Effective date: 18 June 2026

Last Updated: 18 June 2026

1. Introduction and Scope

This Privacy Policy applies to personal information collected through the Website, through our products and services, and through any offline interactions with us (collectively, our “Services”). It applies to visitors, clients, prospects, job applicants, business partners, and any other individual whose personal information we process.

This Policy does not apply to the personal information of InfoBeans employees or contractors, which is governed by separate internal policies.

2.Information We Collect

We collect personal information in three ways: information you provide directly, information collected automatically when you use the Website, and information obtained from third-party sources.

2.1 Information You Provide Directly

We collect personal information when you voluntarily provide it, including when you:

• Request information about InfoBeans services or submit an inquiry
• Subscribe to marketing communications
• Register for or attend an event
• Apply for employment
• Complete a survey or provide feedback
• Contact our sales or support teams

The personal information collected in these contexts may include: your name, job title, company name, email address, telephone number, mailing address, account credentials, and the content of any free-text communications you send us.

2.2 Information Collected Automatically — Website Tracking Technologies

When you visit the Website, certain information is collected automatically through your browser and device as a necessary function of how the internet operates. This includes:

• Internet Protocol (IP) address: Your IP address is a numerical identifier assigned to your device by your internet service provider. It is transmitted as part of every HTTP request your browser makes and is received by our web servers and, where applicable, by third-party services we use. IP addresses may be used to derive approximate geographic location (city or country level). Under California law and certain other privacy frameworks, an IP address is personal information.
• Device and browser identifiers: Hardware model, operating system version, browser type and version, screen resolution, language settings, and similar technical attributes.
• Usage data: Pages visited, links clicked, time spent on pages, referring URLs, and interaction patterns.
• Cookies and similar technologies: See Section 5 (Cookies and Tracking Technologies) for a full description.
• Addressing and signaling information: As part of the HTTP communications necessary to load and operate the Website, your browser transmits addressing and signaling information — including your IP address and device/browser identifiers — to our servers and to third-party services integrated into the Website. This is an inherent and technically necessary characteristic of how web browsers communicate with web servers.

2.3 Information from Third-Party Sources

Subject to applicable law, we may obtain information about you from third-party sources such as public databases, marketing partners, resellers, social media platforms, and business information providers. This may include company information, job role, professional profile, and product or service interest data. We use this information to supplement our records and improve the relevance of our communications.

2.4 Information We Process on Behalf of Customers

When InfoBeans provides technology services to enterprise customers, those customers and their end-users may submit data to InfoBeans systems. InfoBeans processes such data as a service provider or processor on behalf of the customer, under the terms of our contract with that customer. This Policy does not govern that processing. If you have questions about how your information is handled within a customer’s InfoBeans-powered environment, please contact that customer directly.

CCPA / CPRA Categories of Personal Information Collected: Identifiers (name, email, IP address, device ID); Professional or employment-related information; Internet or other electronic network activity information (browsing history, interaction data); Geolocation data (city/country level derived from IP); Inferences drawn from the above to create a profile. We do not intentionally collect sensitive personal information as defined by CPRA (such as Social Security numbers, financial account details, health data, racial or ethnic origin, or precise geolocation) through the Website.

3. How We Use Your Information

We use personal information for the following purposes, and only to the extent permitted by applicable law:

• Providing and improving our Services: Processing inquiries, delivering services, managing accounts, and improving Website functionality and content.
• Marketing and communications: Sending news, updates, event invitations, and promotional materials where you have provided consent or where a legitimate interest applies and is not overridden by your rights.
• Analytics and site measurement: Understanding how visitors use the Website, measuring the effectiveness of our content, and identifying areas for improvement. Analytics data is used only after obtaining required consent.
• Security and fraud prevention: Detecting, preventing, and responding to security incidents, spam, and fraudulent or unlawful activity.
• Legal and compliance: Complying with applicable laws, regulations, legal process, and enforceable governmental requests.
• Business operations: Record-keeping, internal reporting, and auditing.
• Employment: Processing job applications and managing recruitment.

We do not use personal information for automated decision-making that produces legal or similarly significant effects without human review, except where required or permitted by law and disclosed at the point of collection.

4. How We Share Your Information

We do not sell your personal information for monetary consideration. We may share personal information in the following circumstances:

• Service providers and vendors: We share personal information with third-party vendors who perform services on our behalf (e.g., hosting, email delivery, analytics, customer support tools). These vendors are contractually required to use your information only to perform services for us and to maintain appropriate security.
• Third-party tracking and analytics tools: When you consent to non-essential cookies and tracking, your information (including IP address and device identifiers) is shared with the third-party vendors of those tools as described in Section 5. This sharing may constitute “sharing” of personal information for cross-context behavioral advertising under the CCPA/CPRA, and you have the right to opt out.
• Business partners: We may share information with business partners to deliver joint services or co-marketing activities, with your prior consent.
• Affiliated companies: We may share information within the InfoBeans group of companies for sales, marketing, and service delivery purposes.
• Legal requirements: We may disclose information where required by law, subpoena, court order, or governmental authority, or where necessary to protect the rights, property, or safety of InfoBeans, our customers, or the public.
• Corporate transactions: In connection with a merger, acquisition, sale of assets, or similar transaction, personal information may be transferred as part of the transaction, subject to equivalent privacy protections.

California residents: You have the right to opt out of the sharing of your personal information for cross-context behavioral advertising. See Section 8 (Your California Privacy Rights) and the “Do Not Sell or Share My Personal Information” section for how to exercise this right.

5. Cookies and Tracking Technologies

5.1 What Are Cookies and Tracking Technologies?

Cookies are small text files placed on your device by websites you visit. Tracking technologies also include pixels (small image files), tags, SDKs, and scripts that transmit data about your visit to first-party or third-party servers. When your browser loads a web page, it sends HTTP requests that inherently transmit your IP address and device identifiers to each server from which resources are requested — including third-party servers.

In addition to cookies, the Website uses two types of browser storage for certain necessary and functional features:

Session storage, which is automatically deleted when you close your browser tab or window.
Local storage, which is not automatically sent to our servers with each request and remains on your device — with no fixed expiration date — until cleared by you, by your browser, or programmatically by the Website.

See Section 5.2 for the specific items stored under each.

5.2 Categories of Cookies We Use

• Necessary (Always Active): Required to enable the basic features, functional features, and security functions of the Website — such as the Ask Expona AI chat assistant, language preference, spam protection, and storing your cookie consent preferences so your selected settings are respected on future visits. These cookies do not store personally identifiable information for advertising or analytics purposes and cannot be disabled through the cookie preference center. Cookies set under this category include: _GRECAPTCHA, cookieyes-consent.
  In addition to cookies, the following browser storage is used to support the Website’s necessary and functional features:
  • Session storage: chatbot_input_message, expona_* — retain your in-progress message and conversation session with the Ask Expona AI assistant for the duration of your browsing session, so it is not lost if you reload the page. This data is automatically cleared when you close the browser tab or window and is not transmitted to us or to any third party.
  • Local storage: stores your selected display language preference so it is remembered across visits. This data is not transmitted to us or to any third party.
    
• Analytics: These cookies help us understand how visitors interact with the Website by collecting and reporting information anonymously. They allow us to measure website usage, analyze visitor behavior, monitor site performance, and improve the overall user experience. Analytics cookies are disabled by default and are activated only after you provide consent through the cookie preference center. Cookies set under this category include: _ga,_ga_*, _clck,_clsk
• Advertisement: These cookies are used to measure the effectiveness of advertising campaigns, track ad-driven conversions, and help us understand how users interact with our marketing efforts. They may be used to attribute visits and conversions to advertising campaigns and improve the relevance and performance of our advertising activities. Advertisement cookies are disabled by default and are activated only after you provide consent through the cookie preference center.Cookies set under this category include:_gcl_au,gclid

5.3 Cookies and Tracking Technologies

The following third-party tools are integrated into the Website. Non-essential tools are loaded only after you provide consent through our cookie consent manager. The table below discloses each tool, its purpose, the data it transmits, and whether consent is required.

5.4 Consent Management — How We Obtain and Honor Your Consent

When you first visit the Website, a cookie consent banner (powered by CookieYes) will ask for your permission before any non-essential tracking technologies are activated. The banner presents a “Customize Consent Preferences” panel with three action buttons at the bottom. You may:

• Reject All — decline all non-essential tracking. Only Necessary cookies will remain active. All Analytics and Advertisement cookies are blocked.
• Save My Preferences — save your customised selection after toggling individual categories on or off in the “Customize Consent Preferences” panel. You can expand each category to view the specific cookies it contains before making your choice.
• Accept All — consent to all categories of non-essential tracking, including Analytics and Advertisement cookies.

The “Customize Consent Preferences” panel lists the three consent categories — Necessary (Always Active), Analytics, and Advertisement — and allows you to expand each category to view the individual cookies it contains, including each cookie’s name, duration, and description. The Necessary category cannot be toggled off. Analytics and Advertisement toggles are off by default and require your explicit action to enable. The full cookie list visible within the plugin is the authoritative disclosure of all cookies active on this Website at any given time.

Non-essential third-party scripts are technically blocked from executing until you make a choice. Your selection is saved in the cookieyes-consent cookie and honoured on future visits. You may update your preferences at any time by clicking the “Cookie Preferences” link in our website footer, which re-opens the consent panel.

We use Google Consent Mode v2 to ensure that Google services (Analytics, Ads, reCAPTCHA) operate in a consent-respecting mode and do not transmit identifying data before the relevant consent is granted.

5.5 How to Manage Cookies

In addition to our consent manager, you may control cookies through your browser settings. Instructions for major browsers are available at:

• Chrome: support.google.com/chrome/answer/95647
• Firefox: support.mozilla.org/kb/enhanced-tracking-protection
• Safari: support.apple.com/guide/safari/manage-cookies
• Edge: support.microsoft.com/microsoft-edge/delete-cookies

Note that disabling all cookies may affect the functionality of the Website. Strictly necessary cookies cannot be disabled through our consent manager.

6. Data Retention

We retain personal information for as long as necessary to fulfill the purposes described in this Policy, to comply with our legal obligations, to resolve disputes, and to enforce our agreements. Typical retention periods are:

• Website analytics data: Up to 14 months from collection (GA4 default), after which it is aggregated or deleted.
• Marketing contact records: Until you opt out or request deletion, or after 3 years of inactivity.
• Sales and CRM records: For the duration of the business relationship plus 5 years, or as required by law.
• Job applicant data: Up to 12 months after the close of a recruitment process, unless a longer period is required by law or the candidate consents to longer retention.
• Legal and compliance records: As required by applicable law, typically 5–7 years.
• Session recording data (Clarity): 30 days from collection, per Microsoft Clarity defaults.

When personal information is no longer required, we delete or anonymize it in a manner consistent with our data destruction policies.

7. Security

InfoBeans employs organizational and technical security measures appropriate to the nature and sensitivity of the personal information we process. These measures include:

• Encryption of data in transit (TLS/HTTPS) and at rest where applicable
• Access controls limiting personal information to personnel who need it
• Network monitoring, intrusion detection, and firewall protection
• Regular security assessments and vulnerability management
• Contractual data security obligations imposed on service providers

No transmission over the internet or electronic storage system is fully secure. While we take reasonable steps to protect your personal information, we cannot guarantee absolute security. In the event of a data breach that is likely to result in a risk to your rights and freedoms, we will notify you and the relevant regulatory authorities as required by applicable law.

8. Your California Privacy Rights (CCPA / CPRA)

This section applies to California residents. The California Consumer Privacy Act of 2018 (CCPA), as amended by the California Privacy Rights Act of 2020 (CPRA), provides California residents with specific rights regarding their personal information.

8.1 Your Rights

8.2 Do Not Sell or Share My Personal Information

InfoBeans does not sell personal information for monetary consideration. However, the sharing of personal information with third-party analytics and advertising vendors when you consent to non-essential cookies may constitute “sharing” for cross-context behavioral advertising under the CCPA/CPRA.

California residents may opt out of this sharing at any time by:

• Using our cookie consent manager: Click the “Cookie Preferences” link in the footer of any page and select “Reject All” or deselect Marketing/Analytics categories.
• Submitting a written opt-out request: Email privacy@infobeans.ai with the subject line “Do Not Share My Personal Information” and we will process your request within 15 business days.
• Global Privacy Control (GPC): If your browser transmits a GPC signal, we will treat it as an opt-out of sharing for behavioral advertising purposes.

8.3 How to Exercise Your Rights

To submit a verifiable consumer request to know, delete, or correct your personal information, please contact us using one of the following methods:

• Email: privacy@infobeans.ai
• Mail: Privacy Request, InfoBeans Inc., 4115 Blackhawk Plaza Cir, Ste 100, Danville, CA 94506, USA

We will acknowledge your request within 10 business days and respond within 45 calendar days. If we require additional time (up to 90 days total), we will notify you in writing of the extension and the reason. We will verify your identity before processing requests that involve accessing or deleting specific personal information. We do not charge a fee for exercising your privacy rights, and we will not discriminate against you for doing so.

You may designate an authorized agent to submit requests on your behalf. Authorized agents must provide written authorization signed by you, and we may verify your identity directly.

8.4 California Shine the Light (Civil Code § 1798.83)

California residents who have provided personal information to InfoBeans may request information about our disclosures of personal information to third parties for their direct marketing purposes during the preceding calendar year. To make such a request, contact us at privacy@infobeans.ai with the subject line “Shine the Light Request.” We will respond within 30 days.

8.5 Categories of Personal Information Disclosed in the Past 12 Months

In the preceding 12 months, InfoBeans has disclosed the following categories of personal information to third-party service providers for business purposes:

• Identifiers (if available – name, email address, IP address, device identifiers) — shared with analytics, email, and hosting providers
• Professional or employment-related information — shared with CRM and marketing automation providers
• Internet or other electronic network activity — shared with analytics and session-recording providers
• Geolocation data (approximate, city/country level derived from IP) — shared with analytics providers

9. Your European Privacy Rights (GDPR)

If you are located in the European Economic Area (EEA), the United Kingdom, or Switzerland, the following additional provisions apply.

9.1 Legal Bases for Processing

We process personal information only where we have a lawful basis to do so:

• Consent: For non-essential cookies, marketing communications, and any other processing where we have asked for your consent. You may withdraw consent at any time without affecting the lawfulness of processing before withdrawal.
• Contract: Where processing is necessary to perform our contractual obligations to you or to take pre-contractual steps at your request.
• Legitimate interests: For purposes such as improving our Services, security, fraud prevention, and direct marketing to existing contacts, where these interests are not overridden by your rights. You may object to processing based on legitimate interests at any time.
• Legal obligation: Where processing is required to comply with applicable law.

9.2 Your GDPR Rights

EEA, UK, and Swiss residents have the right to: access their personal data; request rectification; request erasure (“right to be forgotten”); restrict processing; object to processing; data portability; and not be subject to solely automated decision-making with significant legal effects. To exercise these rights, contact privacy@infobeans.ai or our EU Representative (details below).

9.3 International Data Transfers

InfoBeans is headquartered in the United States. When we transfer personal information from the EEA, UK, or Switzerland to the US or other countries, we rely on approved transfer mechanisms including: the EU–US Data Privacy Framework (where applicable); Standard Contractual Clauses approved by the European Commission; the UK International Data Transfer Agreement; or other lawful transfer mechanisms. You may request a copy of the applicable safeguards by contacting privacy@infobeans.ai.

9.4 EU Representative

InfoBeans has appointed an EU Representative as required by Article 27 of the GDPR:

Name: RF Privacy Minders Ltd
Address: 33 Konstantinou Paleologou, The Square, 2nd Floor, CY-6036 Larnaca, P.O. Box 42364, CY-6533, Larnaca, Cyprus
Email: infobeans.eu@privacyminders.com
Tel: +357 24 323333

You may also lodge a complaint with the supervisory authority in your country of residence. A list of EEA supervisory authorities is available at edpb.europa.eu.

10. Other Privacy Rights and Notices

10.1 Marketing Opt-Out

You may opt out of marketing communications at any time by clicking “Unsubscribe” in any marketing email, or by emailing privacy@infobeans.ai. We will process opt-outs within 10 business days. Transactional communications (e.g., service updates, account notices) are not subject to marketing opt-out.

10.2 Sensitive Personal Information

We do not intentionally collect sensitive personal information through the Website, including health or medical information, racial or ethnic origin, political opinions, religious or philosophical beliefs, financial account details, or Social Security numbers. Please do not provide sensitive personal information through Website contact forms or communications unless specifically requested and necessary.

10.3 Children’s Privacy

Our Services are directed to businesses and professionals and are not intended for children under the age of 18. We do not knowingly collect personal information from children under 18. If we learn we have inadvertently collected such information, we will delete it promptly. If you believe we may have collected information from a child, contact us at privacy@infobeans.ai.

10.4 Third-Party Websites

The Website may contain links to third-party websites. We are not responsible for the privacy practices of those sites and encourage you to review their privacy policies before providing any personal information.

10.5 Privacy by Design

InfoBeans is committed to embedding privacy considerations into the design of our systems, tools, and processes. New third-party tools and technologies undergo privacy review before deployment on the Website, and we require privacy and data protection assessments for processing activities that may present elevated risk.

11. Contact Us

For questions, concerns, or requests relating to this Privacy Policy or our handling of your personal information, please contact:

Privacy Contact / Data Protection Officer

InfoBeans Technologies Limited
Crystal IT Park
2^nd Floor, Ring Road Square
Indore 452001, MP, India
Email: privacy@infobeans.ai

For EU/EEA inquiries, you may also contact our EU Representative (see Section 9.4).

We aim to respond to all privacy inquiries within 30 days. For CCPA requests, see Section 8.3 for applicable response timelines.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will update the “Last Updated” date at the top of this page and, where required by applicable law, provide more prominent notice (such as an email notification or a banner on the Website). We will not retroactively apply material changes in ways that reduce your rights without your consent.

Your continued use of the Website after the effective date of any update constitutes your acknowledgment of the updated Policy. We encourage you to review this Policy periodically.

This Privacy Policy was prepared to comply with the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA), the EU General Data Protection Regulation (GDPR), the California Invasion of Privacy Act (CIPA), and general industry best practices for IT services companies. It supersedes and replaces all prior versions, including the version dated June 5, 2018.

Caude has become an integral part of our loyalty platform workflow. From designing complex data engineering solutions to reviewing code, optimizing existing services, and accelerating analytical investigations, it consistently helps our teams deliver faster while maintaining high quality standards.InfoBeans has consistently exceeded our expectations on this engagement through its exceptional quality of work, strong sense of accountability, and commitment to delivering results. The team takes responsibility for outcomes, communicates proactively, and consistently delivers on its commitments. Mirko Gojkovic, CTO, Velocity Logic Group