud and security issues. Where lawful and practical, we will tell you before disclosing your information in response to a legal request.

6.7 Corporate transactions. To a buyer, investor, lender or successor in connection with a merger, acquisition, financing, reorganization or sale of assets, subject to this Policy or a notice to you.

6.8 With your direction or consent. For example, when you ask us to share information with a co-marketing partner or an auditor.

6.9 De-identified and aggregated data. We may disclose information that does not identify you (for example, benchmark statistics on control readiness across Customers) without restriction.

7. Cookies and tracking technologies (summary)

We use cookies, pixels, tags and similar technologies on our Sites. They fall into four groups: strictly necessary, functional, analytics (including session-replay and heatmap analytics through Microsoft Clarity) and advertising. Non-essential cookies are set only after you accept them where the law requires opt-in consent, and you can change your choice at any time via "Cookie settings" in the footer. We honor the Global Privacy Control signal as an opt-out of sale/sharing and targeted advertising. Our browsers' "Do Not Track" signals are not honored because there is no accepted standard; GPC is the signal we act on. Full details — names, purposes, providers, durations and how to control them — are in our Cookie Notice at accusights.com/legal/cookies.

8. Health information and HIPAA

Our public Sites, forms and free tools are not designed to receive protected health information ("PHI"). Please do not send PHI, medical records or patient details through the website, email or chat.

The Platform and Services may process PHI only where a Customer that is a HIPAA covered entity or business associate has signed our Business Associate Agreement. That will typically be an AccuSights Protect engagement (executed by AccuSights LLC) that monitors systems holding electronic PHI, or, less commonly, an AccuSights Comply engagement (executed by AccuSights, Inc.) where PHI cannot be avoided. In those engagements we act as the Customer's business associate and processor, use PHI only as the BAA and the Customer permit, apply the HIPAA Security Rule safeguards, and report security incidents and breaches to the Customer as the BAA requires. Where no BAA is signed, Customers must not upload or connect systems containing PHI, and our Terms of Service say so.

Our HIPAA Compliance Officer and Privacy Officer is Dr. Kashmala Khalid. Questions about PHI: [email protected], subject line "ATTN: HIPAA Compliance Officer".

9. Artificial intelligence

The Platform uses AI, including large language models supplied by third-party providers and models and rules we build, to: map controls across frameworks; draft policies, procedures and remediation plans from Customer inputs; classify evidence and reported emails; summarize alerts and prioritize incidents (Protect); generate security-awareness content and phishing-simulation templates when a Customer administrator requests them; and answer questions inside the portal.

What that means for your information:

• AI features process only the information the Customer puts into the Platform or that we already hold for the purposes in Section 5. We do not feed public-website visitor data into AI models.
• Our AI providers (OpenAI and Anthropic, each under enterprise API terms) are contractually prohibited from using inputs or outputs to train their models. Customer Data is not used to train AccuSights' or any third party's foundation models.
• We may use de-identified and aggregated information to improve our own models and mappings.
• AI outputs can be wrong. Readiness findings, control mappings and alert classifications are reviewed by AccuSights staff or the Customer before being acted on, and we make no decision with legal or similarly significant effects on an individual solely by automated means.
• Synthetic-voice (vishing) simulations, if a Customer orders them, use generic synthetic voices. We do not clone the voice of any real person or perform biometric profiling unless the Customer has agreed in writing and obtained any consent the law requires, including under the Illinois Biometric Information Privacy Act.

We will publish additional notices about automated decision-making technology as California's ADMT regulations require.

10. Data retention

We keep personal information only as long as needed for the purposes in Section 5 and to meet legal, accounting and contractual obligations, then delete or de-identify it. Typical retention periods:

Where litigation or an investigation is pending, we may keep records longer.

11. Security

We maintain an information security program aligned to the NIST Cybersecurity Framework 2.0 and designed to protect personal information against accidental or unlawful destruction, loss, alteration, unauthorized disclosure or access. Measures include encryption in transit (TLS 1.2 or higher) and at rest, role-based access on a least-privilege basis, multi-factor authentication for all staff and administrative access, centralized logging and monitoring, vulnerability management and periodic penetration testing, secure development practices, vendor security review, background-checked staff with annual security training, tested backups, and a documented incident response plan. Our Security and Trust Statement (accusights.com/legal/security) has more detail. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

If we learn of a breach affecting your personal information, we will notify you and any regulator as applicable law requires, and we will notify affected Customers under the DPA and BAA timelines.

12. Your rights and how to exercise them

Depending on where you live, you may have the right to:

• Know / access the personal information we hold about you and receive a copy;
• Correct inaccurate information;
• Delete your information;
• Port your information in a structured, commonly used, machine-readable format;
• Opt out of sale, sharing, targeted advertising, profiling that produces legal or similarly significant effects, and marketing;
• Limit use of sensitive personal information;
• Restrict or object to processing (EU/UK);
• Withdraw consent at any time; and
• Not be discriminated against for exercising rights.

How to submit a request. Use any of these methods:

1. Online form: accusights.com/privacy-request
2. Email: [email protected] with the subject line "ATTN: Privacy Request"
3. Phone: +1 (773) 747-7490 (ask for the Privacy team)
4. Mail: AccuSights, Inc., Attn: Privacy Request, 2058 N. Western Ave, Chicago, IL 60647

Verification. We will ask you to confirm information we already hold (for example, the email address on file, and for account holders, to log in). We may ask for more where the request concerns sensitive information or deletion. We will not ask for a government ID unless there is no other way to verify you, and we will delete any ID copy after verification.

Authorized agents. You may use an agent to submit a request. We will ask for the agent's written authorization signed by you, or a power of attorney, and may ask you to confirm your identity directly with us.

Timing. We respond within 45 days (California and most US states), extendable once by a further 45 days with notice, or within one month (EU/UK), extendable by two months for complex requests. We confirm receipt of California requests within 10 business days.

Appeals. If we decline all or part of your request, we will tell you why. You may appeal by replying to our decision or writing to [email protected] with "ATTN: Privacy Appeal" in the subject. A different member of our team will review the appeal and respond within 45 days (60 days in some states). If we deny your appeal, we will tell you how to contact your state attorney general or data protection authority.

Requests about Customer Data. If your information is in the Platform because a Customer put it there, we will refer your request to the Customer and help it respond. We cannot delete or change Customer Data on our own initiative.

Marketing opt-out. Use the unsubscribe link in any marketing email, reply STOP to any text, or email [email protected] with subject "ATTN: Privacy Request". We will honor email opt-outs within 10 business days and SMS opt-outs immediately. Service messages will continue while you have an account or engagement.

13. California privacy rights (CCPA/CPRA)

This section applies to California residents and supplements the rest of this Policy. It also serves as our Notice at Collection. California law makes no exception for information collected in a business-to-business or employment context, so it applies to business contacts, Partners, job applicants and (once hired) employees.

13.1 Categories of personal information collected, sources, purposes and disclosures (preceding 12 months)

We do not collect biometric information, and we do not knowingly collect personal information of consumers under 16.

13.2 Sensitive personal information

We use sensitive personal information only to provide the Services you or your organization requested, to prevent fraud and security incidents, to verify identity, to comply with law, and for other purposes permitted by Cal. Code Regs. tit. 11, § 7027(m). We do not use or disclose it to infer characteristics about you. Because of this, the right to limit does not currently apply; if that changes we will add a "Limit the Use of My Sensitive Personal Information" link.

13.3 Sale and sharing

We do not sell personal information and have not sold it in the preceding 12 months. We share identifiers, internet activity and approximate location collected on our public Sites with Meta, LinkedIn, Google and Reddit for cross-context behavioral advertising. We do not knowingly share the personal information of consumers under 16.

13.4 Your right to opt out of sharing — "Do Not Sell or Share My Personal Information"

You can opt out in any of these ways:

• Click "Do Not Sell or Share My Personal Information" in the footer of any Site (accusights.com/do-not-share) and toggle off "Advertising" cookies;
• Enable Global Privacy Control (GPC) in your browser or extension. We treat a GPC signal as a valid opt-out for that browser and, if you are logged in, for your account;
• Email [email protected] with "ATTN: Privacy Request — Opt out of sharing" in the subject.

Opting out stops the advertising tags from loading. It does not stop necessary, functional or analytics cookies (which you can control separately in Cookie settings), and it does not stop non-targeted advertising.

13.5 Retention

See Section 10. We retain each category no longer than reasonably necessary for the purposes stated there.

13.6 Your California rights

You have the rights to know, delete, correct, opt out of sale/sharing, limit use of sensitive PI, and non-discrimination, plus the right to know the categories of sources, purposes and recipients described above. Submit requests as set out in Section 12. You may make a request to know up to twice in a 12-month period. We will not deny goods or services, charge different prices, or provide a different level of service because you exercised these rights, except as permitted by the CCPA. We do not offer financial incentives in exchange for personal information.

13.7 Authorized agents, household requests, and minors

Authorized-agent rules are in Section 12. We do not collect household-level data. Because the Sites and Services are for adults and businesses, we do not sell or share the personal information of anyone under 16 and have no actual knowledge of doing so.

13.8 "Shine the Light" (Cal. Civ. Code § 1798.83)

We do not disclose personal information to third parties for their own direct-marketing purposes. If that changes, California residents may request the disclosures the statute provides by writing to [email protected] with subject "ATTN: Privacy Request".

13.9 Metrics

If we are required to publish request metrics under Cal. Code Regs. tit. 11, § 7102, they will appear at accusights.com/legal/privacy-metrics.

14. Other US state privacy rights

Residents of Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah and Virginia (and any other state with a comprehensive privacy law that applies to us; most of these laws exempt data about people acting in a business or employment capacity, but we apply these rights to everyone regardless) have rights to access, correct, delete and port their personal data, to opt out of targeted advertising, sale of personal data, and profiling in furtherance of decisions with legal or similarly significant effects, and to appeal a refusal. We do not sell personal data. We engage in targeted advertising through the pixels described in Section 6.2; opt out via the methods in Section 13.4, which work for every state. We honor GPC as a universal opt-out signal where a state requires it. We do not process sensitive data as defined by those laws except with consent or as necessary to provide a service you requested, and we do not process it for targeted advertising. Appeals are handled as described in Section 12; if you are dissatisfied with the outcome you may contact your state attorney general.

Nevada. We do not sell "covered information" as defined in NRS 603A. Nevada residents may submit a verified request to [email protected] (subject "ATTN: Privacy Request") to record a preference that we not sell their covered information in the future.

Texas and other biometric laws. We do not collect biometric identifiers.

15. European Economic Area, United Kingdom and Switzerland

This section applies if you are in the EEA, the UK or Switzerland.

Controller. AccuSights, Inc. (and, for Protect and vCISO relationships, AccuSights LLC), 2058 N. Western Ave, Chicago, IL 60647, USA. AccuSights does not target or actively market to customers in the EU or UK. We have not appointed a representative under Article 27 GDPR / UK GDPR or a Data Protection Officer because our processing of EU/UK personal data is occasional and low-risk. You can reach our privacy lead at [email protected] (subject "ATTN: Privacy Request").

Legal bases. Set out in Section 5. Where we rely on legitimate interests, we have balanced those interests against your rights; you can ask for a summary of that assessment. We do not send electronic marketing to EU/UK individuals without consent except to existing customers about similar services, with an opt-out in every message.

Processor role. For the Platform and Services we act as processor for Customers under Article 28 GDPR / UK GDPR terms in our DPA.

International transfers. We are based in the United States and process data there. AccuSights, Inc. and AccuSights LLC do not participate in the EU-US Data Privacy Framework. Where applicable, transfers from the EEA rely on the European Commission's Standard Contractual Clauses (2021/914), from the UK on the International Data Transfer Addendum to those clauses, and from Switzerland on the SCCs as adapted for the FADP, in each case supplemented by the safeguards in Section 11. You can request a copy of the relevant clauses at [email protected] (subject "ATTN: Privacy Request"). Our subprocessors, including AI and cloud providers, may also be in the US; our contracts with them include appropriate transfer mechanisms.

Rights. In addition to Section 12, you have the right to object to processing based on legitimate interests, including profiling, and to object at any time to direct marketing; the right to restrict processing; and the right to lodge a complaint with your supervisory authority (in the UK, the Information Commissioner's Office, ico.org.uk). We would appreciate the chance to address your concern first.

Retention. Section 10.

16. United Arab Emirates (accusights.ae)

AccuSights Technology Consultants LLC (Dubai, United Arab Emirates), doing business as AccuSights UAE, operates accusights.ae. It is a separate legal entity from AccuSights, Inc. and AccuSights LLC and is a separate data controller for personal data collected through accusights.ae and its UAE operations. That data is handled by AccuSights UAE under UAE Federal Decree-Law No. 45 of 2021 (the UAE Personal Data Protection Law, "PDPL"). AccuSights UAE is not a party to the US agreements, and neither AccuSights, Inc. nor AccuSights LLC is responsible or liable for its processing. Where AccuSights UAE shares personal data with the US entities (for example, to deliver a service through the Platform), the transfer is made under a written data-sharing agreement providing the protections the PDPL requires, and this Policy then governs the US entities' processing. To exercise your rights over data held by AccuSights UAE, write to [email protected] with the subject line "ATTN: AccuSights UAE Privacy".

17. Children

The Sites and Services are for businesses and for individuals aged 18 or over. We do not knowingly collect personal information from anyone under 18, and we do not allow anyone under 18 to create an account. If you believe a minor has provided us with personal information, contact [email protected] (subject "ATTN: Privacy Request") and we will delete it.

18. Text messages (SMS) and calls

We send text messages only with your prior express consent, captured through two separate, unchecked checkboxes on our forms: one for transactional / account messages (appointment reminders, assessment confirmations, account and security alerts, service updates) and one for marketing messages (offers, product news, events). Ticking one does not tick the other. Providing a phone number alone is not consent. Consent to marketing texts is never a condition of buying anything from us.

• Texts are sent by AccuSights, Inc. through GoHighLevel from +1 (773) 747-7490. Message frequency varies by program; marketing texts will not exceed 4 per month.
• Message and data rates may apply; contact your carrier with questions about your plan.
• Reply STOP to any message to cancel that program (you will get one confirmation text); reply HELP for help or email [email protected]. You can also revoke consent by any reasonable means, including telling us on a call or in an email, and we will honor it within 10 business days.
• We do not share mobile numbers or SMS opt-in data with third parties or affiliates for their marketing. Numbers are disclosed only to the SMS platform (GoHighLevel and its carrier partners) needed to deliver the messages you asked for.
• We record the number, consent type, timestamp, IP address and form used to prove consent.
• We may call the business number you gave us about your inquiry. We do not make prerecorded or autodialed marketing calls to mobile numbers without prior express written consent, and we honor the National Do Not Call Registry and internal do-not-call requests.

The full program terms are in the SMS and Communications Consent Terms at accusights.com/legal/sms.

19. Third-party sites and services

The Sites link to third-party sites (LinkedIn, YouTube, framework bodies, partner sites). Their privacy practices are their own. The Platform integrates with third-party services the Customer connects (Microsoft 365, Google Workspace, cloud providers, identity providers); our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

20. Changes to this Policy

We may update this Policy. The version number and effective date at the top will change. For material changes we will give at least 30 days' notice by email to account holders and Partners and by a notice on the Sites and in the Platform before the change takes effect; changes apply prospectively only. Where a change requires your consent under applicable law, we will ask for it. Prior versions are archived at accusights.com/legal/archive.

21. Governing law and language

This Policy and any dispute about it are governed by the laws of the State of Illinois, without regard to conflict-of-laws rules, and are subject to the exclusive jurisdiction of the state and federal courts located in Cook County, Illinois, except where mandatory local law gives you the right to bring a claim elsewhere (for example, before your local data protection authority). This Policy is written in English; translations are for convenience and the English version controls.

22. Contact us

Privacy requests and questions: [email protected], subject "ATTN: Privacy Request" · accusights.com/privacy-request Privacy appeals: [email protected], subject "ATTN: Privacy Appeal" Phone: +1 (773) 747-7490 Mail: AccuSights, Inc. / AccuSights LLC, Attn: Privacy Request, 2058 N. Western Ave, Chicago, IL 60647, USA Legal notices: [email protected], subject "ATTN: Legal Notice" HIPAA Compliance Officer and Privacy Officer (Dr. Kashmala Khalid): [email protected], subject "ATTN: HIPAA Compliance Officer" Security vulnerabilities: [email protected], subject "ATTN: Security" — see our Vulnerability Disclosure Policy AccuSights UAE (accusights.ae) privacy: [email protected], subject "ATTN: AccuSights UAE Privacy" Partner program: [email protected] (Kashmala Khalid, Managing Partner)

AccuSights Privacy Policy v2026.10. © 2026 AccuSights, Inc. and AccuSights LLC.