Xpertly.ai, Inc., a Delaware corporation doing business as Rocksalt (“Rocksalt,” “Company,” “we,” “our,” or “us”), respects your privacy and is committed to protecting personal information in accordance with this Privacy Policy.

This Privacy Policy describes how we collect, use, disclose, and otherwise process personal information when you visit our websites, use our applications, software, products, and services, communicate with us, or otherwise interact with Rocksalt (collectively, the “Services”).

1. Scope of This Privacy Policy

This Privacy Policy applies to personal information Rocksalt collects or processes when you:

• visit Rocksalt websites, including rocksalt.ai;
• create or use a Rocksalt account;
• use Rocksalt applications, software, or other Services;
• communicate with Rocksalt by email, text, forms, or other means;
• participate in a demonstration, pilot, survey, event, or other Rocksalt activity;
• interact with Rocksalt advertising or marketing; or
• otherwise interact directly with Rocksalt.

Customer Data

Rocksalt also processes information submitted to the Services by or on behalf of our business customers (“Customer Data”). Customer Data may include documents, content, sales or customer conversation transcripts, subject-matter expert input, and other information provided by a customer.

When Rocksalt processes personal information contained in Customer Data on behalf of a business customer, that customer generally determines why and how the information is processed, and Rocksalt processes it on the customer's behalf in accordance with our agreement with that customer.

If your personal information was submitted to Rocksalt by one of our customers—for example, because your information appears in a customer-provided sales transcript—you should generally direct questions or requests concerning that information to the relevant customer. We will assist our customers with such requests as required by applicable law and our agreements with them.

Our handling of Customer Data is also governed by our Terms of Service and any applicable Service Agreement or Data Processing Addendum.

2. Personal Information We Collect

The personal information we collect depends on how you interact with Rocksalt.

Information You Provide to Us

We may collect information you provide directly to us, including:

• name;
• email address;
• telephone number;
• company name;
• job title and professional information;
• account credentials;
• information submitted through forms;
• communications with us;
• responses to surveys;
• information you provide when requesting support;
• billing and transaction information; and
• content or other information you submit through the Services.

If you use Rocksalt on behalf of an organization, we may also collect information relating to your role and relationship with that organization.

Customer Data

Customers and Authorized Users may submit information to Rocksalt in connection with their use of the Services.

Depending on how a customer uses Rocksalt, Customer Data may include:

• documents and marketing content;
• sales, pre-sales, support, webinar, or customer conversation transcripts;
• questions, comments, and statements made during those conversations;
• names, job titles, company affiliations, and other professional information;
• subject-matter expert contributions;
• customer or prospect information;
• content libraries and other business materials; and
• other information the customer chooses to provide.

Rocksalt processes Customer Data as described in our Terms of Service, applicable Service Agreements, and, where applicable, a Data Processing Addendum.

Information Collected Automatically

When you access or use our websites or Services, we may automatically collect certain information, including:

• IP address;
• browser type;
• operating system;
• device information;
• pages or features viewed;
• dates and times of access;
• referring pages;
• interactions with the Services;
• log information; and
• approximate location derived from IP address.

We may collect this information using cookies, web beacons, pixels, log files, and similar technologies.

3. Information From Third Parties

We may receive information from third parties, including:

• service providers;
• business partners;
• analytics providers;
• social networks and online communities;
• publicly available sources;
• third-party integrations authorized by customers; and
• other services with which Rocksalt interacts in providing the Services.

For example, certain Rocksalt features analyze publicly available discussions, content, or information from third-party platforms in order to identify buyer questions, topics, or trends.

The collection and use of information by third-party platforms is governed by those platforms' own terms and privacy policies.

4. How We Use Personal Information

We may use personal information to:

• provide, operate, maintain, and support the Services;
• create and manage accounts;
• authenticate users;
• provide requested products, services, or information;
• process transactions and payments;
• communicate with customers and users;
• provide customer support;
• analyze use and performance of the Services;
• maintain and improve the functionality, reliability, and security of the Services;
• personalize aspects of the Services;
• develop new features and functionality;
• detect, investigate, and prevent fraud, abuse, security incidents, and other harmful activity;
• comply with legal obligations;
• enforce our agreements and protect our legal rights;
• send service-related communications;
• send marketing communications where permitted by law; and
• fulfill other purposes disclosed when information is collected or with your consent.

Use of Customer Data and AI

Rocksalt may use artificial intelligence and machine-learning technologies to provide features of the Services, including analyzing content, identifying questions and themes, generating analyses, and assisting with content creation.

Rocksalt uses Customer Data only as permitted by our agreement with the applicable customer.

Rocksalt does not sell Customer Data or use one customer's Customer Data to provide services or deliverables to another customer.

Rocksalt does not use Customer Data to train general-purpose artificial intelligence or machine-learning models for the benefit of other customers unless the applicable customer expressly agrees otherwise in writing.

We may use aggregated or de-identified information derived from use of the Services to operate, analyze, and improve the Services, provided that such information does not identify a customer, user, or individual and cannot reasonably be used to reconstruct a customer's confidential information.

5. How We Disclose Personal Information

We may disclose personal information in the following circumstances.

Service Providers

We may disclose information to vendors and service providers that perform services on our behalf, including providers of:

• cloud hosting and infrastructure;
• artificial intelligence and machine-learning services;
• analytics;
• communications;
• customer support;
• payment processing;
• security; and
• other technology and operational services.

These providers may process information only as necessary to provide services to Rocksalt and subject to applicable contractual obligations.

Business Transfers

We may disclose or transfer personal information in connection with an actual or proposed merger, acquisition, financing, reorganization, sale of assets, bankruptcy, or similar corporate transaction.

Legal Requirements and Protection of Rights

We may disclose personal information if we reasonably believe disclosure is necessary to:

• comply with applicable law, regulation, legal process, or governmental request;
• enforce our agreements;
• detect, investigate, or prevent fraud or security issues;
• protect the rights, property, or safety of Rocksalt, our customers, users, or others; or
• establish, exercise, or defend legal claims.

With Your Direction or Consent

We may disclose information when you direct us to do so or otherwise provide consent.

6. We Do Not Sell Personal Information

Rocksalt does not sell Customer Data.

Rocksalt does not sell personal information for monetary consideration.

To the extent our use of advertising or analytics technologies is considered “selling,” “sharing,” or “targeted advertising” under an applicable U.S. state privacy law, individuals may have the right to opt out as described below.

7. Cookies and Similar Technologies

We and our service providers may use cookies, pixels, web beacons, and similar technologies to operate our websites and Services, understand how they are used, remember preferences, improve functionality, and measure marketing effectiveness.

You can configure your browser to refuse or delete certain cookies. Some features of the Services may not function properly if cookies are disabled.

Where required by applicable law, we will provide additional choices or obtain consent for particular uses of cookies or similar technologies.

8. Data Retention

We retain personal information for as long as reasonably necessary for the purposes for which it was collected, including to provide the Services, comply with legal obligations, resolve disputes, and enforce agreements.

Retention of Customer Data may be governed by the applicable agreement with the customer.

Upon expiration or termination of Services, Customer Data may be deleted in accordance with our Terms of Service, applicable Service Agreement, or Data Processing Addendum.

Certain Service Agreements, including pilot or design-partner agreements, may provide for shorter retention periods or deletion of Customer Data at completion of the engagement.

We may retain information where required by law or where reasonably necessary to establish, exercise, or defend legal claims.

9. Data Security

We maintain reasonable administrative, technical, and organizational safeguards designed to protect personal information against unauthorized access, use, alteration, disclosure, or destruction.

These safeguards may include access controls, encryption, infrastructure security, authentication, monitoring, and other measures appropriate to the nature of the information being processed.

No method of transmission over the internet or method of electronic storage is completely secure. Accordingly, we cannot guarantee absolute security.

Users are responsible for maintaining the confidentiality of their account credentials and should promptly notify Rocksalt if they believe their account has been compromised.

10. International Data Transfers

Rocksalt is based in the United States, and we and our service providers may process information in the United States and other countries.

These countries may have data-protection laws that differ from those in your country of residence.

Where required by applicable law, Rocksalt will use appropriate safeguards for transfers of personal information across jurisdictions.

Where Rocksalt processes personal information on behalf of a customer, applicable international data-transfer requirements may also be addressed through a Data Processing Addendum or other agreement with that customer.

11. Your Privacy Rights

Depending on where you live and subject to applicable law, you may have rights regarding your personal information, including the right to:

• request access to personal information we hold about you;
• request correction of inaccurate personal information;
• request deletion of personal information;
• obtain a copy of certain personal information;
• object to or restrict certain processing;
• withdraw consent where processing is based on consent; and
• opt out of certain sales, sharing, targeted advertising, or profiling where applicable.

You may submit a privacy request by contacting legal@rocksalt.ai.

We may need to verify your identity before fulfilling a request.

You may also have the right to appeal our response to a privacy request where required by applicable state law. Instructions for submitting an appeal will be included in our response where applicable.

We will not discriminate against you for exercising privacy rights provided by applicable law.

Information Controlled by a Rocksalt Customer

If your request concerns personal information contained in Customer Data that Rocksalt processes on behalf of one of our business customers, please submit your request directly to that customer.

If appropriate, Rocksalt will assist the customer in responding to your request.

12. California Privacy Rights

California residents may have additional rights under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (“CCPA”).

Subject to applicable exceptions, these may include rights to:

• know the categories and specific pieces of personal information collected about you;
• know the categories of sources from which personal information is collected;
• know the purposes for collecting, using, or disclosing personal information;
• know the categories of third parties to whom personal information is disclosed;
• request deletion of certain personal information;
• request correction of inaccurate personal information;
• obtain information regarding the sale or sharing of personal information;
• opt out of the sale or sharing of personal information; and
• limit certain uses or disclosures of sensitive personal information where applicable.

Rocksalt does not sell Customer Data or personal information for monetary consideration.

You may exercise applicable California privacy rights by contacting legal@rocksalt.ai.

Where Rocksalt processes personal information on behalf of a business customer as a service provider or contractor, the applicable customer is generally responsible for responding to consumer requests relating to that Customer Data.

13. Additional Information for EEA and UK Residents

This section applies if you are located in the European Economic Area (EEA) or the United Kingdom.

Controller and processor roles. Rocksalt is the controller of personal information it collects through its websites, accounts, and business communications. When Rocksalt processes Customer Data on behalf of a business customer, Rocksalt acts as a processor, and the customer is the controller.

Legal bases for processing. We process personal information on the following legal bases:

Contract: to create and manage accounts, provide the Services, and process payments.

Legitimate interests: to operate, secure, analyze, and improve the Services; to analyze publicly available discussions to identify buyer questions and trends; to communicate with business contacts; and to prevent fraud and misuse. We process data on this basis only where our interests are not overridden by your rights and interests.

Consent: for non-essential cookies and, where required by law, for marketing communications. You may withdraw consent at any time.

Legal obligation: to comply with applicable laws.

Your rights. Subject to applicable law, you have the right to access, correct, or delete your personal information; to restrict or object to its processing, including processing based on legitimate interests; to data portability; and to withdraw consent at any time. To exercise these rights, contact legal@rocksalt.ai.

International transfers. Rocksalt is based in the United States. Where we transfer personal information from the EEA or UK to countries without an adequacy decision, we rely on appropriate safeguards, such as the European Commission's Standard Contractual Clauses or the UK International Data Transfer Addendum.

Complaints. You have the right to lodge a complaint with the data protection authority in your country of residence. In the UK, this is the Information Commissioner's Office (ico.org.uk).13. Additional Information for EEA and UK Residents

14. Marketing Communications

You may opt out of promotional email communications from Rocksalt by using the unsubscribe link included in those emails or by contacting us.

Even if you opt out of promotional communications, we may continue sending non-promotional communications relating to your account, transactions, security, or use of the Services.

15. Children’s Privacy

The Services are intended for businesses and professionals and are not directed to children under 18.

We do not knowingly collect personal information directly from children under 18 through the Services.

If you believe a child has provided personal information directly to Rocksalt, please contact legal@rocksalt.ai.

16. Third-Party Websites and Services

The Services may contain links to or integrate with third-party websites, applications, social networks, AI providers, and other services.

Rocksalt does not control the privacy practices of those third parties. Information you provide directly to a third party is governed by that third party's privacy policy and terms.

We encourage you to review the privacy policies of third-party services you use.

17. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, Services, legal requirements, or other factors.

When we update this Privacy Policy, we will revise the “Last modified” date at the top of this page.

If we make material changes, we will provide additional notice where required by applicable law, such as by posting a notice on our website or notifying affected users by email.

18. Contact Information

If you have questions about this Privacy Policy, our privacy practices, or wish to exercise applicable privacy rights, contact us at:

Xpertly.ai, Inc. d/b/a Rocksalt
303 Twin Dolphin Drive
Redwood City, CA 94065
legal@rocksalt.ai