Privacy Policy

AR WORKFLOW PRIVACY POLICY

Last Updated: October 6, 2026

AR Workflow, Inc., a Nevada corporation ("AR Workflow," "we," "us," or "our"), respects your privacy.

This Privacy Policy explains how AR Workflow collects, uses, processes, discloses, stores, and protects personal information when you:

• Visit AR Workflow's websites;
• Create or use an AR Workflow account;
• Use the AR Workflow software platform;
• Connect third-party services or integrations;
• Use AR Workflow communications, calling, payment, or artificial intelligence features;
• Communicate with our sales, support, implementation, or other teams; or
• Otherwise interact with AR Workflow.

This Privacy Policy also explains the choices and rights that may be available to you regarding your personal information.

AR Workflow provides a business-to-business accounts receivable and collections workflow platform. Our customers use the Service to manage invoices, customer accounts, communications, workflows, payments, tasks, reporting, artificial intelligence features, and other accounts receivable activities.

Capitalized terms not defined in this Privacy Policy have the meanings provided in our Terms of Service and Subscription Agreement.

1. WHO THIS PRIVACY POLICY APPLIES TO

This Privacy Policy applies to personal information AR Workflow processes in connection with its websites, applications, platform, and related services.

Depending on the circumstances, AR Workflow may process information about:

• Customers and prospective customers;
• Customer employees and Authorized Users;
• Website visitors;
• Business contacts;
• Customer support contacts;
• End Customers whose information is uploaded or synchronized by an AR Workflow Customer;
• Individuals receiving emails, SMS messages, telephone calls, payment requests, or other communications through AR Workflow;
• Individuals whose information appears on invoices or within connected accounting systems; and
• Other individuals who interact with AR Workflow or our Customers through the Service.

2. AR WORKFLOW'S ROLE

Our privacy role depends on the information and the context in which we process it.

2.1 Information AR Workflow Processes for Its Own Business

AR Workflow generally determines how and why personal information is processed when the information relates directly to:

• AR Workflow account creation;
• Subscription administration;
• Billing for AR Workflow subscriptions;
• Sales inquiries;
• Marketing;
• Website visitors;
• Customer support;
• Security;
• Fraud prevention;
• Product administration;
• Legal compliance; and
• AR Workflow's internal business operations.

For this information, AR Workflow generally acts as the business, controller, or equivalent entity under applicable privacy law.

2.2 Customer Data Processed on Behalf of Our Customers

AR Workflow Customers may import, synchronize, enter, upload, or otherwise provide information relating to their own customers, clients, debtors, contacts, invoices, transactions, and accounts.

When AR Workflow processes that information on behalf of a Customer in order to provide the Service, the Customer generally determines why and how the information is used.

In that context, AR Workflow generally acts as a service provider, processor, or similar entity on behalf of the Customer.

If you are an End Customer of an AR Workflow Customer and have a question regarding information that the Customer maintains about you, you should ordinarily contact that Customer directly.

AR Workflow may assist its Customers in responding to privacy requests when required by law or contract.

3. INFORMATION WE COLLECT

The information we collect depends on how you interact with AR Workflow and which features you use.

3.1 Account and Contact Information

We may collect:

• First and last name;
• Business email address;
• Telephone number;
• Business address;
• Job title;
• Company name;
• Account username;
• User role;
• User permissions;
• Profile information;
• Administrative contact information;
• Billing contact information; and
• Other information you provide when creating or managing an account.

3.2 Business Information

We may collect information relating to a Customer's business, including:

• Business name;
• Business address;
• Industry;
• Business telephone number;
• Website;
• Accounting platform information;
• Subscription plan;
• Number of users;
• Billing preferences;
• Integration settings;
• Workflow settings;
• Communications settings; and
• Other business configuration information.

3.3 Customer and Accounts Receivable Data

Customers may provide or synchronize information relating to their accounts receivable activities.

This may include:

• Customer or client names;
• Company names;
• Email addresses;
• Telephone numbers;
• Mobile telephone numbers;
• Mailing addresses;
• Billing addresses;
• Invoice numbers;
• Invoice amounts;
• Invoice dates;
• Due dates;
• Outstanding balances;
• Payment status;
• Aging information;
• Payment history;
• Customer account history;
• Customer type;
• Notes;
• Tasks;
• Collection activity;
• Workflow assignments;
• Communications history;
• Contact records; and
• Other information associated with an account or invoice.

This information may originate directly from the Customer, from a connected accounting system such as QuickBooks Online, or from other integrations authorized by the Customer.

3.4 Communications Information

When Customers use AR Workflow's communications functionality, we may process information such as:

• Email addresses;
• Telephone numbers;
• Sender and recipient information;
• Email subject lines;
• Email content;
• SMS content;
• Message status;
• Delivery status;
• Call logs;
• Call dates and times;
• Call duration;
• Voicemail content;
• Communications metadata;
• Opt-out information;
• Consent records;
• Communication history; and
• Other information necessary to send, receive, route, record, track, or manage communications.

Depending on the functionality used, communications may be transmitted or processed through third-party communications providers such as Twilio.

3.5 Call Recordings and Transcripts

If a Customer enables call recording or related functionality, AR Workflow may process:

• Audio recordings;
• Call transcripts;
• Call summaries;
• Notes;
• Speaker information;
• Call metadata;
• Commitments or action items identified from calls; and
• Artificial intelligence-generated analysis relating to calls.

Customers are responsible for determining whether recording a call is permitted and for providing required notices and obtaining required consent from call participants.

AR Workflow does not independently determine whether a particular call may legally be recorded.

3.6 Payment and Transaction Information

AR Workflow integrates with Finix Payments, Inc. ("Finix") to provide payment-processing functionality.

Finix and its applicable banking, card-network, and financial-service partners may collect information necessary to process payments or establish merchant accounts, including:

• Payment card information;
• Bank account information;
• Cardholder information;
• Billing information;
• Merchant information;
• Business ownership information;
• Identity verification information;
• Tax identification information;
• Transaction information; and
• Other information required for payment processing, merchant underwriting, fraud prevention, or regulatory compliance.

Certain sensitive payment or merchant information may be collected directly by Finix rather than AR Workflow.

AR Workflow may receive information necessary to display, administer, reconcile, or support payment functionality, such as:

• Transaction amount;
• Transaction date;
• Payment status;
• Transaction identifiers;
• Masked payment-method information;
• Settlement status;
• Refund status;
• Chargeback information;
• ACH return information; and
• Other payment-processing status information.

Finix independently processes personal information in accordance with its own Privacy Policy and merchant agreements.

3.7 Artificial Intelligence Information

When Customers use AR Workflow's artificial intelligence features, we may process Customer Data that is necessary to provide the requested AI functionality.

This may include:

• Invoice information;
• Account history;
• Payment history;
• Communications;
• Notes;
• Customer contact information;
• Workflow configuration;
• Communication tone or intent;
• Call transcripts;
• Call recordings;
• Prior collection activity; and
• Prompts, instructions, or other content submitted to an AI Feature.

AI-generated information may include:

• Draft communications;
• Follow-up communications;
• Account summaries;
• Call summaries;
• Suggested actions;
• Classifications;
• Workflow recommendations;
• Communication recommendations;
• Commitment extraction; and
• Other generated outputs.

AR Workflow may use third-party artificial intelligence technology providers and subprocessors to provide these features.

Customer Data provided to such providers is processed for purposes of providing the applicable functionality and remains subject to applicable contractual, privacy, and security requirements.

AR Workflow may use aggregated or de-identified information to analyze and improve the Service where permitted by law.

3.8 Information From Connected Services

If you connect a third-party service to AR Workflow, we may receive information from that service based on:

• The permissions you authorize;
• The integration you select;
• The features you enable; and
• The third party's own rules and settings.

Connected services may include:

• QuickBooks Online;
• Google or Gmail;
• Payment providers;
• Telecommunications providers; and
• Other software or applications selected by the Customer.

You control whether to connect supported integrations and may generally disconnect them through AR Workflow or the applicable provider.

3.9 Support, Sales, and Other Communications With AR Workflow

If you communicate directly with AR Workflow, we may collect:

• Your name;
• Email address;
• Telephone number;
• Company name;
• Message content;
• Support ticket information;
• Screenshots;
• Attachments;
• Call recordings where disclosed;
• Meeting recordings where disclosed;
• Product feedback;
• Survey responses; and
• Other information you choose to provide.

3.10 Website and Device Information

When you visit or use our websites or Service, we may automatically collect information such as:

• Internet Protocol address;
• Browser type;
• Operating system;
• Device type;
• Referring website;
• Pages viewed;
• Features used;
• Date and time of access;
• Session information;
• Click activity;
• Error logs;
• General geographic information derived from an IP address;
• Device identifiers;
• Authentication events; and
• Other technical or usage information.

We use this information to operate, secure, analyze, troubleshoot, and improve our websites and Service.

3.11 Cookies and Similar Technologies

We and our service providers may use:

• Cookies;
• Pixels;
• Web beacons;
• Local storage;
• Analytics technologies; and
• Similar tools.

These technologies may help us:

• Authenticate users;
• Maintain sessions;
• Remember preferences;
• Provide website functionality;
• Measure website traffic;
• Understand product usage;
• Diagnose errors;
• Improve performance;
• Measure marketing effectiveness;
• Prevent fraud or abuse; and
• Understand how visitors interact with our websites.

You may be able to control certain cookies through your browser settings or any cookie controls AR Workflow makes available.

Disabling certain cookies may affect website or Service functionality.

4. HOW WE COLLECT INFORMATION

We may collect personal information:

• Directly from you;
• From an AR Workflow Customer;
• From an Authorized User;
• From connected accounting systems;
• From integrations you authorize;
• From payment processors;
• From telecommunications providers;
• From communications with us;
• Automatically through use of the websites and Service;
• From analytics or security providers;
• From publicly available business sources where appropriate; and
• From other service providers assisting us in operating our business.

5. HOW WE USE PERSONAL INFORMATION

We may use personal information to:

5.1 Provide and Operate the Service

Including to:

• Create and manage accounts;
• Authenticate users;
• Synchronize invoices and customer information;
• Operate workflows;
• Send communications;
• Provide calling and messaging features;
• Process Customer-configured actions;
• Display account activity;
• Provide reporting;
• Enable payment functionality;
• Provide AI Features;
• Maintain integrations;
• Provide customer portals; and
• Perform other functionality requested by Customers.

5.2 Provide Customer Support and Implementation

Including to:

• Answer questions;
• Troubleshoot problems;
• Investigate errors;
• Assist with onboarding;
• Configure accounts;
• Provide training;
• Resolve support requests; and
• Communicate about Service issues.

5.3 Process Subscriptions and Billing

Including to:

• Administer subscription plans;
• Process subscription payments;
• Monitor Usage Limits;
• Apply plan changes;
• Process renewals;
• Send billing notices;
• Prevent payment fraud; and
• Maintain billing records.

5.4 Enable Payment Processing

Including to:

• Connect Customers with Finix;
• Display payment functionality;
• Facilitate transaction requests;
• Receive payment status information;
• Display transaction history;
• Support reconciliation;
• Display refunds or chargebacks; and
• Assist Customers with payment-related functionality.

Finix and applicable financial institutions control the underlying payment-processing activities as described in our Terms of Service.

5.5 Provide Communications Functionality

Including to:

• Send emails;
• Send SMS messages;
• Place or receive calls where supported;
• Provide voicemail functionality;
• Route communications;
• Track delivery;
• Maintain communication histories;
• Process opt-outs;
• Record calls where enabled;
• Create transcripts;
• Provide communication analytics; and
• Support Customer-configured collection workflows.

5.6 Provide AI Features

Including to:

• Generate communications;
• Create summaries;
• Analyze account history;
• Analyze invoices;
• Generate workflow recommendations;
• Summarize calls;
• Extract action items or commitments;
• Classify information;
• Generate suggested follow-up actions; and
• Operate automated AI Workflows configured by Customers.

5.7 Secure the Service

Including to:

• Authenticate users;
• Monitor account activity;
• Detect unauthorized access;
• Investigate suspicious behavior;
• Prevent fraud;
• Prevent abuse;
• Detect spam;
• Protect infrastructure;
• Investigate security incidents; and
• Enforce our Terms.

5.8 Improve the Service

We may use usage information, feedback, support information, and aggregated or de-identified data to:

• Understand how features are used;
• Improve performance;
• Develop new features;
• Diagnose errors;
• Improve usability;
• Conduct analytics;
• Measure Service effectiveness; and
• Improve our products and operations.

5.9 Communicate With You

We may send:

• Account notifications;
• Security alerts;
• Billing notices;
• Renewal notices;
• Product updates;
• Feature announcements;
• Support communications;
• Administrative communications; and
• Other Service-related messages.

We may also send marketing communications where permitted by law.

You may unsubscribe from marketing emails using the unsubscribe mechanism included in those communications.

You generally cannot opt out of communications necessary to operate your account or provide the Service.

5.10 Comply With Law and Protect Rights

We may process information to:

• Comply with legal obligations;
• Respond to lawful requests;
• Protect AR Workflow's rights;
• Protect our Customers;
• Protect End Customers;
• Protect our employees and contractors;
• Enforce agreements;
• Investigate fraud or abuse;
• Establish or defend legal claims; and
• Maintain records required by law.

6. QUICKBOOKS AND INTUIT INTEGRATION

AR Workflow allows Customers to connect supported Intuit products such as QuickBooks Online.

When a Customer connects QuickBooks, the Customer authorizes AR Workflow through Intuit's authorization process to access the QuickBooks information permitted by the Customer.

Depending on the functionality enabled, this information may include:

• Customers;
• Contact information;
• Invoices;
• Open balances;
• Payment status;
• Payment history;
• Transaction information;
• Company information; and
• Other accounting information necessary to provide AR Workflow functionality.

AR Workflow uses information obtained from QuickBooks to provide Customer-requested functionality such as:

• Synchronizing invoices;
• Displaying accounts receivable data;
• Updating payment status;
• Operating workflows;
• Generating reports;
• Providing account information; and
• Supporting other AR Workflow features.

Customers may disconnect QuickBooks or revoke AR Workflow's access through applicable AR Workflow or Intuit settings.

Disconnecting QuickBooks may prevent certain AR Workflow features from operating.

Intuit independently processes personal information according to its own privacy policies and terms.

Intuit Global Privacy Statement:
Intuit Global Privacy Statement

7. GOOGLE AND GMAIL API DATA

AR Workflow integrates with Google API Services to allow Customers to send email through a connected Gmail account.

This section specifically explains AR Workflow's handling of information received through Google APIs.

7.1 Gmail Functionality

AR Workflow uses the Gmail API so Customers can:

• Send invoices;
• Send payment reminders;
• Send accounts receivable communications;
• Send Customer-configured messages through AR Workflow; and
• Use the Customer's connected Gmail address when sending applicable business communications.

7.2 Authorization and Consent

When you connect your Google account to AR Workflow:

• You are redirected through Google's authorization process;
• Google displays the permissions AR Workflow requests;
• You decide whether to authorize the connection; and
• You may revoke authorization at any time.

7.3 Gmail Permission Requested

AR Workflow currently requests the Gmail API permission that allows AR Workflow to send email on your behalf using your connected Gmail account.

AR Workflow does not request permission through this scope to:

• Read your existing Gmail messages;
• Modify your existing Gmail messages; or
• Delete your existing Gmail messages.

7.4 How We Use Google Account Data

AR Workflow uses authorized Google account information to:

• Send emails you initiate or configure through AR Workflow;
• Maintain the authorized Gmail connection;
• Identify the Gmail account connected to AR Workflow; and
• Authenticate and administer the integration.

7.5 What We Do Not Do With Google User Data

AR Workflow does not use Google user data to:

• Serve advertisements;
• Create targeted advertising audiences;
• Sell Google user data;
• Provide Google user data to data brokers;
• Determine creditworthiness;
• Provide lending decisions; or
• Access existing Gmail messages that are outside the permissions granted to AR Workflow.

AR Workflow does not permit human access to Google user data except where:

• You provide affirmative permission;
• Access is necessary for security or troubleshooting as permitted by Google;
• Access is required by applicable law; or
• The information has been appropriately aggregated and is used as permitted under Google's requirements.

7.6 Google Email Content

AR Workflow does not retain the content of emails sent through the Gmail API after successful transmission, except to the extent separate content was already created or stored within AR Workflow as Customer Data independently of the Gmail API transmission.

For example, a communication drafted or generated inside AR Workflow may remain part of the Customer's AR Workflow account history even though AR Workflow does not retrieve or retain the message from the Customer's Gmail mailbox.

7.7 Google OAuth Tokens

AR Workflow stores OAuth credentials necessary to maintain the authorized Google connection.

OAuth tokens are protected using encryption and appropriate security controls.

When the Google integration is disconnected, AR Workflow deletes stored OAuth credentials associated with that connection in accordance with our integration processes.

7.8 Revoking Google Access

You may disconnect your Google account through AR Workflow's applicable email or integration settings.

You may also revoke AR Workflow's access through your Google Account's third-party connection or permissions settings.

Once authorization is revoked, AR Workflow will no longer be able to use that authorization to send email through the connected Gmail account.

7.9 Google Privacy Policy

Google independently processes personal information in accordance with its own Privacy Policy.

Google Privacy Policy:
Google Privacy Policy

7.10 Google API Services User Data Policy

AR Workflow's use and transfer of information received from Google APIs will comply with the Google API Services User Data Policy, including its Limited Use requirements.

Google API Services User Data Policy:
Google API Services User Data Policy

AR Workflow limits its use of Google user data to providing or improving user-facing features associated with the Google integration and other uses permitted by Google's policies.

8. TWILIO COMMUNICATIONS SERVICES

AR Workflow uses Twilio Inc. and related Twilio services, including SendGrid where applicable, to support certain:

• SMS messaging;
• Telephone calling;
• Telephone numbers;
• Email delivery;
• Communications routing; and
• Related functionality.

When Customers use these features, information may be transmitted to or processed by Twilio as necessary to provide the communication.

Depending on the feature, this may include:

• Telephone numbers;
• Email addresses;
• Communication content;
• Message content;
• Call recordings;
• Communication metadata;
• Sender and recipient information;
• Delivery information;
• Call duration;
• Timestamps;
• IP addresses;
• Device or routing information; and
• Other communications data.

Twilio independently processes personal information according to its applicable privacy notice and data-protection terms.

Twilio Privacy Notice:
Twilio Privacy Notice

SendGrid is a Twilio service. Information processed through SendGrid is therefore subject to applicable Twilio privacy and service terms.

AR Workflow's integration with Twilio does not give AR Workflow control over telecommunications carriers, message delivery, carrier filtering, telephone networks, or other independent third-party communications systems.

9. FINIX PAYMENT SERVICES

AR Workflow makes payment-processing functionality available through Finix Payments, Inc. and its applicable banking and payment-network partners.

Finix is an independent third-party payment processor.

9.1 Finix Merchant Data

A Customer seeking to use payment-processing functionality may be required to provide information directly to Finix for:

• Merchant onboarding;
• Identity verification;
• Beneficial-owner verification;
• Know Your Customer requirements;
• Know Your Business requirements;
• Bank-account verification;
• Underwriting;
• Fraud prevention;
• Regulatory compliance; and
• Payment processing.

Finix may collect information that AR Workflow does not independently collect or control.

9.2 Transaction Information

AR Workflow may receive transaction and status information from Finix in order to provide payment-related functionality within AR Workflow.

This may include:

• Payment amount;
• Payment status;
• Payment date;
• Transaction identifier;
• Settlement information;
• Masked payment-method information;
• Refund information;
• Dispute information;
• Chargeback information; and
• ACH return information.

9.3 Finix Controls Its Own Processing

Finix and its applicable financial-service partners determine how they process personal information for matters including:

• Merchant approval;
• Identity verification;
• Transaction processing;
• Fraud prevention;
• Settlement;
• Chargebacks;
• ACH processing;
• Payment-network compliance; and
• Financial regulatory requirements.

Finix's own Privacy Policy and merchant terms govern Finix's independent processing activities.

Finix Privacy Policy:
Finix Privacy Policy

10. ARTIFICIAL INTELLIGENCE AND AUTOMATED FEATURES

AR Workflow offers features that may use artificial intelligence, machine learning, large language models, or other automated technologies.

When a Customer uses these features, AR Workflow may process information necessary to produce the requested output or automated action.

This may include Customer Data such as:

• Invoice information;
• Account history;
• Payment activity;
• Communications;
• Contact information;
• Notes;
• Call transcripts;
• Customer classifications;
• Workflow history; and
• Customer-provided instructions.

AR Workflow may disclose the minimum information reasonably necessary to approved technology providers and subprocessors that support these features.

AI-generated output may become part of Customer Data when it is:

• Saved;
• Sent;
• Assigned to a workflow;
• Added to an account;
• Included in a communication;
• Used to create a task; or
• Otherwise retained as part of Customer's use of AR Workflow.

AR Workflow may use aggregated or de-identified information to evaluate and improve the Service.

Information received from Google APIs remains subject to the additional limitations described in Section 7 and Google's applicable Limited Use requirements.

If AR Workflow identifies a third-party AI provider by name in a published subprocessor list or other applicable disclosure, AR Workflow will provide the applicable provider privacy information through that disclosure.

11. HOW WE DISCLOSE PERSONAL INFORMATION

We may disclose personal information as described below.

11.1 Service Providers and Subprocessors

We may provide information to vendors that help us:

• Host infrastructure;
• Store data;
• Secure the Service;
• Provide communications;
• Provide payment functionality;
• Provide artificial intelligence functionality;
• Provide customer support;
• Monitor application performance;
• Provide analytics;
• Send Service notifications;
• Manage authentication;
• Prevent fraud;
• Operate our websites; and
• Perform other services on our behalf.

We provide such service providers access only as reasonably necessary for the services they perform and subject them to appropriate contractual obligations where required.

11.2 Customer-Authorized Integrations

If Customer connects or enables a third-party integration, we may disclose information to and receive information from that provider as necessary to operate the integration.

11.3 Telecommunications Providers

We may disclose communications information to Twilio, telecommunications carriers, email delivery providers, and related communications providers as necessary to send or receive Customer communications.

11.4 Payment Providers and Financial Institutions

Payment information may be provided to Finix and applicable:

• Acquiring banks;
• Issuing banks;
• Financial institutions;
• Card networks;
• ACH networks;
• Fraud-prevention providers; and
• Other payment-service providers.

11.5 Professional Advisers

We may disclose information where reasonably necessary to:

• Attorneys;
• Accountants;
• Auditors;
• Insurers;
• Consultants; and
• Other professional advisers.

11.6 Legal and Safety Disclosures

We may disclose information if we reasonably believe disclosure is necessary to:

• Comply with law;
• Respond to a subpoena, court order, or lawful government request;
• Protect the rights or property of AR Workflow;
• Protect our Customers;
• Protect End Customers;
• Protect another person;
• Investigate fraud;
• Investigate abuse;
• Investigate security incidents; or
• Enforce our agreements.

11.7 Business Transfers

Information may be disclosed or transferred in connection with:

• A merger;
• Acquisition;
• Financing;
• Reorganization;
• Sale of assets;
• Change of control;
• Bankruptcy;
• Due diligence; or
• Similar corporate transaction.

Any successor's handling of personal information will remain subject to applicable privacy law and contractual obligations.

11.8 At Customer Direction

We may disclose information when a Customer:

• Directs us to do so;
• Enables a feature requiring disclosure;
• Connects an integration;
• Sends a communication;
• Creates a payment request;
• Invites an Authorized User; or
• Otherwise instructs AR Workflow to transmit information.

12. SALE, SHARING, AND ADVERTISING

AR Workflow does not sell personal information for monetary consideration.

We do not sell Customer Data, End Customer invoice information, communications content, Google user data, call recordings, or payment information to data brokers.

We may use analytics, marketing, or advertising technologies on AR Workflow's public-facing websites.

These technologies may involve disclosure of limited information such as:

• Cookie identifiers;
• Device identifiers;
• IP address;
• Website activity;
• Advertising identifiers; and
• Similar online activity information

to analytics or advertising partners.

Depending on applicable state law and the technology being used, certain disclosures for cross-context behavioral advertising or targeted advertising may be considered a "sale," "sharing," or "targeted advertising" even when no money is exchanged for the personal information.

Where applicable law gives you the right to opt out of such processing, you may exercise that right using any privacy controls AR Workflow makes available or by contacting us using the information below.

AR Workflow does not use Google API user data for advertising.

13. SMS CONSENT AND OPT-IN DATA

AR Workflow does not sell or disclose text messaging originator opt-in data or consent information to third parties for their own marketing purposes.

SMS opt-in and consent information may be provided only to:

• Telecommunications aggregators;
• Carriers;
• Messaging providers;
• Service providers involved in delivering the requested messaging functionality; or
• Other parties where disclosure is legally required.

This restriction applies to mobile opt-in data and consent collected in connection with AR Workflow messaging functionality.

14. COOKIES, ANALYTICS, AND ONLINE TRACKING

AR Workflow may use first-party and third-party technologies to understand website and product activity.

These may include technologies used for:

• Essential functionality;
• Authentication;
• Security;
• Preferences;
• Analytics;
• Performance monitoring; and
• Marketing measurement.

You can generally adjust browser settings to:

• Delete cookies;
• Block cookies;
• Receive a warning before cookies are stored; or
• Limit certain tracking technologies.

Blocking certain cookies may prevent portions of the website or Service from functioning correctly.

Traditional browser "Do Not Track" signals do not currently have a single universally accepted technical standard.

Where applicable law requires recognition of a legally valid opt-out preference signal, AR Workflow will process such signals as required by applicable law and based on the technical capabilities implemented on the applicable website or Service.

15. AGGREGATED AND DE-IDENTIFIED INFORMATION

AR Workflow may create aggregated or de-identified information from information processed through the Service.

We may use such information for:

• Analytics;
• Benchmarking;
• Product development;
• Security;
• Service improvement;
• Research;
• Operational planning; and
• Business analysis.

Where information is maintained in de-identified form, we will not attempt to re-identify it except where permitted by applicable law to test or validate our de-identification methods.

Google API data remains subject to Google's applicable requirements even when derived or aggregated to the extent required by Google's policies.

16. DATA RETENTION

We retain personal information for as long as reasonably necessary for the purposes described in this Privacy Policy, including to:

• Provide the Service;
• Maintain Customer accounts;
• Perform contractual obligations;
• Maintain business and accounting records;
• Comply with applicable law;
• Resolve disputes;
• Investigate security incidents;
• Prevent fraud;
• Enforce agreements; and
• Protect legal rights.

Retention periods vary depending on:

• The type of information;
• How the information is used;
• Customer configuration;
• Contractual requirements;
• Applicable law;
• Security requirements; and
• Third-party service requirements.

16.1 Customer Data After Account Termination

Customers should export information they wish to retain before terminating their subscription.

Subject to the Terms of Service, technical availability, and applicable law, Customer Data may remain available for export for a limited period following termination.

After the applicable post-termination period, AR Workflow may delete Customer Data from active systems unless retention is necessary for:

• Legal obligations;
• Accounting;
• Tax;
• Fraud prevention;
• Security;
• Audit;
• Regulatory requirements;
• Dispute resolution; or
• Enforcement of agreements.

Information may remain temporarily in backup systems until ordinary backup rotation or deletion occurs.

16.2 Google Data

OAuth tokens used for a Google connection are retained only as needed to maintain the authorized connection and are deleted when the applicable connection is revoked or disconnected in accordance with AR Workflow's integration processes.

AR Workflow does not retain Gmail message content obtained through the Gmail API after successful transmission because the Gmail integration does not provide AR Workflow access to the Customer's existing Gmail mailbox.

16.3 Third-Party Retention

Third-party providers such as Finix, Twilio, Intuit, financial institutions, payment networks, or telecommunications carriers may retain information according to their own legal obligations, contracts, and privacy policies.

AR Workflow does not control independent retention obligations imposed on those providers.

17. DATA SECURITY

AR Workflow maintains reasonable administrative, technical, and organizational safeguards designed to protect personal information against:

• Unauthorized access;
• Unauthorized disclosure;
• Loss;
• Misuse;
• Destruction;
• Alteration; and
• Other unauthorized processing.

Security measures may include, as appropriate:

• Encryption in transit;
• Encryption at rest;
• Authentication controls;
• Access controls;
• Role-based permissions;
• Logging;
• Monitoring;
• Backup practices;
• Vulnerability management;
• Security testing; and
• Incident-response procedures.

For Google integrations, AR Workflow's current security measures include encrypting OAuth tokens at rest and using encrypted TLS/SSL communications with Google APIs.

No internet-based system can be guaranteed to be completely secure.

Customers are responsible for maintaining the confidentiality of their credentials, configuring appropriate user permissions, and promptly notifying AR Workflow of suspected unauthorized account activity.

18. SECURITY INCIDENTS

If AR Workflow becomes aware of unauthorized access to or disclosure of personal information that requires notification under applicable law, AR Workflow will take reasonable steps to:

• Investigate the incident;
• Contain the incident;
• Mitigate harm;
• Remediate identified issues; and
• Provide legally required notices.

When AR Workflow processes Customer Data on behalf of a Customer, we will provide the Customer with reasonably available information required for the Customer to satisfy applicable notification obligations, subject to applicable law and contract.

19. INTERNATIONAL DATA TRANSFERS

AR Workflow is based in the United States.

Personal information may be processed in:

• The United States; or
• Other countries where AR Workflow's service providers or subprocessors operate.

Privacy and data-protection laws may differ between jurisdictions.

Where required by applicable law, AR Workflow will use appropriate safeguards for cross-border transfers of personal information.

Customers requiring specific international data-transfer terms may contact AR Workflow regarding an applicable Data Processing Agreement.

20. YOUR PRIVACY CHOICES

20.1 Account Information

Authorized Users may be able to update certain account information directly within AR Workflow.

You may also contact AR Workflow for assistance correcting applicable account information.

20.2 Marketing Emails

You may unsubscribe from promotional emails using the unsubscribe link contained in the message.

You may continue to receive necessary operational communications relating to:

• Your account;
• Security;
• Billing;
• Transactions;
• Subscription status;
• Product administration; and
• Other Service-related matters.

20.3 Google Integration

You may disconnect your Google account through applicable AR Workflow settings.

You may also revoke AR Workflow's access through your Google Account settings.

20.4 QuickBooks Integration

You may disconnect supported accounting integrations through AR Workflow or through the applicable Intuit account or application settings.

20.5 Cookies

You may control certain cookies through browser settings or other privacy controls that AR Workflow makes available.

20.6 Communications Preferences

Recipients may use applicable unsubscribe, STOP, opt-out, or other communications preference mechanisms made available through the communication.

AR Workflow Customers are responsible for honoring legally valid communications opt-out requests.

21. UNITED STATES STATE PRIVACY RIGHTS

Depending on where you reside and subject to applicable exemptions, state privacy law may provide rights regarding your personal information.

These rights may include the right to:

• Know whether we process your personal information;
• Know the categories of personal information we collect;
• Know the categories of sources from which information is collected;
• Know the purposes for processing personal information;
• Know the categories of third parties to whom information is disclosed;
• Access personal information;
• Obtain a copy of certain personal information;
• Correct inaccurate personal information;
• Delete certain personal information;
• Opt out of certain sales of personal information;
• Opt out of certain sharing or targeted advertising;
• Limit certain uses of sensitive personal information where applicable;
• Opt out of certain profiling or automated decision-making where applicable; and
• Appeal a denial of a privacy request where required by law.

These rights are not absolute.

For example, we may retain information where necessary to:

• Complete a transaction;
• Provide a Service requested by you or our Customer;
• Detect security incidents;
• Prevent fraud;
• Exercise legal rights;
• Comply with law;
• Maintain required business records; or
• Satisfy another legally recognized exception.

22. CALIFORNIA AND OTHER STATE PRIVACY DISCLOSURES

The following provides additional information regarding categories of personal information AR Workflow may process.

22.1 Identifiers

Examples may include:

• Name;
• Email address;
• Telephone number;
• Business address;
• IP address;
• Account identifier; and
• Online identifiers.

Sources may include:

• You;
• Your employer;
• An AR Workflow Customer;
• Integrations;
• Service providers; and
• Automatic collection.

Purposes may include:

• Providing the Service;
• Account administration;
• Communications;
• Security;
• Support;
• Analytics; and
• Marketing.

Recipients may include:

• Service providers;
• Customer-authorized integrations;
• Communications providers;
• Payment providers; and
• Professional advisers.

22.2 Commercial Information

Examples may include:

• Subscription information;
• Services purchased;
• Transaction history;
• Invoice information;
• Payment status; and
• Customer account activity.

Purposes may include:

• Providing the Service;
• Billing;
• Reporting;
• Accounts receivable workflows;
• Payment functionality; and
• Analytics.

22.3 Financial Information

Examples may include:

• Transaction information;
• Masked payment information;
• Bank or payment information submitted to Finix; and
• Merchant account information.

Payment information is generally processed primarily by Finix and applicable financial providers.

22.4 Internet or Electronic Activity

Examples may include:

• IP address;
• Browser information;
• Product activity;
• Website activity;
• Device information;
• Login information; and
• Interaction with features.

Purposes may include:

• Security;
• Authentication;
• Analytics;
• Product improvement;
• Fraud prevention; and
• Website administration.

22.5 Communications Information

Examples may include:

• Email;
• SMS;
• Call information;
• Call recordings;
• Transcripts;
• Voicemails;
• Communication metadata; and
• Communications history.

Purposes may include providing Customer-requested communications functionality, workflow history, AI features, support, compliance, and security.

22.6 Professional or Employment-Related Information

Examples may include:

• Company;
• Job title;
• Role; and
• Business contact information.

Purposes may include Customer account administration, business communications, sales, and support.

22.7 Inferences and AI-Generated Information

Examples may include:

• Account summaries;
• Suggested actions;
• Workflow recommendations;
• Communication recommendations;
• Call summaries;
• Classifications; and
• Other generated business insights.

These are used to provide AR Workflow's AI and automation functionality.

22.8 Sensitive Personal Information

AR Workflow generally seeks to minimize collection of sensitive personal information.

Finix or other regulated payment providers may independently collect sensitive information required for:

• Merchant identity verification;
• Underwriting;
• Banking;
• Fraud prevention; or
• Regulatory compliance.

Where AR Workflow processes information defined as sensitive personal information under applicable law, we use it only for purposes permitted under applicable law unless we provide additional notice.

23. HOW TO SUBMIT A PRIVACY REQUEST

To exercise an applicable privacy right, contact:

Email: support@arworkflow.com

Please include enough information for us to understand and process your request.

We may need to verify your identity before fulfilling a request.

Verification requirements will depend on:

• The type of request;
• The sensitivity of the information; and
• Applicable law.

We will not discriminate against you for exercising a privacy right.

23.1 Authorized Agents

Where permitted by applicable law, you may use an authorized agent to submit a request.

We may request evidence that:

• The agent has authority to act on your behalf; and
• Your identity has been appropriately verified.

23.2 End Customers of AR Workflow Customers

If AR Workflow processes your information solely on behalf of an AR Workflow Customer, we may direct your request to that Customer.

The Customer is generally responsible for deciding how to respond to privacy requests concerning Customer Data.

AR Workflow will assist Customers as required by applicable law or contract.

24. CHILDREN'S PRIVACY

AR Workflow is a business software service and is not intended for children.

The Service is not intended for individuals under 18 years of age.

AR Workflow does not knowingly permit children to create Customer accounts.

If you believe a child has provided personal information directly to AR Workflow inappropriately, contact us at support@arworkflow.com.

25. THIRD-PARTY SERVICES AND PRIVACY POLICIES

AR Workflow integrates with independent Third-Party Services.

Those providers may independently collect, use, retain, disclose, or otherwise process personal information according to their own terms and privacy policies.

The following are the principal third-party platforms specifically identified in this Privacy Policy.

25.1 Google / Gmail

AR Workflow uses Google API Services in connection with its Gmail integration.

Google Privacy Policy:
Google Privacy Policy

Google API Services User Data Policy:
Google API Services User Data Policy

AR Workflow's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including its Limited Use requirements.

25.2 Intuit / QuickBooks Online

AR Workflow integrates with Intuit products, including QuickBooks Online.

Information independently processed by Intuit is governed by Intuit's applicable privacy statement and terms.

Intuit Global Privacy Statement:
Intuit Global Privacy Statement

25.3 Twilio / SendGrid

AR Workflow uses Twilio for certain telecommunications functionality, including SMS and calling, and may use Twilio SendGrid for applicable email-delivery functionality.

Twilio and SendGrid-related processing is subject to applicable Twilio privacy and data-protection terms.

Twilio Privacy Notice:
Twilio Privacy Notice

25.4 Finix

AR Workflow integrates with Finix Payments, Inc. for payment-processing functionality.

Finix independently processes merchant, transaction, payment, financial, identity-verification, and related information as described in its Privacy Policy.

Finix Privacy Policy:
Finix Privacy Policy

25.5 Other Third-Party Services

AR Workflow may add, remove, or replace service providers or integrations as the Service evolves.

Other third parties may include:

• Cloud infrastructure providers;
• Security providers;
• Analytics providers;
• Authentication providers;
• Customer support platforms;
• Artificial intelligence providers;
• Telecommunications carriers;
• Banks and financial institutions;
• Payment networks; and
• Customer-authorized integrations.

Where AR Workflow identifies an additional third-party provider by name in a privacy notice, subprocessor list, product disclosure, integration screen, or other applicable disclosure, AR Workflow may provide a link to that provider's applicable privacy policy.

AR Workflow is not responsible for the independent privacy practices of websites, applications, financial institutions, telecommunications carriers, networks, or services that AR Workflow does not control.

26. THIRD-PARTY LINKS

Our websites or Service may contain links to third-party websites or services.

This Privacy Policy does not govern the privacy practices of independent third parties.

You should review the privacy policies and terms of third-party services before providing personal information to them.

27. DATA PROCESSING AGREEMENTS

AR Workflow may enter into a Data Processing Agreement with Customers where:

• Required by applicable data-protection law;
• Required by an enterprise Customer's compliance program; or
• Otherwise mutually agreed.

A Data Processing Agreement may address matters including:

• Processing instructions;
• Confidentiality;
• Security;
• Subprocessors;
• Data-subject requests;
• Security incidents;
• International transfers; and
• Deletion or return of Customer Data.

If a Data Processing Agreement conflicts with this Privacy Policy regarding AR Workflow's processing of Customer Personal Data on behalf of a Customer, the Data Processing Agreement will control within its scope.

28. CHANGES TO THIS PRIVACY POLICY

AR Workflow may update this Privacy Policy from time to time.

When we update the Privacy Policy, we will update the "Last Updated" date.

If we make a material change to how we process personal information, we may provide additional notice through:

• Email;
• An in-app notification;
• An account notification;
• A website notice; or
• Another reasonable method.

If a change materially affects how AR Workflow uses Google user data, AR Workflow will provide any additional notice or consent required under Google's applicable policies before using Google user data for the new purpose.

29. CONTACT AR WORKFLOW

If you have questions about this Privacy Policy, our privacy practices, or an applicable privacy request, contact:

AR Workflow, Inc.
Attn: Privacy
304 S Jones Blvd #7400
Las Vegas, Nevada 89107

Email: support@arworkflow.com

30. GOOGLE LIMITED USE DISCLOSURE

AR Workflow's use and transfer to any other application of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Google API Services User Data Policy:
Google API Services User Data Policy

AR Workflow uses Google API information only as necessary to provide or improve user-facing functionality authorized by the user and as otherwise permitted by Google's applicable policies.