HQ Privacy Policy

This Privacy Policy explains how REACH Projects, Inc., a Delaware corporation headquartered at 861 Corriente Pointe Drive, Redwood City, California 94065 (“REACH,” “we,” “us,” or “our”), collects, uses, discloses, retains, and otherwise processes personal information in connection with HQ.

“HQ” means REACH’s videoconferencing, online-office, collaboration, recording, transcription, note-taking, scheduling, webinar, messaging, whiteboard, task, board, AI-answer, and related services, including associated websites, applications, software, features, communications, and support services.

This Privacy Policy should be read together with the HQ Terms of Service and any order form, enterprise agreement, data processing agreement, consent notice, or other terms that apply to your use of HQ.

For purposes of this Privacy Policy, “personal information” or “personal data” means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with an identified or identifiable person or household, as defined by applicable law. It does not include information excluded from applicable privacy-law definitions, such as lawfully de-identified or aggregated information, although we describe our handling of such information below for transparency. References to “processing” include collecting, recording, organizing, structuring, storing, adapting, retrieving, consulting, using, analyzing, disclosing, transmitting, combining, restricting, deleting, or otherwise handling information.

1. Scope

This Privacy Policy applies to personal information that REACH processes in connection with:

• HQ accounts, profiles, workspaces, meetings, and events;
• HQ websites, applications, and related online services;
• Recordings, transcriptions, summaries, notes, and AI-enabled features;
• Messaging, files, whiteboards, tasks, boards, bookings, and webinars;
• Integrations with calendars, cloud storage, identity providers, and other third-party services;
• Sales, billing, support, research, testing, and business communications; and
• Guests, participants, invitees, prospective customers, and other people whose information is submitted to or processed through HQ.

This Privacy Policy does not govern third-party products, services, websites, or integrations that maintain their own privacy policies. An organization using HQ may also have its own privacy policies and legal obligations. If you participate in an organization’s HQ workspace, that organization may separately determine how your information is collected, used, shared, retained, or deleted.

This Privacy Policy also does not apply to information processed solely in an employment or independent-contractor relationship with REACH where a separate workforce notice applies. Third-party services may collect information directly from you, combine it with other information, or process it under terms and settings that REACH does not control. You should review the privacy notices and permissions of the relevant organization and third party before using an integration or following an external link.

2. Our Roles

The role REACH has under privacy law depends on the circumstances.

REACH as a controller or business

REACH may determine the purposes and means of processing personal information relating to:

• Account creation and administration;
• HQ websites and direct communications;
• Product analytics, security, fraud prevention, and billing;
• Product research, development, evaluation, and improvement;
• REACH’s permitted use of Customer Content and derived information;
• Marketing and prospective-customer relationships; and
• Compliance with law and enforcement of our agreements.

In these circumstances, REACH may be considered a “controller,” “business,” or similar regulated entity. REACH may act in different roles for different data elements or activities within the same relationship. For example, we may process meeting content on a customer’s instructions while independently determining how to process account, transaction, diagnostic, security, abuse-prevention, and service-improvement information for our own legitimate purposes, subject to law and contract. Nothing in this Privacy Policy changes a role allocation stated in an applicable written agreement.

REACH as a processor or service provider

When an organization uses HQ to process personal information under its direction, REACH may act as that organization’s “processor,” “service provider,” “contractor,” or equivalent. The organization may be responsible for determining the legal basis for processing, providing required notices, obtaining required consents, and responding to individual privacy requests. In that role, we may process information on documented instructions, including as necessary to provide, secure, support, maintain, and improve contracted services; use subprocessors; comply with law; and perform activities permitted by the agreement and applicable law. The customer remains responsible for the lawfulness of its instructions, configuration, users, submitted content, and participant notices and consents.

If your information was submitted through an organization’s HQ workspace, we may refer your request to that organization or ask you to contact it directly.

Workspace owners and administrators

Workspace owners, administrators, meeting hosts, and authorized users may control:

• Workspace membership and account permissions;
• Whether and how meetings are recorded or transcribed;
• Access to recordings, transcripts, summaries, messages, files, and other content;
• Retention, sharing, download, export, and public-link settings;
• Integrations and connected accounts; and
• Features, settings, and data-use options made available under the applicable plan or agreement. Depending on configuration and law, workspace owners and administrators may access, monitor, export, modify, disclose, restrict, suspend, recover, transfer, or delete accounts and content; view usage, audit, security, and activity information; manage domains and identity settings; and enable features that affect processing. An organization-managed account generally is not a private personal account and may remain under the organization’s control after a user leaves.

You should direct questions about an organization’s practices to that organization.

3. Information We Collect

The information we collect depends on how you interact with HQ, the features you use, your organization’s settings, the permissions you provide, and the choices made by workspace owners, administrators, hosts, and other users. We may collect information directly from you; automatically from devices, browsers, and use of HQ; from customers, users, participants, connected services, integrations, vendors, business partners, and identity providers; and from public or commercially available sources. Certain information is necessary to create or administer an account, deliver a requested feature, process a transaction, provide support, or comply with law. If required information is not provided, the relevant account, feature, or service may not be available.

3.1 Account, profile, and authentication information

We may collect:

• Name, username, email address, telephone number, photograph, avatar, job title, department, organization, and profile details;
• Account identifiers, workspace membership, role, permissions, and account preferences;
• Password-related information, passkey information, authentication tokens, single sign-on identifiers, multifactor-authentication details, and sign-in records;
• Time zone, language, working hours, availability, presence, office status, and communication preferences; and
• Information used to verify identity, authority, account ownership, or eligibility.

We generally do not receive a readable copy of passwords where passwords are processed through appropriate authentication mechanisms.

3.2 Workspace and organizational information

We may collect:

• Workspace name, domain, branding, configuration, plan, and settings;
• Workspace owners, administrators, members, guests, teams, groups, and organizational relationships;
• Invitations, membership requests, provisioning information, access controls, and audit events;
• Information supplied through an employer, organization, administrator, or identity provider; and
• Workspace usage, feature adoption, seat assignments, and subscription information.

3.3 Meeting, participant, and guest information

We may collect:

• Meeting titles, descriptions, identifiers, links, rooms, dates, times, durations, recurrence, and scheduling details;
• Host, organizer, participant, invitee, and guest identities;
• Attendance, join and leave times, waiting-room activity, reactions, status, hand raises, and participation information;
• Display names, profile images, background selections, and other information shown during meetings;
• Meeting chat, questions, polls, responses, captions, and submitted materials;
• Information entered on booking, registration, webinar, consent, or guest-join forms; and
• Information provided by a host, administrator, organizer, participant, invitee, or other user about another person.

3.4 Audio, video, voice, recordings, and transcripts

Depending on the features and settings used, we may process:

• Live audio and video streams;
• Meeting, webinar, screen-share, presentation, or room recordings;
• Voice, image, likeness, speech, screen activity, and audiovisual surroundings captured during a session;
• Captions, transcripts, speaker labels, diarization, timestamps, and language information;
• Notes, recaps, action items, summaries, highlights, keywords, topics, and searchable meeting information;
• Technical features derived from audio or video to provide, secure, evaluate, or improve HQ; and
• Information inferred from recordings, transcripts, participation, and meeting context.

HQ may process voice or image data that could be considered sensitive or biometric information under some laws. The legal classification depends on the data, feature, purpose, and jurisdiction; ordinary audio or video is not necessarily regulated biometric information. Unless we expressly state otherwise for a specific feature, HQ is not designed to identify individuals through biometric identity matching. If a feature creates or uses regulated biometric identifiers or templates, REACH will provide any additional notices, choices, retention disclosures, or consent mechanisms required by applicable law. Customers, hosts, and users must not use HQ to collect or process biometric or other sensitive information unless they have a lawful basis and have satisfied all notice, consent, authorization, and deletion obligations that apply to them.

3.5 Communications and collaboration content

We may process content submitted to, transmitted through, created with, or stored in HQ, including:

• Messages, comments, replies, reactions, announcements, and channels;
• Documents, images, links, attachments, uploads, and other files;
• Whiteboards, drawings, annotations, diagrams, and presentations;
• Tasks, assignments, due dates, status information, projects, and boards;
• Notes, agendas, templates, forms, polls, surveys, and responses;
• Booking pages, availability, appointments, registration information, and webinar submissions;
• Feedback, feature requests, reviews, survey responses, and support correspondence; and
• Associated metadata, permissions, access history, revision history, and sharing settings.

3.6 AI inputs, outputs, and interactions

We may collect and process:

• Prompts, queries, commands, instructions, and uploaded reference materials;
• Information retrieved from content you are authorized to access;
• AI-generated answers, transcripts, notes, summaries, suggestions, classifications, and recommendations;
• User edits, ratings, corrections, selections, rejections, and other feedback;
• Context supplied to or retrieved by an AI-enabled feature;
• Model, feature, evaluation, and performance information; and
• Inferences, embeddings, representations, labels, annotations, and other information derived from AI interactions.

AI-generated content may be inaccurate, incomplete, outdated, misleading, biased, or inappropriate and should be independently reviewed before being relied upon or shared. Outputs may reproduce information from inputs, connected content, or other context; may not be unique; and may be similar to outputs provided to other users. Users are responsible for evaluating the accuracy, suitability, lawfulness, and consequences of prompts, retrieved content, outputs, and decisions made using AI-enabled features, including before using outputs for employment, housing, credit, education, health, legal, financial, or other consequential purposes.

3.7 Calendar, contact, and integration information

If you connect HQ to another service, we may receive or process information permitted by your settings and the third party’s authorization process, such as:

• Calendar events, participants, availability, titles, descriptions, links, and attachments;
• Contact names, email addresses, organization information, and address-book entries;
• Cloud-storage files, folders, permissions, and metadata;
• Identity-provider attributes and directory information;
• Communications, notifications, or workflow information from connected services; and
• Authentication tokens, authorization scopes, and connection status.

We use integration credentials and information to authenticate connections, synchronize or retrieve authorized information, operate and troubleshoot the requested integration, maintain continuity, prevent abuse, and for other purposes permitted by this Privacy Policy, applicable agreements, and law. An integration may continue to exchange information until it is disconnected, its authorization expires or is revoked, or the applicable service stops access. Disconnecting an integration may prevent new collection but may not delete information previously imported, copied, transformed, or included in HQ content, logs, backups, or derived information. Third-party services may independently process information under their own terms and privacy policies, and REACH is not responsible for their practices.

3.8 Device, network, usage, diagnostic, and security information

We may automatically collect the categories below when you visit, access, or use HQ, open or interact with our communications, or allow HQ to run in the foreground or background. Collection may occur through server logs, cookies, local storage, pixels, tags, software development kits, application programming interfaces, device permissions, and similar technologies:

• IP address, approximate location derived from IP address, device type, device identifiers, operating system, browser, language, and application version;
• Network type, connection quality, latency, bandwidth, media statistics, crash data, and performance information;
• Pages, screens, rooms, meetings, links, features, buttons, and content accessed or interacted with;
• Dates, times, duration, referral information, navigation paths, and session activity;
• Cookies, local storage, software-development-kit identifiers, advertising identifiers, pixels, and similar technology data;
• Log files, authentication events, permission changes, administrative activity, and audit records;
• Error reports, debugging information, system events, and diagnostic data; and
• Signals used to detect spam, fraud, abuse, unauthorized access, malware, security incidents, or violations of our agreements.

3.9 Payment and transaction information

We and our payment, invoicing, and financial service providers may collect:

• Billing name, address, email address, and contact details;
• Subscription, plan, seat, usage, invoice, and transaction information;
• Payment status, payment method type, limited payment-card details, and tax information;
• Purchase history, credits, discounts, refunds, and collection activity; and
• Information necessary to prevent fraud, process payments, or comply with financial and tax requirements.

Payment-card information may be collected directly by a payment processor rather than stored by REACH. Payment processors and financial institutions may independently determine how they process payment credentials, perform identity or fraud checks, comply with financial regulation, and retain transaction records. We may receive tokens, confirmation details, limited card information, account status, risk signals, and other information needed to administer purchases and subscriptions without receiving complete payment credentials.

3.10 Support, sales, and communications information

We may collect:

• Support requests, correspondence, screenshots, files, recordings, and troubleshooting information;
• Communications with sales, product, research, security, legal, and customer-success teams;
• Information supplied during demonstrations, onboarding, training, or testing;
• Marketing preferences, event attendance, campaign interactions, and referral information; and
• Call, email, and message metadata and, where permitted, recordings or transcripts of communications with REACH.

3.11 Inferred and derived information

We may infer or derive information from the information described above, including:

• Likely preferences, interests, relationships, roles, and usage patterns;
• Meeting topics, sentiment indicators, action items, decisions, and areas of interest;
• Workspace activity, engagement, feature adoption, and product needs;
• Fraud, spam, abuse, safety, and security risk indicators;
• Suggested contacts, tasks, content, workflows, and features; and
• Aggregated, de-identified, pseudonymized, statistical, or modeled information. Derived information may be generated through manual review, rules, statistical techniques, machine learning, or other automated methods. Where permitted by law and applicable agreements, we may use and retain derived, aggregated, de-identified, or pseudonymized information for any lawful purpose, including analytics, benchmarking, research, product development, security, model development and evaluation, dataset creation, and commercialization. We will treat information as personal information where applicable law requires, and we will not attempt to reidentify information that is maintained as de-identified except to test or validate de-identification, protect security, comply with law, or as otherwise permitted by law.

Inferences are probabilistic and may be incorrect, incomplete, or change over time. They may reflect patterns rather than verified facts and should not be understood as definitive statements about a person. We may correct, suppress, refresh, or discontinue an inference as our systems, information, or legal obligations change.

4. Sources of Information

We may obtain personal information from the sources below and may combine information received from different sources, collected at different times, or associated with different devices, browsers, accounts, workspaces, or identifiers. The availability and accuracy of source information may depend on the choices and representations of the person or organization providing it:

• You, when you create an account, communicate, participate in a meeting, upload content, use a feature, or contact us;
• Workspace owners and administrators, including through account provisioning, directory synchronization, permissions, and workspace settings;
• Meeting hosts, organizers, participants, and other users, including when they invite you, record or transcribe a session, mention you, upload information about you, or share content with you;
• Guests and invitees, including through registration, booking, webinar, and meeting-join forms;
• Connected services and integrations, such as identity, calendar, contact, communications, storage, workflow, and payment providers;
• Vendors and service providers, including hosting, security, analytics, support, payment, communications, research, and fraud-prevention providers;
• Business and commercial partners, including resellers, referral partners, event organizers, and prospective transaction counterparties;
• Publicly available and licensed sources, where permitted by law, including professional directories, company websites, public profiles, event lists, business contact databases, and information supplied by data, research, or marketing partners; and
• Automated technologies, including cookies, logs, analytics tools, software development kits, and similar technologies.

5. Cookies and Similar Technologies

We and parties acting on our behalf may use cookies, local storage, pixels, tags, software development kits, and similar technologies to:

• Authenticate users and maintain sessions;
• Remember settings, preferences, and workspace selections;
• Operate communications and media features;
• Measure performance, reliability, and feature usage;
• Understand how users navigate and interact with HQ;
• Diagnose errors and improve functionality;
• Prevent fraud, abuse, and unauthorized access;
• Measure communications and campaigns; and
• Support advertising or marketing where permitted.

Some technologies are strictly necessary to provide requested functionality, authenticate users, maintain security, balance traffic, remember privacy choices, or complete transactions. Other technologies may be functional, analytics, performance, personalization, advertising, or social-media technologies and may be subject to choices presented through a cookie banner, settings page, browser or device controls, or legally recognized opt-out preference signal. Where applicable law requires consent, we seek it before using nonessential technologies for the relevant purpose. Consent can be withdrawn through available controls without affecting the lawfulness of processing that occurred before withdrawal.

Disabling technologies may affect the availability, security, personalization, or operation of certain features. Browser-based controls may not affect technologies used within mobile or desktop applications, and settings may need to be applied separately for each browser, device, application, account, or domain. Clearing cookies or changing devices may reset choices. We may not respond to “Do Not Track” signals where no uniform legal standard applies, but we process legally recognized opt-out preference signals where required. Third parties may provide their own controls and may recognize signals differently.

6. How We Use Information

Subject to applicable law and applicable contractual restrictions, we may use personal information for the following purposes, alone or in combination. A particular item of information may support more than one purpose, and the examples below are illustrative rather than exhaustive. Where required, we will provide additional notice, obtain consent, offer a choice, or identify another lawful basis before materially different processing.

6.1 Providing and administering HQ

We may use information to:

• Create, authenticate, secure, and administer accounts and workspaces;
• Connect meetings, route audio and video, enable collaboration, and manage participation;
• Record, transcribe, caption, summarize, index, search, and analyze content;
• Provide messaging, files, whiteboards, tasks, boards, scheduling, webinars, and AI-enabled features;
• Synchronize integrations and perform user-requested actions;
• Display content to authorized users and recipients;
• Process payments, subscriptions, invoices, taxes, credits, and collections; and
• Provide onboarding, support, training, and customer-success services.

6.2 Personalization and recommendations

We may use information to:

• Remember preferences and settings;
• Customize interfaces, content, results, and workflows;
• Suggest meetings, contacts, tasks, features, content, or actions;
• Improve transcription, language, speaker separation, search, and AI responses; and
• Adapt HQ based on plan, role, organization, context, and prior use.

6.3 Analytics and business operations

We may use information to:

• Measure usage, engagement, performance, adoption, retention, and demand;
• Prepare reports, statistics, forecasts, and business intelligence;
• Understand customers and improve business operations;
• Determine eligibility, pricing, plans, capacity, and product strategy;
• Conduct research, surveys, experiments, and market analysis; and
• Create, combine, analyze, license, disclose, distribute, publish, commercialize, or otherwise use aggregated, de-identified, pseudonymized, statistical, synthetic, modeled, or derived information, subject to applicable law and contractual restrictions. Such information may support benchmarks, insights, reports, datasets, products, services, research, and commercial offerings. Pseudonymized information remains personal information where applicable law so provides, while information maintained as de-identified or aggregated may be used for any lawful purpose.

6.4 Development, testing, evaluation, and quality assurance

We may use information to:

• Design, develop, test, debug, evaluate, validate, and improve HQ and other REACH technologies;
• Review and assess feature, model, transcription, summarization, and system performance;
• Conduct quality assurance, benchmarking, annotation, labeling, error analysis, and human review;
• Develop, train, tune, adapt, test, evaluate, validate, and improve products, services, algorithms, models, datasets, taxonomies, tools, and commercial offerings, including through supervised, unsupervised, reinforcement, retrieval, ranking, classification, and other technical methods where lawfully permitted;
• Test changes, prototypes, experiments, and product configurations; and
• Maintain reliability, accessibility, interoperability, and performance.

Review may involve automated systems and, where appropriate, authorized personnel, contractors, researchers, evaluators, or service providers operating subject to applicable confidentiality, security, contractual, and legal obligations. Review may include sampling, annotation, red-teaming, quality scoring, comparison, correction, troubleshooting, investigation, and evaluation of inputs, outputs, recordings, transcripts, metadata, and derived information. We may use access controls, minimization, pseudonymization, de-identification, or other safeguards when appropriate, but no technique eliminates every risk.

6.5 Safety, security, and abuse prevention

We may use information to:

• Protect accounts, users, workspaces, systems, content, and REACH;
• Authenticate identities and verify permissions;
• Detect, investigate, prevent, and respond to fraud, spam, abuse, harassment, malware, unauthorized access, and security incidents;
• Enforce rate, usage, access, and product restrictions;
• Preserve evidence and maintain audit records; and
• Enforce the HQ Terms of Service and other agreements.

6.6 Communications

We may use information to:

• Send service, security, billing, account, and administrative communications;
• Respond to support and rights requests;
• Provide information about features, plans, offers, events, and services;
• Conduct surveys and request feedback; and
• Measure engagement with communications.

You may opt out of promotional email through the unsubscribe mechanism in the message. You may continue to receive non-promotional communications relating to your account, transactions, security, or use of HQ.

6.7 Legal, compliance, and corporate purposes

We may use information to:

• Comply with laws, regulations, legal processes, and governmental requests;
• Establish, exercise, investigate, or defend legal claims;
• Conduct audits and compliance reviews;
• Enforce contracts, policies, and legal rights;
• Protect the rights, safety, property, and integrity of users, third parties, REACH, and the public;
• Complete or evaluate a financing, investment, merger, acquisition, reorganization, sale, transfer, bankruptcy, or similar transaction; and
• Fulfill other purposes disclosed at collection or authorized by law.

7. AI, Model Training, Product Development, and Commercialization

7.1 Customer Content and derived information

“Customer Content” includes information and materials submitted to, transmitted through, generated with, displayed in, or stored using HQ. Depending on your use of HQ, Customer Content may include:

• Audio, video, voice, images, likenesses, and recordings;
• Transcripts, captions, speaker labels, notes, summaries, and action items;
• Prompts, instructions, AI inputs, AI outputs, edits, and feedback;
• Messages, comments, files, documents, attachments, and links;
• Whiteboards, tasks, boards, bookings, forms, surveys, and webinar content;
• Meeting, participant, workspace, usage, and content metadata; and
• Labels, annotations, embeddings, representations, inferences, and other information derived from the foregoing.

Subject to applicable law and applicable contractual terms, REACH may process Customer Content and derived information to:

• Operate, maintain, host, deliver, personalize, secure, and support HQ;
• Provide transcription, summarization, search, answers, recommendations, and other AI-enabled functionality;
• Analyze, troubleshoot, test, monitor, review, and evaluate HQ;
• Develop, train, fine-tune, retrain, adapt, benchmark, validate, and improve machine-learning systems, artificial-intelligence models, algorithms, datasets, and features;
• Conduct quality assurance, safety testing, red teaming, abuse detection, and error analysis;
• Develop and commercialize HQ and other REACH products, services, technologies, models, datasets, insights, and features; and
• Exercise rights and fulfill obligations under our agreements.

These activities may involve automated processing and appropriately authorized review by REACH personnel, contractors, vendors, or partners, including sampling, annotation, classification, comparison, correction, red teaming, safety testing, quality scoring, error analysis, and evaluation of inputs, outputs, recordings, transcripts, metadata, and derived information. Depending on the activity and risk, REACH may use access controls, confidentiality obligations, minimization, filtering, pseudonymization, de-identification, or other safeguards; however, no safeguard eliminates every privacy, confidentiality, or security risk.

7.2 Different plans, settings, and contractual terms

Data-use practices and choices may vary based on:

• The applicable HQ plan or product edition;
• Workspace, account, host, or administrator settings;
• Whether a feature is optional or separately enabled;
• An enterprise agreement, order form, data processing agreement, or other negotiated terms;
• The location of the customer, user, participant, or processing; and
• Consent, objection, opt-out, deletion, sensitive-data, biometric, recording, or other rights required by applicable law.

REACH may offer plans or contractual commitments under which particular categories of Customer Content are excluded from certain model-training, dataset-development, human-review, or commercialization activities. We do not represent that every plan has the same settings, exclusions, or data-use options.

Where applicable law requires consent, permits an objection or opt-out, or otherwise restricts a particular use, REACH will apply the legally required mechanism or restriction. A choice may apply only to the account, workspace, feature, browser, device, or processing activity through which it is exercised and generally operates prospectively. It may not require deletion of information lawfully processed before the choice, information REACH must retain, information another controller directs REACH to retain, or models, datasets, statistics, or derived materials that applicable law does not require us to alter or delete.

7.3 Aggregated, de-identified, pseudonymized, and derived data

To the maximum extent permitted by law, REACH may create and use aggregated, de-identified, pseudonymized, statistical, synthetic, modeled, and derived information for any lawful business purpose, including to:

• Analyze and improve products and business operations;
• Conduct research and measurement;
• Develop, train, evaluate, and commercialize models and datasets;
• Publish or provide statistics, benchmarks, and insights;
• License or provide datasets, models, insights, evaluations, or derived materials to third parties; and
• Develop and commercialize REACH products, services, technologies, and intellectual property.

REACH may retain and use information that is not personal information under applicable law without the limitations that apply to personal information.

De-identification reduces, but may not eliminate, the risk that information could be associated with a person, organization, or event. Context, distinctive statements, combinations of data, and information held by a recipient may create reidentification risks even after direct identifiers have been removed or replaced. REACH does not characterize identifiable or reasonably linkable information as anonymous.

Where required by law, REACH will maintain de-identified information in de-identified form, take reasonable measures designed to prevent reidentification, publicly commit not to attempt reidentification except as legally permitted for testing or compliance, and contractually restrict recipients from attempting reidentification.

7.4 Dataset, model, research, and commercial partners

Subject to applicable law and applicable contractual restrictions, REACH may disclose or provide aggregated, de-identified, pseudonymized, or derived information to:

• Model developers and technology providers;
• Dataset, evaluation, annotation, and research partners;
• Academic or commercial researchers;
• Product, analytics, and safety partners;
• Licensees and other commercial counterparties; and
• Customers of models, datasets, insights, benchmarks, or derived materials.

If information remains personal information under applicable law, REACH will apply legally required notices, agreements, safeguards, choices, and restrictions.

8. Recording, Transcription, and Participant Consent

HQ may enable a host, workspace, or authorized user to record, transcribe, caption, summarize, or analyze a meeting, webinar, call, or other session.

REACH may provide:

• On-screen recording or transcription indicators;
• Audible notifications;
• Pre-join or in-session notices;
• Consent or acknowledgment flows;
• Host or administrator controls; and
• Information about recording, transcription, AI, or data use.

The availability or presentation of these features may vary by product, plan, device, jurisdiction, and session configuration. An in-product notice, indicator, audible alert, or consent control does not necessarily satisfy every legal obligation applicable to a host or customer, including all-party consent, workplace monitoring, wiretap, call-recording, biometric, sector-specific, confidentiality, or cross-border requirements. Hosts and customers must evaluate the law applicable to every participant and location and must use additional notices or obtain separate consent when required.

Host and customer responsibilities

The customer, workspace owner, administrator, organizer, or host is responsible for:

• Determining whether recording, transcription, monitoring, or AI processing is lawful;
• Providing all notices required by law, contract, workplace policy, or professional obligation;
• Obtaining all required consents or authorizations before recording or processing participants;
• Respecting objections and stopping or disabling features when legally required;
• Configuring appropriate access, retention, and sharing settings;
• Ensuring that invited participants are authorized to disclose the information they submit; and
• Avoiding use of HQ in circumstances where required notices or consents cannot be obtained.

If you do not want to be recorded, transcribed, summarized, or analyzed, do not join or remain in a session after receiving notice, disable your audio or video where appropriate, and contact the host regarding alternatives. Where the law gives you a nonwaivable right to withhold or withdraw consent, object, or request deletion, you may exercise that right through the host, relevant organization, or REACH as appropriate. Leaving, muting, or turning off video may not remove information captured before the action, information supplied by others, or content already incorporated into a recording, transcript, summary, output, backup, audit record, or lawful derived dataset.

9. Sensitive and Restricted Information

HQ is a general-purpose business collaboration service and is not designed as a substitute for specialized systems subject to heightened regulatory requirements unless REACH has expressly agreed otherwise in writing. Customer Content may reveal sensitive information, including health, disability, genetic or biometric information, racial or ethnic origin, religious or philosophical beliefs, political opinions, union membership, sex life or sexual orientation, citizenship or immigration status, precise location, government identifiers, account credentials, financial information, communications content, information about children, or other legally protected characteristics. The sensitivity of information may depend on its context, use, inference, and jurisdiction.

Do not submit, record, upload, or otherwise process legally restricted or highly sensitive information unless:

1. You have authority and a valid legal basis to do so;
2. All required notices and consents have been provided or obtained;
3. The applicable HQ feature and plan expressly support the intended use; and
4. Any required agreement with REACH is in place.

Unless REACH expressly agrees otherwise in writing:

• HQ is not intended to process protected health information regulated by HIPAA, and REACH does not act as a HIPAA business associate unless it has signed an applicable Business Associate Agreement;
• HQ is not intended to store complete payment-card data or regulated financial-account credentials;
• HQ is not designed for government-classified, export-controlled, or national-security information;
• HQ is not intended for data whose processing requires specialized regulatory controls not expressly supported by REACH; and
• Users must not submit passwords, private keys, authentication secrets, or other credentials in Customer Content.

REACH may restrict, suspend, remove, or decline to support processing that presents legal, security, operational, or compliance risk.

10. How We Disclose Information

We may disclose personal information as described below, subject to applicable law and applicable agreements.

10.1 Workspace owners, administrators, and users

Workspace owners and administrators may access account, membership, usage, security, audit, meeting, and Customer Content information based on their permissions. Other workspace users may access information made available through workspace, room, meeting, channel, board, file, or sharing settings.

If your account uses an organization-controlled email address, the organization may be able to claim, manage, or administer the account as permitted by applicable terms and law.

10.2 Hosts, participants, invitees, and recipients

Information may be disclosed to:

• Meeting hosts, organizers, presenters, participants, and invitees;
• People included in messages, files, tasks, boards, bookings, or webinars;
• Recipients selected by a user;
• Anyone who receives a shareable or public link; and
• People who download, export, copy, record, forward, or otherwise receive content.

A recipient may save, copy, screenshot, record, download, retransmit, publish, index, train on, analyze, or use information outside HQ. Public or broadly accessible links may be opened by unintended recipients, forwarded without authorization, discovered through external services, or indexed by search engines where technically permitted. Revoking a link or changing permissions may prevent future access through HQ but may not retrieve copies or remove information already accessed, cached, indexed, exported, or disclosed. REACH does not control information after it has been received or exported by another person or third-party service.

10.3 Vendors and subprocessors

We may disclose information to providers that support:

• Infrastructure, cloud computing, hosting, storage, networking, and content delivery;
• Audio, video, transcription, translation, AI, and machine-learning functionality;
• Authentication, identity, security, fraud prevention, and abuse detection;
• Analytics, diagnostics, testing, and product development;
• Payments, billing, accounting, tax, and collections;
• Customer support, communications, email, and notifications;
• Sales, marketing, surveys, and customer relationship management;
• Professional services, compliance, and business operations; and
• Dataset preparation, labeling, evaluation, research, and model development.

These providers may process information in the United States and other countries. They may receive the information reasonably necessary to perform services, comply with law, protect their systems, and fulfill permitted ancillary purposes. Depending on context and law, a provider may act as our processor, subprocessor, service provider, contractor, or independent controller. We may add, replace, or remove providers as our services and business evolve, subject to applicable notice and contractual requirements.

10.4 Integrations and third-party services

At a user’s, host’s, administrator’s, or customer’s direction, we may disclose information to connected calendars, storage providers, identity systems, applications, bots, extensions, webhooks, application programming interfaces, and other integrations. The scope may include current and future content within authorized permissions, and an integration may read, write, modify, delete, synchronize, or trigger actions in HQ or the connected service. Information disclosed to or received from an integration may persist after disconnection in either service, recipients’ copies, logs, backups, or derived materials.

Third-party developers and providers may independently process information under their own terms. Customers and users are responsible for reviewing an integration’s permissions and practices before enabling it.

10.5 Affiliates and related entities

We may disclose information among entities that control, are controlled by, or are under common control with REACH for the purposes described in this Privacy Policy, including shared infrastructure, security, support, administration, analytics, research, development, commercialization, compliance, and corporate operations. An affiliate may process information on REACH’s behalf or for its own lawful purposes, depending on the relationship, activity, applicable agreement, and governing law.

10.6 Professional advisers

We may disclose information to lawyers, auditors, accountants, insurers, banks, consultants, and other professional advisers where reasonably necessary for their services, professional obligations, risk assessment, financing, audits, claims, compliance, or protection of legal and business interests. These recipients may process information subject to professional duties, contractual restrictions, legal privilege, confidentiality obligations, or independent legal responsibilities, as applicable.

10.7 Legal, safety, and security disclosures

We may disclose information if we reasonably believe disclosure is necessary or appropriate to:

• Comply with law, regulation, legal process, court order, or governmental request;
• Respond to emergencies or protect a person from harm;
• Detect, investigate, prevent, or address fraud, abuse, security incidents, or illegal activity;
• Protect the rights, property, safety, and integrity of REACH, users, customers, third parties, or the public;
• Enforce agreements and policies; or
• Establish, exercise, or defend legal claims.

Where legally permitted and appropriate, we may notify an affected customer before responding to a governmental request. We may be unable to provide advance notice if notice is prohibited, the request is urgent, an emergency involves a risk of harm, notice could prejudice an investigation or security response, the customer cannot reasonably be identified or reached, or REACH determines that notice would be unlawful or inappropriate. We may challenge, narrow, preserve, or disclose information in response to a request as permitted by law and the circumstances.

10.8 Corporate transactions

We may disclose or transfer information in connection with an actual or proposed:

• Merger, acquisition, consolidation, financing, investment, or reorganization;
• Sale, license, transfer, or disposition of assets, products, rights, or business lines;
• Due diligence process;
• Bankruptcy, insolvency, receivership, or similar proceeding; or
• Change in ownership or control.

Recipients may use information to evaluate, negotiate, finance, secure, or complete the transaction and, after completion, as permitted by this Privacy Policy, any successor policy, applicable agreements, and law. A transaction may involve transfer of control over databases, contracts, systems, intellectual property, and continuing obligations. Where required, we will provide notice or honor applicable rights in connection with a material change in control or processing.

10.9 Dataset, model, and commercial disclosures

As described in Section 7, we may provide datasets, insights, models, evaluations, benchmarks, or derived materials to research, technology, model, dataset, and commercial partners.

Depending on the information, recipient, purpose, and governing law, such activity may be characterized as a “sale,” “sharing,” targeted-advertising disclosure, or another regulated transfer. Where required, we will provide applicable notices and choices.

11. Data Retention

We retain information for as long as reasonably necessary or permitted for the purposes described in this Privacy Policy. Retention periods may depend on:

• Account, subscription, workspace, and customer status;
• Workspace, host, administrator, or user settings;
• The nature, sensitivity, volume, and context of the information;
• The purpose for which the information was collected or developed;
• Product operation, support, security, and continuity needs;
• Applicable customer agreements and enterprise commitments;
• Legal, tax, accounting, regulatory, and reporting obligations;
• Actual or anticipated disputes, investigations, claims, or enforcement matters;
• Backup, archival, disaster-recovery, and system-integrity requirements;
• Fraud, abuse, and security-prevention needs; and
• Technical feasibility and the design of relevant systems.

Deletion from active systems may not immediately remove information from backups, logs, archives, fraud-prevention systems, legal holds, caching layers, search indexes, or disaster-recovery environments. Information may remain until those systems are overwritten, isolated, anonymized, or retired in the ordinary course, subject to applicable law and contractual commitments. During that period, retained information may be unavailable for ordinary use but may be restored or accessed for continuity, security, investigation, compliance, or legal purposes.

Deletion of an account, workspace, recording, or item of Customer Content may not remove:

• Information retained to comply with law or protect legal rights;
• Security, fraud, billing, transaction, and audit records;
• Copies made or exported by customers, users, participants, recipients, or integrations;
• Information already lawfully provided to third parties;
• Aggregated or de-identified information that is no longer personal information under applicable law;
• Derived information that does not identify or reasonably relate to an individual;
• Model parameters, weights, statistical relationships, or learnings that cannot reasonably be isolated or reversed to identify the source information; or
• Information whose deletion is prohibited, exempted, or not required under applicable law.

When retention is no longer reasonably necessary, we may delete, de-identify, aggregate, isolate, overwrite, restrict, or otherwise dispose of information in accordance with our processes. Retention periods may differ across systems, copies, records, and data elements. Unless a specific period is required by law or an applicable agreement, this Privacy Policy does not promise a fixed retention schedule or immediate deletion, and users should maintain their own copies of information they need.

12. Security

REACH uses administrative, technical, physical, and organizational measures designed to protect information against unauthorized access, destruction, loss, alteration, misuse, or disclosure. Measures may include, as appropriate to the risk and service, access controls, authentication, encryption in transit or at rest, logging, monitoring, vulnerability management, incident response, personnel training, vendor review, business-continuity planning, data minimization, segregation, and secure-development practices. Safeguards evolve with technology, threats, cost, functionality, and legal requirements and may differ by system, feature, plan, and data type.

No security measure, transmission method, network, storage system, or service can be guaranteed to be completely secure, available, or error-free. Unauthorized parties may defeat safeguards, and incidents may result from user actions, third parties, integrations, software defects, or events beyond reasonable control. To the extent required by law, we will investigate qualifying incidents and provide legally required notifications. Users and customers share responsibility for security and are responsible for:

• Protecting account credentials and authentication devices;
• Using appropriate passwords, passkeys, and multifactor authentication;
• Maintaining device and network security;
• Reviewing permissions, integrations, public links, and access settings;
• Promptly removing unauthorized members and credentials; and
• Notifying REACH of suspected unauthorized access or security incidents.

If you believe an HQ account or workspace has been compromised, contact postmaster@reachprojects.co.

13. International Processing and Transfers

REACH and the parties described in this Privacy Policy may process, access, support, store, host, or transfer information in the United States and other countries where REACH, customers, users, vendors, partners, or recipients operate. Those countries may have privacy laws, government-access rules, and individual rights that differ from, and may provide less protection than, the laws where you live. Remote access from another country may itself constitute an international transfer under some laws.

Where applicable law requires safeguards for international transfers, REACH may use:

• Adequacy determinations;
• Standard contractual clauses or equivalent transfer terms;
• Data processing agreements;
• Contractual, technical, and organizational safeguards;
• Consent or another legally permitted transfer mechanism; or
• Other mechanisms recognized by applicable law.

REACH does not guarantee that all information will be stored, accessed, or processed in a particular country or region unless expressly agreed in a written contract. Where required, we may conduct transfer assessments, supplement contractual clauses, use access and encryption controls, or rely on a lawful derogation. Transfer mechanisms may change as law, guidance, vendor locations, and service architecture evolve. You may contact us for information about safeguards relevant to your transfer, subject to confidentiality and security limitations.

14. Children and Teenagers

HQ is not directed to children under 13, and REACH does not knowingly permit children under 13 to create individual HQ accounts. We do not knowingly sell or share the personal information of children in a manner requiring authorization under applicable law. A child may nevertheless appear in Customer Content submitted by an adult, organization, school, host, or participant; in that situation, the submitting customer or user is responsible for authority, notice, consent, minimization, and appropriate settings, and REACH may act as its processor or service provider.

People between 13 and 17 may use HQ only where the minimum age, parental-consent, school-authorization, contract-capacity, and youth-privacy requirements of their jurisdiction are satisfied, including where:

• The use is legally permitted;
• A parent, guardian, school, employer, or other authorized organization has provided any required authorization;
• The applicable customer or organization has approved the use; and
• The use complies with the HQ Terms of Service and any age restrictions presented through HQ.

HQ is not offered as a school-directed educational service for children unless REACH expressly agrees otherwise in writing. A school, district, parent, guardian, or other organization that enables a young person to use HQ is responsible for determining whether the use is appropriate and lawful; providing required notices; obtaining and documenting required consent or authorization; configuring accounts, access, recording, retention, and sharing settings; limiting collection to what is appropriate; and responding to parent, guardian, student, or regulatory requests within its responsibility.

If you believe a child has provided personal information in violation of this section, contact postmaster@reachprojects.co. We may request information reasonably necessary to evaluate and respond to the report.

15. Your Privacy Choices

Depending on your account, plan, location, and applicable law, you may be able to:

• Review or update account and profile information;
• Change workspace, meeting, recording, sharing, or communication settings;
• Disconnect integrations;
• Delete particular content or request deletion of an account or workspace;
• Opt out of promotional email;
• Manage cookies and similar technologies;
• Object to or opt out of certain processing;
• Opt out of qualifying sales, sharing, or targeted advertising;
• Limit certain uses or disclosures of sensitive personal information; or
• Withdraw consent where processing is based on consent.

Some choices are controlled by the relevant workspace owner, administrator, customer, or meeting host. A setting or request may apply only to the relevant browser, device, account, workspace, feature, communication channel, or processing activity and may need to be repeated elsewhere. Choices generally operate prospectively and may not remove information already lawfully processed, disclosed, exported, incorporated into another user’s content, retained under a legal obligation, or maintained in a form that applicable law does not require us to alter or delete. Certain choices may affect the availability, continuity, personalization, security, or functionality of HQ.

We will honor nonwaivable consent, objection, deletion, opt-out, sensitive-data, biometric, recording, and other privacy rights where required by applicable law.

16. U.S. State Privacy Rights

Residents of certain U.S. states may have privacy rights where the applicable state law applies to REACH and the relevant processing. These rights may include the right to:

• Confirm whether we process personal information;
• Know or access personal information and related processing details;
• Obtain a portable copy of certain personal information;
• Correct inaccurate personal information;
• Delete certain personal information;
• Opt out of the sale of personal information;
• Opt out of sharing for cross-context behavioral advertising;
• Opt out of targeted advertising;
• Opt out of certain profiling or automated decision-making;
• Limit certain uses or disclosures of sensitive personal information;
• Withdraw consent for processing sensitive data where applicable;
• Receive equal service and not be unlawfully discriminated against for exercising a privacy right; and
• Appeal the denial of a privacy request where applicable.

These rights are subject to definitions, exceptions, exemptions, verification requirements, and limitations under applicable law. We do not represent that every state privacy statute applies to REACH or to every activity described in this Privacy Policy.

Submitting a request

The practical mechanism for submitting an access, correction, deletion, portability, objection, limitation, or other privacy request is to email:

postmaster@reachprojects.co

You may also write to:

REACH Projects, Inc. Attn: Privacy Request 861 Corriente Pointe Drive Redwood City, CA 94065 United States

Please describe your request, your relationship with HQ, the relevant workspace or account, and the jurisdiction in which you reside.

Where required, REACH will make additional request methods available, such as an online form, toll-free number, or privacy-choice interface. Instructions for sales, sharing, targeted-advertising, sensitive-information, or cookie choices may also be presented through HQ or our website.

Verification

We may need to verify:

• Your identity;
• The account, email address, or information involved;
• Your residency or eligibility;
• Your authority to act for another person; and
• The scope and authenticity of the request.

We will use information submitted for verification to evaluate and respond to the request. Verification measures may vary with the sensitivity of the information, the requested action, the risk of unauthorized access or deletion, and the information reasonably available to us. We may ask for clarification, request additional information, use an existing authenticated account, compare information already maintained, or propose a less sensitive response method. We may deny or limit a request where we cannot reasonably verify it, where an exception applies, or where the request is fraudulent, abusive, excessive, technically infeasible, or otherwise not required by law. Where legally permitted, we may charge a reasonable fee or decline to act on manifestly unfounded, excessive, or repetitive requests, and we will provide any explanation required by applicable law.

Authorized agents

Where permitted, an authorized agent may submit a request on your behalf. We may require a signed authorization, power of attorney, registration evidence, or other documentation reasonably sufficient to establish the agent’s identity, authority, and requested scope, and we may ask you to verify your identity or confirm that you authorized the request. We may communicate directly with you where permitted and may decline an agent request if legally required authorization or verification is not provided.

Appeals

If applicable law provides a right to appeal, you may appeal our decision by replying to our response or emailing postmaster@reachprojects.co with the subject line “Privacy Request Appeal.”

17. California Privacy Disclosures

This section supplements the rest of this Privacy Policy for California residents. It applies only to the extent the California Consumer Privacy Act, as amended (“CCPA”), applies to REACH and the relevant processing. Terms such as “consumer,” “personal information,” “sensitive personal information,” “sale,” “sharing,” “business purpose,” “service provider,” and “contractor” have the meanings assigned by the CCPA. Information outside the CCPA’s scope, including information subject to statutory exemptions, may not be covered by this section.

17.1 Categories collected during the preceding 12 months

The following table describes categories of personal information we may have collected during the 12 months preceding October 4, 2026. The examples are illustrative; we do not necessarily collect every example from every person.

The retention considerations in Section 11 apply to these categories. Actual retention varies by data element, purpose, account or workspace status, customer direction, legal obligation, security need, system design, and applicable agreement; information within the same statutory category may therefore be retained for different periods.

17.2 Categories disclosed during the preceding 12 months

During the 12 months preceding October 4, 2026, we may have disclosed each applicable category listed above for one or more business or commercial purposes described in this Privacy Policy to the recipient categories below. A recipient may fall within more than one category, and not every category is disclosed to every type of recipient:

• Workspace owners, administrators, users, hosts, participants, invitees, and recipients;
• Hosting, infrastructure, security, analytics, support, communications, payment, and other vendors;
• Integration and third-party service providers at a user’s or customer’s direction;
• Affiliates and professional advisers;
• Governmental, legal, safety, and security recipients;
• Transaction counterparties; and
• Dataset, model, evaluation, research, and commercial partners, subject to applicable law and safeguards.

17.3 Sale and sharing

California law defines “sale” and “sharing” broadly and does not limit “sale” to transfers for money.

Depending on the circumstances, the following activities may constitute a sale or sharing under the CCPA:

• Licensing or providing personal information or transcript-derived datasets to a commercial partner;
• Disclosing identifiers, device information, or online activity to certain advertising or analytics partners;
• Providing pseudonymized or derived information that remains reasonably linkable to a consumer or household; or
• Other transfers involving monetary or valuable consideration or cross-context behavioral advertising.

REACH may have sold or shared, as those terms are legally defined, identifiers, internet or electronic-network activity, commercial information, inferences, and other personal information to analytics, advertising, dataset, model, research, or commercial partners. We do not knowingly sell or share the personal information of consumers under 16 without the affirmative authorization required by law.

Where the CCPA applies, California residents may opt out through any privacy-choice interface we make available or by contacting postmaster@reachprojects.co. REACH will also process legally valid browser-based opt-out preference signals, such as qualifying Global Privacy Control signals, as required by law. A signal may apply to the browser or device sending it and, where we can reasonably associate the signal with an authenticated account, may also be applied to that account as required. Opting out does not prohibit disclosures that are not legally considered sale or sharing, including certain disclosures to service providers or contractors, disclosures at the consumer’s direction, or other permitted transfers.

17.4 Sensitive personal information

We may use sensitive personal information to provide requested services, authenticate users, protect accounts, process communications and Customer Content, maintain security, prevent fraud, and perform other legally permitted activities.

If REACH uses or discloses sensitive personal information for purposes that trigger a California right to limit, we will provide the legally required limitation mechanism.

17.5 California rights

Subject to applicable exceptions, California residents may have the right to:

• Know the categories and specific pieces of personal information collected about them;
• Know the categories of sources, purposes, and recipients;
• Delete personal information;
• Correct inaccurate personal information;
• Opt out of sale or sharing;
• Limit certain uses and disclosures of sensitive personal information; and
• Receive nondiscriminatory treatment for exercising CCPA rights.

To exercise these rights, follow the procedures in Section 16.

17.6 Financial incentives

REACH may offer different prices, plans, features, benefits, rewards, discounts, credits, or service levels associated with the collection, retention, or use of personal information where permitted by law. If an arrangement constitutes a financial incentive or price or service difference regulated by California law, we will provide any required notice describing material terms, how the value of data relates to the benefit, and how to opt in or withdraw. Participation will be voluntary, and withdrawal will not affect rights or benefits already provided except as permitted by the disclosed terms and law.

17.7 California “Shine the Light”

California residents may have separate rights concerning disclosure of certain personal information to third parties for their direct-marketing purposes. Requests may be sent to postmaster@reachprojects.co.

18. EEA, United Kingdom, and Switzerland

This section applies where European Economic Area, United Kingdom, or Swiss data-protection law governs REACH’s processing.

18.1 Lawful bases

Depending on the processing, we may rely on:

The appropriate lawful basis depends on the purpose, information, relationship, and context; no single basis applies to every processing activity. We may rely on different bases for different operations involving the same information. Where processing involves special-category data or criminal-offence data, we also identify an applicable additional condition or obtain explicit consent where required. If a basis is no longer available, we may cease the processing or rely on another lawful basis where permitted after providing any required notice.

Where we rely on legitimate interests, those interests may include providing and improving HQ, maintaining safety and security, understanding use, supporting customers, developing and commercializing technology, preventing fraud, and protecting REACH’s rights. We consider whether those interests are overridden by the interests or fundamental rights and freedoms of affected individuals.

Where we rely on consent, you may withdraw it at any time through the available feature, by contacting the relevant customer or host, or by contacting REACH. Withdrawal does not affect processing that occurred before withdrawal or processing supported by another lawful basis. Withdrawal may limit access to a feature that requires the relevant processing, and it may not require deletion of information that must or may lawfully be retained for compliance, claims, security, or another valid purpose.

18.2 Individual rights

Subject to applicable conditions and exceptions, you may have rights to:

• Access personal information;
• Correct inaccurate or incomplete information;
• Request deletion;
• Restrict processing;
• Receive certain information in a portable format;
• Object to processing based on legitimate interests;
• Object to direct marketing;
• Withdraw consent;
• Receive information about applicable automated decision-making; and
• Lodge a complaint with your local data-protection authority.

These rights are not absolute. They may be limited by identity-verification requirements, the rights and freedoms of others, confidentiality, legal privilege, trade secrets, manifestly unfounded or excessive requests, technical feasibility, legal obligations, public-interest grounds, or other exceptions. We may provide an explanation when we decline or limit a request and will identify available complaint or appeal avenues where required.

REACH does not intend to make decisions producing legal or similarly significant effects about individuals solely through automated processing unless permitted by law and accompanied by required disclosures and safeguards. Where applicable, safeguards may include a means to obtain human intervention, express a viewpoint, contest a decision, receive meaningful information about the logic involved, or provide explicit consent. Customers may independently use HQ outputs in decision-making and are responsible for their own compliance.

18.3 Controller and processor requests

If REACH processes information on behalf of an HQ customer, you should ordinarily submit your request to that customer because it determines the relevant purposes, means, scope, and response. We may forward a request to the customer, ask you to contact it, or assist it in responding as required by contract and law. We generally cannot override a customer’s lawful instructions or provide access to Customer Content without authorization, particularly where doing so could affect other people’s rights or confidentiality.

If REACH acts as controller, submit your request to postmaster@reachprojects.co.

18.4 Complaints

You may complain to the data-protection authority where you reside, work, or believe an infringement occurred. We encourage you to contact us first so that we can try to address your concern.

19. Additional Jurisdiction-Specific Rights

Privacy laws in Canada, Brazil, Australia, New Zealand, and other jurisdictions may provide rights or protections in addition to those described above where the relevant law applies to REACH or the processing. Depending on the jurisdiction and circumstances, these may include rights to receive information about processing; access, correct, update, delete, anonymize, restrict, or obtain a portable copy of personal information; object to or opt out of particular processing; withdraw consent; obtain information about disclosures or automated processing; designate an authorized representative; or complain to a regulator.

The procedures in Section 16 apply unless applicable law requires another method or standard. REACH will honor legally nonwaivable privacy rights and will not interpret this Privacy Policy as requiring a waiver of those rights. Rights remain subject to applicable definitions, verification requirements, exceptions, exemptions, and limitations. If REACH processes the relevant information for an HQ customer, we may refer or forward the request to that customer or assist it as required by law and contract.

20. Third-Party Services and Public Links

HQ may include links, integrations, embedded content, applications, plug-ins, bots, extensions, or services operated by third parties. A third party may receive information directly from you, from HQ at your or a customer’s direction, or automatically when its feature loads or is used. REACH does not control or assume responsibility for a third party’s independent privacy, security, terms, availability, or data-handling practices. Review the third party’s notices, permissions, retention terms, and controls before enabling or using it.

Content shared through a public, unrestricted, or broadly distributed link may be accessible to anyone who obtains the link and may be indexed, cached, copied, downloaded, recorded, analyzed, or redistributed. A link can be forwarded beyond the intended audience, and recipients may retain copies after access is revoked. Search engines and archival services may take time to update or remove cached results. Users are responsible for selecting appropriate sharing settings and recipients, reviewing permissions periodically, and avoiding public links for information that should remain confidential or restricted.

21. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect:

• Changes to HQ, our technology, or business operations;
• New products, features, plans, settings, or data uses;
• Changes in vendors, partners, or corporate structure;
• Changes in legal, regulatory, security, or industry requirements; or
• Other operational or commercial developments.

We will post the updated Privacy Policy and revise the “Last Updated” date. Changes become effective on the stated effective date. We may provide additional notice through HQ, email, account notifications, website banners, administrators, or other appropriate channels if a change is material or if law requires a particular form of notice. The method and timing of notice may depend on the nature of the change, the information available to us, account status, and legal requirements.

Where applicable law requires consent, renewed consent, an opt-in, an opt-out opportunity, or another form of notice before a new practice applies, we will provide the required mechanism. Continued use of HQ after an update is governed by the updated Privacy Policy to the extent permitted by law and the applicable HQ Terms of Service.

22. Contact Us

For privacy questions, requests, objections, complaints, or concerns, contact:

REACH Projects, Inc. Attn: Privacy 861 Corriente Pointe Drive Redwood City, CA 94065 United States

Email: postmaster@reachprojects.co

Emailing postmaster@reachprojects.co is the practical method for submitting a privacy or individual-rights request. Include your name, contact details, state or country of residence, relationship to HQ, the relevant account, workspace, meeting, transaction, or interaction, the right or concern involved, and the outcome requested. We may acknowledge the request, seek clarification, verify identity or authority, coordinate with a customer, search relevant systems, apply legal exceptions, and respond within the period required by applicable law. If additional time is legally available and reasonably necessary, we may notify you of an extension. Do not send passwords, authentication codes, complete payment credentials, government identification documents, or other highly sensitive information unless we specifically request an appropriate verification method. We will not unlawfully discriminate or retaliate against you for exercising an applicable privacy right.