Heap Trust Center

Welcome and thank you for your interest in Heap Inc., a member of the Contentsquare Group of companies, who are listedat this link,( “Heap”,“we”,“our”or “us”).

Heap is a SaaS product analytics platform. We allow our customers to collect and analyze data about how their visitors are interacting with their website and mobile application to optimize performance of product usage, diagnose problems in our customer’s visitor experience, and correlate our customer’s visitor activity with long-term value. Heap does this by collecting data on what visitors are doing, including but not limited to what webpages they visit, what visitors click on, where those visitors are located, what browser or platform those visitors are using, and other types of behavioral data.

When we use the term “personal information”in this Privacy Policy, we mean information relating to an identified or identifiable natural person.

This Privacy Policy explains how information about you is collected, used and disclosed by Heap when you visit our websitehttps://heap.io/(the “Site”), and/or use our SaaS product and related services (collectively, the “Service”).

• Heap as a Data Controller:For purposes of data protection laws, Heap Inc., a company duly incorporated and organized under the laws of United States of America, having its registered address at 225 Bush St. 2nd Floor, San Francisco, CA 94104, is the “data controller” and is generally responsible for and controls the processing of your personal information collected through your use of our Service. This Privacy Policy applies only to instances where Heaps acts as a data controller.

• Heap as a Data Processor:Wherever our customers use our Service to submit, manage, or otherwise use content relating to our customers’ end users during the provision of our Service, we act as a “data processor” and have contractually committed ourselves, including by signing data processing agreements, to only process such information on behalf and under the instruction of the respective customer, who is the data controller, and as provided for under the contractual agreements we sign with them. As such, this Privacy Policy does not apply to such processing.

GLOBAL APPLICABILITY AND REGION-SPECIFIC DISCLOSURES

This Privacy Policy is designed to apply to our Site visitors, users of our Service and other companies and users on a global basis. We may choose or be required by law to provide additional disclosures relating to the processing of personal information in certain countries, regions or states. Please refer below for disclosures that may be applicable to you:

• California:If you are a California resident, please see thePrivacy Disclosures for California Residentssection below for additional California-specific privacy disclosures, including the categories of personal information we process, our “sale” / “sharing” disclosures, and your rights under California law.

• Nevada:Chapter 603A of the Nevada Revised Statutes permits a Nevada resident to opt out of future sales of certain covered information that a website operator has collected or will collect about the resident. Note we do not sell your personal information within the meaning of Chapter 603A. However, if you would still like to submit such a request, please submit a request via ourData Subject Request Webform.

• European Economic Area, United Kingdom or Switzerland:If you are located in the European Economic Area ( “EEA”), United Kingdom or Switzerland, or otherwise engage with Heap’s European operations, please see thePrivacy Disclosures for the European Economic Area, United Kingdom and Switzerlandsection below for additional European-specific privacy disclosures, including what constitutes your personal data, the lawful bases we rely on to process your personal data, and your rights in respect of your personal data.

1. INFORMATION WE COLLECT AND OUR USE

We collect personal information in connection with your visits to and use of our Site and Service. This collection includes information that you provide to us, information from third parties, and information that is collected automatically such as through the use of cookies and other technologies.

Information That You Provide

We collect personal information from you. The categories of information we collect can include:

• Service Inquiries, Free Trial, or Demo Requests.We may collect personal information that you provide when you inquire about our Service or request a free trial or demo. This information may include your business information, including your first name, last name, email, phone number, company, company size, industry type, and any other information you provide, including your interests in relation to our Service or applicable business information. We use this information to communicate with you about your inquiry or interests, provide the free trial or demo, or schedule an information call to discuss our Service.

• Registration information.We collect personal and/or business information that you provide when you register for an account to use our Service. This information may include your name, email, and password. We use this information to administer your account, provide you with the relevant services and information, communicate with you regarding your account, the Service, and for customer support purposes.

• Payment information.If you sign up for our Service, we collect the information provided in connection with your payment. Please note that we use third party payment processors to process payments made to us. As such, we do not retain any personally identifiable financial information such as credit card numbers. Rather, all such information is provided directly by you to our third-party processor. The payment processor’s use of your personal information is governed by their Privacy Policy.

• Marketing Emails and Blog Subscription.If you consent to receive marketing emails from us, or subscribe to our blog, we collect your personal information, and applicable interests and communication preferences in order to send you regular updates about the Service and other information about Heap. We use this information to manage our communications with you and send you information about products and services we think may be of interest to you. To unsubscribe from marketing emails, please follow the instructions within our messages and review theControl Over Your Informationsection below. Note that you cannot unsubscribe from certain services-related email communications (e.g., account verification, confirmations of transactions, technical or legal notices).

• Communications.If you communicate with us through any paper or electronic form, we may collect your name, email address, mailing address, phone number, or any other personal information you choose to provide to us. We use this information to investigate and respond to your inquiries, and to communicate with you, to enhance the services we offer to our users and to manage and grow our organization.

• Events, Surveys, and Promotions.If you fill out any forms relating to Heap events, surveys, contests, sweepstakes, or other promotional events, we collect your contact and demographic information, and any other information requested on the form or at sign up. We use this information to fulfill the purpose of the form or sign up, facilitate the event, survey, contest, sweepstakes, and promotion, and, if you consent, to inform you about future programs that may be of interest to you.

• Employment Applications.If you apply for employment, we collect your contact and demographic information, educational and work history, employment interests, information obtained during interviews and any other information you choose to provide. We use the information provided to evaluate your candidacy for employment, to communicate with you during the application process, to facilitate the onboarding process, and, if you consent, to consider your application for alternative positions.

You are free to choose which personal information you want to provide to us or whether you want to provide us with personal information at all. However, some information, such as your name, address, payment transaction information, and information on your requested services may be necessary for the performance of our contractual obligations.

Automatic Data Collection

We and our third-party providers and partners collect certain personal information automatically when you visit or interact with our Site and Service:

• LogData:Including your internet protocol (IP) address, operating system, browser type, browser ID, the URL you entered and the referring page/campaign, date/time of your visit, the time you spent on our Service and any errors that may occur during your visit. Please note that our systems may also record personal information that you type into our websites and Service even if you do not choose to submit it.

• AnalyticsData:Including the electronic path you take to our Service, through and when exiting our Service, as well as your usage and activity on our Service, such as the links, objects, products and benefits you view, click or otherwise interact with (also known as “Clickstream Data”). Our emails may also contain tracking pixels that identify if and when you have opened an email that we have sent you, how many times you have read it and whether you have clicked on any links in that email. This helps us measure the effectiveness of our marketing email campaigns, make the emails we send to you more relevant to your interests and to understand if you have opened and read any important administrative emails we might send you.

• LocationData:Including your general geographic location based on the Log Data we collect.

• ApplicationData:Some of our services offer mobile or browser applications to allow you to take advantage of our service offerings on the go and/or when visiting third-party websites and other online services. Certain of these applications also allow us to access more precise Location Data about you and collect information about your use and interactions with third-party websites and online services (including the products or services you are interested in or purchase) to better serve you.

For information about our, and our third-party providers and partners’, use of cookies and related technologies to collect information automatically on our online services, and the choices you may have in relation to those practices, please visit our Cookies Policyhere.

Information from Third Party Sources

We may receive personal information about you from our business partners and service providers and combine this information with other data we collect from you. The third parties may include website and service operators, payment processors, marketing partners, and shipping providers. The information may include contact information, demographic information, information about your communications and related activities, and information about your purchase orders. We may use this information to administer and facilitate our Service, your subscriptions, and our marketing activities.

• Account Creation / Single Sign-On.We may use single sign-on ( "SSO") to allow a user to authenticate their account through their work email. We do this by using OAuth authentication (similar methods), a secure mechanism to give Heap access to your account data without letting us know your password. We will have access to certain information from those third parties in accordance with the authorization procedures determined by those third parties, including, for example, your username, password, name, email address, and profile picture. We use this information to operate, maintain, and provide to you the features and functionality of the Service. We may also send you service-related emails or messages (e.g., account verification, purchase confirmation, customer support, changes, or updates to features of the App, technical and security notices).

• Social Media.When you interact with our Site through various social media (LinkedIn, X, Facebook, YouTube), such as when you click on the social media icon on the Site, follow us on a social media site, or post a comment to one of our pages, we may receive information from the social network such as your profile information, profile picture, gender, username, user ID associated with your social media account, age range, language, country, and any other information you permit the social network to share with third parties. We use this information to provide you with interactive functionalities between our Site and social media networks, as well as to communicate directly with you, such as to send you email messages about the Service that may be of interest to you. For more information on how the social media networks process your personal information when you use their network, please refer to their respective privacy policies:

• LinkedIn:LinkedIn Corporation, 1000 W. Maude Ave. Sunnyvale, CA 94085, USA;Privacy Policy,Cookie Policy.

• X:X Corp., 1355 Market St, Suite 900, San Francisco, CA 94103, USA;Privacy Policy,Cookie Policy.

• Facebook:Meta Platforms, Inc., 1601 Willow Road, Menlo Park, CA 94025, USA;Privacy Policy,Cookie Policy.

• YouTube:Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA, 94043, USA;Privacy Policy,Cookie Policy.

• Information from Other Sources.We may obtain information from other sources, including through third-party information providers, customers, public sources, or through transactions such as mergers and acquisitions. We may combine this information with other information we collect from or about you. In these cases, our Privacy Policy governs the handling of the combined personal information. We use this information to operate, maintain, and provide to you the features and functionality of the Service, as well as to communicate directly with you, such as to send you email messages about products and services that may be of interest to you.

Other Uses of Personal Information

In addition to the uses described above, we may collect and use personal information for the following purposes:

• For our business activities, including to operate the Service and to provide you with the features and functionality of the Service;

• To communicate with you and respond to your requests, such as to respond to your questions, contact you about changes to the Service, and communicate about account related matters;

• For marketing and advertising purposes, such as to market to you or offer you with information and updates on our Service we think that you may be interested in. While we may use your personal information in this manner, please note that we do not use user content to serve you ads, and we will never share user content with any third parties for marketing or advertising purposes, unless you have explicitly submitted it to us for that purpose;

• For analytics, development, and research purposes to improve, develop, and optimize the use, function, and performance of the Site and Service;

• To enforce ourMaster Services Agreement,to resolve disputes, to carry out our obligations and enforce our rights, and to protect our business interests and the interests and rights of Heap, you, or third parties;

• To comply with contractual and legal obligations and requirements, including to respond to privacy requests or requests/communications from regulators, law enforcement authorities, or other governmental officials;

• To fulfill any other purpose for which you provide personal information; and

• For any other lawful purpose, or other purpose that you consent to.

2. HOW AND TO WHOM WE SHARE PERSONAL INFORMATION

We may also share, transmit, disclose, grant access to, make available, and provide personal information with and to third parties, as described below.

• Service Providers.We share personal information with third party contractors and service providers who perform services on our behalf, which are subject to reasonable confidentiality terms, and which may include processing payments, providing web hosting services, technology support providers, email communications providers, analytics providers, data storage providers, and web and video hosting providers and developers.

• Business Partners.We may disclose personal information to our business partners for transactional and marketing purposes, including to promote their products or services if you consent. We may also share your personal information with other third parties who may have products or services we think you may enjoy.

• Online Advertising Partners.We also share personal information with advertising networks or permit these partners to collect information from you directly on our websites to facilitate online advertising, such as search engines and social network advertising providers to serve targeted ads to you or to groups of other users who share similar traits, such as likely commercial interests and demographics, on third-party platforms. For more information, including how to opt out of interest-based advertising, please see our Cookie Policyhere.

• Contentsquare Group.We may share, disclose and transfer your personal information with Contentsquare Group for all purposes mentioned above.

• Corporate Transaction.We may transfer to third-parties any information we collect in the event we sell or transfer all or a portion of our business or assets (including any shares in the company) or any portion or combination of our products, services, businesses and/or assets. Should such a transaction occur (whether a divestiture, merger, acquisition, bankruptcy, dissolution, reorganization, liquidation, or similar transaction or proceeding), we will use reasonable efforts to ensure that any transferred information is treated in a manner consistent with this Privacy Policy.

• Legal Requirements.We may share your information with third parties, including government authorities or public authorities, courts, intergovernmental or supranational bodies, as required by law or subpoena or if we reasonably believe that such action is necessary to (a) comply with the law and the reasonable requests of law enforcement; (b) to enforce ourMaster Services Agreementor other agreements or to protect the security or integrity of the Heap services, including to prevent harm or financial loss, or in connection with preventing fraud or illegal activity; and/or (c) to exercise or protect the rights, property, or personal safety of Heap, our Customers, visitors, or others.

• With Your Consent.We may disclose your information publicly or with another third party with your prior authorization.

3. HOW LONG WILL WE STORE YOUR INFORMATION

We will usually keep the personal information we collect about you for no longer than necessary for the purposes set out in Section 1, in accordance with our legal obligations and legitimate business interests.

The criteria used to determine the period for which personal information about you will be retained varies depending on the legal basis under which we process the personal information:

1. Legitimate Interests.Where we are processing personal information based on our legitimate interests, we generally will retain such information for a reasonable period of time based on the particular interest, taking into account the fundamental interests and the rights and freedoms of data subjects.

2. Consent.Where we are processing personal information based on your consent, we generally will retain the information until you withdraw your consent, or otherwise for the period of time necessary to fulfill the underlying agreement with you or provide you with the applicable service for which we process that personal information.

3. Contract.Where we are processing personal information based on contract, we generally will retain the information for the duration of the contract plus some additional limited period of time that is necessary to comply with law or that represents the statute of limitations for legal claims that could arise from the contractual relationship.

4. Legal Obligation.Where we are processing personal information based on a legal obligation, we generally will retain the information for the period of time necessary to fulfill the legal obligation.

5. Legal Claim.We may need to apply a “legal hold” that retains information beyond our typical retention period where we face a threat of legal claim. In that case, we will retain the information until the hold is removed, which typically means the claim or threat of claim has been resolved.

In all cases, in addition to the purposes and legal bases, we consider the amount, nature and sensitivity of the personal information, as well as the potential risk of harm from unauthorised use or disclosure of your personal information.

4. CONTROL OVER YOUR INFORMATION

• Email Communications.From time to time, we may send you emails regarding updates to our Service, products or services, notices about our organization, or information about products/services we offer (or promotional offers from third parties) that we think may be of interest to you. If you wish to unsubscribe from such emails, simply click the “unsubscribe link” provided at the bottom of the email communication. Note that you cannot unsubscribe from certain services-related email communications (e.g., account verification, confirmations of transactions, technical or legal notices).

• Modifying Account Information.If you have an online account with us, you have the ability to modify certain information in your account (e.g., your contact information) through the [ “profile,” “account,” “settings,” or “preferences” ] options provided on the Site. If you would like to request access to, or correction or deletion of personal information, you may send your request to us at the email provided below..

• How to Control Push Notifications.You can stop receiving push notifications from us by changing your preferences in the iOS or Android notifications settings menu.

5.LINKS TO THIRD-PARTY WEBSITES AND SERVICES

For your convenience, our Service may provide links to third-party websites or services that we do not own or operate. We are not responsible for the practices employed by any websites or services linked to or from our Service, including the information or content contained within them. Your browsing and interaction on any other website or service are subject to the applicable third party’s rules and policies, not ours. If you are using a third-party website or service, you do so at your own risk. We encourage you to review the privacy policies of any site or service before providing any personal information.

6. CHILDREN’S PRIVACY

Our services are not intended for children under the age of 16. We do not knowingly solicit or collect personal information from children under the age of 16. If we learn that any personal information has been collected inadvertently from a child under 16, we will delete the information as soon as possible. If you believe that we might have collected information from a child under 16, please contact us via our Data Subject Request Formhere.

7. CHANGES TO PRIVACY POLICY

We reserve the right to change this Privacy Policy from time to time in our sole discretion. We will notify you about material changes in the way we treat personal information by sending a notice to the primary email address specified in your account, by placing a prominent notice on our Site, or through other appropriate communication channels. It is your responsibility to review this Privacy Policy periodically. All changes shall be effective from the date of publication unless otherwise provided.

8. CONTACT US

For additional inquiries about this Privacy Policy, please send us an email atprivacy@contentsquareor contact us at:

Heap, Inc.

53 Beach St, 6th Floor,

New York, NY 10013

Data Protection Officer:

Nicole Mazanitis

privacy@contentsquare