Privacy Policy

Effective Date: August 21, 2026 Last Updated: October 30, 2026

This Privacy Policy describes how AcknowledgePoint LLC, a California Limited Liability Company (“AcknowledgePoint,” “we,” “us,” or “our”), collects, uses, discloses, stores, and protects information in connection with our websites, applications, services, subscription platform, customer portals, administrative tools, billing workflows, templates, document builder, employee acknowledgement workflows, communications, and related services (collectively, the “Services”).

AcknowledgePoint is a business-to-business software platform that allows companies and organizations to create policies and other internal documents using our document builder or template-based starting points, assign those documents to employees, administrators, departments, locations, teams, or other users, and maintain records of employee acknowledgement activity.

This Privacy Policy explains our practices alongside our Terms of Service, Subscription and Billing Terms, Data Processing Addendum, and any customer agreement. A customer agreement may set additional instructions and safeguards for customer-controlled data. Neither that agreement nor this notice takes away privacy rights provided by applicable law.

This is a notice about how we handle information. Reading it or using the Services does not by itself give consent to optional tracking or waive your privacy rights.

1. SCOPE OF THIS PRIVACY POLICY

This Privacy Policy applies to information we collect through:

• AcknowledgePoint.com and related websites;
• the AcknowledgePoint application and administrative portal;
• company account registration and onboarding;
• administrator and employee user accounts;
• document creation and template-based document workflows;
• policy assignment and acknowledgement workflows;
• billing, invoicing, payment coordination, and account administration;
• customer support and communications;
• product usage analytics and security monitoring; and
• other interactions you may have with us.

This Privacy Policy does not apply to:

• third-party websites or services that we do not control;
• an employer's own handling of employee information outside the Services;
• the independent processing activities of third parties when you use their websites or payment portals (our disclosures to providers are described in this Policy); or
• information collected offline unless specifically referenced in this Privacy Policy.

2. OUR ROLE: BUSINESS, SERVICE PROVIDER, PROCESSOR, AND CUSTOMER DATA HOST

AcknowledgePoint may process information in different roles depending on the context.

2.1 Account, Website, Billing, and Business Contact Information

For information we collect directly for our own business purposes, such as website inquiries, sales communications, billing contacts, account setup details, support requests, and marketing communications, AcknowledgePoint generally acts as the business or controller of that information.

2.2 Customer Employee Data and Acknowledgement Records

For information uploaded, entered, generated, or maintained by a customer within the Services about its employees, contractors, administrators, locations, departments, document assignments, and acknowledgement activity, AcknowledgePoint generally acts as a service provider or processor on behalf of the customer. In that context, the customer determines the purpose and means of processing, and AcknowledgePoint processes the information to provide the Services.

Examples of customer-controlled data may include:

• employee names;
• employee business email addresses;
• company names;
• department names;
• location assignments;
• user roles;
• assigned documents;
• due dates;
• acknowledgement status;
• acknowledgement timestamps;
• administrator actions;
• document status;
• audit history; and
• related activity logs.

Customers are responsible for providing appropriate notices to their employees and other users regarding their use of AcknowledgePoint and the processing of employee-related data through the Services.

Your employer or organization can manage your access and review its documents, assignments, and acknowledgement records. Removing your login or employee access does not automatically erase those business records. For requests about employer-controlled records, contact your organization's administrator; you may also contact us using the Privacy option on the Contact Support form so we can help route the request.

3. INFORMATION WE COLLECT

We collect information in several ways, including information provided directly by customers and users, information generated through use of the Services, information collected automatically, and information received from service providers.

3.1 Information You Provide Directly

We may collect information you provide directly, including:

• name;
• email address;
• company name;
• job title or role;
• billing contact name;
• billing email address;
• business address;
• phone number, if provided;
• account identifiers and authentication information received from our sign-in provider;
• support requests;
• sales inquiries;
• feedback;
• communication preferences;
• administrative account details; and
• other information you choose to submit.

Clerk provides sign-in, password setup, verification, and account recovery. Passwords entered in those flows are handled by Clerk; our application stores the identity and access information needed to link your login to your workspace, rather than your Clerk password.

3.2 Company Account Information

When a company creates or manages an account, we may collect and maintain:

• company name;
• account status;
• selected subscription plan;
• account start date;
• invoice date;
• billing cycle information;
• billing contact information;
• plan limits;
• number of administrators;
• number of users;
• number of active documents;
• number of assignments;
• department and location configuration;
• account hold status;
• cancellation status;
• support history; and
• administrative notes related to account operations.

3.3 User and Employee Information

Customers may enter or maintain information about users and employees, including:

• first and last name;
• email address;
• role or permission level;
• department;
• location;
• assignment status;
• acknowledgement status;
• document access status;
• due dates;
• completion dates;
• overdue status;
• audit activity; and
• related workflow history.

3.4 Document and Template Information

The Services allow customers to create documents using AcknowledgePoint’s document builder and reusable templates. We do not position the Services as a general document upload repository unless a future product feature expressly allows it. Depending on customer usage, we may process:

• document titles;
• document descriptions;
• document categories;
• document body content created in the document builder;
• template selections;
• document status, such as draft or published;
• document version information;
• assigned audiences;
• review dates;
• administrator edits; and
• acknowledgement instructions.

Customers are responsible for ensuring that documents they create in the Services do not include unnecessary sensitive personal information unless permitted under their internal policies and applicable law.

3.5 Assignment and Acknowledgement Records

The Services generate and store records related to document assignments and acknowledgements, including:

• document assigned;
• employee or user assigned;
• department or location assigned;
• assignment date;
• due date;
• status;
• acknowledgement date and time;
• overdue status;
• administrator actions;
• reminder activity;
• reporting exports; and
• audit trail details.

These records may be important to customers for compliance, HR, training, operational, safety, IT, or audit purposes.

3.6 Billing and Payment Information

AcknowledgePoint maintains subscription and historical invoice records. Paddle is the merchant of record for subscriptions purchased through its hosted checkout and processes payments, payment methods, tax information, and provider-generated billing documents through its checkout and customer portal.

We may collect or maintain:

• plan name;
• subscription amount;
• invoice number;
• invoice date;
• billing period;
• payment status;
• due date;
• past-due status;
• account hold status;
• payment confirmation status;
• billing contact information; and
• related invoice metadata.

Our application does not collect or store full payment-card numbers or card security codes. Enter payment details only in Paddle's checkout or customer portal, not in documents, support messages, or other application fields. Paddle's privacy policy and payment terms govern its independent payment, tax, and fraud-prevention processing.

3.7 Technical, Usage, and Device Information

When you use the Services, we may automatically collect technical information, including:

• IP address;
• browser type;
• device type;
• operating system;
• referring page;
• pages viewed;
• features used;
• date and time of access;
• session information;
• approximate location derived from IP address;
• login events;
• authentication events;
• failed login attempts;
• administrative actions;
• error logs;
• performance data;
• security events; and
• other usage information.

3.8 Cookies and Similar Technologies

We may use cookies, pixels, local storage, session storage, and similar technologies to support:

• login sessions;
• authentication;
• security;
• user preferences;
• analytics;
• site performance;
• feature improvement; and
• fraud prevention.

We may use essential cookies that are necessary for the operation of the Services. If we use non-essential analytics or advertising technologies, we will describe those practices in this Privacy Policy or a separate Cookie or Tracking Notice.

Essential sign-in and security services, including Clerk and Cloudflare, process connection and device information to keep sessions working, prevent abuse, and deliver the site. Cloudflare's security and traffic reports and our operational logs are separate from optional Google Analytics. Declining optional analytics does not stop the processing needed to provide and protect the Services.

Optional public-website analytics: When configured, Google Analytics 4 starts automatically on eligible public pages for visits identified as originating in the United States, unless a saved refusal, browser exclusion, or browser privacy signal keeps it off. For visits identified outside the United States, or when the country check is unavailable or inconclusive, it starts only after you choose Allow analytics. An automatic U.S. default is not recorded as your consent. We use it to measure public-page visits, Get Started clicks, new company signup submissions accepted by the platform, and successful contact-form submissions. A signup submission is not a measurement of completed email verification or workspace activation. We do not include form answers, email addresses, company names, document content, account identifiers, or invitation links in these events. Analytics is not loaded on login, payment, or workspace pages, or on pages with query strings or unrecognized fragments. Recognized homepage section links, such as Pricing and Reporting, count as the homepage; their fragments are omitted from our event URLs. Analytics is also disabled on local development sites.

When a regional default is needed, your browser requests Cloudflare's country information through our own domain. The application uses only the reported host and country to decide whether the U.S. default applies. It does not save that response, your IP address, or a country record in our application database or browser storage, and it does not send that response to Google Analytics. The country decision is checked again on a new page load when no saved choice applies. Country detection is approximate and may reflect a VPN or proxy connection.

Google Analytics may receive browser and device information, cookie identifiers, and network information needed to receive the event. We send only a search engine's origin as a referrer for supported search engines; other referrers and search terms are omitted. Google advertising features and automatic form, click, and site-search measurement are disabled in this setup. You can choose No thanks to turn analytics off, or change your decision with Cookie choices on public pages. We remember your explicit decision for up to 180 days; valid saved refusals apply in every region. Global Privacy Control and Do Not Track also keep optional analytics off. If browser storage cannot be read, analytics stays off unless a choice can subsequently be saved successfully. See our Cookie / Tracking Notice for details.

Cookie choices also offers an option to exclude a browser from visitor statistics, useful for your own visits and testing. This stores a local exclusion flag, not a visitor identifier, until you remove it or clear site storage. It applies only to that browser and does not change your separate analytics consent choice. Unique-user figures estimate browsers using analytics identifiers; they do not identify individual people or reliably combine different devices.

Changing your choice stops future optional measurement and removes this setup's analytics cookies; it does not automatically delete information already received by Google. You can contact us about that information using the privacy-request process below.

3.9 Communications Information

If you contact us, request support, submit a form, subscribe to communications, or communicate with us by email, we may collect:

• your name;
• email address;
• company name;
• subject matter;
• message content;
• attachments you provide;
• support history;
• issue resolution details; and
• communication preferences.

When you submit the Contact Support form while signed in, your message creates a support ticket linked to your user account and, where applicable, your company. Ticket messages, replies, status, and timestamps are stored in the platform. Tickets are available to their requester and authorized Platform Admin support staff; Company Admin status alone does not grant access to another user's tickets. New tickets and customer replies also generate email alerts to our support operation.

Guest contact-form submissions are sent to our support mailbox through Resend. Messages sent to or received by that mailbox are processed through Google Workspace. Support messages may contain information you choose to provide, so please avoid sending passwords, payment-card details, or unnecessary sensitive personal information.

We may use technical assistance tools, including OpenAI's ChatGPT/Codex, to help an authorized operator review support correspondence and service alerts, troubleshoot problems, and prepare responses. Information made available for those tasks may include message content, sender details, and relevant diagnostics. This is part of our support and maintenance work, not an employee-facing chatbot or an automated employment decision service.

3.10 Information from Third Parties

We may receive information from third-party service providers, such as:

• billing and accounting platforms;
• email service providers;
• analytics providers;
• authentication providers;
• cloud hosting providers;
• customer support tools;
• payment confirmation services; and
• security monitoring tools.

The information we receive depends on the service provider and the customer’s use of the Services.

4. HOW WE USE INFORMATION

We use information for legitimate business and service purposes, including to:

4.1 Provide and Operate the Services

• create and manage company accounts;
• authenticate users;
• provide administrator and employee access;
• enable document creation through the document builder;
• provide template-based document starting points;
• assign documents to users, departments, locations, teams, or other audiences;
• collect and store acknowledgements;
• generate acknowledgement history and reports;
• maintain audit trails;
• operate dashboards;
• manage account limits and plan usage;
• provide customer support; and
• maintain service availability.

4.2 Billing and Account Administration

• manage subscriptions and preserve historical invoices;
• track payment status;
• manage billing contacts;
• apply subscription plan limits;
• manage recurring capacity blocks;
• identify past-due accounts;
• place accounts on hold when applicable;
• reactivate accounts after payment;
• process cancellations;
• maintain tax, accounting, and business records; and
• communicate about billing or account status.

4.3 Security and Fraud Prevention

• protect accounts and data;
• monitor suspicious activity;
• detect unauthorized access;
• prevent abuse;
• enforce Terms of Service;
• investigate security incidents;
• maintain logs;
• protect the integrity of the Services; and
• comply with legal obligations.

4.4 Product Improvement and Analytics

• understand how the Services are used;
• improve user experience;
• troubleshoot errors;
• measure performance;
• develop new features;
• improve document, assignment, and reporting workflows;
• evaluate platform usage trends; and
• improve customer onboarding.

4.5 Customer Communications

• respond to inquiries;
• provide support;
• send service announcements;
• send administrative notices;
• provide billing reminders;
• notify users of changes to the Services;
• provide security notices;
• send product updates; and
• communicate about features, templates, or account activity.

4.6 Legal and Compliance Purposes

• comply with applicable laws;
• respond to lawful requests;
• enforce agreements;
• preserve records;
• resolve disputes;
• prevent harm;
• protect rights and property; and
• support audits or legal claims.

5. HOW WE DISCLOSE INFORMATION

We do not sell customer employee data. We may disclose information in the following circumstances.

5.1 To Customer Administrators

Information relating to a customer’s users, employees, documents, assignments, and acknowledgement records may be visible to that customer’s authorized administrators, depending on permissions configured in the Services.

5.2 To Service Providers

We may disclose information to service providers that help us operate the Services, including providers of:

• cloud hosting;
• data storage;
• database services;
• email delivery;
• billing and invoicing;
• payment processing;
• accounting;
• analytics;
• customer support;
• logging and monitoring;
• cybersecurity;
• authentication;
• backup and disaster recovery; and
• business operations.

Our current providers and their roles include:

• Render: application hosting, database storage, backups, and operational logs containing customer workspace records and service diagnostics.
• Clerk: account authentication, invitations, verification, and account security, using identity, contact, session, and device information.
• Resend: transactional email delivery, using recipient details, email content, and delivery, bounce, and complaint information.
• Cloudflare: DNS, network delivery, traffic measurement, and security, including anti-abuse checks using request, network, and device information.
• Google Workspace: our business and support mailbox, including correspondence and any attachments you send.
• Google Analytics: optional public-site measurement under the regional defaults and saved choices described in Section 3.8.
• OpenAI: operator-assisted support and technical troubleshooting, as described in Section 3.9.
• GitHub and UptimeRobot: development/release operations and availability monitoring. These functions use repository or service-health information and operational alerts; they do not require routine copies of customer document libraries or employee lists.

The information each provider receives depends on its function; not every provider receives every category of information. Providers acting on our behalf process information under applicable service agreements. Some providers, including Paddle for its merchant-of-record activities, also process information for their own legal, payment, or security purposes under their own privacy notices. Customers can request further information about the providers relevant to their workspace through the Contact Support form, using Privacy.

5.3 To Payment and Billing Providers

Paddle processes payment information through its hosted checkout and customer portal. We receive customer, subscription, transaction, and payment-status information needed to administer service and billing. Our application does not store full payment-card numbers or card security codes.

5.4 Business Transfers

We may disclose information in connection with a merger, acquisition, financing, reorganization, sale of assets, bankruptcy, or similar business transaction. If such a transaction occurs, customer information may be transferred as part of the transaction, subject to applicable law and contractual commitments.

5.5 Legal Requirements and Protection of Rights

We may disclose information if we believe disclosure is necessary or appropriate to:

• comply with law;
• respond to subpoenas, court orders, or lawful requests;
• enforce our agreements;
• protect our rights, privacy, safety, or property;
• protect customers, users, or others;
• investigate fraud or security issues; or
• prevent illegal or harmful activity.

5.6 With Consent or Direction

We may disclose information with your consent or at the direction of a customer or authorized administrator.

6. SALE, ADVERTISING, AND AUTOMATED DECISIONS

AcknowledgePoint does not sell personal information for money or other valuable consideration, or share it for cross-context behavioral advertising. We do not use customer documents or employee acknowledgement records for targeted advertising. Our optional Google Analytics configuration disables advertising features.

The platform calculates assignment, completion, and overdue status to provide records to customers. AcknowledgePoint does not use those records to make automated hiring, dismissal, or other employment decisions about employees. Customers are responsible for how they use their reports and for any employment decisions they make.

7. DATA RETENTION

We retain information for as long as reasonably necessary for the purpose for which it was collected, applicable customer retention requirements, legal obligations, security investigations, and dispute resolution. The relevant record type, account status, customer instructions, and any preservation requirement determine the period; there is not one deletion date for all information.

7.1 Customer Accounts, Documents, and Acknowledgements

Active workspace records are retained to provide the Services and maintain customer evidence. Documents, published versions, assignments, acknowledgements, and related audit evidence follow the customer's recorded retention requirements and applicable agreement. Removing an employee's access, closing a login, or canceling a subscription is separate from requesting erasure of these records.

New workspaces have a default recorded retention setting of 2,555 days (approximately seven years), subject to the customer's agreement and applicable requirements. This setting is considered when preserving and reviewing business evidence; it is not an automatic deletion timer. Contact us to confirm the retention requirements for your workspace.

Customers may request an export within 90 days after cancellation takes effect, unless a different written agreement applies. Use Contact Support; if the account is on hold, an authorized support operator must assist with the export. This is an export-request window and retention-review threshold, not a promise of automatic deletion on day 90 or continued access to all workspace features. We review customer instructions, acknowledgement evidence, billing obligations, and preservation requirements before deleting customer records. You may submit a privacy request before or after this review threshold; applicable legal deadlines still apply.

7.2 Support Records

Resolved support tickets become eligible for retention review after 365 days without activity. This does not automatically delete a ticket or its related emails. Open issues, privacy-request evidence, security investigations, disputes, and legal obligations may require longer retention. Support mailbox copies are managed separately from platform tickets and email-delivery logs.

7.3 Email Delivery and Diagnostics

Our operational email-retention schedule uses purpose-specific targets: 7 days for test-delivery records; 30 days for employee and reseller invitation records, registration notices, and general or sales contact-delivery records; 90 days for document-assignment, billing, support-ticket alert, technical-support, and administrator-invitation delivery records; and 180 days for privacy or security contact-delivery records. These periods describe delivery metadata, not deletion of the underlying support message, invoice, user, document, or acknowledgement.

For queued email, the retention clock starts from a verified final delivery outcome; accepted messages with no final outcome are treated as delivery unknown after seven days. Successful delivery diagnostics generally have a seven-day target and failure diagnostics a 30-day target. Cleanup applies when enabled and records are eligible; unresolved delivery work, missing evidence, or preservation holds can delay removal. Compact assignment-delivery evidence can be retained with the related business record. These targets do not control retention in recipients' inboxes, our support mailbox, or providers' own systems.

7.4 Billing, Security, Backups, and Deletion

Billing and transaction records are retained for applicable tax, accounting, dispute, and other legal requirements. Security and operational records are retained according to their purpose and any investigation or preservation need. Analytics choices saved in your browser expire after 180 days; this browser setting is not a retention period for every provider's records.

Backup copies may remain until the applicable backup rotation expires and are kept for recovery purposes. Approved erasure decisions must be reapplied if a backup is restored before the restored data returns to normal use. Deleting a record from the live platform does not immediately remove it from every backup or a provider's independently required records.

Use the Privacy option on Contact Support to ask about the retention period applicable to your information or request access, correction, or deletion. We review such requests under applicable law and customer instructions, explain any reason for retaining information, and delete or de-identify information when it is no longer needed.

8. DATA SECURITY

We use reasonable administrative, technical, and physical safeguards designed to protect information from unauthorized access, use, disclosure, alteration, or destruction.

Security measures may include:

• encryption in transit;
• access controls;
• role-based permissions;
• authentication controls;
• logging and monitoring;
• administrative access restrictions;
• secure hosting environments;
• data backup procedures;
• vulnerability management;
• account activity monitoring;
• least-privilege access practices; and
• internal security procedures.

No system can be guaranteed to be completely secure. Customers and users are responsible for maintaining the confidentiality of account credentials, using strong passwords, protecting administrative accounts, limiting access to authorized personnel, and promptly notifying us of suspected unauthorized access.

9. CUSTOMER RESPONSIBILITIES

Customers are responsible for:

• determining what employee and company information is entered into the Services;
• ensuring they have the right to provide such information to AcknowledgePoint;
• providing appropriate employee notices, if required;
• configuring user permissions appropriately;
• maintaining accurate user, department, and location data;
• managing administrator access;
• ensuring policy content is accurate and lawful;
• avoiding unnecessary sensitive information in documents;
• exporting records as needed;
• complying with employment, privacy, labor, and record retention laws applicable to their organization; and
• responding to employee privacy requests when the customer controls the relevant data.

AcknowledgePoint does not provide legal, HR, employment, or compliance advice. Templates and document builder tools are provided as operational aids and should be reviewed by the customer’s appropriate legal, HR, compliance, or safety professionals before use.

10. INTERNATIONAL DATA TRANSFERS

AcknowledgePoint is intended primarily for use by companies operating in the United States. Information may be stored or processed in the United States or other locations where our service providers operate.

Privacy laws in these locations may differ from those where you live. Using the Services is not, by itself, consent to a restricted international transfer. Where transfer rules apply, the relevant parties must establish the required safeguards or other lawful transfer basis. Contact us using Privacy before arranging processing that requires specific residency or international-transfer commitments; this notice does not establish a local-hosting guarantee or represent that a particular transfer agreement has been executed.

Where European Economic Area, United Kingdom, or similar data-protection laws apply to processing for which we are a controller, the applicable basis depends on the activity: performing a contract with you, meeting a legal obligation, pursuing legitimate interests in operating and securing a business service and responding to inquiries, or consent for optional analytics. You may request information about the basis and safeguards applicable to your information. For customer-controlled employee records, the customer determines its lawful basis.

11. CHILDREN’S PRIVACY

The Services are designed for business use and are not intended for children under the age of 13. We do not knowingly collect personal information directly from children under 13. If we learn that we have collected personal information from a child under 13 without appropriate authorization, we will take reasonable steps to delete it.

Customers may not use the Services to assign documents to minors unless they are authorized to do so and comply with all applicable laws.

12. CALIFORNIA PRIVACY DISCLOSURES

This section provides additional information for California residents and is intended to supplement the rest of this Privacy Policy.

12.1 California Online Privacy Protection Act Notice

California law requires operators of certain commercial websites and online services that collect personally identifiable information from California residents to conspicuously post a privacy policy and identify the policy's effective date. This Privacy Policy describes the categories of personally identifiable information we may collect, how we use and disclose that information, how users may contact us regarding privacy matters, and the date this Privacy Policy was last updated.

12.2 California Consumer Privacy Act / California Privacy Rights Act

The California Consumer Privacy Act, as amended by the California Privacy Rights Act (CCPA), applies according to statutory thresholds, the processing activity, and our role. The rights below apply when the relevant legal requirements are met. We accept privacy inquiries through our Contact Support form regardless of whether a particular law applies. For customer-controlled employee records, we assist the customer in responding as required by law and agreement.

12.3 Categories of Personal Information Collected

In the preceding 12 months, we may have collected the following categories of personal information:

A. Identifiers

Examples: name, email address, company name, IP address, account identifier, billing contact details.

B. Customer Records Information

Examples: business contact details, billing information, invoice records, support information.

C. Commercial Information

Examples: subscription plan, invoice history, payment status, account status, add-ons, service usage.

D. Internet or Other Electronic Network Activity

Examples: login activity, feature usage, browser information, device information, page views, security logs.

E. Geolocation Data

Examples: approximate location derived from IP address.

F. Professional or Employment-Related Information

Examples: company affiliation, department, location, role, administrator status, employee assignment information.

G. Inferences

Examples: limited usage or account status indicators, such as active account, overdue account, or feature adoption, to improve Services and support customers.

H. Sensitive Personal Information

Sign-in credentials handled by our authentication provider can be sensitive personal information. Correspondence and customer-entered documents may also contain sensitive information. We use such information to provide the requested service, authenticate users, respond to support requests, and protect the platform, not to infer sensitive characteristics for advertising. Do not submit government identifiers, health information, precise location, or other sensitive information unless necessary, lawful, and covered by an appropriate agreement. The Services are not offered as a specialized medical-record repository.

12.4 Sources of Personal Information

We may collect personal information from:

• customers;
• administrators;
• employees and users;
• website visitors;
• billing contacts;
• customer support communications;
• automated technologies;
• service providers;
• payment and invoicing providers; and
• security and analytics tools.

12.5 Purposes for Collection, Use, and Disclosure

We may collect, use, and disclose personal information for the purposes described in this Privacy Policy, including to provide the Services, manage accounts, process billing, support customers, secure the platform, improve the Services, comply with law, and enforce agreements.

12.6 Categories of Third Parties to Whom Information Is Disclosed

We may disclose personal information to:

• customer administrators;
• cloud hosting providers;
• billing and accounting providers;
• payment processors;
• email providers;
• analytics providers;
• customer support providers;
• security vendors;
• professional advisors;
• business transaction parties; and
• government or legal authorities when required.

In the preceding 12 months, the business-purpose disclosures covered by this notice include identity and employment information to hosting and authentication providers; customer content and acknowledgement records to hosting providers and authorized customer administrators; contact and correspondence information to email and support-assistance providers; billing information to payment providers; and network, device, and activity information to hosting, security, monitoring, and, where enabled under the regional defaults or your saved choice, analytics providers. Section 5 identifies current providers. Personal information has not been sold or shared for cross-context behavioral advertising during that period. Retention criteria and available periods are described in Section 7.

12.7 California Privacy Rights

Subject to applicable law and verification, California residents may have the right to:

• know what personal information we collect, use, disclose, sell, or share;
• request access to specific pieces of personal information;
• request deletion of personal information;
• request correction of inaccurate personal information;
• opt out of the sale or sharing of personal information;
• limit the use or disclosure of sensitive personal information in certain circumstances;
• receive information about data retention; and
• not be discriminated against for exercising privacy rights.

12.8 Customer Employee Requests

If you are an employee or user of one of our customers and your information is processed in AcknowledgePoint as part of your employer’s or organization’s account, please direct privacy requests to that customer. Because the customer controls the relevant employee account and acknowledgement records, we may refer your request to the customer or assist the customer in responding as required by contract or law.

12.9 How to Submit a Privacy Request

You may submit a privacy request by contacting us at:

Contact: Use the Contact Support page and choose Privacy. Support form: https://www.acknowledgepoint.com/contact-support Mailing Address: 2108 N St, Suite 17763, Sacramento, CA 95816

Please include enough information for us to verify and process your request. We may need to verify your identity or authority before responding. If you are submitting a request on behalf of someone else, we may require proof of authorization.

You do not need to create an account to use the Contact Support form. Select Privacy, describe the request, and provide an address where we can respond. We use verification information to verify and handle the request; do not send passwords, payment-card numbers, or identity documents through the initial form. If you can edit a profile field directly in your account, you may do so; for other corrections, contact us or your organization's administrator.

For requests to know, correct, or delete that are covered by the CCPA, we generally respond within 45 days of receipt. If a lawful extension is necessary, we explain the reason and revised response date within the initial period. If we cannot fulfill a request, we explain the applicable reason, subject to legal restrictions. We do not require an account to make a request or discriminate against you for exercising applicable privacy rights.

12.10 Authorized Agents

California residents may use an authorized agent to submit certain requests. We may require proof that the agent is authorized to act on your behalf and may require you to verify your identity directly with us.

12.11 Do Not Track

Some browsers transmit “Do Not Track” or Global Privacy Control signals. Our optional public-page Google Analytics setup stays off when either signal is enabled. These settings do not disable essential authentication and security services.

12.12 Shine the Light

California Civil Code Section 1798.83 permits California residents to request information about certain disclosures of personal information to third parties for their direct marketing purposes. We do not disclose personal information to third parties for their own direct marketing purposes.

13. OTHER PRIVACY RIGHTS AND APPEALS

Residents of certain states may have privacy rights under applicable state privacy laws. Depending on where you reside and whether the law applies to AcknowledgePoint, you may have rights to access, correct, delete, or obtain a copy of certain personal information, or to opt out of certain processing activities.

Where applicable, these rights also include objecting to or restricting processing, withdrawing consent without affecting earlier lawful processing, and complaining to a privacy regulator. We do not conduct targeted advertising or profiling to make decisions with legal or similarly significant effects on individuals. You can withdraw optional analytics consent through Cookie choices on public pages.

To exercise privacy rights, contact us at:

Contact: Use the Contact Support page and choose Privacy. Support form: https://www.acknowledgepoint.com/contact-support

We will respond within the period required by the law that applies to your request. If we deny a request and your law provides an appeal right, use the same Privacy contact form, identify the original request, and state that you wish to appeal. We will explain the outcome and any further complaint options required by law. You may also contact your state attorney general or applicable data-protection authority. For information controlled by your employer or organization, we help route the request to that customer.

14. EMAIL COMMUNICATIONS AND MARKETING CHOICES

We may send administrative, transactional, billing, security, and service-related communications. These communications are necessary for the Services and you may not be able to opt out of them while maintaining an active account.

If we send marketing emails, you may opt out by using the unsubscribe link in the email or contacting us. Even if you opt out of marketing communications, we may still send service-related communications.

15. THIRD-PARTY LINKS AND SERVICES

The Services may contain links to third-party websites, platforms, or services, including billing, payment, support, documentation, or integration providers. When you use a third-party website or service independently, its privacy policy and terms apply to that activity. Our own disclosure of information to providers remains subject to this notice and our applicable obligations.

16. INTEGRATIONS

If AcknowledgePoint offers integrations with third-party systems, such as identity providers, HR systems, email platforms, accounting systems, or reporting tools, customers may choose to connect those integrations. Information exchanged through integrations will depend on the integration selected, customer configuration, and permissions granted.

Customers are responsible for reviewing third-party integration terms, privacy policies, permissions, and data flows before enabling integrations.

17. DATA EXPORTS AND REPORTS

AcknowledgePoint may allow administrators to export reports, acknowledgement records, document performance data, user lists, or billing records. Customers are responsible for protecting exported data after download, including applying appropriate access controls, retention practices, and security safeguards.

18. ACCOUNT HOLDS, SUSPENSION, AND CANCELLATION

If an account becomes past due or violates applicable terms, AcknowledgePoint may place the account on hold or restrict access according to our Subscription and Billing Terms and Terms of Service.

Account hold or suspension does not necessarily mean immediate deletion of customer data. We may retain data during a hold period to allow payment resolution, account reactivation, record export, legal compliance, or dispute resolution. Data deletion following cancellation will be handled according to our retention practices and applicable agreements.

19. CHANGES TO THIS PRIVACY POLICY

We update this Policy as our practices change and identify the revision date above. For material changes, we will provide notice through the website, application, email, or another appropriate channel as required by applicable law. The updated notice applies from its stated effective date or publication date, unless otherwise stated.

A policy update does not by itself authorize a materially different use of previously collected information. Where applicable law requires consent or another step before a change takes effect, we will take that step. Continued use does not waive privacy rights or replace required consent.

20. CONTACT US

If you have questions about this Privacy Policy, privacy practices, or privacy requests, contact us at:

AcknowledgePoint LLC Contact: Use the Contact Support page and choose Privacy. Support form: https://www.acknowledgepoint.com/contact-support Mailing Address: 2108 N St, Suite 17763, Sacramento, CA 95816 Website: https://www.acknowledgepoint.com