Privacy Policy

1. Introduction

This is Hapstack's Privacy Policy. It tells you how we collect, use, and share information about you, and what rights you have over that information. When we say "Hapstack," we mean Hapstack LLC and its subsidiaries, and when we say "you," we mean the person using our website, web application, Browser Extension, emails, or any other place where we provide this Privacy Policy (collectively referred to as the "Service" or "Product").

This Privacy Policy applies if you use our website, web application, or any other place where we provide this policy.

By using the Service or Product, you agree to our data practices and any other policies we make available to you. If you don't agree, please let us know in writing, close your Hapstack Account, delete any cookies on your devices, and stop using the Service and Product. In some cases, the business customer we provide services for may need to confirm your decision before we can process your request fully.

If you have any questions or want to exercise your rights and choices, please contact us at privacy@hapstack.com or as explained in the "Contact Us" section. If you're a resident of Nevada or California, please read the additional disclosures at the end of this Privacy Policy.

2. Information that we collect

A. Information collected through the Service

We gather information when you use or interact with our Service. For instance, we collect data when you browse our Website, use our Web Application or Browser Extension, read our emails, participate in our affiliate referral program, apply for a job, contact us, or ask us a question. We collect both information that you actively provide to us and information that is automatically collected through tracking technologies (explained below).

The categories of information you provide us through our Service include:

• Contact Information: This includes your first and last name, and email address.
• Company Information: This includes your company name, size, address, and job title.
• Content: This covers the content within any messages you send us, such as when you contact sales or ask a question.
• Job Application Information: This includes your employment and education history, transcripts, writing samples, and references, as necessary to consider your job application for open positions.
• Referral Information: This includes the details you provide about any potential referrals as part of our affiliate referral program, such as their name, email address, and phone number. By providing us with this information, you agree that you have all the necessary rights and permissions to do so.

You can choose to provide other information to us voluntarily that we don't request. In such cases, you are solely responsible for the information you provide.

The categories of information we automatically collect through our Service include:

• Service Use Data, including information about how much time you spend on particular pages you visit, the features you use, your preferences or selections, the services you view, the SaaS products you use, the time of day your browse, and your referring and exiting pages
• Device Data, including information about the type of device or browser you use, your device's operating software, your internet service provider, your device's regional and language settings, and device identifiers such as IP address
• Location Data, including imprecise location information (such as location derived from an IP address or information that indicates a city or postal code level)

The types of tracking technologies we use to automatically collect information include:

• Cookies, which are small data files stored on your device that act as a unique tag to identify your browser. We use two types of cookies: session cookies and persistent cookies. Session cookies make it easier for you to navigate websites and expire when you close your browser. Persistent cookies help with personalizing your experience, remembering your preferences, providing authentication, and supporting security features. Persistent cookies may remain on your device for extended periods of time, and generally may be controlled through your browser settings.
• Device Fingerprinting, which is the process of analyzing and combining sets of data elements from your device's browser, such as JavaScript objects and installed fonts, to create a "fingerprint" of your device and uniquely identify your browser and device.

You may choose to limit our collection of information through tracking technologies by adjusting your browser or device settings. However, please note that doing so may impact or restrict certain features available to you.

B. Information collected through the Product

Our Product is designed for use by business customers and their employees and authorized users. It is important to note that if you are using the Product as an employee or authorized user of a business customer, your employer or the business customer may have access to the information you provide or that is collected through your use of the Product. We encourage you to review your employer or business customer's privacy policy and practices to understand how they handle your information. If you have any questions or concerns about how your information is being processed by Hapstack or our business customers, please contact us at privacy@hapstack.com.

We collect information through the Product when you:

• Start the process of creating a Hapstack Account
• Open a Hapstack Account
• Sign-in to or access your Hapstack Account
• Browse the Platform
• Make a purchase
• Make changes to your Hapstack Account
• Use integrations to connect your Hapstack Account to third party services
• Install and log in to the Hapstack Browser extension

The categories of information you provide to us through the Product include:

• Contact Data
• Company Data, including the information listed in Section 2A as well as any information you submit to us about your company when you use your Hapstack Account
• Account Credentials, including your password and information for authentication and account access
• SaaS Usage Data, including the SaaS products you use and how frequently you access them

If you do not provide the required information, or if the information you provide is inaccurate, out-of-date, or cannot be verified, we may not allow you to use our Product.

When you use our Platform, we automatically collect Service Use Data, Device Data, and Location Data using the tracking technologies listed in Section 2A above.

C. Information collected from other sources

We may also collect information from other sources. These sources may include:

• Financial partners, card network partners, merchants, payment processors and card issuing partners in connection with your use of the Product
• Third party integrations, such account services, transactional information providers, and other integrations that you connect to your Hapstack account
• Social networks and other locations that serve or assist in serving our advertisements
• Publicly available sources, including information in the public domain

We always comply with any laws or contractual obligations applicable to us when collecting information from these sources. If we are allowed to use this information for our own purposes, we will handle it according to the practices described in this Privacy Policy.

3. How we use information

We collect and use your information for business and commercial purposes as described in this Privacy Policy. We use your information for the following purposes:

1. Providing Services: We use your information to operate and manage our Service and Product, including providing the Website, determining eligibility for the Product, allowing you to use the Card and access the Platform, and providing services requested by you and our business customers.
2. Important Communications with You: We use your information to send you technical notices, updates, security alerts, information regarding changes to our policies, and support administrative messages.
3. Understanding Usage and Improving our Services and Products: We use your information to understand how our business customers use the Service and Product, and improve our services and products. For example, we may use your information to provide you with recommendations on how to lower your spending and inefficiency. We may also improve usability of the Service and Product by analyzing how you interact with our Service and Product.
4. Auditing and Research: We use your information to conduct internal reporting, auditing, and research, including focus groups and surveys.
5. Marketing and Advertising: We may use your information to develop and send advertising, direct marketing, and communications about our products, offers, promotions, rewards, events, and services. You may opt out of this communication at any time.
6. At your Direction: We use your information to fulfill any other purpose at your direction. For example, if you send us a photo of your receipt through text message, we will process that receipt to provide the Product to you. Also, if you direct us to connect your Hapstack Account to a third-party integration, we will process that request accordingly.
7. With Notice to You and Your Consent: We may otherwise use your information after providing notice to you and obtaining your consent.

However, there are cases where we may use information that cannot be linked back to you (such as aggregated or de-identified information) for any purpose, as long as it is not prohibited by applicable laws or contractual obligations. If you want to learn more about your rights and choices regarding how we use information about you, please refer to the "Your Rights and Choices" section below.

4. Sharing information

Hapstack shares information collected from users with various third party providers that allow us to operate our Service. Please refer to our Privacy for Humans for more details about our third party providers. Information may also be shared in the event of a merger or acquisition, compelled disclosure, or with notice and consent from the user.

Hapstack may also share information that does not identify individual users for any purpose, except as prohibited by law or contractual obligation. Users have rights and choices regarding how their information is shared, which can be found in the "Your Rights and Choices" section of this policy.

5. Other parties

The Service and Product offered by Hapstack may include links or integrations with third-party websites, platforms, and services that are not operated or controlled by Hapstack. This may include log-in integrations with other services such as Google, social media content, and platform linking to retrieve certain information about your account on another service.

If you choose to engage with these integrations, Hapstack may receive information from the other service that you have authorized to share with us. However, please note that the other service may independently collect information about you through the integration.

When you interact with third parties through our Service or leave our Service, those parties may collect and store information about you according to their own policies and practices, including whether they store information in the U.S. or elsewhere. We encourage you to review and consult their privacy policies and terms of use.

Our Service's use and transfer to any other app of information received from Google APIs will adhere to Google API Services User Data Policy, including the Limited Use requirements.

6. Data transfer

Our Service and Product are operated from and directed toward business customers with a presence in the United States. If you are accessing the Service or Product from outside the United States, please note that you are transferring your personal information to the United States and other jurisdictions which may not have the same data protection laws as your country of residence. We take appropriate measures to ensure that any such transfers comply with applicable data protection laws and regulations, and we have implemented safeguards to ensure that your information is protected in accordance with this Privacy Policy.

If you have any questions or concerns about the transfer of your information, please contact us using the contact information provided in the "Contact us" section of this policy.

7. Additional important information

Security. We use organizational, technical, and administrative measures designed to protect information about you from loss, theft, misuse, and unauthorized access, disclosure, alteration and destruction. However, no information security program or transfer via the internet is entirely secure and we cannot guarantee the security of information about you.

Use by Minors: We don't provide our services to children and don't knowingly collect personal information from children under 13. We also don't sell personal information of minors under 16 who are California residents. If you're a parent or guardian and believe we've violated this provision, please contact us at privacy@hapstack.com.

Change to this Privacy Policy. We reserve the right to update this policy at any time by posting an updated version. If we have a business relationship with you, we may also provide notice through our Website or your Hapstack Account. If you're only visiting our Website, we'll post any updates on our Website. Any changes are effective upon posting or when we provide notice to you. Your continued use of our Service or Product indicates your acceptance of the updated Privacy Policy.

8. Your rights and choices

Accessing your Hapstack Account. Your Hapstack Account is governed by our agreements with the applicable business customer. You can access, update, or delete certain information within your account through the Platform, but the business customer will make the ultimate decision about how your information is processed. The business customer administrator manages your account and can grant or restrict your access to the Product, as well as access information about you on the Product. Please note that if you delete information through your Hapstack Account, we will retain and use information about you as necessary to comply with our legal obligations, resolve disputes, and enforce our agreements.

Tracking technology choices

Cookies and pixels. Most browsers accept cookies by default. You can instruct your browser, by changing its settings, to decline or delete cookies. If you use multiple browsers on your device, you will need to instruct each browser separately. Your ability to limit cookies is subject to your browser settings and limitations.

Do Not Track. Your browser settings may allow you to automatically transmit a "Do Not Track" signal to online services you visit. Note, however, there is no industry consensus as to what site and app operators should do with regard to these signals. Accordingly, unless and until the law is interpreted to require us to do so, we do not monitor or take action with respect to "Do Not Track" signals. For more information on "Do Not Track," visit http://www.allaboutdnt.com.

Please be aware that if you disable or remove tracking technologies some parts of the Service and Product may not function correctly.

If you opt out using any of these methods, the opt out will only apply to the specific browser or device from which you opt out. We are not responsible for the effectiveness of, or compliance with, any opt out options or programs, or the accuracy of any other entities' statements regarding their opt out options or programs.

Communications

You can opt-out of receiving promotional emails from us at any time by following the instructions as provided in emails to click on the unsubscribe link or changing your email preferences in the Hapstack Web Application. Please note that you cannot opt-out of non-promotional emails, such as those about your Hapstack Account, transactions, servicing, or our ongoing business relations.

Please note that your opt out is limited to the email address used and will not affect subsequent subscriptions.

Unlinking platforms

If you have linked your Hapstack Account with certain other services, such as Slack or Google Workspace, you may unlink your accounts at any time by visiting your Hapstack Account settings. Please note that unlinking your accounts will not affect any information previously shared through the linking. Hapstack is not responsible for the data practices of any other entities, and we recommend that you carefully review their privacy policies and terms of use. If you log in to the Service with Google, you can also manage third-party apps and services with access to your Google account by following the instructions in this article.

9. Contact us

If you have any questions about this Privacy Policy, our data practices, or our compliance with applicable law, please contact us at privacy@hapstack.com.

If you experience any difficulties accessing the information in this Privacy Policy, please contact us at privacy@hapstack.com.

10. Additional disclosures for Nevada residents

Nevada law (NRS 603A.340) requires each business to establish a designated request address where Nevada consumers may submit requests directing the business not to sell certain kinds of personal information that the business has collected or will collect about the consumer. A sale under Nevada law is the exchange of personal information for monetary consideration by the business to a third party for the third party to license or sell the personal information to other third parties. If you are a Nevada consumer and wish to submit a request relating to our compliance with Nevada law, please contact us at privacy@hapstack.com.

11. Additional disclosures for California residents

These additional disclosures apply only to California residents and only to the extent applicable.

Our Service and Product are primarily intended to provide information and services to job applicants and business customers. You understand and agree that personal information collected about you is solely within the context of (i) your role as an employee, authorized user, job applicant, owner, director, officer, or contractor or (ii) Hapstack conducting due diligence regarding, or providing or receiving a product or service to or from your employer.

We acknowledge that you may have rights under the CCPA in connection with the personal information we process on behalf of our business customers. If personal information about you has been processed by us as a service provider on behalf of a business customer and you wish to exercise any rights you have with such personal information, please inquire with our business customer directly. If you wish to make your request directly to us, please provide the name of our business customer on whose behalf we processed your personal information. We will refer your request to that business customer, and will support them to the extent required by applicable law in responding to your request.

Notice of collection

The California Consumer Privacy Act of 2018 ("CCPA") provides additional rights and requires businesses collecting or disclosing personal information to provide notices and means to exercise rights. In the past 12 months, we have collected the following categories of personal information enumerated in the CCPA:

• Identifiers, including name, postal address, email address, and online identifiers (such as IP address).
• Customer records, including phone number.
• Commercial or transactions information, including records of products or services purchased, obtained, or considered.
• Internet activity, including interactions with a website, email, application, or advertisement.
• Geolocation data.
• SaaS usage data, including the SaaS products you use and how frequently you access them.

For further details on information we collect, including the sources from which we receive information, review the "Information that Hapstack collects" section above. We collect and use these categories of personal information for the business purposes described in the "How we use information" section above.

Right to know and delete

You have the right to know certain details about our data practices in the past 12 months. In particular, you may request the following from us:

• The categories of personal information we have collected about you;
• The categories of sources from which the personal information was collected;
• The categories of personal information about you we disclosed for a business purpose or sold;
• The categories of third parties to whom the personal information was disclosed for a business purpose or sold;
• The business or commercial purpose for collecting or selling the personal information; and
• The specific pieces of personal information we have collected about you.

In addition, you have the right to delete the personal information we have collected from you.

To exercise any of these rights, please submit a request by sending an email to privacy@hapstack.com with "CCPA Request" in the subject line and specify which right you are seeking to exercise and the scope of the request. We will confirm receipt of your request within 10 days. If personal information about you has been processed by us as a service provider on behalf of a business customer, we will follow the procedure set out above. We may require specific information from you to help us verify your identity and process your request. If we are unable to verify your identity, we may deny your requests to know or delete.

Authorized agent

You can designate an authorized agent to submit requests on your behalf. However, we will require signed proof of the agent's permission to do so and verify your identity directly.

Right to non-discrimination

You have the right not to receive discriminatory treatment by us for the exercise of any your rights.

Shine the Light

Customers who are residents of California may request (i) a list of the categories of personal information disclosed by us to third parties during the immediately preceding calendar year for those third parties' own direct marketing purposes; and (ii) a list of the categories of third parties to whom we disclosed such information. To exercise a request, please write us at privacy@hapstack.com or the postal address set out in "Contact us" above and specify that you are making a "California Shine the Light Request." We may require additional information from you to allow us to verify your identity and are only required to respond to requests once during any calendar year.