Cookie Declaration

This Declaration applies only to cookies and similar technologies deployed by or on behalf of Lacy through Services that link to this Declaration.

It does not govern:

cookies or technologies used on third-party websites, applications, platforms, or services, even if they are linked to or integrated with the Services;

technologies independently deployed, configured, or controlled by a Lacy customer on the customer’s own website, application, telephone system, workflow, or other digital property; or

a customer’s collection or use of information processed through the Lacy platform.

When a customer uses Lacy technology on a customer-controlled property, the customer may determine the purposes and means of the relevant processing and may be responsible for providing legally required notices, obtaining consent, and honoring applicable privacy choices. Please review that customer’s privacy and cookie notices for additional information.

Cookies are small data files placed on or accessed from a browser or device. They can enable a website or application to recognize a browser or device, maintain a session, remember settings, secure an account, measure activity, or support other functionality.

We may also use technologies that perform similar functions, including:

local and session storage;

pixels, tags, and web beacons;

software development kits;

application programming interfaces;

device or browser identifiers;

secure authentication tokens;

server-side identifiers and event data; and

fraud-prevention, measurement, and attribution technologies.

In this Declaration, “cookies” refers collectively to cookies and these similar technologies. Some cookies expire when a browser session ends. Others remain for a specified period, until they are replaced, or until they are deleted through browser or device settings.

Depending on the Service, device, configuration, and choices you make, cookies may collect or generate information such as:

Internet Protocol address;

browser, device, and operating-system information;

approximate location derived from an IP address;

language, time zone, and accessibility preferences;

referring and exit pages;

pages, features, links, or content viewed or used;

session, login, authentication, and security events;

timestamps, diagnostic data, crash data, and performance information;

campaign, referral, and conversion information; and

identifiers used to recognize a browser, device, session, or account.

This information may constitute personal information or personal data under applicable law, including when it can reasonably be linked to an individual, household, browser, device, or account.

Cookies are not intended to serve as the primary storage location for customer conversation recordings, transcripts, AI-generated summaries, payment-card numbers, or account passwords. Certain identifiers, tokens, or limited data necessary to securely operate a feature may nevertheless be stored in or accessed through a browser or device. Lacy does not represent that cookies are incapable of containing personal information.

Subject to applicable law and your available choices, Lacy may use cookies to:

provide, operate, and maintain the Services;

authenticate users and maintain secure sessions;

protect accounts, systems, and infrastructure;

prevent fraud, misuse, unauthorized access, and automated abuse;

remember privacy choices, language, accessibility settings, and other preferences;

enable requested features and customer configurations;

diagnose errors and improve availability, performance, and reliability;

understand how the Services are discovered and used;

measure audience activity, feature adoption, and onboarding effectiveness;

improve products, documentation, communications, and user experience;

measure campaigns, referrals, and conversions;

personalize content or marketing where permitted by law; and

comply with law, enforce our agreements, and protect Lacy, our customers, users, and others.

Our legal basis for processing information collected through cookies depends on the technology, purpose, and jurisdiction. It may include your consent, performance of a contract, compliance with legal obligations, or our legitimate interests or those of another party, provided those interests are not overridden by applicable rights. Where consent is legally required, we will request consent before using the relevant non-essential cookies.

A. Strictly Necessary Cookies

These cookies are required to provide a Service or feature you request or to protect the security and integrity of the Services. They may support:

account authentication and session management;

load balancing and network routing;

fraud, abuse, and bot prevention;

privacy-choice storage;

security controls and incident detection;

service availability; and

form, transaction, and request integrity.

Because these cookies are necessary to provide requested functionality or secure the Services, they generally cannot be disabled through our cookie preference center. You may be able to block them through your browser, but doing so may cause some or all of the Services to function incorrectly or become unavailable.

B. Functional Cookies

Functional cookies enable enhanced features or remember choices, such as:

language and region;

accessibility and display settings;

workspace or interface preferences;

previously selected options; and

certain product or communication settings.

If you disable these cookies, some features may not operate as intended.

C. Analytics and Performance Cookies

Analytics and performance cookies help us understand and improve the operation and use of the Services. They may be used to:

measure visits, traffic sources, and interaction patterns;

evaluate feature adoption and onboarding;

identify errors, latency, and performance issues;

test and improve content, design, and workflows; and

produce aggregated or statistical insights.

Where required by law, we use these cookies only after receiving valid consent.

D. Advertising and Marketing Cookies

Advertising and marketing cookies may help us:

understand how visitors find Lacy;

measure campaign reach and effectiveness;

attribute referrals and conversions;

limit or sequence advertising;

create or measure audiences; and

personalize advertising or marketing communications where permitted.

Depending on how a provider uses the information, these activities may be considered “targeted advertising,” “cross-context behavioral advertising,” “sale,” or “sharing” under certain U.S. state privacy laws. Where applicable, Lacy will provide required choices and will process legally recognized opt-out preference signals as described below.

We do not use advertising or marketing cookies where prohibited by law. Where prior consent is required, these cookies will not be activated unless and until valid consent is obtained.

The specific cookies and providers active on the Services may vary based on the page, feature, geography, consent status, browser, account configuration, and changes to our technology providers.

Our cookie preference center, where available, is intended to provide current information regarding non-essential cookie categories and choices. Cookie expiration settings do not always determine how long a provider retains information collected through a cookie. Provider retention may also depend on account settings, legal obligations, security requirements, and the provider’s applicable terms and notices.

We retain cookie-derived information only for as long as reasonably necessary for the purposes described in this Declaration, including to provide and secure the Services, satisfy legal or contractual obligations, resolve disputes, and enforce agreements. Retention periods may vary by data type, purpose, and legal requirement.

The names and examples of providers or technologies identified in this Declaration or in a cookie preference center are descriptive and may change as we modify the Services. A provider’s inclusion does not mean that the provider is used on every page, for every user, or at all times.

We may engage service providers to support functions such as:

hosting, content delivery, and infrastructure;

authentication and account security;

fraud, bot, and abuse prevention;

analytics, diagnostics, and product performance;

customer support and communications;

payment and transaction support;

marketing automation, advertising, and attribution; and

Service administration and integration.

Depending on our configuration and your interaction with the Services, providers may include Google, Cloudflare, HubSpot, PostHog, Mixpanel, LinkedIn, or other providers. This list is illustrative, not a representation that every named provider is currently active across all Services.

Third-party providers may process information on our behalf as service providers or processors. In other circumstances, a provider may process information for its own disclosed purposes, subject to its own terms and privacy notices. Lacy does not control, and this Declaration does not govern, a third party’s independent processing. To the extent required by applicable law, we use contractual and other safeguards appropriate to the provider’s role.

Cookie Preference Center

Where available, you may use our cookie preference center to accept, reject, or change choices for non-essential cookies. Your choices apply prospectively to the browser and device on which they are made. You may need to repeat your choices if you use another browser or device, clear browser storage, use a private-browsing session, or if our consent technology cannot recognize a prior selection.

Withdrawing consent does not affect the lawfulness of processing that occurred before withdrawal.

Browser and Device Controls

Most browsers and devices allow you to delete or block cookies, restrict certain technologies, or receive a notification when a cookie is being used. Your browser or device provider controls these settings. Blocking cookies may affect the availability, security, or functionality of the Services.

Opt-Out Preference Signals

Where required by applicable law, Lacy will treat a legally recognized, technically valid browser-based opt-out preference signal, such as Global Privacy Control, as a request to opt out of sale, sharing, targeted advertising, or comparable processing for the browser or device that sends the signal.

Because these signals generally operate at the browser or device level, we may not be able to associate the signal with every account or device you use. A signal does not necessarily disable strictly necessary cookies or processing that is exempt under applicable law.

Industry and Provider Controls

Certain advertising, analytics, browser, or device providers offer their own controls. These controls are operated by third parties and may not prevent all measurement, contextual advertising, or other processing.

Do Not Track

“Do Not Track” signals are not governed by a uniform, universally accepted legal or technical standard. Except where a signal is recognized and must be honored under applicable law, the Services may not respond to Do Not Track signals. This does not limit our handling of Global Privacy Control or another legally binding preference signal.

Residents of certain U.S. states may have rights concerning personal information collected through cookies, including rights to access, correct, delete, or obtain a copy of certain information and to opt out of sale, sharing, targeted advertising, or certain profiling.

These rights are subject to definitions, exceptions, verification requirements, and applicability thresholds under the relevant law. Lacy will not unlawfully discriminate against you for exercising an applicable privacy right.

Instructions for submitting privacy requests, appealing an applicable decision, or using an authorized agent are provided in our Privacy Policy. If Lacy does not engage in an activity that a law defines as a sale, sharing, or targeted advertising, an associated opt-out right may not apply.

Where applicable law requires prior consent to store information on or access information from a device, Lacy will seek consent before activating non-essential cookies. Strictly necessary technologies may be used without consent where an applicable exception permits their use.

You may withdraw consent at any time through the available cookie controls. Any later processing of personal data obtained through cookies remains subject to applicable data-protection law and our Privacy Policy.

Lacy and its providers may process cookie-derived information in the United States and other countries whose data-protection laws may differ from those of your jurisdiction. Where required, we use appropriate legal mechanisms for restricted transfers of personal data. Additional information is provided in our Privacy Policy.

The Services are intended for businesses and are not directed to children. Lacy does not knowingly use cookies to sell or share the personal information of children or to engage in targeted advertising to children in violation of applicable law. If you believe a child has provided personal information to Lacy, please contact us at the address below.

We use administrative, technical, and organizational measures designed to protect information processed through cookies. No method of transmission, storage, or security is completely secure, however, and Lacy cannot guarantee absolute security.

We may update this Declaration from time to time to reflect changes in the Services, technologies, providers, business practices, or legal requirements. The “Last Updated” date indicates when this Declaration was most recently revised.

Where required by law, we will provide additional notice of material changes or request renewed consent. Unless applicable law requires otherwise, changes become effective when the updated Declaration is posted. Your cookie choices will continue to be governed by applicable law and the controls made available through the Services.

This Declaration is a transparency notice. It does not create a warranty, contractual commitment, private right of action, or obligation beyond those imposed by applicable law or expressly agreed in a separate written agreement signed by Lacy.

Nothing in this Declaration limits or waives rights that cannot lawfully be limited or waived. If this Declaration conflicts with an applicable customer agreement, Data Processing Addendum, or other negotiated written agreement, that agreement will control solely with respect to its subject matter and to the extent permitted by law. The Privacy Policy governs Lacy’s broader processing of personal information.

Questions or requests concerning this Declaration or Lacy’s privacy practices may be directed to:

Lacy AI, Inc.Email: privacy@lacy.ai

Please review our Privacy Policy for additional information about our privacy practices and available rights.