TLDNXS Privacy Policy

This policy covers information Esotech collects and controls.

It does not mean Esotech sells customer data. We do not sell our customers' data or our customer base.

TLDNXS is a SaaS CRM and dialer platform. Our customers upload, manage, and dial their own leads and contact lists. When a customer places outbound calls or sends messages through TLDNXS, that activity is the customer's use of the platform on data the customer controls. Esotech provides the software and infrastructure. The customer remains responsible for the lawfulness of their campaigns, consent, DNC compliance, and how they obtained their leads.

Customer Content stored in a customer account is processed to provide the Services under the customer's agreement with Esotech. That is service provider / processor activity, not a sale of personal information by Esotech.

• Website visitors and prospects who browse the Site, submit a walkthrough or contact form, or receive our marketing communications.
• Customer account users (admins, agents, and other authorized users) who log into TLDNXS.
• End consumers / leads whose information a customer stores or contacts through TLDNXS are primarily the customer's responsibility. Esotech processes that information to provide the Services to the customer.

3.1 Information you provide

Depending on how you interact with us, you may provide:

• Name, email, phone, company, role, and message content (for example, walkthrough or sales forms)
• Account registration details (name, work email, username, password, company)
• Billing and payment-related details needed to process invoices (handled through payment processors where applicable)
• Support requests, survey responses, and correspondence
• Configuration and content you or your organization put into TLDNXS (leads, contacts, notes, recordings, documents, and similar Customer Content)

3.2 Information collected automatically

When you use the Site or Services, we and our service providers may automatically collect:

• IP address, device and browser type, operating system
• Pages viewed, links clicked, referring URLs, timestamps
• Approximate location derived from IP
• Log and security data needed to operate and protect the Services
• Cookie and similar technology data (see Section 5)

3.3 Information from customers and integrations

If you are an end consumer contacted by a TLDNXS customer, the customer may upload your information into TLDNXS or connect integrations that send data into their account. Esotech processes that Customer Content to provide the Services to that customer.

We use information to:

• Operate, maintain, secure, and improve the Site and Services
• Create and manage accounts, authenticate users, and provide support
• Respond to inquiries, schedule walkthroughs, and communicate about our products
• Process transactions and send service-related notices
• Analyze Site and product usage (including through Google Analytics and similar tools)
• Detect, prevent, and investigate fraud, abuse, and security incidents
• Comply with law and enforce our agreements
• Develop and improve features, including limited AI-assisted functionality as described in Section 10

We do not sell Customer Content or our customer base to third parties.

We use cookies and similar technologies on the Site and, where applicable, in the Services.

Google Analytics and related Google tools

We use Google Analytics and related Google measurement tools to understand how visitors use the Site, measure performance, and improve marketing and product experience. These tools may collect device identifiers, IP address, pages visited, and usage events. Depending on configuration, this may include Google Analytics features such as demographics reporting, audience measurement, and remarketing / Google advertising features.

You can control cookies through your browser settings. Declining cookies may limit some Site functionality.

Google provides opt-out mechanisms for Google Analytics and certain Google advertising features, including the Google Analytics opt-out browser add-on and Google ad settings:

• https://tools.google.com/dlpage/gaoptout
• https://adssettings.google.com/

Where required by law, we will present cookie consent or preference controls before non-essential cookies run.

We may share information with:

• Service providers / subprocessors that help us host, secure, analyze, communicate, bill, or support the Services (for example hosting, email, SMS delivery, analytics, payment, and security vendors), under contracts that limit their use of the data
• Customer-authorized users and integrations when you are using a customer account
• Professional advisors (legal, accounting) under confidentiality
• Authorities when required by law, legal process, or to protect rights, safety, and security
• Corporate transaction parties in connection with a merger, acquisition, financing, or sale of assets, subject to appropriate confidentiality

What we do not do

• We do not sell personal information for money.
• We do not sell or rent our customers' lead lists or customer databases.
• We do not let other companies buy access to Customer Content from us.
• Customer dialing, texting, or emailing of leads inside TLDNXS is customer-directed activity, not Esotech selling data.

If analytics or advertising cookies are treated as a "sale" or "share" under California law for website visitor data, you may opt out as described in Section 11. That concept is about certain website advertising/analytics disclosures. It is not Esotech selling customer CRM data.

For Customer Content in TLDNXS:

• The customer controls what data is uploaded and how campaigns are run
• Esotech processes Customer Content to provide, secure, support, and improve the Services as a service provider / processor
• Customers are responsible for providing any notices and obtaining any consents required for their leads and contacts
• Customers are responsible for TCPA, DNC, consent, recording laws, and industry rules that apply to their outreach
• Esotech may access Customer Content only as needed to provide the Services, prevent abuse, comply with law, or as otherwise permitted by the customer agreement

If you are a consumer who wants access or deletion of data a business stored about you in TLDNXS, contact that business first. We will support customers with verified requests as required by law and contract.

If you opt into an Esotech SMS program, we will not share that SMS opt-in with third parties for unrelated purposes. We may share SMS opt-in status with vendors needed to deliver the messages (messaging platforms, carriers, and similar providers).

You may opt out of Esotech marketing emails using the unsubscribe link in those emails. Service and account messages may still be sent as needed.

Esotech is based in the United States. If you access the Site or Services from outside the United States, your information may be processed in the United States and other countries where we or our service providers operate. Those countries may have different data protection laws than your home country.

Where required, we use appropriate transfer mechanisms (such as Standard Contractual Clauses or successor mechanisms) for cross-border transfers.

TLDNXS may include AI-assisted features (for example an AI help wizard, and additional quality, analytics, or assistance features as they become available).

Google-connected data is subject to the stricter Google Services restrictions below, including our prohibition on using it to train general-purpose AI models. The permissions described in this section do not override those restrictions.

• Customer Content is not used to train public foundation models without the customer's authorization
• Where training or model improvement uses customer-related data, it is done only as described in the customer agreement or product documentation, and with de-identification / aggregation where appropriate
• AI outputs can be wrong. Customers must review outputs before relying on them for business, compliance, or consumer-facing decisions
• Platform AI processing of Customer Content is governed by the customer agreement and this policy's service-provider terms

11.1 General rights

Subject to applicable law, you may request to:

• Access the personal information we hold about you
• Correct inaccurate personal information
• Delete personal information
• Opt out of marketing communications
• Appeal a denied request where state law provides an appeal right

Email privacy requests to privacy@esotech.com. We may need to verify your identity before completing a request. You do not need a TLDNXS account to make a website-related privacy request.

11.2 California (CCPA/CPRA) disclosures

Categories we may collect (depending on your interaction):

Identifiers

Name, email, phone, IP, account IDs. Business purpose: Provide Site/Services, support, security, sales follow-up

Commercial information

Plan interest, purchase history, billing metadata. Business purpose: Contracting, billing, customer success

Internet / network activity

Page views, events, device data, cookie IDs. Business purpose: Analytics, security, Site improvement

Geolocation (coarse)

Approximate location from IP. Business purpose: Security, localization, analytics

Audio / visual

Call recordings or uploads in a customer account. Business purpose: Provide dialer/CRM features for the customer

Professional information

Company, role, business contact details. Business purpose: B2B sales and account administration

Inferences

Usage or preference inferences from Site analytics. Business purpose: Improve Site and marketing

Sale / share

• Esotech does not sell personal information for money.
• Esotech does not sell Customer Content or customer lead databases.
• Website analytics and advertising technologies (including Google Analytics / Google advertising features, if enabled) may involve disclosures of website visitor identifiers and usage data to analytics/advertising partners. Under California law, some of those disclosures can be considered a "sale" or "sharing" for cross-context behavioral advertising even when no money changes hands.

To opt out of sale/sharing of website analytics/advertising data: email privacy@esotech.com with the subject line "Do Not Sell or Share My Personal Information," and use available cookie/Google opt-out tools. We will also honor recognized browser opt-out preference signals (such as Global Privacy Control) for sale/sharing of website visitor data where required and technically feasible.

Sensitive personal information

We do not use website forms to intentionally collect sensitive personal information such as government ID numbers, precise geolocation, or health data. Customers must not place prohibited sensitive data into unprotected fields. Limit-use requests for sensitive personal information may be sent to privacy@esotech.com where applicable.

Other California rights

California residents may request know/access, delete, correct, and opt-out rights described above. We will not discriminate against you for exercising privacy rights. Authorized agents may submit requests with proof of authority. We generally respond within 45 days, or longer if permitted by law.

Shine the Light

California residents may request information about disclosures of personal information to third parties for those third parties' direct marketing purposes by writing to the address below and labeling the request "California Privacy Rights Notice." We do not disclose personal information to third parties for their own direct marketing in the ordinary course of providing TLDNXS.

11.3 GDPR / UK GDPR rights

If EU or UK data protection law applies, you may also have rights to access, rectify, erase, restrict, object, and data portability, and the right to lodge a complaint with a supervisory authority. For the UK, the ICO is at https://ico.org.uk/. Lawful bases may include contract, legitimate interests, consent, and legal obligation, depending on the processing.

We keep information only as long as reasonably needed for the purposes described in this policy, including:

• Website inquiries: as needed to respond and for related sales follow-up, unless you request deletion or opt out earlier
• Account and billing records: for the life of the account and as required for legal, tax, and accounting retention
• Customer Content: per the customer agreement, customer instructions, and legal holds
• Security and server logs: for shorter operational and security periods
• Analytics data: per our analytics provider settings and business needs

When no longer needed, we delete or de-identify information, subject to backup and legal exceptions.

We use administrative, technical, and organizational measures designed to protect personal information. No method of transmission or storage is completely secure. Customers are responsible for safeguarding their account credentials and for configuring the Services appropriately, including not storing prohibited data in unprotected fields.

The Site and Services are for business use and are not directed to children under 18. We do not knowingly collect personal information from children under 18.

The Site may link to third-party sites. Their privacy practices are their own. Review their policies before providing information.

We may update this Privacy Policy from time to time. We will post the updated policy and revise the effective / last updated date. Material changes will be highlighted on this page when practical. Continued use of the Site or Services after an update means you acknowledge the revised policy.

If we propose a new use of Google data beyond your existing authorization, we will disclose that use and obtain any required additional consent before proceeding. Continued use alone does not authorize additional Google access.

When available and enabled by your organization, you may connect Google Sign-In, Gmail, Google Drive, or Google Calendar. You choose which supported capabilities to authorize. Signing in with Google does not by itself authorize access to your mailbox, files, or calendar.

What we access and why

• Identity: your Google account identifier, email address, and available profile information identify your login or connection. We use verified organization information to enforce your organization's connection rules.
• Gmail: message and thread identifiers, sender and recipient information, subjects, labels, message bodies, and attachments support your connected inbox. Lists, message content, and attachments are retrieved as needed for the actions you take. Sending and reply permissions let you send correspondence from your selected connected mailbox; message-management permissions support the actions you request. Connecting Gmail does not enroll your mailbox in automated marketing campaigns.
• Google Drive: file identifiers, names, types, links, and selected file contents let you import a copy into Documents, link to the original, or export and explicitly update a document copy. Access is limited to files you select or authorize for this application and files the application creates. We do not scan your entire Drive or automatically synchronize folders.
• Google Calendar: calendar identifiers and event details let you display selected external calendars and synchronize supported CRM events to Google. Synchronization from CRM to Google may create, update, or remove the corresponding events. Displaying external events does not automatically import changes into CRM records.

Your accounts and storage

You may connect more than one Google identity. A connection must be enabled separately for each TLDNXS organization account, subject to its policies. Using a Google identity in one organization does not automatically authorize its use in another.

We retain connection identifiers, permissions, synchronization status, and encrypted authorization credentials to operate the connection. We retain outgoing message submissions, including recipients, subject, content, and attachment references, to process sending and show its status. Selected files and email attachments you import become stored CRM documents. Those documents follow the destination account's access controls; linking a Google original does not change Google's sharing permissions.

Limited Use and sharing

TLDNXS's use and transfer of information received from Google APIs adhere to the Google API Services User Data Policy, including its Limited Use requirements, and the Google Workspace API User Data and Developer Policy. These restrictions also apply to derived Google data and take priority over broader provisions elsewhere in this policy or our Terms.

We use Google data only for the connected features you authorize. We do not sell it, use it for advertising or credit decisions, or train general-purpose AI models with it. Website analytics and advertising provisions do not apply to connected Google content.

Transfers are limited to operating authorized features with your consent, security, legal requirements, or a business transfer with your explicit prior consent. This includes sending to your chosen email recipients or importing a selected document into your organization. Service providers handling that data must follow these restrictions. Our personnel may read specific Google content only with your affirmative agreement or when necessary for security or legal compliance.

Disconnecting and deleting data

Disconnect the connection in your TLDNXS profile to disable its use in the current organization. This does not disconnect it in other organizations or erase existing CRM documents, outgoing submissions, or credentials. To revoke Google's authorization for the application, use Google Account connections; that can affect other TLDNXS connections using the same Google authorization.

Revocation stops future authorized Google access; it does not recall sent mail, erase recipients' copies, or remove files already copied into TLDNXS or Google. To request deletion of retained Google-connected data or credentials, contact privacy@esotech.com and identify the relevant TLDNXS organization and connection. Do not send passwords or access tokens. We verify the request and coordinate with the account owner where necessary. Retention and deletion follow Section 12, applicable law, and the customer agreement; disconnecting is not a promise of immediate deletion.

Esotech, Inc. (dba TLDNXS) Attn: Privacy 1000 Heritage Center Circle Round Rock, TX 78664 United States

Email: privacy@esotech.com Support: support@esotech.com Compliance: compliance@esotech.com