PRIVACY POLICY

1. WHAT INFORMATION DO WE COLLECT?

Personal information you disclose to us

In Short: We collect personal information that you provide to us.

We collect personal information that you voluntarily provide to us when you register on the Services, express an interest in obtaining information about us or our products and Services, participate in activities on the Services, or otherwise contact us.

Personal Information Provided by You. The personal information we collect depends on the context of your interactions with us and the Services, the choices you make, and the products and features you use. It may include:

• Email addresses
• Names

Sensitive Information. We do not process sensitive information.

Social Media Login Data. We may provide the option to register using an existing social-media account, such as Facebook, X, or another supported provider. If you choose to register this way, we will collect certain profile information from that provider as described in How Do We Handle Your Social Logins?

All personal information you provide must be true, complete, and accurate, and you must notify us of changes to that information.

2. HOW DO WE PROCESS YOUR INFORMATION?

In Short: We process your information to provide, improve, and administer our Services, communicate with you, prevent fraud, protect security, and comply with law. We may process information for other purposes only with your prior explicit consent where required.

We process personal information for reasons that depend on how you interact with our Services, including:

• To facilitate account creation and authentication and otherwise manage user accounts. We may process information so you can create and log in to your account and keep the account in working order.
• To save or protect an individual’s vital interest. We may process information when necessary to save or protect an individual’s vital interests, such as to prevent harm.

3. WHAT LEGAL BASES DO WE RELY ON TO PROCESS YOUR INFORMATION?

In Short: We process personal information only when we believe it is necessary and we have a valid legal reason under applicable law, such as consent, compliance with law, performance of a contract, protection of rights, or legitimate interests.

If you are located in the EU or UK

The General Data Protection Regulation and UK GDPR require us to explain the legal bases we rely on to process personal information. We may rely on:

• Consent. We may process information when you have given permission for a specific purpose. You may withdraw consent at any time. See Withdrawing your consent.
• Legal Obligations. We may process information where necessary to comply with legal obligations, cooperate with law-enforcement or regulatory bodies, exercise or defend legal rights, or provide evidence in litigation.
• Vital Interests. We may process information where necessary to protect your vital interests or those of a third party, including situations involving potential threats to a person’s safety.

If you are located in Canada

We may process information when you have given express consent for a specific purpose or where consent may lawfully be implied. You may withdraw consent at any time.

In exceptional cases, applicable law may permit processing without consent, including:

• When collection is clearly in an individual’s interests and consent cannot be obtained in a timely way.
• For investigations and fraud detection or prevention.
• For qualifying business transactions.
• When information is contained in a witness statement and is needed to assess, process, or settle an insurance claim.
• For identifying injured, ill, or deceased persons and communicating with next of kin.
• When there are reasonable grounds to believe an individual has been, is, or may be a victim of financial abuse.
• When collection with consent would reasonably be expected to compromise the availability or accuracy of information needed to investigate a breach of an agreement or a contravention of Canadian or provincial law.
• When disclosure is required by subpoena, warrant, court order, or court rules relating to production of records.
• When information was produced by an individual in the course of employment, business, or a profession and collection is consistent with the purpose for which it was produced.
• When collection is solely for journalistic, artistic, or literary purposes.
• When the information is publicly available and specified by regulation.
• We may disclose de-identified information for approved research or statistics projects, subject to ethics oversight and confidentiality commitments.

4. WHEN AND WITH WHOM DO WE SHARE YOUR PERSONAL INFORMATION?

In Short: We may share information in the specific situations described below and/or with specified third parties.

• Business Transfers. We may share or transfer information in connection with, or during negotiations concerning, a merger, sale of company assets, financing, or acquisition of all or part of our business by another company.
• Service Providers. We may disclose personal information to service providers under written contracts where necessary to operate and support the Services.

5. HOW DO WE HANDLE YOUR SOCIAL LOGINS?

In Short: If you register or log in using a social-media account, we may have access to certain information about you.

Our Services may offer the ability to register and log in using third-party social-media account details, such as Facebook or X. If you choose this option, we may receive profile information from the provider. The information may vary by provider but often includes your name, email address, friends list, profile picture, and other information you make public on that platform.

We will use information received from a social-media provider only for the purposes described in this Privacy Notice or otherwise made clear to you on the relevant Services. We do not control and are not responsible for the provider’s other uses of your personal information. Review the provider’s privacy notice and privacy settings to understand its practices.

6. HOW LONG DO WE KEEP YOUR INFORMATION?

In Short: We keep information for as long as necessary to fulfill the purposes described in this Privacy Notice unless law requires or permits a longer period.

We retain personal information only for as long as necessary for the purposes set out in this Privacy Notice, unless a longer retention period is required or permitted by law, such as for tax, accounting, or other legal requirements. No purpose in this notice requires us to keep personal information longer than the period in which a user has an account with us.

When we no longer have an ongoing legitimate business need to process personal information, we will delete or anonymize it. If immediate deletion is not possible, such as because information is stored in backup archives, we will securely store and isolate it from further processing until deletion is possible.

7. DO WE COLLECT INFORMATION FROM MINORS?

In Short: We do not knowingly collect data from or market to children under 18 years of age, or the equivalent age specified by law in the user’s jurisdiction.

We do not knowingly collect or solicit data from, market to, or sell personal information concerning children under 18 or the equivalent legal age in the applicable jurisdiction. By using the Services, you represent that you are at least the applicable minimum age or that you are the parent or guardian of a minor dependent and consent to that dependent’s use of the Services.

If we learn that personal information from an underage user has been collected, we will deactivate the account and take reasonable measures to delete the data promptly. Please report possible underage data collection to smartlp.support@icloud.com.

8. WHAT ARE YOUR PRIVACY RIGHTS?

In Short: Depending on your US state or your region, including the European Economic Area, United Kingdom, Switzerland, and Canada, you may have rights that provide greater access to and control over your personal information. You may review, change, or terminate your account at any time, subject to applicable law.

Rights may include requesting access to and a copy of personal information, rectification or erasure, restriction of processing, data portability where applicable, and protection from solely automated decisions. If a decision producing legal or similarly significant effects is made solely by automated means, we will inform you, explain the principal factors, and provide a simple way to request human review. In certain circumstances, you may also object to processing.

Submit requests through the contact details in How Can You Contact Us About This Notice?. We will consider and act upon requests in accordance with applicable data protection laws.

UK complaints

If you are located in the UK and are unhappy with how we handled your personal information, you may complain directly to us in addition to exercising rights under the UK GDPR and Data Protection Act 2018.

How to contact us:

• Email: smartlp.support@icloud.com

What happens after you complain:

• We will acknowledge your complaint within 30 days of receiving it.
• We will investigate without unjustifiable or excessive delay.
• We will keep you informed of progress and explain the outcome.

If you are not satisfied with our final response, you may refer the complaint to the Information Commissioner’s Office, the UK supervisory authority:

• Website: ico.org.uk/make-a-complaint
• Helpline: 0303 123 1113
• Post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

Residents of the EEA or UK who believe we are unlawfully processing personal information may also complain to their data protection authority or the UK data protection authority. Residents of Switzerland may contact the Federal Data Protection and Information Commissioner.

Withdrawing your consent

If we rely on consent to process personal information, which may be express or implied depending on applicable law, you may withdraw consent at any time by contacting us or updating your preferences. Withdrawal does not affect the lawfulness of processing conducted before withdrawal or processing based on lawful grounds other than consent.

Account Information

To review or change account information or terminate your account, you may:

• Log in to account settings and update your user account.
• Contact us using the information in this notice.

Upon a request to terminate an account, we will deactivate or delete the account and information from active databases. We may retain limited information where necessary to prevent fraud, troubleshoot problems, assist investigations, enforce legal terms, or comply with legal requirements.

Questions about privacy rights may be sent to smartlp.support@icloud.com.

9. CONTROLS FOR DO-NOT-TRACK FEATURES

Most web browsers and some mobile operating systems and applications include a Do-Not-Track (“DNT”) feature or setting that signals a preference not to have online browsing activity monitored and collected. No uniform technology standard for recognizing and implementing DNT signals has been finalized. We therefore do not currently respond to DNT browser signals or other mechanisms that automatically communicate a choice not to be tracked online. If a standard is adopted that we must follow, we will describe that practice in a revised notice.

California law requires us to explain our response to browser DNT signals. Because there is currently no industry or legal standard for recognizing or honoring DNT signals, we do not respond to them at this time.

10. DO UNITED STATES RESIDENTS HAVE SPECIFIC PRIVACY RIGHTS?

In Short: Residents of California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, or Virginia may have rights to request access to and details about personal information, correct inaccuracies, obtain a copy, delete information, or withdraw consent. Rights may be limited by applicable law.

Categories of Personal Information We Collect

The table shows categories of personal information collected during the preceding twelve months. Examples are illustrative and do not necessarily describe every data element collected. See What Information Do We Collect? for the personal information identified in this notice.

We may also collect other personal information when you interact with us in person, online, or by phone or mail in connection with:

• Receiving help through customer-support channels.
• Participating in customer surveys or contests.
• Facilitating delivery of the Services and responding to inquiries.

Category A information is retained for as long as the user has an account with us, subject to the retention terms elsewhere in this notice.

Sources of Personal Information

See What Information Do We Collect? for the sources of personal information.

How We Use and Share Personal Information

See How Do We Process Your Information? and When and With Whom Do We Share Your Personal Information?.

We may disclose personal information to service providers under written contracts. We may use personal information for our own business purposes, including internal research, technological development, and demonstration. This is not considered a sale of personal information.

We have not disclosed, sold, or shared personal information with third parties for a business or commercial purpose in the preceding twelve months. We will not sell or share personal information belonging to website visitors, users, and other consumers in the future.

Your Rights

Rights under US state privacy laws are not absolute and may be declined where permitted by law. Depending on the applicable law, rights may include:

• The right to know whether we process your personal data.
• The right to access your personal data.
• The right to correct inaccuracies in your personal data.
• The right to request deletion of your personal data.
• The right to obtain a copy of personal data you previously shared with us.
• The right to non-discrimination for exercising privacy rights.
• The right to opt out of targeted advertising, sale of personal data, sharing as defined under California law, or profiling in furtherance of decisions producing legal or similarly significant effects.

Depending on your state, additional rights may include:

• Access to the categories of personal data being processed, including where permitted by Minnesota law.
• A list of categories of third parties to which personal data was disclosed, including where permitted in California, Delaware, and Maryland.
• A list of specific third parties to which personal data was disclosed, including where permitted in Minnesota and Oregon.
• A list of third parties to which personal data was sold, including where permitted in Connecticut.
• The right to review, understand, question, and in some locations correct how personal data has been profiled, including where permitted in Connecticut and Minnesota.
• The right to limit the use and disclosure of sensitive personal data, including where permitted in California.
• The right to opt out of collection of sensitive data and personal data collected through a voice- or facial-recognition feature, including where permitted in Florida.

How to Exercise Your Rights

Submit a data subject access request, email smartlp.support@icloud.com, or use the contact details below.

Under certain state laws, you may designate an authorized agent to make a request on your behalf. We may deny an agent request that does not include proof of valid authorization in accordance with applicable law.

Request Verification

After receiving a request, we may need to verify your identity and authority. We use information provided in the request only for verification, security, or fraud-prevention purposes. If identity cannot be verified from information already maintained, we may request additional information. An authorized agent may need to provide written and signed permission from you.

Appeals

Where applicable state law permits an appeal, you may appeal a decision by emailing smartlp.support@icloud.com. We will provide a written response explaining any action taken or not taken. If an appeal is denied, you may submit a complaint to your state attorney general.

California “Shine The Light” Law

California Civil Code section 1798.83 permits California residents to request, once per year and free of charge, information about categories of personal information disclosed to third parties for direct-marketing purposes and the names and addresses of those third parties. Submit a written request using the details in How Can You Contact Us About This Notice?.

11. DO WE MAKE UPDATES TO THIS NOTICE?

In Short: Yes. We update this notice as necessary to remain compliant with relevant laws.

We may update this Privacy Notice from time to time. The updated version will be identified by a revised date at the top. If we make material changes, we may post a prominent notice or send a direct notification. We encourage you to review this notice frequently.

12. HOW CAN YOU CONTACT US ABOUT THIS NOTICE?

Questions or comments may be sent by email to smartlp.support@icloud.com or by post to:

13. HOW CAN YOU REVIEW, UPDATE, OR DELETE THE DATA WE COLLECT FROM YOU?

Based on the laws of your country or US state of residence, you may have the right to request access to personal information, receive details about how it has been processed, correct inaccuracies, delete personal information, or withdraw consent. These rights may be limited in some circumstances by applicable law.

To request review, correction, access, or deletion, submit a data subject access request.