Privacy Notice

Notice at Collection, Information We Collect and How We Use It

This section describes our collection and use of information practices through our Services, also serves as our Notice at Collection for California residents for purposes of the California Consumer Privacy Act (“CCPA”).

VectorBuilder does not sell personal information. VectorBuilder does not share personal information for cross-context behavioral advertising purposes. VectorBuilder does not collect sensitive personal information as defined under the applicable data protections laws.

Data retention

We retain your personal information for as long as necessary to carry out the purposes described in this Privacy Notice, or as otherwise required by applicable law. The length of time we retain personal information varies based on whether the information is needed to administer your account, deliver services, meet legal or regulatory requirements, resolve disputes, or enforce our agreements and policies. When personal information is no longer required, we securely delete or anonymize it. You may request us to delete your personal information (see details in Your Rights and Choices section).

Cookie notice

We and our third-party service providers use cookies and similar technologies on our websites to collect information automatically. A cookie is a small data file downloaded to your computer or device when you visit our websites. We use the following categories of cookies:

• Strictly necessary cookies: These cookies are essential for our websites to function properly. They enable core functionality such as login, region selection, and secure access to your account. These cookies cannot be disabled.

• Analytics cookies: We use analytics cookies, including Google Analytics, to understand how visitors use our websites. Google Analytics collects data anonymously, including number of visitors, time on page, pages visited, and browsing patterns. A user-ID is assigned to logged-in users for anonymized website tracking across multiple devices; no personally identifiable data is connected to the user-ID. For more information on Google’s privacy practices, see https://policies.google.com/privacy.

• Functional/performance cookies: These cookies allow us to remember your actions and preferences (such as login status and region selection) to enhance your browsing experience.

• Advertising and targeting: VectorBuilder does not enable advertising features such as Google Signals or remarketing through Google Analytics, and does not share personal information with advertising networks for targeted advertising purposes.

• Data shared with Google: Information collected by Google Analytics cookies (e.g. pages visited, session duration, device type, approximate geographic location derived from IP address) is transmitted to Google servers for traffic analysis. VectorBuilder does not share personally identifiable information with Google through these cookies.

Opt-Out Mechanisms: You may manage or block cookies through your browser settings. Most browsers allow you to refuse or delete cookies in their “Tools” or “Preferences” menu. If you choose to disable cookies, some website features may be limited. You may also opt out of Google Analytics by installing the Google Analytics opt-out browser add-on available at https://tools.google.com/dlpage/gaoptout. For more information about managing cookies, visit https://www.aboutcookies.org/.

Global Privacy Control (GPC): Where required by applicable law, we recognize and honor Global Privacy Control (GPC) signals transmitted by your browser. When we detect a GPC signal, we will treat it as a valid opt-out request for the sale or sharing of personal information associated with that browser.

Do Not Track: Your browser may transmit a “Do Not Track” (DNT) signal to websites you visit. Because there is no consistent industry standard for responding to DNT signals, our websites are not currently configured to respond to DNT signals from browsers.

How do we protect your information

We will not share your personal information with third parties without your permission or as required by law. We may disclose personal information to service providers who perform services on our behalf (such as payment processing, data analytics, customer support, cloud hosting, fulfillment, and shipping). These providers access personal information solely to perform services for us and are bound by contractual confidentiality obligations.

No mobile information will be shared with third parties/affiliates for marketing/promotional purposes. All other categories exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties.

Your information is safely stored in our computer systems, protected by commercially reasonable technical and organizational security measures, and only accessed by authorized VectorBuilder personnel. These measures include network firewalls, endpoint protection, encryption of data in transit and at rest, role-based access controls, and continuous system monitoring.

We may also disclose personal information: (a) to our affiliates or within our corporate group for internal business purposes; (b) in connection with a business transaction, such as a merger, acquisition, or asset sale; (c) to comply with applicable legal obligations, respond to lawful requests, or protect our rights, property, or safety; or (d) when you direct us or consent to such disclosure.

Your Rights and Choices

Regardless of your location, you have certain fundamental rights with respect to your personal information as described below. Depending on your jurisdiction and applicable law, you may also have additional rights as described in the jurisdiction specific sections below.

Unified rights (applicable to all individuals)

The following rights apply to all individuals whose personal information we process, regardless of jurisdiction. These rights reflect obligations common to the GDPR, UK GDPR, and CCPA/CPRA.

• Right to access / right to know: You may request confirmation of whether we process your personal information and, if so, obtain access to and a copy of that information, including the categories and specific pieces of personal information we have collected, the sources of collection, the purposes of processing, and the categories of third parties to whom we have disclosed it.

• Right to rectification / right to correct: You may request that we correct inaccurate or incomplete personal information that we maintain about you.

• Right to erasure / right to delete: You may request that we delete personal information we have collected from or about you, subject to certain exceptions permitted by applicable law.

To exercise any of these rights, please see the jurisdiction-specific section applicable to where you live below.

Information for individuals in the European Economic Area and United Kingdom (GDPR / UK GDPR)

Additional Rights Under GDPR / UK GDPR: Subject to applicable law, individual in the EEA and UK have the following additional rights with respect to their personal data (in addition to the unified rights described above):

• Right to restriction of processing: You may request that we restrict the processing of your personal data in certain circumstances.

• Right to data portability: You may request to receive your personal data in a structured, commonly used, machine-readable format, or to have it transmitted to another controller where technically feasible.

• Right to object: You may object to processing based on legitimate interests or direct marketing at any time.

• Right to withdraw consent: Where we process personal data based on your consent, you may withdraw that consent at any time.