Privacy Policy

Welcome to Colony ("Colony," "we," "our," or "us").

Colony is an AI-powered collaborative workspace designed to help individuals, teams, and organizations manage projects, knowledge, customer relationships, calendars, workflows, and other business operations within a unified platform. The platform integrates artificial intelligence capabilities to enhance productivity, automate workflows, and assist users in creating, organizing, and managing work more efficiently.

This Privacy Policy explains how Colony collects, uses, stores, shares, and protects personal information when you access or use our website, applications, products, services, integrations, APIs, and any related features (collectively, the "Services").

We are committed to protecting your privacy and handling your personal information in a transparent, secure, and responsible manner. This Privacy Policy has been developed to help you understand:

• •What information we collect;
• •Why we collect it;
• •How we use your information;
• •When we share information with third parties;
• •How we safeguard your information;
• •The choices and rights available to you regarding your personal information.

By accessing or using Colony, you acknowledge that you have read and understood this Privacy Policy.

This Privacy Policy applies to all users of Colony, including:

• •Visitors to our website;
• •Registered users;
• •Workspace owners and administrators;
• •Team members and collaborators;
• •Enterprise customers;
• •Individuals interacting with our AI-powered features;
• •Users accessing Colony through third-party integrations.

This Privacy Policy applies regardless of the device used to access the Services, including desktop computers, laptops, tablets, and mobile devices.

This Privacy Policy also applies to information collected through customer support interactions, beta testing programs, product demonstrations, surveys, marketing communications, and any other interactions with Colony.

Where local laws impose additional privacy obligations, Colony will process personal information in accordance with those applicable laws.

For purposes of this Privacy Policy:

"Account"

Means a registered Colony profile created by a user to access the Services.

"AI Services"

Means any artificial intelligence functionality made available through Colony, including AI-powered assistants, content generation, workflow automation, document analysis, summarization, search, recommendations, and other machine learning capabilities integrated into the platform.

"Business Customer"

Means an organization, company, institution, or other legal entity that purchases or subscribes to Colony for use by its employees, contractors, or authorized users.

"Content"

means any information submitted, uploaded, created, stored, transmitted, or otherwise made available through Colony, including projects, documents, files, messages, notes, tasks, calendars, customer records, comments, and AI prompts.

"Personal Information"

Means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked to an identifiable individual. Depending on applicable law, this may also be referred to as "Personal Data."

Examples include:

• •Name
• •Email address
• •Profile information
• •Device identifiers
• •IP address
• •Workspace activity
• •Uploaded files
• •AI prompts
• •AI-generated outputs (where linked to an individual)

"Processing"

Means any operation performed on personal information, whether automated or manual, including collection, recording, organization, storage, adaptation, retrieval, consultation, use, disclosure, transmission, deletion, or destruction.

"Services"

Means Colony, including all websites, applications, APIs, integrations, software, and related services provided by Colony.

"Third-Party Service Provider"

Means an external organization that provides services supporting Colony, including cloud hosting, authentication, payment processing, analytics, AI infrastructure, email delivery, customer support, monitoring, and security.

"User"

Means any individual who accesses or uses Colony, whether as a visitor, registered account holder, workspace member, administrator, or enterprise customer.

"Workspace"

Means a collaborative environment within Colony where users can organize projects, documents, tasks, customer information, calendars, AI interactions, and other business activities.

The categories of information we collect depend on how you interact with Colony and the features you use.

Information You Provide Directly

When you create an account or use our Services, we may collect information such as:

Account Information

• •Full name
• •Email address
• •Encrypted account credentials
• •Profile photograph (if provided)
• •Job title
• •Professional expertise
• •Organization or company name
• •Workspace membership information

Workspace Information

• •Projects
• •Tasks
• •Knowledge base content
• •CRM records
• •Calendar events
• •Notes
• •Documents
• •Files
• •Comments
• •Messages
• •Team collaboration data

Communications

• •Support requests
• •Feedback
• •Survey responses
• •Feature requests
• •Communications with our support team

Information Collected Automatically

When you access or use the Services, we automatically collect certain technical information, including:

• •IP address
• •Browser type and version
• •Device type
• •Operating system
• •Session information
• •Log data
• •Authentication events
• •Usage analytics
• •Error reports
• •Security events
• •Cookie identifiers
• •Performance metrics

This information helps us maintain the security, performance, and reliability of the Services.

AI Interaction Data

When you use Colony's AI-powered features, we may process information necessary to provide those services, including:

• •AI prompts submitted by users
• •Context required to generate AI responses
• •AI-generated outputs
• •Metadata relating to AI interactions (such as timestamps and model identifiers)
• •User feedback on AI-generated responses

Where applicable, AI interactions may be processed by trusted third-party AI service providers that support Colony's AI functionality. We take steps to ensure these providers handle information in accordance with contractual commitments and applicable privacy requirements.

Information from Third Parties

We may receive information from third-party services that you choose to connect to Colony or that support our operations, including authentication providers, collaboration tools, analytics providers, and other authorized integrations. Any information received from these services will be processed in accordance with this Privacy Policy and the permissions you grant.

We collect personal information through a variety of methods depending on how you interact with the Services.

Information You Provide Directly

We collect information that you voluntarily provide when you:

• •Create or register an account;
• •Join or create a workspace;
• •Complete your user profile;
• •Upload documents, files, images, or other content;
• •Create tasks, notes, projects, CRM records, calendars, or knowledge base entries;
• •Submit prompts to AI-powered features;
• •Invite other users to collaborate;
• •Contact customer support;
• •Participate in surveys, beta testing, webinars, or promotional activities;
• •Subscribe to newsletters or marketing communications.

You control much of the information you choose to provide. However, certain information is required in order to create an account and provide the Services.

Information Collected Automatically

When you access or use Colony, we automatically collect certain technical and usage information necessary to operate, maintain, and secure the Services.

This may include:

• •Internet Protocol (IP) address;
• •Browser type and version;
• •Device type and operating system;
• •Authentication logs;
• •Session identifiers;
• •Date and time of access;
• •Error reports and diagnostic information;
• •Performance metrics;
• •Security events;
• •Cookie identifiers and similar technologies.

This information helps us improve system reliability, detect and prevent fraud or abuse, troubleshoot technical issues, monitor performance, and enhance the overall user experience.

Information from Workspace Administrators

If you access Colony through an organization or enterprise account, your workspace administrator may provide certain information necessary to create or manage your account, including your:

• •Name;
• •Business email address;
• •Job title;
• •Team assignment;
• •User permissions;
• •Workspace role.

Workspace administrators may also manage certain information associated with your account in accordance with your organization's policies.

Information from Third-Party Integrations

Where you choose to connect third-party applications or services to Colony, we may receive information from those integrations necessary to provide the requested functionality.

Examples may include authentication services, productivity platforms, communication tools, or other authorized integrations.

The information we receive depends on the permissions granted by you or your organization and the privacy practices of the relevant third-party provider.

Artificial Intelligence Interactions

When you use Colony's AI-powered capabilities, information necessary to process your request may be transmitted to AI service providers engaged by Colony.

Depending on the feature being used, this may include:

• •User prompts;
• •Context necessary to generate responses;
• •Documents or content intentionally submitted for AI analysis;
• •AI-generated outputs;
• •Technical metadata associated with AI interactions.

Colony seeks to minimize the amount of personal information shared with AI providers and uses enterprise-grade services where available to support appropriate privacy and security protections.

Colony processes personal information only where necessary to provide, maintain, improve, secure, and support the Services.

Depending on how you use the Services, we may use your information for the following purposes.

To Provide the Services

We use personal information to:

• •Create and manage user accounts;
• •Authenticate users;
• •Enable access to workspaces;
• •Synchronize user content across devices;
• •Facilitate collaboration between workspace members;
• •Store and organize projects, tasks, documents, calendars, CRM records, and other workspace content;
• •Provide requested features and functionality.

To Deliver AI-Powered Features

Where you choose to use Colony's AI capabilities, we process relevant information to:

• •Generate responses to prompts;
• •Assist with content creation;
• •Summarize documents;
• •Support workflow automation;
• •Improve search functionality;
• •Provide contextual recommendations;
• •Enhance productivity features.

AI processing is limited to the information necessary to fulfill the requested functionality.

To Maintain Security

We process personal information to help:

• •Detect suspicious activity;
• •Prevent fraud;
• •Monitor unauthorized access;
• •Protect user accounts;
• •Investigate security incidents;
• •Maintain platform integrity;
• •Enforce our Terms of Service;
• •Protect the rights, property, and safety of Colony, our users, and third parties.

To Improve Our Services

We use information to better understand how our Services are used, including to:

• •Improve product performance;
• •Develop new features;
• •Analyze usage trends;
• •Identify usability issues;
• •Diagnose technical problems;
• •Conduct testing and quality assurance;
• •Improve accessibility and user experience.

Where possible, we use aggregated or de-identified information for analytics and product improvement.

To Communicate With You

We may use your information to:

• •Respond to support requests;
• •Send service-related notifications;
• •Notify you of important account activity;
• •Communicate security alerts;
• •Inform you of material changes to the Services;
• •Provide onboarding resources;
• •Respond to inquiries.

To Comply With Legal Obligations

We may process personal information where necessary to:

• •Comply with applicable laws;
• •Respond to lawful requests from courts, regulators, or government authorities;
• •Establish, exercise, or defend legal claims;
• •Enforce contractual obligations;
• •Meet regulatory and compliance requirements.

Business Operations

We may also process personal information for legitimate internal business purposes, including:

• •Internal auditing;
• •Financial reporting;
• •Corporate governance;
• •Risk management;
• •Business continuity planning;
• •Compliance monitoring;
• •Vendor management;
• •Mergers, acquisitions, reorganizations, or other corporate transactions where permitted by law.

The legal basis on which we process your personal information depends on the nature of the processing activity and the jurisdiction in which you are located.

Where applicable, Colony relies on one or more of the following legal bases:

Performance of a Contract

We process personal information where necessary to provide the Services you request, create and manage your account, authenticate users, facilitate collaboration, and fulfill our contractual obligations.

Legitimate Interests

We may process personal information where necessary to pursue our legitimate business interests, provided those interests are not overridden by your rights and freedoms.

These interests include:

• •Maintaining platform security;
• •Preventing fraud and abuse;
• •Improving the Services;
• •Developing new features;
• •Conducting analytics;
• •Managing business operations;
• •Protecting our legal rights.

Consent

Where required by applicable law, we rely on your consent before processing certain categories of personal information or using particular technologies, such as optional cookies or marketing communications.

Where processing is based on consent, you may withdraw your consent at any time. Withdrawal will not affect the lawfulness of processing carried out before consent was withdrawn.

Compliance with Legal Obligations

We may process personal information where necessary to comply with applicable legal, regulatory, judicial, or governmental obligations.

Protection of Vital Interests

In limited circumstances, we may process personal information where necessary to protect the vital interests of an individual or another person, where permitted by applicable law.

International Users

Because Colony serves users globally, the legal bases described above may vary depending on the privacy laws applicable in your jurisdiction. Where local laws provide additional rights or impose additional obligations, Colony will process personal information in accordance with those applicable legal requirements.

Colony incorporates artificial intelligence ("AI") features to enhance productivity, improve collaboration, and assist users in managing projects, documents, workflows, customer relationships, and other business activities.

Our AI-powered features are designed to assist users by generating content, summarizing information, answering questions, organizing data, and supporting workflow automation. These features are intended to complement (not replace) human judgment.

How AI is used

Depending on the Services you use, Colony may use AI technologies to:

• •Generate text or content based on user prompts;
• •Summarize documents, notes, and conversations;
• •Assist with knowledge management;
• •Support search and information retrieval;
• •Recommend workflows or actions;
• •Help organize projects and workspace content;
• •Automate repetitive administrative tasks;
• •Improve productivity and collaboration.

AI-generated content is provided to assist users and should be reviewed before being relied upon for business, legal, financial, medical, or other significant decisions.

Information Processed by AI Services

When you use AI-powered features, Colony may process information that you intentionally submit, including:

• •User prompts;
• •Questions or requests;
• •Documents uploaded for analysis;
• •Workspace content necessary to generate responses;
• •Files you choose to submit for AI-assisted processing;
• •Technical metadata associated with AI interactions.

Only the information necessary to provide the requested AI functionality is processed.

Users are responsible for exercising appropriate judgment before submitting confidential, sensitive, or regulated information through AI-powered features.

Third-Party AI Service Providers

To provide AI functionality, Colony uses trusted third-party AI service providers.

These providers may process information submitted through AI features solely for the purpose of generating responses or providing requested functionality.

Colony selects providers that offer enterprise-grade security and privacy protections and seeks to ensure that contractual commitments governing data handling are in place where appropriate.

Where additional AI providers are integrated into the Services, this Privacy Policy may be updated to reflect those changes.

AI Observability and Monitoring

To maintain the quality, reliability, and performance of AI-powered features, Colony may use AI observability and monitoring tools.

These tools may collect operational information relating to AI interactions, including prompts, generated responses, timestamps, performance metrics, error information, and other technical metadata necessary for debugging, monitoring, security, and service improvement.

Such information is processed in accordance with applicable contractual obligations and appropriate technical and organizational safeguards.

AI Model Training

Colony does not use your User Content, prompts, or Outputs to train, fine-tune, or otherwise develop artificial intelligence models, whether ours or those of any third party. We will not do so except where you have given express, separately obtained, opt-in consent, which you may withdraw at any time.

Where third-party AI providers process prompts or other content submitted through the Services, Colony uses commercial or business-tier offerings from those providers that contractually exclude our traffic, including your Content, from being used for the provider's own model training. This restriction does not limit our right to use aggregated or de-identified information, or voluntarily submitted Feedback, as described elsewhere in this Privacy Policy.

However, users should review the privacy practices of any third-party services connected to Colony, as those services maintain their own privacy policies and terms governing their respective platforms.

Human Oversight

AI-generated outputs are probabilistic in nature and may occasionally produce inaccurate, incomplete, outdated, or misleading information.

Users remain responsible for reviewing AI-generated content before relying on it or sharing it with others.

Colony encourages users to exercise appropriate professional judgment, particularly where AI-generated information may affect business operations, legal matters, financial decisions, regulatory compliance, or other significant activities.

Future AI Features

As Colony evolves, we may introduce additional AI capabilities designed to improve the functionality of the Services.

Where those features involve materially different processing of personal information, we will update this Privacy Policy and, where required by applicable law, provide additional notice or obtain any necessary consent before implementing such changes.

Colony uses cookies and similar technologies to provide, maintain, secure, and improve the Services.

Cookies are small text files stored on your device when you visit a website or use an online service. They allow the Services to recognize your browser or device and remember certain information about your preferences or session.

Types of Cookies We Use

Essential Cookies

Colony primarily uses essential cookies that are necessary for the operation of the Services.

These cookies enable core functionality such as:

• •User authentication;
• •Session management;
• •Security;
• •Fraud prevention;
• •Account access;
• •Workspace functionality.

Without these cookies, certain parts of the Services may not function properly.

Functional Cookies

From time to time, Colony may use functional cookies to remember user preferences and improve the user experience.

Examples include remembering language preferences, interface settings, and other customization choices.

Analytics Cookies

As Colony continues to develop its platform, we may use analytics technologies to better understand how users interact with the Services, improve product performance, and identify opportunities to enhance the user experience.

Where required by applicable law, analytics technologies will only be deployed following any necessary notice or consent.

Future Advertising Technologies

At the time of publication of this Privacy Policy, Colony does not use advertising cookies or third-party behavioral advertising technologies within the Services.

Should this change in the future, this Privacy Policy and any applicable cookie notices will be updated accordingly.

Managing Cookies

Most web browsers allow users to manage cookie preferences through browser settings.

Users may choose to:

• •Delete existing cookies;
• •Block future cookies;
• •Receive notifications before cookies are stored.

Please note that disabling certain cookies may affect the availability or functionality of some features within the Services.

Cookie Policy

Additional information regarding our use of cookies may be provided in our separate Cookie Policy, which forms part of our overall privacy framework.

Colony does not sell personal information.

We disclose personal information only where necessary to operate the Services, comply with legal obligations, protect our legitimate interests, or where you have directed us to do so.

Depending on how you use the Services, we may disclose personal information to the following categories of recipients.

Service Providers

We may share information with trusted third-party service providers that perform services on our behalf, including providers supporting:

• •Cloud hosting;
• •Authentication;
• •Email delivery;
• •Artificial intelligence functionality;
• •Application monitoring;
• •Analytics;
• •Infrastructure;
• •Security;
• •Customer support.

These providers are authorized to process personal information only as necessary to provide services to Colony and are contractually required to protect such information where applicable.

Payment Processing

We use Dodo Payments as our merchant of record to process subscription payments. When you make a purchase, your payment card details and related billing information are collected and processed directly by Dodo Payments, acting as an independent controller of that transaction data, and are not stored by us. Dodo Payments' handling of your payment information is governed by Dodo Payments' own privacy policy, which we encourage you to review. We receive limited transaction information from Dodo Payments, such as confirmation of payment, subscription tier, and billing status, in order to administer your account.

Workspace Administrators

If you use Colony through an organization or enterprise account, your workspace administrator may access information associated with your account in accordance with your organization's policies and administrative controls.

This may include account information, workspace activity, user-generated content, and other information necessary to manage organizational workspaces.

Business Transfers

If Colony is involved in a merger, acquisition, financing, reorganization, sale of assets, bankruptcy, or other corporate transaction, personal information may be transferred as part of that transaction, subject to applicable legal requirements.

Where required by law, affected users will be notified of any material changes relating to the handling of their personal information.

Legal and Regulatory Requirements

We may disclose personal information where we believe such disclosure is necessary to:

• •Comply with applicable laws or legal processes;
• •Respond to lawful requests from government authorities;
• •Enforce our agreements;
• •Protect the rights, safety, or property of Colony, our users, or others;
• •Detect, investigate, or prevent fraud, security incidents, or other unlawful activities.

Colony is operated by The Coast Global Inc., a company incorporated in the United States. As a result, personal information collected through the Services may be processed, stored, or accessed in the United States and other jurisdictions where Colony, its affiliates, or its trusted service providers operate.

Our infrastructure and service providers may be located in different countries. Accordingly, your personal information may be transferred across national borders where necessary to provide the Services, support our operations, or comply with applicable legal obligations.

Where personal information is transferred internationally, Colony will take appropriate measures designed to ensure that such information remains protected in accordance with applicable privacy and data protection laws. These measures may include:

• •Entering into appropriate contractual arrangements with service providers;
• •Implementing technical and organizational safeguards;
• •Assessing the security and privacy practices of third-party providers;
• •Applying additional safeguards where required under applicable law.

By using the Services, you acknowledge that your personal information may be transferred to, processed, and stored in countries other than the country in which you reside, which may have different data protection laws than those in your jurisdiction.

Where required by applicable law, Colony will implement additional safeguards for cross-border data transfers.

Where we transfer personal information out of the European Economic Area, the United Kingdom, or Switzerland, we rely on the European Commission's Standard Contractual Clauses and, for transfers from the United Kingdom, the UK International Data Transfer Addendum (or the UK Standard Contractual Clauses, as applicable), together with supplementary measures where required.

Our Role: Controller and Processor

We act in different capacities depending on the personal information involved. With respect to personal information contained within your workspace or User Content, we act as a processor (or service provider, as that term is used under U.S. state privacy laws), processing that information on your documented instructions as the controller of that data. With respect to account, billing, authentication, telemetry, support, and marketing information that we collect directly to operate and improve the Services, we act as a controller (or business, as that term is used under U.S. state privacy laws). If you are a business customer and require a data processing agreement reflecting our processor role, one is available on request; see Section 18 (Contact Us).

Colony is committed to protecting the confidentiality, integrity, and availability of personal information.

We maintain administrative, technical, and organizational safeguards designed to protect personal information against unauthorized access, disclosure, alteration, loss, misuse, or destruction.

Our security program includes measures such as:

• •Encryption of data in transit using industry-standard protocols;
• •Encryption of stored data where appropriate;
• •Secure authentication mechanisms;
• •Role-based access controls;
• •Logging and monitoring of security events;
• •Routine vulnerability assessments and security testing;
• •Backup and recovery procedures;
• •Infrastructure monitoring;
• •Access management processes;
• •Security incident detection and response procedures.

Access to personal information is limited to personnel, contractors, and service providers who require such access to perform their responsibilities and who are subject to appropriate confidentiality obligations.

While Colony takes reasonable measures to protect personal information, no method of electronic transmission or storage can be guaranteed to be completely secure. Accordingly, we cannot guarantee absolute security, and users should also take reasonable steps to protect their accounts, including maintaining strong passwords and safeguarding authentication credentials.

If we become aware of a security incident affecting personal information, we will investigate the matter promptly and provide any notifications required under applicable law.

Colony retains personal information only for as long as necessary to fulfill the purposes described in this Privacy Policy, comply with legal obligations, resolve disputes, enforce our agreements, and maintain the security and integrity of the Services.

Retention periods vary depending on the nature of the information and the purposes for which it was collected.

Generally:

When personal information is no longer required, Colony will securely delete, anonymize, or otherwise dispose of the information in accordance with applicable legal and operational requirements.

Certain information may be retained for longer periods where required by law, necessary to establish or defend legal claims, prevent fraud, comply with regulatory obligations, or protect the rights and interests of Colony and its users.

Depending on your location and applicable law, you may have certain rights regarding your personal information.

These rights may include the ability to:

Access Your Information

Request confirmation as to whether Colony processes your personal information and obtain a copy of that information, subject to applicable legal limitations.

Correct Inaccurate Information

Request correction of inaccurate or incomplete personal information held by Colony.

Request Deletion

Request deletion of your personal information where such deletion is permitted under applicable law and is not inconsistent with our legal or contractual obligations.

Certain information may continue to be retained where required for legitimate business, legal, regulatory, or security purposes.

Object to Certain Processing

Where permitted by applicable law, you may object to certain processing activities carried out on the basis of our legitimate interests.

We will evaluate such requests in accordance with applicable legal requirements.

Restrict Processing

In certain circumstances, you may request that we temporarily restrict the processing of your personal information while we consider a request relating to its accuracy, use, or lawfulness.

Data Portability

Where applicable, you may request a copy of certain personal information in a structured, commonly used, and machine-readable format.

Where technical functionality is not yet available within the Services, requests may be handled manually where feasible and in accordance with applicable law.

Withdraw Consent

Where processing is based on your consent, you may withdraw that consent at any time.

Withdrawal of consent will not affect processing carried out before consent was withdrawn.

Lodge a Complaint

If you believe your privacy rights have been violated, you may contact us using the details provided in this Privacy Policy.

Where applicable, you may also have the right to lodge a complaint with the relevant supervisory authority or regulatory body in your jurisdiction.

Exercising Your Rights

Requests relating to personal information may be submitted using the contact information provided at the end of this Privacy Policy.

To protect the privacy and security of our users, Colony may take reasonable steps to verify your identity before responding to certain requests.

We will respond to requests within the timeframes required by applicable law.

Enterprise Accounts

If you use Colony through an employer, educational institution, or other organization, certain requests relating to your personal information may need to be directed to your workspace administrator or organization, particularly where that organization determines how your information is managed within the workspace.

California Residents

If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act (together, "CCPA"), gives you the rights described above (to know, delete, and correct your personal information) plus the rights described in this subsection. The categories of personal information we collect, and the categories of third parties to whom we disclose it, are set out in Appendix A and Appendix B.

We do not sell personal information or share it for cross-context behavioral advertising, as those terms are defined under the CCPA, and we have not done so in the twelve months preceding the date of this Privacy Policy. We do not use or disclose sensitive personal information for purposes other than those permitted under the CCPA without your consent. We honor recognized opt-out preference signals, including the Global Privacy Control, where technically feasible, as an exercise of your right to opt out to the extent applicable. We will not discriminate against you for exercising any right under the CCPA. You may designate an authorized agent to submit a request on your behalf, subject to our ability to verify that authorization as required by law.

Colony is designed for use by businesses, professionals, organizations, and individuals who are at least the age required to enter into a legally binding agreement under applicable law. Our Services are not directed to children under the age of 16, and you must be at least 16 years old to use the Services. We do not knowingly collect personal information from anyone under 16. If you will act as a workspace owner, workspace administrator, or billing contact responsible for a paid subscription, you must be at least 18 years old, or the age of legal majority in your jurisdiction if higher.

If you are between the ages of 16 and 18 (or the applicable age of majority in your jurisdiction), you may use the Services only with the involvement or permission of a parent, legal guardian, or other authorized adult where required by applicable law.

If Colony becomes aware that personal information has been collected from a child in violation of applicable law, we will take reasonable steps to delete such information as soon as practicable.

If you believe that a child has provided personal information to Colony in violation of this Privacy Policy, please contact us using the details provided below.

The Services may contain links to websites, applications, integrations, or services operated by third parties.

Additionally, Colony relies on third-party service providers to deliver certain functionality, including cloud infrastructure, authentication, artificial intelligence capabilities, analytics, email delivery, monitoring, and other operational services.

These third-party services operate independently from Colony and maintain their own privacy policies, terms of service, and security practices.

This Privacy Policy applies only to information processed by Colony and does not govern the privacy practices of third parties. We encourage users to review the privacy policies of any third-party services they choose to access or integrate with Colony.

Colony is not responsible for the privacy practices, content, or security of third-party websites, products, or services that are not owned or controlled by us.

Colony may update this Privacy Policy from time to time to reflect:

• •Changes in applicable laws or regulations;
• •Changes to our products or services;
• •The introduction of new features or technologies;
• •Changes in our business operations;
• •Security or compliance improvements; or
• •Other operational or legal requirements.

When we make material changes to this Privacy Policy, we will take reasonable steps to notify users by appropriate means, which may include:

• •Posting an updated version on our website;
• •Providing notice within the Services;
• •Sending email notifications where appropriate; or
• •Using other communication methods permitted by applicable law.

The "Last Updated" date at the beginning of this Privacy Policy will indicate when the most recent revisions became effective.

Your continued use of the Services after the effective date of an updated Privacy Policy constitutes your acknowledgment of the revised Privacy Policy, to the extent permitted by applicable law.

Where applicable law requires your consent before changes take effect, we will obtain such consent in accordance with legal requirements.

If you have any questions, concerns, requests, or complaints regarding this Privacy Policy or the manner in which Colony processes personal information, please contact us using the details below.

Where applicable, requests relating to privacy rights, data access, correction, deletion, or other data protection matters may be submitted using the contact details above.

We will make reasonable efforts to respond to privacy-related requests within the timeframes required under applicable law.

Colony may engage trusted third-party providers to support the operation of the Services, including providers offering:

• •Cloud hosting and infrastructure services;
• •Authentication and identity management;
• •Payment processing (Dodo Payments, acting as merchant of record);
• •Artificial intelligence and machine learning services;
• •Email delivery and communications;
• •Application monitoring and observability;
• •Security and fraud prevention;
• •Analytics and performance monitoring;
• •Customer support tools;
• •Productivity and collaboration integrations.

The list of service providers may change from time to time as our Services evolve. Where required by law, we will update this Privacy Policy or maintain a separate list of subprocessors to reflect material changes. A current named list of our subprocessors, including our AI model providers, is available to business customers on request and is included with our Data Processing Agreement; see Section 18 (Contact Us) to request a copy.

In handling personal information, Colony is guided by the following principles:

• •Transparency: We communicate clearly about how personal information is collected, used, and shared.
• •Lawfulness: We process personal information in accordance with applicable legal requirements.
• •Purpose Limitation: We collect personal information for specified, legitimate purposes and do not use it in ways that are incompatible with those purposes.
• •Data Minimization: We collect only the personal information reasonably necessary to provide and improve the Services.
• •Accuracy: We take reasonable steps to maintain accurate and up-to-date information.
• •Security: We implement technical and organizational safeguards designed to protect personal information.
• •Accountability: We continually review and improve our privacy practices to support responsible data governance.