1. Information We Collect

• Account Data: Name, email, company, role, SSO claims, profile preferences
• Billing Data: Stripe tokens; no full card numbers stored
• Integration Data: Tenant metadata, license/SKU assignments, usage metrics from connected platforms (Microsoft 365, Google Workspace, Slack)
• Smart Tracking Data: User counts, license assignments, and usage data from Okta, Zoom, Zendesk, DocuSign, Salesforce, and GitHub via API connections or manual entry
• PSA / Billing Export Data (MSP Partners): CSV exports of license and billing data prepared for use with MSP partners' existing PSA tools. AppReclaim does not currently maintain live API connections to third-party PSA platforms.
• Branding Data (MSP Partners): Company logos, brand colors, and custom report configurations for white-label features
• Technical Data: IP address, device/browser information, logs, cookies, and similar local-storage identifiers
• Support Data: Support tickets, attachments, and communication history

2. How We Use Information

• Operate, secure, and improve the Service
• AI summaries, recommendations, health scores & optimization insights (actions require explicit human approval)
• Payments/subscriptions via Stripe
• Communications about updates, security, and support
• Legal compliance and fraud prevention

3. Legal Bases (GDPR)

• Contract performance
• Legitimate interests (security, service improvement)
• Consent (cookies, marketing communications)
• Legal obligation

4. Sharing & Disclosures

We share personal information only as necessary to provide the Service:

• Service Providers: Under confidentiality and data‑processing obligations
• Legal Compliance: When required by law, court order, or legal process
• Corporate Transactions: In connection with mergers, acquisitions, or asset sales

4A. Sub-Processors

We use the following sub-processors to deliver the Service:

An up-to-date sub-processor list is available on request at legal@appreclaim.com. We will provide at least 30 days' advance notice of any new sub-processor that processes Customer Data and an opportunity to object on reasonable grounds.

4B. MSP Partner Data Sharing

For MSP Partner accounts: Client organization data is accessible to the managing MSP account as designated by the partner relationship. MSP Partners act as controllers for their end-client relationships and are responsible for appropriate data handling agreements with their clients.

4C. No Sale of Personal Data

We do not sell, rent, or trade your personal information to third parties for their marketing purposes, and we do not "share" personal information for cross-context behavioral advertising as those terms are defined under U.S. state privacy laws.

4D. Google Workspace API — Limited Use Disclosure

AppReclaim's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

• We use Google Workspace data only to provide and improve user-facing license analytics, idle-seat detection, and optimization features visible in your portal.
• We do not transfer Google data to others except to provide or improve those features, comply with applicable law, or as part of a merger/acquisition with appropriate notice.
• We do not use Google data for serving advertisements.
• We do not allow humans to read Google data unless we have your explicit consent, it is necessary for security purposes (e.g., investigating abuse), to comply with law, or the data is aggregated and used for internal operations such as model evaluation.
• We do not use Google data to develop, improve, or train generalized or non-personalized AI/ML models.

5. International Transfers

Standard Contractual Clauses (EU SCCs 2021/914), the UK International Data Transfer Addendum (IDTA), and the Swiss FDPIC-recognized clauses, or other approved safeguards, are used where required for transfers outside the EEA, UK, or Switzerland.

6. Retention

Data retained for subscription term plus reasonable period for legal/operational needs; deletion/return on termination or request, subject to legal holds and backup retention policies. Free-scan results inactive for 12 months may be deleted with 30-day notice.

7. Your Rights (GDPR / UK GDPR / Swiss FADP)

If you are in the EEA, UK, or Switzerland, you have the following rights:

• Access: Request a copy of your personal data
• Rectification: Correct inaccurate or incomplete data
• Erasure: Request deletion of your personal data
• Portability: Receive your data in a structured, machine-readable format
• Restriction: Limit how we use your data
• Objection: Object to certain processing activities
• Withdraw Consent: Where processing is based on consent
• Lodge a Complaint: With your local data protection supervisory authority

Contact privacy@appreclaim.com. We respond within 30 days where feasible.

7A. California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have specific rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):

Your Rights

• Right to Know: Request disclosure of the categories and specific pieces of personal information we collect, use, disclose, and sell about you
• Right to Delete: Request deletion of personal information we have collected from you, subject to certain exceptions
• Right to Correct: Request correction of inaccurate personal information
• Right to Opt-Out of Sale/Sharing: We do not sell your personal information or share it for cross-context behavioral advertising
• Right to Limit Use of Sensitive Personal Information: We do not use sensitive personal information for purposes beyond those permitted without additional consent
• Right to Non-Discrimination: You will not receive discriminatory treatment for exercising your privacy rights

Categories of Personal Information Collected

In the preceding 12 months, we have collected the following categories of personal information:

• Identifiers (name, email, IP address, account ID)
• Commercial information (subscription history, transaction records)
• Internet activity (usage logs, feature interactions)
• Professional information (company name, job role)
• Inferences (usage patterns, recommendations)

How to Submit a Request

To exercise your California privacy rights:

• Email: privacy@appreclaim.com
• Subject line: "California Privacy Request"
• Include your name and account email for verification

You may designate an authorized agent to submit requests on your behalf. We will verify your identity and, if applicable, your agent's authority before processing requests. Requests are fulfilled within 45 days (extendable by an additional 45 days with notice).

Do Not Sell or Share My Personal Information

AppReclaim does not sell your personal information and does not share it for cross-context behavioral advertising purposes. Therefore, there is no need to opt out, but you may contact us at any time to confirm this status.

7B. Other U.S. State Privacy Rights

Residents of the following U.S. states have rights to access, correct, delete, and obtain a portable copy of their personal information, as well as the right to opt out of "targeted advertising," the "sale" of personal information, and certain "profiling" — none of which AppReclaim engages in for individual consumers:

Colorado (CPA), Virginia (VCDPA), Connecticut (CTDPA), Utah (UCPA), Oregon (OCPA), Texas (TDPSA), Montana (MCDPA), Delaware (DPDPA), Iowa (ICDPA), New Hampshire, New Jersey, Tennessee (TIPA), Florida (FDBR), Indiana, Kentucky, Maryland (MODPA), Minnesota, Nebraska, and Rhode Island.

To exercise any of these rights, contact privacy@appreclaim.com with subject line "State Privacy Request" and your state of residence. We respond within 45 days where required by applicable law (extendable by an additional 45 days with notice). You have the right to appeal a denial; appeal procedures are provided in our response.

7C. How to Submit a Data Subject Request

Three ways to submit a privacy request:

• In-product (recommended): Authenticated MSP admins can open a structured DSAR ticket from MSP Portal → Compliance → GDPR Data Requests.
• Email: privacy@appreclaim.com with the relevant subject line and your account email.
• Mail: AppReclaim LLC, Attn: Privacy, 4545 E Warren Ave, Denver, CO 80222, USA.

We verify identity before disclosing or modifying data and may require additional information to confirm your relationship to the account.

8. Security

Administrative, technical, and physical safeguards including:

• Encryption in transit (TLS 1.3) and at rest (AES-256)
• SOC 2 Type II aligned controls
• Role-based access control (RBAC) and least-privilege scopes
• Monitoring, logging, and alerting
• Webhook URLs and API credentials stored in a secure vault with pgsodium encryption
• Regular security assessments

9. Children

Service not intended for children under 16; no knowing collection of children's data. If we learn we have collected personal information from a child under 16, we will delete it promptly.

10. Changes

We will note effective dates and notify of material changes via email or in-app notification. Continued use after changes constitutes acceptance.

11. Contact

For privacy inquiries:

• Privacy / DSAR: privacy@appreclaim.com
• Legal / Contracts: legal@appreclaim.com
• Security / Vulnerability disclosure: security@appreclaim.com
• Mail: 4545 E Warren Ave, Denver, CO 80222, USA

Appendix: Data Processing Addendum (DPA)

A. Roles & Scope

Customer = Controller; AppReclaim = Processor for Customer Data processed on behalf of Customer.

B. Instructions

Processing solely per Customer's documented instructions and authorized integrations.

C. Security Measures

• Access controls and least-privilege
• Encryption in transit (TLS 1.3) and at rest (AES-256)
• Secrets in a managed vault with pgsodium encryption
• Monitoring, logging, and alerting
• Backups and business continuity planning

D. Sub-Processors

See §4A above for the current list. Sub-processors are contractually bound with equivalent protections. We will provide at least 30 days' advance notice of any new sub-processor and a right to object on reasonable grounds.

E. Data Subject Requests

Assistance for access/correction/deletion/portability requests within reasonable timeframes.

F. Transfers

Approved transfer mechanisms used as applicable:

• EU Standard Contractual Clauses (Module 2 / Module 3, Decision 2021/914)
• UK International Data Transfer Addendum (IDTA)
• Swiss FDPIC-recognized SCC variant

G. Incident Notification

Notice without undue delay (within 72 hours where feasible) of personal data breaches impacting Customer Data.

H. Return/Deletion

Delete or return Customer Data upon termination unless law requires retention.

I. Audits

Annual audit rights on reasonable written request, subject to confidentiality and reasonable notice.

12. Related Documents

• Terms of Service
• Cookie Policy
• Subscription Agreement & SLA
• AI Transparency Disclosure
• Responsible AI Policy

13. Change Log

• October 20, 2026 — Listed Google Analytics (consent-gated) and Plausible as website-analytics sub-processors.
• May 12, 2026 — Replaced AWS sub-processor row with truthful "Lovable Cloud (Supabase) on AWS" entry; consolidated AI providers under Lovable AI Gateway. Corrected PSA disclosure (CSV export, no live API). Added Google Limited Use (§4D), other U.S. state rights (§7B), in-product DSAR path (§7C), supervisory-authority complaint right, TLS 1.3/AES-256, 30-day sub-processor notice, and UK IDTA / Swiss SCC transfer mechanisms.
• January 18, 2026 — Initial publication.