Privacy Policy

1. Introduction and Scope

Welcome to Cash Flow Optimizer. We respect your privacy and are committed to protecting your personal and business data. In this Privacy Policy, "Cash Flow Optimizer," "CFO," "we," "us," and "our" refer to RealtoResource, LLC, doing business as Solidify Solutions, the company that operates the Cash Flow Optimizer platform.

This Privacy Policy applies to personal data we collect and process when you:

• Visit or interact with our website at https://www.cfoptimizer.com and its subdomains (the "Site");
• Access or use our web and mobile applications, including at https://app.cfoptimizer.com (the "Application");
• Use any of our features, modules, integrations, APIs, browser extensions, or related products (together with the Site and Application, the "Services");
• Communicate with us, request support or a demo, subscribe to communications, or participate in our events, webinars, surveys, promotions, or affiliate program.

The Services include, among other modules: a customer relationship management (CRM), marketing, and sales suite; task, project, and transaction management with internal communications; accounts receivable and billing management; financial reporting, cash-flow forecasting, and data analytics; labor cost (COGS) tracking; human resources onboarding, performance, and culture/morale tools; and business development and strategy tools. Certain features are AI-powered, as described in Section 6.

For purposes of this Privacy Policy, "personal data" (also referred to as "personal information") means any information relating to an identified or identifiable individual. It does not include aggregated or de-identified information that cannot reasonably be used to identify you.

The Services are intended for businesses and users located in the United States, and we currently offer the Services only to U.S.-based customers. The Services are not directed to individuals located outside the United States, and this Privacy Policy is drafted to reflect U.S. federal and state privacy law.

This Privacy Policy does not apply to personal information we process about our own job applicants, personnel, or contractors in their employment capacity, which is handled under a separate notice, or to information handled solely on behalf of our business customers as their processor (see Section 2), which is governed by our agreement with the relevant customer.

By accessing or using the Services, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with it, please do not access or use the Services. This Privacy Policy is incorporated into and supplements our Terms of Service, Cookie Policy, and other applicable agreements. Capitalized terms not defined here have the meaning given to them in our Terms of Service.

2. Our Two Roles: When We Act as a Controller and When We Act as a Processor

Cash Flow Optimizer processes personal data in two distinct capacities. Understanding which role applies is important because it determines who is responsible for the data and how you exercise your rights.

2.1 When we act as a "Controller." We act as a controller with respect to personal data we collect for our own purposes — for example, when you register for an account, purchase a subscription, visit our Site, contact us, or receive our marketing. This includes your account, contact, billing, device, and usage data. This Privacy Policy governs how we handle that data.

2.2 When we act as a "Processor" or "Service Provider." When you and your authorized users use the Services to run your business, you input, upload, import, or generate data — including personal data about your own contacts, leads, customers, clients, vendors, employees, job applicants, and team members. We refer to this data as "Customer Data." With respect to Customer Data, you (our customer) are the controller and we act as a processor (or "service provider") on your behalf and in accordance with your instructions and our Customer Terms of Service and Data Processing Addendum.

Examples of Customer Data include:

• CRM, marketing, and sales data — names, email addresses, phone numbers, and other details of your leads, prospects, and customers, including information submitted through lead-capture forms and landing pages you build in the Services.
• Accounts receivable and billing data — your customers' billing details, invoices, payment status, and collections history.
• Scheduling and transaction data — calendar bookings and details of individuals who schedule meetings with you, product-catalog and proposal content, service records, and related communications.
• Communications and social data — email content and attachments, calendar events (including meeting details and the names/email addresses of attendees), and social-media and messaging content (including direct messages, comments, and reactions) synced into the Services, and social-media posts published on your behalf through connected accounts.
• Financial data — transactions, cash-flow inputs, labor costs, payroll figures, and financial records you enter or import into the Services.
• HR and "people" data — information about your employees, candidates, applicants, and contractors, including applicant-tracking records, onboarding and offboarding records, performance reviews, compensation and commission data, and culture/morale or pulse-survey responses.
• Internal communications — messages, notes, and content your team members exchange within the Services.

2.3 If you interact with a business that uses our Services. If you are an individual whose personal data has been entered into the Services by one of our customers, that business — not Cash Flow Optimizer — is the controller of your data. To exercise your rights or ask questions about how your data is handled, please contact that business directly.

A Data Processing Addendum (DPA) governing our processing of Customer Data is available to business customers on request; where required by law, it forms part of our agreement with you.

3. Your Responsibilities for Data You Submit About Others

Through your use of the Services, you may provide us with personal data about other individuals (for example, your customers, employees, candidates, or contacts). If you do so, you represent and warrant that:

• You have the authority and a valid legal basis to provide that data to us and to have it processed as described in this Privacy Policy and our Customer Terms of Service;
• You have provided any legally required notices to, and obtained any legally required consents from, the relevant individuals regarding the collection, use, disclosure, and cross-border transfer of their personal data; and
• You will comply with all laws applicable to your collection and use of that data, including any notice, disclosure, consent, and data-subject-rights obligations.

You are solely responsible for the accuracy, quality, legality, and lawful handling of Customer Data and for ensuring that your use of the Services complies with applicable law.

If you use the Services to build lead-capture forms or landing pages, or to sync your email or social-media communications, you are responsible for providing any privacy notices and obtaining any consents required on those forms and pages.

We ask that you do not submit special categories of sensitive personal data (such as government identifiers, Social Security numbers, financial account credentials belonging to individuals, health or biometric data, or information about racial or ethnic origin, religious beliefs, or trade union membership) into free-text fields or areas of the Services not specifically designed to collect it.

4. Information We Collect

We collect the following categories of information.

4.1 Information You Provide Directly

• Identity Data — first name, last name, username, job title, and business/company name.
• Contact Data — email address, telephone number, mailing or billing address.
• Account Credentials — passwords and authentication information (stored in hashed or otherwise protected form).
• Billing and Payment Data — billing contact and address, subscription plan, transaction history, and payment method details. Payment card and bank-account details are collected and processed by our third-party payment processors; we do not store full payment card numbers on our systems.
• Business Profile Data — industry, company size, fiscal year, business goals, and configuration preferences you provide during onboarding and setup.
• Communications and Content — messages, support requests, feedback, survey and questionnaire responses, demo and event registrations, and any other content you send to us or post in community or feedback areas.

4.2 Customer Data You Submit or Import

As described in Section 2, when you use the Services you submit, upload, import, or generate Customer Data across the CRM/marketing, sales, accounts receivable, transaction management, financial reporting, analytics, labor-cost, HR/people, business development, and internal-communications modules. We process this data as a processor on your behalf.

4.3 Financial Data Collected Through Integrations

When you connect QuickBooks Online, your bank or credit-card accounts, or other financial services to Cash Flow Optimizer, we access and process financial data necessary to provide the Services, which may include:

• Transaction Data — bank and credit-card transactions, including amounts, dates, payees, and descriptions imported through bank feeds and connected accounting systems.
• Accounting and Categorization Data — your chart of accounts, categories, classes, locations, and historical categorization patterns.
• Reconciliation Data — statements, matched and unmatched transactions, and reconciliation status for connected accounts.
• Invoices, Bills, and Receipts — documents you upload or that are imported from connected services for matching and record-keeping.
• Derived Financial Data — forecasts, cash-flow analyses, labor COGS calculations, KPIs, and AI-generated financial insights produced by the Services.

We access this data only through authorized API connections using secure, token-based authentication. We do not receive or store your online-banking or QuickBooks login credentials.

4.4 Information from Connected Email, Calendar, and Social Media

If you connect your email, calendar, or social-media and messaging accounts to the Services, we may access and process information from those accounts as needed to provide the features you enable. We use Unipile, a third-party connectivity provider, to connect and sync data from supported email providers (Google/Gmail, Microsoft 365/Outlook, and other IMAP-based providers), calendar providers (Google Calendar and Microsoft/Outlook Calendar), and social-media and messaging platforms (currently LinkedIn, WhatsApp, Instagram, Telegram, and Facebook Messenger, as supported by Unipile and enabled in your account), and postforme.dev to publish and schedule original posts to your connected social accounts. Depending on the permissions you grant and the features enabled in your account, this may include:

• Email — message content, attachments, headers, folders, and sender/recipient details for connected mailboxes;
• Calendar — event titles, descriptions, locations, start/end times, meeting links, and the names and email addresses of meeting attendees;
• Messaging — direct messages and attachments exchanged through connected LinkedIn, WhatsApp, Instagram, Telegram, or Messenger accounts, and the contact/profile details of the people you message; and
• Social engagement — comments, reactions, and related interactions you post or receive on connected social-media accounts, and the public profile information of the people you interact with.

Not every feature described above is available on every plan, and some may still be in active development; we will identify features that are in beta or not yet generally available within the Application. The scope of access always depends on the permissions you grant and the settings of the connected service, and you may disconnect any connected account at any time through your account settings or the connected provider's own settings. See Section 8.7 for additional detail, including platform-specific risks of using automated messaging and engagement features.

4.5 Information We Collect Automatically

When you access the Services, we automatically collect certain technical and usage information, including:

• Device and Connection Data — IP address, browser type and version, operating system, device identifiers, connection type, mobile carrier, time zone, and language and configuration settings.
• Usage Data — pages and features viewed, actions taken within the Services, objects created or modified, frequency and duration of use, search terms, referring/exit URLs, and access date/time stamps.
• Log Data — server logs recording the above categories for operation, analytics, security, and debugging purposes.
• Cookies and Similar Technologies — see Section 9.

4.6 Information We Receive from Other Users and Other Sources

• From other users of your account — your account administrator or team members may add or provide information about you when they invite you, assign you a task, or mention you in a message.
• From your workspace administrator — if you use the Services within a business account you do not own or control, the account owner controls that account and may access, manage, or remove your access and associated data.
• From authentication providers — if you register or log in using a third-party credential (for example, Google), we receive basic profile information such as your name and email address.
• From third parties and public sources — we may receive business-contact and related information from analytics providers, marketing and advertising partners, our affiliates, and publicly available sources, which we may combine with other information we hold.

4.7 AI Interaction Data

When you use our AI-powered features — for example, the AI analyst chat, AI financial insights, or other AI features — we collect and process the prompts, questions, instructions, conversation content, and the underlying account, financial, and Customer Data needed to generate a response, along with the outputs produced.

We store your AI analyst chat conversation history and transcripts so that we can maintain your history within the Application, analyze usage to operate and improve the Services, and provide you with a more tailored and personalized experience. This stored conversation content is treated as your account and Customer Data, is protected using the measures described in Section 12, and is retained in accordance with Section 13. We do not use this content to train general-purpose or foundation AI models (see Section 6.2).

5. How We Use Your Information

We use personal data only as permitted by applicable law and for the purposes described below. We use information to:

• Provide, operate, and maintain the Services — create and manage your account, authenticate users, configure modules, deliver the CRM, financial, HR, and other features you use, and process the data you enter or import.
• Process transactions and manage billing — handle subscriptions, payments, invoicing, and account administration.
• Provide customer support — respond to your requests, troubleshoot issues, and provide onboarding and guidance.
• Generate AI-powered insights and automation — produce forecasts, analytics, anomaly detection, recommendations, summaries, and other AI outputs you request, as described in Section 6.
• Personalize and tailor your experience — remember your AI chat history and preferences and tailor content, recommendations, and features to how you use the Services.
• Improve and develop the Services — analyze usage trends and performance, diagnose and fix technical issues, and develop new and improved features, using aggregated and de-identified data wherever practicable.
• Communicate with you — send transactional and administrative messages (such as billing, security, and service notices) and, where permitted, marketing communications about our products and services.
• Advertise and measure our marketing — understand how our advertising and organic web traffic perform, measure campaign effectiveness, and reach potential customers, including through the analytics and advertising technologies described in Section 9.
• Secure and protect the Services — verify accounts, monitor for and investigate suspicious activity, prevent fraud and abuse, and enforce our terms and policies.
• Comply with legal obligations and defend our rights — meet legal, tax, accounting, and regulatory requirements, respond to lawful requests, and establish, exercise, or defend legal claims.
• For other purposes with your consent — where we ask for and you provide consent for a specific purpose.

We may aggregate or de-identify information so that it no longer reasonably identifies you, and we may use and retain such aggregated or de-identified information for any lawful purpose, including to analyze, benchmark, and improve the Services.

6. Artificial Intelligence (AI) Features, Data Use, and User Acknowledgment

6.1 AI-Powered Features

Our platform uses AI to provide enhanced functionality that currently includes, and may in the future expand to include: automated business, financial, and cash-flow insights and recommendations; predictive analytics and forecasting; anomaly and pattern detection on spend, revenue, and KPIs; a conversational AI analyst and chat interfaces; content generation, drafting, and summarization; intelligent data processing, categorization, and reconciliation (including planned AI bookkeeping); and AI-assisted marketing, administrative, and workflow-optimization tools. New AI features may be added, modified, or discontinued over time.

6.2 How Your Data Is Used in AI Processing

When you interact with an AI-powered feature, your prompts and the relevant account, financial, and Customer Data are processed to generate the requested outputs. This processing may involve transmitting data to trusted third-party AI service providers that supply the underlying models and infrastructure. The AI providers we currently use are Anthropic (Claude), Google (Gemini), and OpenAI (ChatGPT/OpenAI API).

• We do not sell your data to AI providers.
• We access these providers exclusively through their paid business, enterprise, or developer APIs, under terms that restrict use of your data to generating the outputs you request. We do not use your identifiable personal data, financial data, or Customer Data to train general-purpose or foundation AI models, and we do not permit our AI providers to use your data to train their models, without your explicit consent.
• We may use aggregated, anonymized, and de-identified data — which cannot reasonably be used to identify you or your business — to develop, evaluate, and improve our own features and models.

6.3 Automated Decision-Making and Human Oversight

Our AI features are designed to assist and inform your decisions, not to replace them. The Services do not make legally or similarly significant decisions about individuals solely by automated means without human involvement. You remain in control: AI outputs are recommendations and analyses for you to review, and you may request human assistance or disregard, override, or independently verify any AI output at any time.

6.4 Limitations of AI Technology

You understand and acknowledge that AI-generated content, recommendations, analyses, forecasts, and outputs:

• May contain inaccuracies, errors, or omissions, and should not be relied upon as the sole basis for any business, financial, tax, accounting, legal, or other critical decision;
• Are provided "as is," without warranties of any kind, express or implied, regarding accuracy, completeness, reliability, timeliness, or fitness for a particular purpose;
• Should be independently verified by you before you take any action based on them;
• May reflect biases or limitations inherent in training data or algorithmic processes;
• Are not a substitute for professional advice from a qualified accountant, bookkeeper, financial advisor, tax professional, attorney, or other licensed professional; and
• May produce different results for similar inputs due to the probabilistic nature of AI systems.

6.5 User Responsibility and Discretion

By using AI-powered features, you expressly acknowledge and agree that: you use all AI tools at your own risk and discretion; you are solely responsible for evaluating the appropriateness and accuracy of any AI output for your specific circumstances; you will exercise independent judgment and appropriate due diligence before acting on any AI output; you will treat AI outputs as supplementary information only; and you will seek professional advice for matters requiring specialized expertise.

6.6 Disclaimer of Liability

To the maximum extent permitted by applicable law, Cash Flow Optimizer and its affiliates, officers, directors, employees, agents, and licensors shall not be liable for any direct, indirect, incidental, special, consequential, exemplary, or punitive damages arising out of or related to: any reliance on AI-generated content, recommendations, analyses, or outputs; any errors, inaccuracies, or omissions in AI-generated materials; any decisions made or actions taken based on AI-generated information; any business losses, lost profits, or financial damages resulting from the use of AI features; any failure of AI systems to perform as expected; or any unintended consequences arising from AI outputs. Nothing in this Section limits liability that cannot be limited or excluded under applicable law.

6.7 Continuous Improvement and Changes

AI technology is continuously evolving. While we strive to improve the accuracy and reliability of our AI features, outcomes cannot be guaranteed. We reserve the right to modify, update, add, or discontinue AI features at any time.

6.8 No Professional Advice (All Services)

The Services and their outputs — whether generated by AI features or by other tools such as reports, dashboards, forecasts, cash-flow projections, and analytics — are provided for informational and business-operations purposes only and do not constitute financial, accounting, bookkeeping, tax, investment, legal, or other professional advice. You are responsible for your own business decisions and should consult a qualified professional before relying on any output for a material decision.

7. How We Share Your Information

We do not sell your personal data for money. We share personal data only as described below. (For how certain advertising cookies may qualify as a "sale" or "sharing" under some U.S. state laws, and how to opt out, see Sections 9, 14, and 15.)

• Service providers and subprocessors. We share information with trusted vendors who perform services on our behalf, such as application hosting (Vercel), database and infrastructure services (Supabase), payment processing (Stripe), email, calendar, and social-media/messaging syncing (Unipile), social-media publishing (postforme.dev), data storage, analytics, security and fraud prevention, email and SMS delivery, customer support, and communications tools. These providers are contractually required to protect your information and to use it only to provide services to us.
• Third-party AI providers. As described in Section 6, we share the data necessary to deliver AI features with our AI providers — currently Anthropic (Claude), Google (Gemini), and OpenAI (ChatGPT) — subject to their business/enterprise terms and to confidentiality and no-training commitments.
• Integration partners. When you connect a third-party service (e.g., Intuit/QuickBooks, banks via Plaid, Google, social platforms), data flows between that service and Cash Flow Optimizer as needed to provide the integration, governed by that provider's terms and this Privacy Policy. See Section 8.
• Firms, advisors, and administrators managing your account. If your account is managed or accessed by an accounting firm, bookkeeper, fractional CFO, consultant, or other advisor, or by an administrator of a business account, they may access data within the Services as part of the services they provide to you.
• Corporate affiliates. We may share information with our corporate parents, subsidiaries, and entities under common control, who will handle it in accordance with this Privacy Policy.
• Professional advisors. We may share information with our lawyers, auditors, insurers, bankers, and similar advisors where necessary for legitimate business purposes.
• Legal, safety, and compliance. We may disclose information where we believe in good faith it is necessary to comply with applicable law, regulation, subpoena, court order, or other legal process; to respond to lawful requests by public authorities; to enforce our terms and agreements; or to protect the rights, property, or safety of Cash Flow Optimizer, our users, or the public.
• Business transfers. See Section 18.
• With your consent or at your direction. We share information for any other purpose disclosed to you with your consent.
• Aggregated or de-identified data. We may share aggregated or de-identified information that cannot reasonably identify you for any lawful purpose.

Except as described in this Privacy Policy, our Cookie Policy, our Data Processing Addendum, or as authorized by you, we do not disclose your information to third parties. Customer Data is treated as your confidential information and is not shared except on your instruction or as required by law.

Affiliate and referral program. If you participate in our affiliate/referral program, we collect the information needed to administer the program and pay you — including your contact details, payment information, and tax information. Commission payouts are processed through Stripe Connect, which separately collects your IRS Form W-9, identity-verification (KYC) information, and U.S. bank account details to issue payments and meet tax-reporting obligations (for example, Form 1099-NEC or 1099-K); Stripe, not us, stores this information. Affiliate partners do not receive access to the personal data of customers who sign up through their code or link.

8. Third-Party Integrations

The Services are designed to connect with tools you already use. Your use of any integration is subject to the third party's own terms and privacy policy, which we encourage you to review. We are not responsible for the privacy practices of third-party services.

8.1 Intuit / QuickBooks Online. When you authorize a connection to QuickBooks Online, financial data flows between Intuit's systems and Cash Flow Optimizer through authorized APIs using secure authentication. Our access to and use of QuickBooks data is limited to providing the Services. You may revoke access at any time through your Intuit/QuickBooks account settings or by disconnecting the integration.

8.2 Bank and credit-card connections (Plaid). We use Plaid Inc. ("Plaid") to connect your bank and credit-card accounts to the Services. When you link an account, you authenticate through Plaid's secure flow, and Plaid provides us with account and transaction data through its API. We do not receive or store your online-banking username or password. Plaid's collection and use of your information is governed by Plaid's end-user privacy policy. You can manage or disconnect Plaid connections at the Plaid Portal or within the Services.

8.3 Google, Gmail, and Google Calendar. If you connect a Google Workspace, Gmail, or Google Calendar account, you will be asked to grant specific permissions to enable the features you use. Our use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data to develop, improve, or train generalized AI or machine-learning models. You can review or revoke our access in your Google account's security settings.

8.4 Microsoft 365, Outlook, and Microsoft Calendar. If you connect a Microsoft 365, Outlook, or Exchange email or calendar account, you will be asked to grant specific Microsoft Graph permissions (for example, to read, send, and organize mail, and to read, create, edit, and delete calendar events) to enable the features you use. We access Microsoft data only through Microsoft's official Graph API using a token-based OAuth connection, and we do not use Microsoft user data to develop, improve, or train generalized AI or machine-learning models. You can review or revoke our access at any time in your Microsoft 365 account's security or app-permissions settings.

8.5 Social media and messaging accounts. If you connect social-media or messaging accounts — currently supported platforms include LinkedIn, WhatsApp, Instagram, Telegram, and Facebook Messenger for messaging and other Unipile-powered features, and LinkedIn, X (Twitter), YouTube, Instagram, Facebook, and TikTok for scheduled publishing — we access information from those accounts as needed to provide the enabled features (which may include sending and receiving messages, posting and retrieving comments and reactions, retrieving contact and profile details, and publishing or scheduling content), based on the permissions you grant. Not every platform supports every feature, and some features described in this Section may not yet be generally available on all plans. We use Unipile and postforme.dev for these features, as described in Sections 8.7 and 8.8.

8.6 Payment processors. We use third-party payment processors — currently Stripe — to handle subscription payments and, where offered, ACH transactions. Your payment information is processed by those providers in accordance with their privacy policies; we do not store full payment card numbers. If you participate in our affiliate program, we also use Stripe Connect to verify your identity, collect your tax and payout information, and issue commission payments, as described in Section 7.

8.7 Email, calendar, messaging, and social-engagement syncing (Unipile). We use Unipile, a third-party connectivity provider, to connect your email, calendar, and social-media/messaging accounts to the Services and to sync messages, comments, reactions, calendar events, and related communications with records in your account, based on the permissions you grant. Unipile hosts and processes data in France (EU) on Scaleway infrastructure and makes a data processing addendum available. Because Unipile processes communications data in the EU, some Customer Data may be processed outside the United States, as described in Section 11. Connecting and using automated messaging, connection-request, InMail, posting, or commenting features on a third-party platform (such as LinkedIn or WhatsApp) is subject to that platform's own terms of use, and some platforms restrict or prohibit certain automated or third-party-tool activity. Excessive, repetitive, bulk, or non-human-like use of these features may cause the connected platform to rate-limit, flag, restrict, or suspend the connected account, independent of any action by us. You are responsible for using these features reasonably and in accordance with each connected platform's terms, and we are not responsible for actions a third-party platform takes against your connected account.

8.8 Social-media publishing (postforme.dev). We use postforme.dev to publish and schedule posts to your connected social-media accounts. postforme.dev is a cloud-hosted service that runs on infrastructure providers such as Supabase, Vercel, and Render. Your use of connected social platforms also remains subject to those platforms' own terms.

9. Cookies and Tracking Technologies

We and our partners use cookies, web beacons, pixels, tags, and similar technologies to operate, secure, analyze, and improve the Site and Services, and to support our marketing and advertising. The categories we use include:

• Strictly necessary cookies — required for core functionality such as authentication, session management, and security. These cannot be turned off through our cookie controls.
• Functional/preference cookies — remember your settings and preferences.
• Analytics cookies — help us understand how the Site and Services are used so we can improve them and measure how our organic and paid web traffic performs.
• Advertising and targeting cookies — used by us and third-party advertising and social-media partners to measure the performance of our advertising and to deliver relevant advertising to you across other sites, apps, and services.

9.1 Google Analytics. We use Google Analytics, a web-analytics service provided by Google LLC, to help us understand how visitors find and use our Site and how our organic and paid web traffic performs. Google Analytics uses cookies and similar technologies to collect information such as your IP address, device and browser information, pages and content viewed, referring source, and on-site behavior. This information is processed by Google in accordance with Google's Privacy Policy. You can opt out of Google Analytics across websites by installing the Google Analytics Opt-out Browser Add-on.

9.2 Meta (Facebook) Pixel. We use the Meta Pixel, an analytics and advertising tool provided by Meta Platforms, Inc., to measure the effectiveness of our advertising, understand the actions people take on our Site, and reach current and prospective customers with relevant ads on Meta platforms (such as Facebook and Instagram) and across the Meta audience network. This information is processed by Meta in accordance with Meta's Privacy Policy and Meta's Cookies Policy. You can manage how Meta uses your data for advertising through your Meta account's ad-preferences and off-Meta-activity settings.

9.3 Managing cookies and tracking. When you first visit our Site, our cookie-consent banner lets you accept, reject, or manage non-essential cookies. Analytics and advertising technologies, including Google Analytics and the Meta Pixel, do not load until you consent to the applicable category, and you can change your choices at any time through the "Cookie Settings" control on our Site. You can also limit or block these technologies through your browser settings, the Google Analytics opt-out add-on, Meta ad preferences, and industry opt-out tools at the Digital Advertising Alliance (optout.aboutads.info) and Network Advertising Initiative (optout.networkadvertising.org). To opt out of any "sale" or "sharing" of your personal information, you may use the "Cookie Settings" control on our Site, broadcast a Global Privacy Control (GPC) signal, or contact us as described in Section 21. For more detail, see our Cookie Policy.

9.4 Effect under state privacy law. Because Google Analytics and the Meta Pixel involve disclosing identifiers and internet-activity information to Google and Meta for analytics and advertising purposes, our use of these technologies may be considered a "sale" or "sharing" (for cross-context behavioral advertising) of personal information under certain U.S. state privacy laws. We do not exchange your personal information for money. You may opt out of this "sale"/"sharing" using our cookie-consent banner, the "Cookie Settings" control on our Site, a Global Privacy Control (GPC) signal, or the other methods described in Sections 9.3 and 15.

10. Marketing, Email, SMS, and Push Communications

We may send you communications about the Services and our related products, offers, and content.

• Email marketing. We send marketing emails in accordance with applicable law (including the CAN-SPAM Act). You can opt out at any time using the unsubscribe link in any marketing email or by contacting us.
• SMS/text messaging. We may send text messages in connection with the Services, such as account verification, security alerts, accounts-receivable and collections reminders, and — where you have opted in — marketing messages. Message frequency varies, and message and data rates may apply. You can opt out of marketing texts by replying STOP. Opt-in data and consent for text messaging will not be shared with third parties except with aggregators and providers used to deliver the messages.
• Push notifications. If you use our mobile applications, we may send push notifications, which you can control at the device level.
• Transactional communications. Even if you opt out of marketing, we will continue to send essential account, billing, security, and service communications related to your use of the Services.
• Call monitoring and recording. We do not currently record or transcribe sales, demo, or customer-support calls. If we introduce call recording or transcription in the future, we will provide notice at or before the time of the call and obtain consent where required by applicable law.
• Testimonials, logos, and marketing features. With your permission, or as otherwise permitted by our agreement with you, we may display your name, business name, logo, statements, quotes, testimonials, reviews, and case studies in our marketing and promotional materials. If you have provided a testimonial and later wish to update or remove it, please contact us as described in Section 21.

11. Where Your Data Is Processed

Cash Flow Optimizer is based in the United States, and we store and process your information primarily in the United States. Some of our subprocessors process data outside the United States: in particular, Unipile, which we use to sync email and social-media communications, processes data in France (EU) on Scaleway infrastructure. Where a subprocessor processes your information outside the United States, we require appropriate contractual and technical safeguards to protect it consistent with this Privacy Policy.

The Services are intended for U.S.-based businesses and users, and we do not currently offer the Services to customers outside the United States. If you access the Site from outside the United States, please be aware that your information will be processed in the United States, which may have data-protection rules that differ from those of your location.

12. Data Security

We implement appropriate technical, organizational, and physical measures designed to protect personal data against accidental or unlawful loss, misuse, alteration, and unauthorized access or disclosure. These measures include, as appropriate:

• Encryption in transit using industry-standard protocols (such as TLS) and encryption at rest for stored data;
• Access controls, including role-based access, the principle of least privilege, and authentication safeguards for internal systems;
• Secured, enterprise-grade cloud infrastructure with logical isolation of customer data;
• Monitoring, logging, and incident-response processes for security events; and
• Periodic reviews of our systems and practices.

No method of transmission or storage over the Internet is completely secure, and we cannot guarantee absolute security. You are responsible for maintaining the confidentiality of your account credentials and limiting access to your devices. If we become aware of a security incident affecting your personal data, we will notify you and the relevant authorities as required by applicable law.

13. Data Retention

We retain personal data for as long as necessary to fulfill the purposes for which it was collected, including to provide the Services, comply with our legal, tax, accounting, and regulatory obligations, resolve disputes, and enforce our agreements. Illustrative retention periods include:

• Account and profile data — retained for the duration of your active subscription and for a reasonable period after account termination, after which it is deleted or anonymized unless a longer period is required or permitted by law.
• Financial and Customer Data — retained for the duration of your subscription; following account termination, deleted or anonymized within a reasonable period (generally within 90 days), unless a longer period is required by applicable tax, accounting, or legal obligations or by your instructions.
• Backup archives — data in backups may persist for a limited additional period (generally up to 30 days) after deletion from active systems.
• Marketing data — retained for a reasonable period from your last engagement with our communications, subject to your preferences.
• Aggregated or de-identified data — may be retained indefinitely, as it cannot reasonably identify you.

When you delete your account, we will delete or de-identify your personal data from our active systems within a reasonable period (and, for most account data, within 30 days), subject to the exceptions above and to technical limitations of backup systems.

For Customer Data, retention and deletion are also governed by your instructions and our Customer Terms of Service and Data Processing Addendum.

14. Your Privacy Rights and Choices

Depending on your location and applicable law, you may have some or all of the following rights regarding your personal data:

• Access — request access to, and a copy of, the personal data we hold about you.
• Correction/Rectification — request that we correct inaccurate or incomplete personal data.
• Deletion/Erasure — request that we delete your personal data, subject to legal exceptions.
• Restriction — request that we restrict processing in certain circumstances.
• Objection — object to certain processing of your personal data, including direct marketing and targeted advertising.
• Portability — request your personal data in a structured, commonly used, machine-readable format.
• Withdraw consent — withdraw consent at any time where we rely on it (without affecting prior processing).
• Opt out of marketing — unsubscribe from marketing communications at any time.
• Opt out of "sale"/"sharing"/targeted advertising — as described in Sections 9 and 15.
• Non-discrimination and appeal — not be discriminated against for exercising your rights, and appeal a denial where applicable law provides for it.

How to exercise your rights. To make a request, contact us using the details in Section 21. We will respond within the time required by applicable law. To protect your privacy, we may need to verify your identity before acting on your request, and we may decline requests where permitted by law.

If your data is controlled by one of our customers. If your personal data was submitted to the Services by a business that uses Cash Flow Optimizer (see Section 2.3), please direct your request to that business, which is the controller. We will assist our customers in responding as required.

15. U.S. State Privacy Rights

Several U.S. states have enacted comprehensive consumer privacy laws that provide their residents with specific rights. This Section describes those rights and how to exercise them.

15.1 California (CCPA/CPRA)

If you are a California resident, you have rights under the California Consumer Privacy Act, as amended by the California Privacy Rights Act ("CCPA"). In the preceding 12 months, we may have collected the following statutory categories of personal information: identifiers (such as name, email, address, phone number, and account identifiers); commercial information (such as subscription and billing records); internet or network activity (such as usage and browsing data); geolocation data (such as approximate location from IP address); financial information (such as billing details and financial data you provide); professional or employment-related information (such as job title and company); audio/electronic information (such as communications and support recordings, where applicable); and inferences drawn from the above.

We do not sell your personal information for money. However, our use of certain analytics and advertising technologies — specifically Google Analytics and the Meta (Facebook) Pixel (see Section 9) — may constitute a "sale" or "sharing" for cross-context behavioral advertising under the CCPA. You may opt out of such "sale"/"sharing" using our cookie-consent banner or the "Cookie Settings" control on our Site, by broadcasting a Global Privacy Control (GPC) signal, by contacting us as described in Section 21, or by using the browser and industry opt-out tools described in Section 9.3.

As a California resident, you have the rights to: know and access the personal information we have collected; delete your personal information (subject to exceptions); correct inaccurate personal information; opt out of the "sale" or "sharing" of your personal information; limit the use of sensitive personal information; appeal a denial of your request; and not be discriminated against for exercising these rights.

We collect a limited amount of information that may be considered sensitive personal information under the CCPA, such as account log-in credentials and financial-account information you or your integrations provide. We use and disclose this information only for purposes permitted under the CCPA without triggering a right to limit — namely, to provide the Services you request, secure your account, and perform necessary business operations — and not to infer characteristics about you.

California "Shine the Light" (Civil Code § 1798.83). California residents may request information about our disclosure of personal information to third parties for those third parties' own direct-marketing purposes. We do not disclose personal information to third parties for their own direct marketing. You may confirm this by contacting us as described in Section 21.

15.2 Other U.S. State Privacy Laws

If you are a resident of another U.S. state with a comprehensive consumer privacy law (including, for example, Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, and other states as their laws take effect), you may have rights to: confirm whether we process your personal data and access it; correct inaccuracies; delete your personal data; obtain a portable copy of your personal data; and opt out of targeted advertising, the sale of personal data, and certain profiling. You may also have the right to appeal a denial of your request.

Because we use Google Analytics and the Meta Pixel for analytics and targeted advertising (see Section 9), you may exercise the right to opt out of targeted advertising and any "sale"/"sharing" of your personal data using our Cookie Settings control, a Global Privacy Control (GPC) signal, or by contacting us as described in Section 21.

15.3 How to Exercise Your Rights

To exercise any of the rights above, contact us using the details in Section 21. We will verify your identity before acting on your request and will respond within the timeframe required by applicable law. You may use an authorized agent to submit a request where the law permits, subject to verification. If your personal data was submitted to the Services by a business that uses Cash Flow Optimizer (see Section 2.3), please direct your request to that business as the controller of your data.

16. Children's Privacy

The Services are business tools intended for use by businesses and their authorized personnel. They are not directed to individuals under the age of 18, and we do not knowingly collect personal data directly from children under 18, and in no event from children under 13 (consistent with the Children's Online Privacy Protection Act). If we learn that we have collected personal data directly from a child under 18, we will take steps to delete it promptly. If you believe a child has provided us personal data, please contact us using the details in Section 21.

17. Third-Party Websites and Services

The Services may contain links to, or integrate with, third-party websites, applications, and services that we do not operate or control. This Privacy Policy does not apply to those third parties, and we are not responsible for their privacy practices. We encourage you to review the privacy policies of any third-party service before providing it with your information.

18. Business Transfers and Corporate Changes

If we are involved in a merger, acquisition, financing, reorganization, bankruptcy, dissolution, or sale of all or a portion of our assets or business, your information may be transferred as part of that transaction, subject to the acquiring party's agreement to honor commitments consistent with this Privacy Policy. Where required by law, we will notify you of any such change in ownership or use of your personal data and of any choices you may have.

19. Do Not Track and Global Privacy Control

Some browsers and browser extensions offer "Do Not Track" (DNT) signals or opt-out preference signals such as the Global Privacy Control (GPC). While there is no common industry standard for DNT and we do not respond to DNT signals, our Site detects and honors the Global Privacy Control (GPC) signal: when we receive a GPC signal from your browser or device, we treat it as a valid request to opt out of the "sale" or "sharing" of your personal information and of targeted advertising for that browser or device. You can also opt out using our cookie-consent banner, the "Cookie Settings" control on our Site, or the other methods described in Sections 9 and 15.

20. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or other factors. We will post the updated version on this page and revise the "Last Updated" date above. If we make material changes, we will provide additional notice as required by law (for example, by email or a prominent notice in the Services). Your continued use of the Services after an update takes effect constitutes your acceptance of the revised Privacy Policy. We encourage you to review this Privacy Policy periodically.

21. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, or if you would like to exercise your privacy rights, please contact us:

RealtoResource, LLC dba Solidify Solutions (Cash Flow Optimizer)
Attn: Privacy Team
Email: privacy@cfoptimizer.com
Support: support@cfoptimizer.com
Mailing Address: 191 Prescott Lane, Winchester, KY 40391
Website: https://www.cfoptimizer.com

Business customers may request our Data Processing Addendum by contacting us at the address above.

This Privacy Policy is governed by and construed in accordance with the laws of the Commonwealth of Kentucky, United States, without regard to its conflict-of-laws principles, except where applicable data-protection law provides otherwise.