Privacy Policy

SmartReach AI LLC (“SmartReach,” “Company,” “we,” “us,” or “our”) respects your privacy and is committed to responsible handling of personal information.

This Privacy Policy explains how SmartReach collects, receives, uses, processes, stores, analyzes, derives, discloses, and protects personal information in connection with:

• smartreachai.com and other SmartReach websites;
• the SmartReach AI platform;
• SmartData;
• SmartAgent;
• SmartMail;
• SmartLink;
• SmartSonar;
• Managed Outbound and full-service outreach;
• SmartDesign website services;
• SmartConvert;
• CRM, automation, AI chat, voice, telephone, SMS, WhatsApp, email, appointment booking, analytics, website hosting, and related services;
• our sales, support, marketing, and business operations; and
• other products and services offered by SmartReach.

This Policy should be read together with our Terms and Conditions, Cookie Policy, and Data Processing Addendum (“DPA”), where applicable.

1. Who We Are

SmartReach AI LLC is a limited liability company organized under the laws of the State of Wyoming, United States.

Our website is:

https://smartreachai.com

Our platform may be accessed through:

https://app.smartreachai.com

For privacy inquiries:

privacy@smartreachai.com

For legal inquiries:

legal@smartreachai.com

2. Business Transfer

Effective June 1, 2026, certain business operations, customer relationships, software platforms, technology, intellectual property, data assets, and services previously operated by SSC International Ltd. were transferred to or are now operated by SmartReach AI LLC.

SmartReach AI LLC is responsible for processing personal information in connection with the SmartReach Services described in this Policy, except where SmartReach acts solely as a processor or service provider on behalf of a Client.

3. When This Privacy Policy Applies

This Policy may apply to information relating to:

• Website visitors;
• SmartReach customers;
• SmartReach platform users;
• potential customers;
• business contacts;
• people who request demos or information;
• individuals who communicate with SmartReach;
• business professionals contained in B2B research or intelligence data;
• prospects included in outreach campaigns;
• recipients of Managed Outbound communications;
• SmartConvert users;
• visitors interacting with SmartConvert-enabled websites;
• people communicating through AI chat, SMS, WhatsApp, email, telephone, or voice tools;
• people booking appointments through SmartConvert;
• individuals contained in a Client’s CRM or customer database;
• vendors, contractors, partners, and service providers; and
• applicants for employment or contractor roles.

4. SmartReach’s Role

SmartReach may process personal information in different roles depending on the circumstances.

4.1 SmartReach as Controller or Business

SmartReach generally determines the purposes and means of processing when we collect information for our own business purposes.

Examples include:

• visitors to SmartReach websites;
• SmartReach customers and account holders;
• billing information;
• SmartReach sales prospects;
• people communicating directly with SmartReach;
• SmartReach marketing activities;
• security and fraud prevention;
• website analytics;
• B2B business intelligence activities where SmartReach determines the purpose of processing;
• creating Aggregated Data and De-identified Data, including from Client Data and Campaign Data, and licensing it to third parties, including for AI training (see Section 9); and
• our own business administration.

In these situations, SmartReach generally acts as a controller, business, or equivalent role under applicable privacy law.

4.2 SmartReach as Processor or Service Provider

Clients may provide personal information to SmartReach through SmartConvert, Managed Outbound, SmartDesign, integrations, CRM systems, communications tools, or other Services.

Where SmartReach processes personal information solely on behalf of a Client and according to that Client’s instructions, the Client generally acts as controller or business and SmartReach acts as processor, service provider, or contractor.

This processing is governed by our DPA where applicable. SmartReach acts as the Client’s processor or service provider for every campaign and service it runs for a Client, including Managed Outbound email and LinkedIn campaigns, SmartConvert and SmartDesign. SmartReach acts as an independent controller (or business) only (a) for its own business, sales and marketing activities listed in Section 4.1, including its own outreach, and (b) when it creates Aggregated Data and De-identified Data from information it processes for Clients, and for its later use and licensing of that data, as described in Section 9, Section 6 of our Terms and Sections 2.2, 2.3 and 22 of our DPA.

If your information was collected by one of our Clients through a SmartConvert-powered website, chatbot, form, CRM, telephone interaction, campaign, or other Client service, you may need to contact that Client directly to exercise your privacy rights.

SmartReach will assist Clients with valid privacy requests as required by law and our DPA.

5. Personal Information We May Collect

The information we collect depends on how you interact with SmartReach and which Services are used.

5.1 Identity and Contact Information

We may process:

• first name;
• last name;
• business name;
• job title;
• department;
• professional role;
• work email address;
• telephone number;
• business address;
• country;
• state, region, or general location;
• professional website;
• social or professional profile information; and
• other business contact details.

5.2 Account Information

We may process:

• account identifier;
• username;
• authentication information;
• account role;
• permissions;
• organization membership;
• subscription information;
• account settings;
• preferences;
• connected accounts;
• integration information; and
• login and security information.

Passwords are intended to be maintained using security measures appropriate to the applicable system.

5.3 Client and Commercial Information

We may process information relating to:

• Services purchased;
• subscription level;
• contracts;
• invoices;
• transactions;
• usage credits;
• billing status;
• support history;
• order forms;
• proposals;
• customer preferences;
• account activity; and
• business relationship history.

5.4 Payment Information

Payments may be processed through third-party payment providers.

Depending on the payment method, we may receive:

• payer name;
• billing address;
• transaction identifier;
• payment status;
• card type;
• limited card information;
• bank-related transaction information; and
• other information necessary to process or reconcile payments.

SmartReach may not directly receive or store complete payment card numbers when payment information is collected directly by a payment processor.

5.5 Communications and Support Information

When you communicate with SmartReach, we may process:

• emails;
• chat messages;
• support requests;
• telephone communications;
• meeting notes;
• call summaries;
• correspondence;
• files or documents you provide;
• feedback;
• survey responses; and
• information contained in your communications.

5.6 SmartConvert CRM Information

Depending on Client configuration, SmartConvert may process:

• names;
• email addresses;
• telephone numbers;
• company information;
• lead source;
• pipeline stage;
• contact status;
• tags;
• notes;
• tasks;
• opportunities;
• estimated deal values;
• appointments;
• customer history;
• communication history;
• forms;
• survey responses;
• custom fields;
• workflow activity;
• consent status;
• opt-out status; and
• other information entered into the CRM.

5.7 Chat and AI Assistant Information

When someone interacts with a SmartConvert AI assistant or chatbot, we may process:

• chat messages;
• questions;
• responses;
• timestamps;
• conversation history;
• contact information submitted during the conversation;
• page or website context;
• appointment requests;
• product or service interests;
• lead qualification information;
• AI-generated summaries;
• conversation classifications;
• intent signals;
• recommended actions; and
• related metadata.

5.8 Telephone and Voice Information

Where SmartConvert telephone or voice functionality is used, we may process:

• telephone numbers;
• incoming and outgoing call information;
• call date and time;
• call duration;
• routing information;
• call outcome;
• transcripts;
• AI-generated summaries;
• conversation classifications;
• appointment information;
• call metadata; and
• audio recordings where recording is enabled.

Calls may be recorded or transcribed where the applicable Client has enabled those features.

Required notices or consent must be provided or obtained where applicable law requires them.

When SmartReach processes calls on behalf of a Client, the Client is responsible for determining whether recording or transcription is lawful and what notice or consent is required.

SmartReach does not represent that audio recordings are used to create biometric identifiers unless expressly disclosed for a specific feature.

5.9 SMS and WhatsApp Information

Where SMS, WhatsApp, or similar messaging features are used, we may process:

• telephone number;
• account or messaging identifier;
• message content;
• attachments;
• timestamps;
• delivery status;
• read or interaction status where available;
• opt-in information;
• opt-out information;
• workflow activity; and
• related metadata.

5.10 Email Information

Our Services may process:

• sender address;
• recipient address;
• subject line;
• message content;
• reply content;
• send status;
• delivery status;
• bounce status;
• unsubscribe status;
• timestamps;
• engagement information where permitted;
• classification of responses;
• email infrastructure information; and
• campaign performance information.

5.11 Appointment and Calendar Information

SmartConvert and other Services may process:

• requested appointment times;
• scheduled date and time;
• timezone;
• meeting type;
• calendar availability;
• participant information;
• calendar identifiers;
• appointment status;
• cancellations;
• rescheduling information;
• meeting links; and
• appointment-related communications.

5.12 Website Visitor and Usage Information

When you visit a SmartReach website or a SmartConvert-enabled website, depending on configuration and consent requirements, we may process:

• IP address;
• browser type;
• operating system;
• device type;
• language;
• approximate geographic location;
• referring website;
• landing page;
• pages viewed;
• links clicked;
• date and time of visits;
• session information;
• time spent on pages;
• conversion events;
• forms opened or submitted;
• chatbot interactions;
• booking activity;
• website navigation;
• traffic source;
• cookie identifiers;
• advertising identifiers; and
• similar technical information.

5.13 Managed Outbound and B2B Prospect Information

SmartReach’s outreach, research, and intelligence Services may process professional or business-related information such as:

• name;
• company;
• job title;
• department;
• seniority;
• professional email address;
• business telephone number;
• company location;
• company size;
• industry;
• company website;
• professional profile URL;
• professional profile information;
• publicly available business information;
• professional interests;
• business events or signals;
• campaign history;
• outreach status;
• reply information;
• outcome classifications;
• intent indicators;
• engagement data;
• campaign metadata; and
• derived business intelligence.

Sources may include Clients, public business information, professional websites, company websites, publicly accessible professional information, licensed data providers, verification providers, enrichment providers, business directories, integrations, and other lawful sources.

5.14 Social and Professional Platform Information

Where a Service connects with or uses professional or social platforms, we may process information made available through authorized integrations, Client-provided access, licensed providers, or publicly available sources.

This may include:

• profile information;
• business name;
• professional role;
• profile URL;
• business-related posts;
• public engagement;
• public business interests; and
• communications processed as part of a Client-authorized campaign.

5.15 SmartDesign Information

For SmartDesign projects, we may process:

• Client contact information;
• company details;
• branding materials;
• logos;
• website content;
• photographs;
• videos;
• product information;
• service descriptions;
• testimonials;
• employee or team information;
• website credentials;
• domain information;
• hosting information;
• integration credentials;
• analytics information; and
• materials supplied by the Client.

Clients are responsible for ensuring they have the right to provide personal information contained in website content and materials supplied to SmartReach.

5.16 Derived Information and Inferences

Our technology may generate information from other data, including:

• lead scores;
• intent classifications;
• prospect classifications;
• reply classifications;
• sentiment or topic classifications;
• predicted relevance;
• recommended next actions;
• engagement scores;
• campaign performance indicators;
• website intent signals;
• customer journey information;
• account-level signals;
• AI summaries;
• analytics;
• benchmarks; and
• similar derived information.

5.17 Sensitive Personal Information

SmartReach does not generally require sensitive personal information to provide standard B2B Services.

However, Clients or users may submit information through CRM records, chat conversations, telephone calls, forms, messages, or other communications that could be considered sensitive under applicable law.

Users and Clients should avoid providing sensitive information unless it is reasonably necessary.

Where sensitive information is processed, we use it only as permitted under applicable law and applicable contractual instructions.

6. Where We Obtain Personal Information

We may obtain personal information:

• directly from you;
• from a SmartReach Client;
• from your employer or organization;
• from authorized users;
• through SmartReach websites;
• through SmartConvert-enabled websites;
• through forms;
• through chat;
• through email;
• through telephone or voice communications;
• through SMS or WhatsApp;
• through appointment systems;
• through CRM systems;
• from integrations authorized by a Client;
• from professional or business websites;
• from publicly accessible sources;
• from licensed B2B data providers;
• from data enrichment providers;
• from verification providers;
• from business directories;
• from professional databases;
• from advertising or analytics providers;
• from referral partners;
• from service providers; and
• from information generated through use of our Services.

When required by applicable law, SmartReach provides appropriate information regarding personal data obtained from third-party or public sources.

7. How We Use Personal Information

We may process personal information for the following purposes.

7.1 Providing the Services

We use information to:

• create and manage accounts;
• provide SmartReach products;
• provide Managed Outbound;
• operate SmartConvert;
• provide SmartDesign;
• process campaigns;
• operate CRM functionality;
• manage leads;
• send communications;
• schedule appointments;
• operate telephone and messaging functions;
• host websites;
• provide analytics;
• perform research;
• provide integrations;
• provide support; and
• otherwise perform our contractual obligations.

7.2 Customer Support

We may use information to:

• respond to questions;
• investigate problems;
• provide technical support;
• troubleshoot;
• process requests;
• provide training;
• manage Client relationships; and
• improve customer service.

7.3 Sales and Marketing

Where permitted by law, we may use business contact information to:

• respond to inquiries;
• conduct B2B outreach;
• market SmartReach products;
• provide product information;
• invite people to demonstrations or events;
• follow up with business contacts;
• personalize communications;
• measure campaign performance; and
• develop customer relationships.

Recipients may opt out of marketing communications as described below.

7.4 Managed Outbound

When providing outreach Services for Clients, we may process professional contact and campaign information to:

• identify relevant business prospects;
• verify contact information;
• segment prospects;
• research companies;
• personalize communications;
• send Client-authorized outreach;
• manage replies;
• maintain suppression lists;
• book meetings;
• classify outcomes;
• update CRM systems;
• measure campaign performance; and
• improve campaign effectiveness.

7.5 SmartConvert

We may process information to:

• manage customer relationships;
• operate CRM records;
• respond through AI assistants;
• route inquiries;
• automate follow-up;
• send messages;
• place or receive calls;
• schedule appointments;
• manage leads and opportunities;
• provide analytics;
• identify website activity;
• personalize customer experiences;
• trigger workflows; and
• perform actions configured by the applicable Client.

7.6 Artificial Intelligence

We may use AI systems to:

• generate communications;
• summarize conversations;
• classify replies;
• analyze data;
• detect intent;
• assist with research;
• answer questions;
• recommend next actions;
• support sales and customer service;
• personalize communications;
• improve workflows;
• perform quality evaluation; and
• provide features requested by Clients.

7.7 Analytics and Product Improvement

We may use information to:

• measure product usage;
• understand feature performance;
• troubleshoot;
• improve Services;
• test new functionality;
• measure campaigns;
• develop analytics;
• develop benchmarks;
• evaluate models;
• improve AI systems;
• improve fraud detection;
• analyze trends; and
• understand customer needs.

7.8 Security and Fraud Prevention

We may process information to:

• authenticate users;
• detect unauthorized access;
• prevent abuse;
• investigate fraud;
• protect accounts;
• maintain network security;
• enforce usage restrictions;
• identify malicious activity; and
• protect SmartReach, Clients, Users, and third parties.

7.9 Legal and Compliance Purposes

We may process information to:

• comply with legal obligations;
• respond to lawful requests;
• enforce agreements;
• establish or defend legal claims;
• protect rights and property;
• investigate misuse;
• maintain required records;
• respond to regulatory authorities; and
• meet tax, accounting, corporate, and compliance obligations.

8. Legal Bases for Processing

Where GDPR, UK GDPR, or another law requires a lawful basis, SmartReach relies on the bases below. Section 8.6 links each purpose to the categories of personal information involved, its legal basis and how long we keep it.

8.1 Contract

Processing may be necessary to perform a contract with you or take steps at your request before entering into a contract.

This may apply to:

• account creation;
• delivery of Services;
• billing;
• SmartDesign;
• SmartConvert;
• customer support;
• subscriptions; and
• other contractual services.

8.2 Legitimate Interests

We may process information where necessary for legitimate business interests and where those interests are not overridden by applicable individual rights.

These interests may include:

• operating a B2B technology company;
• providing and improving Services;
• B2B sales and marketing;
• business development;
• researching business prospects;
• network and information security;
• fraud prevention;
• measuring product usage;
• improving customer experience;
• protecting legal rights;
• maintaining accurate business information;
• developing analytics and business intelligence; and
• creating Aggregated Data and De-identified Data (anonymised statistics and datasets) and licensing them, including for AI training (see Sections 8.6 and 9).

8.3 Consent

Where required, we rely on consent.

Examples may include:

• certain cookies;
• certain electronic marketing;
• recording calls where consent is legally required;
• certain communications;
• certain uses of sensitive information; and
• other activities requiring consent.

Consent may be withdrawn as permitted by law.

8.4 Legal Obligation

We may process information where necessary to comply with legal obligations.

8.5 Other Lawful Bases

Where applicable law provides another lawful basis, SmartReach may rely on that basis.

8.6 Purposes, Personal Information, Legal Bases and Retention

The table below explains, for each purpose, our role, the categories of personal information involved (with the matching part of Section 5), the legal basis we rely on where the GDPR or UK GDPR applies, and how long we keep the information. Where we act as a processor for a Client, the Client decides the purpose and the legal basis, and the Client’s own privacy notice applies.

9. Aggregated, De-identified and Anonymised Data

9.1 What we create

SmartReach creates statistics, benchmarks and datasets about how B2B outreach performs. Examples are reply, meeting and conversion rates and timings by industry band, company-size band, seniority band, channel and message type. We use them for analytics, benchmarking, research, product development, and AI and machine-learning development. We may license, sell or otherwise make them available to third parties, including for training, evaluating and improving AI models.

9.2 Anonymised data and de-identified (pseudonymised) data

• Anonymised data cannot be linked to an individual or a Client by anyone using means reasonably likely to be used. Properly anonymised data is not personal information, so privacy laws such as the GDPR no longer apply to it. In this Policy, our Terms and our DPA, “Aggregated Data” and “De-identified Data” mean only data that meets this standard.
• De-identified (pseudonymised) data is data from which only some identifiers have been removed or replaced. An example is a record with the name removed that still has a record key, exact dates or detailed job details. It is still personal information. We protect it as personal information under this Policy, and we never license or disclose it outside SmartReach.

In this Policy, “Aggregated Data” means information that combines data relating to multiple individuals, Clients or campaigns so that no individual, Client or single record can be singled out, and that meets the De-identification Standard. “De-identified Data” means information, including anonymized information, that cannot reasonably be used to infer information about, or otherwise be linked to, an identified or identifiable individual or Client, directly or indirectly, and that meets the De-identification Standard. The “De-identification Standard” and the “Anonymisation Measures” are defined in Sections 1.8 and 1.12 of our DPA and Section 2 of our Terms. “Campaign Data” and “Effective Date” have the meanings given in Section 2 of our Terms. These terms have the same meaning in this Policy, our Terms and our DPA.

9.3 Our anonymisation standard

Before any Aggregated Data or De-identified Data leaves SmartReach, it must meet the anonymisation requirements of the GDPR and UK GDPR (Recital 26), the “deidentified” standard of the California Consumer Privacy Act, and the three criteria in the European Data Protection Board Guidelines 02/2026 on anonymisation (published 7 July 2026 for public consultation, or any later final version):

1. No isolation. The data contains no combination of values that relates to a single person. For example, it must not be possible to pick out the CEOs of the five largest companies in an industry.
2. No linkage. No record can be matched, with certainty or high likelihood, to a record about the same person in another dataset. For example, job, industry and location together must not allow a match to a public LinkedIn profile.
3. No inference. No specific and meaningful conclusion can be drawn about any person, including about their engagement, interests, preferences or purchasing behaviour. This also covers combining our statistics with other reasonably available information.

9.4 How we meet it

For every dataset or statistic we license or disclose, we apply at least these measures:

• Pooling. Data from Client campaigns is pooled across Clients. Every group or combination of descriptive fields contains at least 10 records and, for data from Client campaigns, comes from at least 5 different Clients.
• Bands. Job title, seniority, department, industry, company size, location, dates and times (such as time to reply or to a meeting) are shown as bands or categories, never exact values.
• No prospect-written text. No replies, chat messages, call recordings or transcripts, or other text written by the people we contacted.
• No identifiers or profile links. No names, email addresses, telephone numbers, postal addresses, profile URLs or other links to a personal or company profile, online or device identifiers, or record keys that could link records across datasets. No Client names or prospect company names.
• Suppression. Groups that are too small, or in which every member has the same outcome so that each person’s outcome could be inferred, are removed or made broader.
• Testing. Before release, we test each dataset against the three criteria in Section 9.3 and keep a record of the result.

9.5 Our role and legal basis

Creating Aggregated Data and De-identified Data uses personal information, so we treat that step as processing under privacy law. We do it as an independent controller (or business), on the basis of our legitimate interests, as described in row 9 of the table in Section 8.6. This applies to our own outreach prospects, to prospects contacted on behalf of Clients, and to other individuals whose information we process for Clients. For all other processing of Client information, SmartReach acts as the Client’s processor (see Section 4.2). Once the data meets the standard in Section 9.3, it is no longer personal information.

9.6 Where the information comes from

The information we use includes outcomes of our own outreach and of campaigns we run for Clients under our Terms and DPA. It can include outreach performed before June 1, 2026 by SSC International Ltd. (which operated the SSC Digital brand), to the extent SSC International Ltd. has transferred or licensed that information to SmartReach AI LLC. We do not use information from a Client whose signed contract with us prohibits this use.

9.7 LinkedIn

For LinkedIn and other social-platform campaigns, we use only content written by SmartReach, such as message templates, and pooled statistics that meet the standard in Section 9.3, such as connection, reply and meeting rates by message type and industry band. We do not use LinkedIn member data. That means no member names, profile URLs or profile content, connection lists, or messages written by members.

9.8 Our commitments

SmartReach publicly commits to maintain and use Aggregated Data and De-identified Data only in aggregated or de-identified form and not to re-identify or attempt to re-identify it, except to test whether its de-identification processes are effective. We contractually require every recipient to make the same commitment and to impose it on anyone they pass the data to. Externally licensed Aggregated Data and De-identified Data do not contain personal information.

9.9 Your right to object to dataset use

Where we rely on legitimate interests to create Aggregated Data or De-identified Data, you can object at any time, on grounds relating to your particular situation, simply by emailing privacy@smartreachai.com (for example with the subject “Dataset objection”). You do not need to use a form, and there is no charge. We will honour your objection going forward: we will stop using your personal information to create new Aggregated Data or De-identified Data, exclude it from future datasets and deliveries, and confirm this to you. We do not rely on overriding legitimate grounds to refuse a dataset objection. Datasets we have already licensed contain only anonymised data that cannot be linked to you, so your information cannot be found in them or removed from them.

10. AI Model Processing

SmartReach Services may use proprietary or third-party artificial intelligence systems.

Information submitted to AI-enabled features may be transmitted to AI technology providers acting as service providers or subprocessors.

The information processed depends on the feature being used and may include:

• prompts;
• chat messages;
• emails;
• business information;
• CRM information;
• prospect information;
• call transcripts;
• summaries;
• website content;
• documents; and
• other information needed to produce the requested output.

SmartReach may use de-identified, aggregated, or derived data to evaluate, train, test, or improve its own models, systems, classifiers, prompts, algorithms, and Services.

Use of identifiable Client Data for AI processing remains subject to applicable agreements, our DPA, applicable law, and the purpose for which the information was provided, except that SmartReach may create Aggregated Data and De-identified Data from Client Data and use and license it, including for AI training, as described in Section 9.

11. Automated Processing and Profiling

SmartReach uses automated systems for activities that may include:

• prospect scoring;
• lead qualification;
• reply classification;
• intent detection;
• prioritization;
• personalization;
• website visitor analysis;
• workflow routing;
• spam and fraud detection;
• recommended next actions;
• conversation analysis; and
• campaign optimization.

SmartReach does not generally use solely automated processing, in its own capacity as controller, to make decisions that produce legal or similarly significant effects concerning individuals.

SmartConvert Clients may configure automated systems to:

• send messages;
• route leads;
• schedule follow-up;
• classify inquiries;
• book appointments;
• update CRM records; or
• perform other workflow actions.

Where SmartReach acts as processor, the Client determines how those automated features are configured and used.

Where applicable law grants rights relating to certain automated decision-making or profiling, requests may be submitted using the contact details in this Policy.

12. Cookies and Tracking Technologies

SmartReach and its service providers may use:

• cookies;
• pixels;
• tags;
• local storage;
• SDKs;
• analytics technologies;
• advertising technologies;
• session technologies; and
• similar tracking tools.

These technologies may be used for:

• essential website functionality;
• authentication;
• security;
• remembering settings;
• analytics;
• measuring website performance;
• understanding traffic;
• attribution;
• conversion measurement;
• personalization; and
• advertising where permitted.

Where applicable law requires consent before using non-essential cookies or similar technologies, SmartReach will request consent.

Additional information is provided in our Cookie Policy and cookie preference tools.

13. Advertising and Analytics

We may use analytics and advertising providers to measure website usage, understand campaign effectiveness, and market SmartReach Services.

Depending on the technologies enabled and your choices, these providers may receive information such as:

• IP address;
• device information;
• cookie identifiers;
• pages viewed;
• referring URLs;
• interaction information;
• advertising identifiers; and
• conversion events.

Certain disclosures for cross-context behavioral advertising may be considered “sharing” under California law even where no money is exchanged.

Where required, SmartReach provides mechanisms to opt out of qualifying sale or sharing.

SmartReach honors legally recognized opt-out preference signals, including Global Privacy Control, where required by applicable law.

14. How We Disclose Personal Information

We may disclose personal information to the following categories of recipients.

14.1 Service Providers and Subprocessors

We may use providers for:

• cloud hosting;
• infrastructure;
• security;
• databases;
• AI;
• email;
• telecommunications;
• SMS;
• WhatsApp;
• telephone services;
• CRM functionality;
• analytics;
• customer support;
• payment processing;
• appointment scheduling;
• website hosting;
• data enrichment;
• data verification;
• professional data;
• marketing;
• development;
• storage;
• monitoring; and
• other business operations.

These providers may process information only for permitted purposes subject to applicable contractual arrangements.

14.2 SmartReach Clients

Where SmartReach provides Services on behalf of a Client, information may be disclosed to that Client.

For example, information submitted through a Client’s SmartConvert chatbot may become part of that Client’s CRM.

14.3 Connected Services

If a Client connects SmartReach to another platform, we may transmit information to that platform according to Client instructions.

Examples may include:

• calendars;
• CRMs;
• email systems;
• social platforms;
• payment systems;
• communication systems;
• analytics services; and
• other integrations.

14.4 Affiliates

Information may be disclosed to SmartReach Affiliates for legitimate business purposes subject to appropriate protections.

14.5 Professional Advisers

We may disclose information to:

• attorneys;
• accountants;
• auditors;
• insurers;
• financial institutions;
• consultants; and
• other professional advisers.

14.6 Legal and Regulatory Disclosures

We may disclose information when reasonably necessary to:

• comply with law;
• respond to legal process;
• respond to lawful government requests;
• protect legal rights;
• investigate fraud;
• protect safety;
• enforce agreements; or
• protect SmartReach, Clients, Users, or third parties.

14.7 Business Transactions

Information may be transferred as part of:

• a merger;
• acquisition;
• financing;
• restructuring;
• reorganization;
• bankruptcy;
• sale of assets;
• investment;
• due diligence process; or
• transfer of all or part of SmartReach’s business.

Appropriate confidentiality and data protection measures will be used where required.

15. Sale and Sharing of Personal Information

SmartReach does not sell personal information for money in the ordinary meaning of the word “sell.”

Some privacy laws define “sale” or “sharing” more broadly.

For example, certain advertising or analytics disclosures may qualify as sale or sharing even if SmartReach receives no direct monetary payment.

Where SmartReach engages in activities that qualify as sale, sharing, or targeted advertising under applicable law, eligible individuals may opt out.

De-identified and aggregated information that does not constitute personal information under applicable law may be used, disclosed, licensed, or commercialized as described in this Policy.

SmartReach does not knowingly sell or share for cross-context behavioral advertising the personal information of individuals under 16 years old without legally required authorization.

16. Retention

SmartReach retains personal information only for as long as reasonably necessary for the purposes described in this Policy, subject to legal, contractual, operational, security, and compliance requirements.

Retention periods vary depending on the information. The table in Section 8.6 sets out the retention period for each purpose.

16.1 Customer and Account Information

Account and Service information may be retained during the customer relationship and for a reasonable period afterward for:

• contractual records;
• dispute resolution;
• security;
• fraud prevention;
• tax;
• accounting;
• legal compliance; and
• legitimate business records.

Financial and contractual information may be retained for longer periods where required by law.

16.2 Client Data

Where SmartReach acts as processor, retention is generally governed by:

• Client instructions;
• the applicable Service;
• Client configuration;
• the DPA; and
• applicable law.

16.3 CRM and SmartConvert Data

SmartConvert information may be retained while the applicable Client account remains active and for a limited period afterward according to account configuration, applicable contractual terms, technical requirements, backup cycles, and legal requirements.

Clients should export information they require before terminating Services.

16.4 Communications

Customer service, sales, and business communications may be retained for as long as reasonably necessary to maintain business records, resolve issues, comply with law, or support the customer relationship.

16.5 Voice and Call Data

Call recordings, transcripts, summaries, and related information may be retained according to Client configuration, contractual terms, provider settings, applicable law, and operational requirements.

16.6 B2B Professional Data

Business contact information may be retained for as long as it remains relevant to legitimate B2B purposes, subject to applicable rights, suppression requests, accuracy controls, legal requirements, and periodic updating.

16.7 Suppression Information

Certain minimal information may be retained after an opt-out or deletion request when reasonably necessary to ensure that the individual is not contacted again.

16.8 Website and Analytics Information

Website and cookie-related data is retained according to the applicable technology, configuration, and Cookie Policy.

16.9 Backups

Information may remain temporarily in secure backup systems after deletion until those backups are overwritten according to normal backup cycles.

17. International Data Transfers

SmartReach operates from the United States and works with service providers located in multiple countries.

Personal information may therefore be processed outside the country where it was originally collected.

Where applicable law requires safeguards for international transfers, SmartReach uses appropriate transfer mechanisms.

These may include:

• adequacy decisions;
• Standard Contractual Clauses;
• the UK International Data Transfer Addendum;
• contractual safeguards;
• approved certifications or frameworks; or
• other legally recognized transfer mechanisms.

Additional transfer terms may be included in our DPA.

18. Security

SmartReach uses reasonable administrative, technical, and organizational safeguards designed to protect personal information.

Measures may include:

• access controls;
• authentication;
• encryption;
• secure communications;
• restricted administrative access;
• monitoring;
• logging;
• backup processes;
• vendor controls;
• confidentiality obligations;
• security policies; and
• incident response procedures.

No website, network, communications system, cloud service, or storage system can be guaranteed completely secure.

Users are responsible for protecting their own credentials and devices.

Please notify SmartReach promptly if you believe your SmartReach account or information has been compromised.

19. Your Privacy Rights

Your rights depend on where you live and applicable law.

You may have the right to:

• obtain information about processing;
• request access to personal information;
• request correction;
• request deletion;
• request restriction of processing;
• request portability;
• object to certain processing;
• withdraw consent;
• opt out of direct marketing;
• opt out of certain sale or sharing;
• opt out of targeted advertising;
• limit certain uses of sensitive personal information;
• object to certain profiling;
• appeal a privacy request decision;
• lodge a complaint with a supervisory authority; and
• receive equal service without unlawful discrimination for exercising privacy rights.

Not every right applies in every situation.

Certain legal exceptions may allow or require us to retain information.

20. Right to Object to Direct Marketing

You may object to the use of your personal information for direct marketing at any time.

You may:

• use the unsubscribe mechanism in a marketing email;
• reply to an appropriate B2B communication asking not to be contacted;
• follow opt-out instructions provided in a message; or
• contact privacy@smartreachai.com.

SmartReach may retain minimal suppression information after an opt-out to help ensure the request is honored.

21. California Privacy Rights

This section applies to California residents to the extent SmartReach is subject to the California Consumer Privacy Act, as amended (“CCPA”), with respect to the relevant processing.

21.1 Categories Collected

During the preceding 12 months, depending on the interaction or Service, SmartReach may have collected the following statutory categories of personal information:

Identifiers

Examples include:

• name;
• email address;
• postal address;
• telephone number;
• online identifiers;
• IP address; and
• account identifiers.

Customer Records Information

Examples may include:

• contact information;
• business information;
• account information;
• payment-related information; and
• customer records.

Commercial Information

Examples include:

• products or Services purchased;
• subscription information;
• transactions;
• customer history;
• account activity; and
• Service usage.

Internet or Other Electronic Network Activity

Examples include:

• browsing activity;
• website interactions;
• device information;
• pages viewed;
• click activity;
• cookie information; and
• SmartReach platform activity.

Geolocation Information

We may process approximate location based on IP address or business information. SmartReach does not generally require precise geolocation for its standard Services.

Audio, Electronic, or Similar Information

Examples may include:

• voice communications;
• call recordings where enabled;
• transcripts;
• chat communications; and
• electronic messages.

Professional or Employment-Related Information

Examples include:

• employer;
• title;
• department;
• role;
• seniority;
• professional profile; and
• business contact information.

Inferences

Examples may include:

• lead scores;
• prospect classifications;
• intent signals;
• engagement classifications;
• predicted interests;
• campaign classifications; and
• recommended actions.

Sensitive Personal Information

Certain account credentials, message contents, or other information may fall within statutory sensitive information definitions. SmartReach does not generally use sensitive personal information for purposes requiring a right to limit unless otherwise disclosed.

21.2 Sources

California personal information may come from:

• the individual;
• SmartReach Clients;
• employers;
• public sources;
• business websites;
• professional sources;
• licensed data providers;
• service providers;
• integrations;
• analytics providers; and
• use of our Services.

21.3 Purposes

We use these categories for the purposes described in this Policy, including:

• providing Services;
• Managed Outbound;
• SmartConvert;
• SmartDesign;
• B2B research;
• account administration;
• customer support;
• security;
• billing;
• analytics;
• product development;
• marketing;
• creating, licensing and commercializing Aggregated Data and De-identified Data, including for AI training;
• legal compliance; and
• business operations.

21.4 Categories Disclosed for Business Purposes

During the preceding 12 months, we may have disclosed the categories described above to:

• cloud and hosting providers;
• AI providers;
• payment processors;
• telecommunications providers;
• email providers;
• messaging providers;
• analytics providers;
• CRM and integration providers;
• professional data and verification providers;
• customer support providers;
• SmartReach Clients;
• professional advisers; and
• other service providers described in this Policy.

21.5 Sale or Sharing

SmartReach does not sell personal information for money in the ordinary meaning of “sell.”

Certain advertising or analytics disclosures involving identifiers or internet activity may constitute “sharing” or a “sale” under the CCPA’s broader statutory definitions.

Where applicable, California residents may opt out.

SmartReach may license Aggregated Data and De-identified Data as described in Section 9. For deidentified information, SmartReach takes reasonable measures to ensure it cannot be associated with a consumer or household, publicly commits to maintain and use it only in deidentified form and not to attempt to reidentify it (except to test whether its de-identification processes are effective, as permitted by law), and contractually obligates every recipient to comply with these requirements.

21.6 California Rights

Subject to applicable exceptions, California residents may have the right to:

• know categories of personal information collected;
• obtain specific pieces of personal information;
• know sources;
• know purposes;
• know categories of third parties receiving information;
• request deletion;
• request correction;
• opt out of sale or sharing;
• limit certain uses of sensitive personal information; and
• receive equal treatment for exercising privacy rights.

21.7 Global Privacy Control

Where legally required, SmartReach recognizes qualifying Global Privacy Control signals as an opt-out request for the browser or device from which the signal is sent.

21.8 Authorized Agents

California residents may use an authorized agent to submit a request where permitted by law.

We may require reasonable verification of the consumer, the agent’s authority, or both.

22. Other United States Privacy Rights

Residents of certain U.S. states may have additional rights under applicable comprehensive state privacy laws.

Depending on the jurisdiction, these may include rights to:

• access;
• correct;
• delete;
• obtain copies of data;
• opt out of sale;
• opt out of targeted advertising;
• opt out of certain profiling;
• restrict certain sensitive data processing; and
• appeal decisions concerning privacy requests.

SmartReach will process valid requests according to applicable law.

Where applicable law provides a right to appeal a denied privacy request, you may appeal by contacting:

privacy@smartreachai.com

Include the word “Privacy Appeal” in the subject line.

23. EEA and UK Privacy Rights

Where GDPR or UK GDPR applies, you may have rights including:

• access;
• rectification;
• erasure;
• restriction;
• data portability;
• objection;
• withdrawal of consent; and
• the right to complain to an applicable supervisory authority.

Where processing is based on legitimate interests, you may object based on your particular circumstances. This includes the use of your information to create Aggregated Data and De-identified Data (see “Your right to object to dataset use” in Section 9).

Where personal information is processed for direct marketing, you may object at any time.

Where processing is based on consent, withdrawing consent does not affect processing lawfully performed before withdrawal.

24. Privacy Requests

To exercise an applicable privacy right, contact:

privacy@smartreachai.com

Please identify:

• your name;
• your email address;
• your relationship with SmartReach;
• the right you wish to exercise; and
• enough information for us to locate the relevant records.

We may request additional information reasonably necessary to verify identity and protect personal information against unauthorized disclosure.

We will respond within the period required by applicable law.

We may deny or limit requests where permitted or required by law.

25. SmartConvert End Users

If you interact with a company using SmartConvert, that company may be the controller or business responsible for your personal information.

For example, if you:

• chat with a company’s AI assistant;
• submit a contact form;
• send that company an SMS;
• communicate through WhatsApp;
• call the company;
• receive an AI voice call;
• schedule an appointment;
• submit lead information; or
• otherwise communicate through a SmartConvert-enabled system,

SmartReach may process your information on behalf of that company.

Privacy questions concerning how that company uses your information should generally be directed to that company. SmartReach acts as an independent controller (or business) only when it creates Aggregated Data and De-identified Data from that information, as described in Section 9; you can object to that use by emailing privacy@smartreachai.com.

SmartReach will assist its Clients in responding to valid requests where required.

26. Managed Outbound Recipients

SmartReach may process professional information about individuals in connection with B2B research or outreach performed for SmartReach or its Clients.

This may include information obtained from public, professional, licensed, Client-provided, or business sources.

If you receive a communication and do not wish to receive further outreach:

• use the unsubscribe or opt-out mechanism provided;
• reply requesting removal where appropriate; or
• contact privacy@smartreachai.com.

Valid opt-out requests will be processed as required by applicable law.

SmartReach may retain limited suppression information to prevent renewed outreach. You may also object to the use of your information to create Aggregated Data and De-identified Data, as described in Section 9.

27. Client Responsibilities

Clients using SmartReach Services are responsible for their own privacy and data protection obligations.

Depending on how a Client uses the Services, this may include:

• providing privacy notices;
• establishing lawful bases;
• obtaining consent;
• maintaining consent records;
• honoring opt-outs;
• providing cookie notices;
• obtaining call-recording consent;
• complying with telecommunications rules;
• responding to individual rights requests;
• configuring data retention;
• maintaining accurate data; and
• entering into legally required data processing agreements.

SmartReach’s Privacy Policy does not replace a Client’s own privacy policy.

28. Communications Compliance

SmartReach and its Clients may be subject to laws governing commercial communications.

Client use of email, SMS, WhatsApp, telephone, voice, or other communications must comply with applicable:

• privacy laws;
• electronic communication laws;
• marketing laws;
• consent requirements;
• opt-out rules;
• telecommunications laws;
• platform requirements; and
• carrier requirements.

SmartReach may maintain records necessary to manage consent, opt-outs, suppression, delivery, abuse prevention, and compliance.

29. Children

SmartReach Services are designed primarily for businesses and are not directed to children.

SmartReach does not knowingly solicit personal information directly from children under 18 through its business Services.

If you believe a child has provided personal information directly to SmartReach improperly, contact:

privacy@smartreachai.com

If SmartReach learns that personal information was collected from a child in violation of applicable law, appropriate steps will be taken.

SmartReach does not knowingly sell or share for cross-context behavioral advertising personal information of individuals under 16 without legally required authorization.

30. Third-Party Websites and Services

SmartReach Services may contain links to, integrate with, or direct users to third-party websites or services.

Those third parties operate under their own privacy policies.

SmartReach is not responsible for privacy practices independently controlled by third parties.

Users should review the applicable third-party privacy terms.

31. Data Processing Addendum

Where SmartReach processes Client Personal Data as a processor, service provider, or contractor, our Data Processing Addendum applies where required.

The DPA addresses matters including:

• processing instructions;
• confidentiality;
• security;
• subprocessors;
• assistance with data subject requests;
• breach response;
• international transfers;
• deletion and return of data; and
• other processor obligations.

32. Subprocessors

SmartReach uses third-party providers to support its Services.

Subprocessors may include providers of:

• cloud infrastructure;
• hosting;
• AI;
• databases;
• telecommunications;
• email;
• messaging;
• CRM technology;
• analytics;
• security;
• payment processing;
• customer support;
• data enrichment;
• data verification;
• scheduling; and
• integrations.

Where required, SmartReach enters into appropriate contractual protections with subprocessors.

Where the DPA applies, subprocessors are handled according to the DPA.

33. Do Not Track and Privacy Signals

Some browsers offer “Do Not Track” settings.

There is not one universally accepted standard governing all Do Not Track signals.

SmartReach responds to legally recognized opt-out preference signals, including Global Privacy Control, where applicable law requires such recognition.

Cookie preference controls may also be available on the SmartReach website.

34. Changes to This Policy

SmartReach may update this Privacy Policy as our Services, technology, business practices, or legal obligations change.

The “Last Updated” date indicates when the Policy was most recently revised.

Where required by law, we will provide additional notice of material changes.

If a new use of personal information requires consent under applicable law, we will obtain consent before beginning that use.

35. European Representative

Where applicable law requires SmartReach to appoint a representative in the European Economic Area or United Kingdom, information concerning the applicable representative will be made available to affected individuals.

Details available on request at privacy@smartreachai.com.

36. Contact Us

Questions, concerns, or privacy rights requests may be sent to:

SmartReach AI LLC

Privacy: privacy@smartreachai.com

Legal: legal@smartreachai.com

Website: https://smartreachai.com

For requests relating to information controlled by a SmartReach Client, you may be directed to that Client.

37. Summary of Privacy Practices

SmartReach’s core privacy practices include:

• collecting information needed to provide business technology and services;
• processing Client data according to Client instructions where SmartReach acts as processor;
• using professional B2B data for legitimate business research and outreach where legally permitted;
• providing opt-out mechanisms for marketing communications;
• processing AI, chat, voice, CRM, messaging, and website activity as needed to operate SmartConvert;
• using appropriate providers and subprocessors;
• using safeguards designed to protect information;
• honoring applicable privacy rights;
• maintaining suppression information where needed to honor opt-outs;
• creating Aggregated Data and De-identified Data that meet our anonymisation standard (Section 9) for analytics, research, product development, AI development and data products licensed to third parties; and
• never including names, contact details, profile links or text written by prospects in licensed datasets.