Privacy Policy

Owner and Data Controller

Testa, Inc. DBA Kronologic
PO BOX 26990
Austin, TX 78755

Owner Contact Email: privacy@kronologic.ai

Introduction

Testa, Inc. DBA Kronologic ("Kronologic," "we," "our" or "us") respects your privacy and is committed to protecting your privacy through our compliance with this policy.

This Privacy Policy ("Policy") describes our practices in connection with information that we collect through the Kronologic cloud software platform and applications (collectively, our "Platform") as well as Kronologic's privacy practices in relation to the use of Kronologic's website www.kronologic.ai and its associated domains (collectively, the "Site").

This Policy also describes your data protection rights, including the right to object to some of Kronologic's processing. This Policy does not apply to information collected by any third party, including through any third-party application or content (including advertising) that links to or is accessible from our Platform or websites.

Before submitting information to the Site or Platform, please review this Policy carefully. By using or accessing the Site or Platform, you are accepting this Policy. You are responsible for submitting accurate information to the Site. If you prefer that we not collect your personal information, please do not provide it to us. When you submit your personal and other information on the Site, you hereby consent to the collection, use and disclosure of such information as set forth in the Policy.

Kronologic may update this Policy from time to time by posting a new version on the Site. We encourage you to periodically review this page for the latest information on our privacy practices.

Users Outside of the United States

The Site is hosted in the United States and is governed by United States law. If you are outside the United States when you visit the Site, please be aware that your information may be transferred to, stored and processed in the United States where our servers are located and our central database is operated. The data protection and other laws of the United States and other countries might not be as comprehensive as those in your country. By using the Site, you consent to your information being transferred to our facilities in the United States and to the facilities of those third parties with whom we share it as described in this Policy.

Information We Collect

We may collect, store, and use the following kinds of information and personal data ("Collected Information"):

1. information and personal data about your visits to and use of our Platform. We collect personal data about your computer and your visits to our Platform, including your IP address, geographical location, browser type, referral source, length of visit and number of page views, all of which are also collected Information.
2. information about any transactions carried out between you and us on or in relation to our Platform, including information relating to any purchases you make of our goods or services. We collect:
   • First and last name
   • Title
   • Position
   • Employer
   • Contact information (company, email, phone, physical business address)
   • Localization data
   • Application usage data
   • Email communication data
3. information that you provide to us for the purpose of registering with us or subscribing to the Platform. We collect first and last name, email address, and phone number for these purposes.

Kronologic does not capture or store credit card information.

Cookies & Other Tracking Technologies We Use

We use cookies on the Platform. A cookie is a text file sent by a web server to a web browser, and stored by the browser. The text file is then sent back to the server each time the browser requests a page from the server. This enables the web server to identify and track the web browser.

We may send one or more cookies which may be stored by your browser on your computer. The information we obtain from cookies is part of the Collected Information. Our advertisers and service providers may also send you cookies.

Most browsers allow you to refuse to accept cookies. You can choose to refuse all cookies by configuration in your browser. This will, however, have a negative impact upon the usability of many websites, including access of the Platform.

To improve our Site and the Platform, we may retain third party service providers to operate this Site and help us monitor, collect and analyze information regarding your interactions with the Platform and data you input, including through the use of such providers' cookies on your computer.

For more information about cookies and other tracking technologies we use, please see our Cookies Policy here.

Why We Use Collected Information

Your Collected Information will be used to:

1. administer and improve the Platform's usability;
2. improve your browsing experience by modification and replacement of text, images, videos, links to increase relevance to you as a visitor;
3. facilitate communication between Kronologic and you;
4. provide you with important administrative information regarding the Site and Platform, such as changes to this Policy, our Terms of Use and our other policies;
5. prevent fraud and other prohibited or illegal activities; and
6. provide other companies with statistical information about our users. Information we provide to other companies will not identify any individual user.

By authorizing your account to be accessed by the Kronologic Platform, you allow the transmission of emails and calendar invitations which you compose and submit as permitted through the Platform. Kronologic imports replies to these emails and invitations into the Platform for continued processing and responses enabled by Kronologic's technology. You retain the ability to respond to any email message and import/update events on your linked calendar and email. Please note that to the extent that you elect to connect with a Google or Microsoft account, our use of Collected Information will be further limited as indicated in the "Additional Limits on Use of Your Google and Microsoft User Data" section of this Policy.

SMS/Text Messaging Communications

Certain meeting types on the Kronologic Platform can be configured by the host to send SMS text message reminders and follow-up messages to guests before and after a scheduled meeting. This section describes how Kronologic collects, uses, and protects phone numbers provided for SMS communications.

How we collect phone numbers for SMS

Phone numbers are collected voluntarily from meeting guests at the point of booking. When a guest visits a Kronologic-hosted booking page for a meeting type that has SMS reminders enabled, the booking form displays an optional phone number field. If the guest chooses to enter a phone number, they are required to explicitly check a consent checkbox reading:

"I agree to receive SMS text reminders about this meeting from [Host Name] via Kronologic. Message frequency depends on meeting settings (typically 1-2 per meeting). Message and data rates may apply. Reply STOP to opt out, HELP for help."

Bookings cannot be submitted with a phone number unless this consent checkbox is affirmatively ticked. Kronologic records the date, time, and exact wording of each consent for audit purposes.

How we use phone numbers collected for SMS

Phone numbers collected through this mechanism are used solely to deliver transactional SMS messages related to the specific meeting the guest scheduled. This includes:

• Appointment reminders before the meeting (typically 1-2 messages)
• Optional post-meeting follow-ups if the host has configured them
• Automated responses to HELP or STOP keywords
• Account-related notifications required for the transaction to complete

Phone numbers collected on booking pages are not used for marketing, promotional messaging, upselling, cross-selling, or any non-transactional purpose. They are not shared or sold to third parties. They are not used to send messages about any meeting the guest did not themselves schedule.

Message frequency and rates

SMS message frequency depends on the meeting host's configuration, but is typically 1-2 messages per scheduled meeting. Message and data rates may apply depending on the recipient's mobile carrier and plan. Kronologic does not charge recipients for SMS messages; any charges come from the recipient's own mobile carrier.

How to opt out of SMS

Recipients can opt out of Kronologic SMS messages at any time by replying STOP (or any of: UNSUBSCRIBE, CANCEL, END, QUIT) to any SMS from Kronologic. Upon receipt of a STOP keyword, Kronologic will immediately suppress all future SMS delivery to that phone number, across every host and every booking.

To re-subscribe after having opted out, the recipient can reply START (or YES, UNSTOP) to the same number.

For help, recipients can reply HELP (or INFO, SUPPORT) to receive an automated response containing contact information and a reminder of the opt-out mechanism.

Phone number retention

Phone numbers collected for SMS are retained as part of the booking record for the duration of Kronologic's standard data retention policy described elsewhere in this Privacy Policy. Recipients can request earlier deletion by contacting privacy@kronologic.ai.

Data sharing

Kronologic uses Twilio, Inc. as a sub-processor to deliver SMS messages. Phone numbers are shared with Twilio solely for the purpose of sending and receiving SMS messages on Kronologic's behalf and are subject to Twilio's own privacy and security practices. Phone numbers are not shared with any other third party for any purpose except as required by law.

Additional Limits on Use of Your Google and Microsoft User Data on the Platform

Certain limited use requirements apply with respect to information input to or transferred from the Platform via certain third-party applications. Specifically with respect to user data transmitted from a Gmail account (and corresponding Google Calendar) or Microsoft email account (and corresponding Outlook Calendar) through the Google OAuth API or Microsoft OAuth API, the following applies:

1. The Platform will only use access to a user's Gmail account (and corresponding Google Calendar) or Microsoft email account (and corresponding Outlook Calendar) to read, write, modify, or control message and invitation bodies (including attachments), metadata, headers, and settings to provide a solution that allows your users of the Platform to compose, send, read, and process emails and calendar invitations.
   • This calendar invite data will not be transferred to others unless doing so is necessary to provide, support and improve these features, comply with applicable law, or as part of a merger, acquisition, or sale of assets.
   • The Platform will not use this data for serving advertisements.
2. The Platform will not allow humans to read this data unless (a) we have your affirmative agreement for specific messages, (b) doing so is necessary for security purposes such as investigating abuse, (c) to comply with applicable law, or (d) for the Platform's internal operations to support your organization's business processes.

If Google or Microsoft modifies its terms related to the use of such data, those modifications may change the above to the extent they relate to our use of the affected data.

Kronologic's use and transfer to any other app of information received from Google APIs will adhere to Google API Services User Data Policy, including the Limited Use requirements.

Disclosure of Collected Information

Unless you have consented or as otherwise described in this Policy, we will not disclose your Personal Information except:

1. to enable our third party subprocessors to perform functions consistent with this Policy on our behalf. Such third parties may be provided with access to Personal Information needed to perform their functions, but may not use such information for any other purpose;
2. to the extent that we are required to do so by law;
3. in connection with any legal proceedings or prospective legal proceedings;
4. in order to establish, exercise or defend our legal rights (including providing information to others for the purposes of fraud prevention and reducing churn risk); or
5. in response to lawful requests by public authorities, including to meet national security or law enforcement requirements

Security of Collected Information

Kronologic has implemented technical, administrative and physical security measures to protect your information from unauthorized access and use as described on our Kronologic Trust & Security page. While Kronologic strives to protect your information, no data transmission over the Internet is 100% secure and, consequently, we cannot ensure the security of any information. We will store all the personal data you provide or that we collect about you on secure servers.

You are responsible for keeping your passwords confidential. We will not ask you for your passwords.

Controlling Your Personal Information

If you tell us that you do not want us to use your Personal Information to contact you, Kronologic will comply with the applicable law. You may instruct Kronologic to stop sending you emails, newsletters, or other information by submitting a request at privacy@kronologic.ai with your name, email address, and your opt-out instructions with "UNSUBSCRIBE" in the subject, or, if available, following the "UNSUBSCRIBE" instructions provided. For SMS text messages, reply STOP (or UNSUBSCRIBE, CANCEL, END, or QUIT) to any message to immediately opt out of future SMS delivery, or contact privacy@kronologic.ai with the phone number you would like opted out. Kronologic may, however, continue to use your Personal Information to contact you to service your account or as otherwise authorized by law. Please note that if you use more than one name or e-mail address when communicating with Kronologic or using the Site, you may continue to receive communications from Kronologic to any name and/or email address not specified in your opt-out request.

For data collected via the Site, we retain your personal data indefinitely or until data is requested to be purged from our systems. We will respond to such requests within 30 days.

For data collected via the Platform, we will retain your information for as long as your account is active or as needed to provide you services. You may request action be taken on your data as described in this Policy. We will respond to such requests within 30 days or per any required time period as listed under specific privacy requirements in this Policy. Upon termination of your subscription to the Platform, we will delete your data within 90 days of termination. We may need to retain and use your information as necessary to comply with our legal obligations and as required by law. Also, we may retain deidentified and anonymized data and metadata to support processing and enhancements to the Platform.

Cross-Border Data Transfers personal data rights and controls

We process data both inside and outside of the United States and rely on legally-provided mechanisms to lawfully transfer data across borders. Countries where we process data may have laws which are different from, and potentially not as protective as, the laws of your own country.

For individuals that are from the European Economic Area (EEA) or other regions that stipulate a lawful basis for processing personal information (such as under GDPR Article 6), our legal basis for collecting and using this personal information will depend on the nature and circumstances of the processing activity. Where we are the processor for our customers, our legal basis may be fulfilment of a contract or consent. Where we are the controller, our legal basis will be consent or legitimate interest where the processing is in our legitimate interests and not overridden by the individual's data protection interests, or fundamental rights and freedoms. These interests are to provide individuals with access to the Platform and features of the Platform; to send them information they have requested; to ensure the security of our Platform by trying to prevent unauthorized or malicious activities; or to enforce compliance with our terms of use, contracts and other policies.

If you are from the EEA or another region that stipulates a lawful basis for processing personal information, you may request a copy of your personal data from Kronologic or exercise your rights to your data by contacting Kronologic via the contact method listed at the top of this Policy.

Privacy laws, including the General Data Protection Regulation ("GDPR"), give rights to individuals over their personal data.

It's your right to:

• Access: Be informed of the personal data we process about you and to request access to it
• Rectification: Request that we amend or update your personal data where it's inaccurate or incomplete
• Erasure: Request that we delete certain of your personal data
• Restriction: Request that we temporarily or permanently stop processing all or some of your personal data
• Object: Object to us processing your personal data at any time, on grounds relating to your particular situation. Object to your personal data being processed for direct marketing purposes.
• Data portability: Request a copy of your personal data in electronic format and the right to transmit that personal data for use in another party's service
• Not be subject to automated decision-making: Not be subject to a decision based solely on automated decision making (decisions without human involvement), including profiling, where the decision would have a legal effect on you or produce a similarly significant effect

Third Party Websites

The Platform may contain links to other websites and third-party products, which you may elect to use at your sole discretion. We are not responsible for the privacy policies of third-party websites or such site operators' actions including the collection or use of your personal data.

Severability

The invalidity or unenforceability of any provisions of this Policy in any country shall not affect the validity or enforceability of any other provision of this Policy, which shall remain in full force and effect.

Information for California consumers

Under the California Consumer Privacy Act, or CCPA, California residents have certain rights regarding their data, including:

• To know the categories of personal information collected and disclosed and the sources from which such information was collected (see below and also the section Information We Collect).
• The business purpose for using or sharing personal information (see the section Why We Use Collected Information).
• The categories of third parties with whom personal information has been disclosed or sold (see the section How we use the information we collect: sharing and disclosing of your personal information with third parties for a business purpose)
• The ability to opt-out of the sale of personal information
• The ability to access or delete certain pieces of personal information (see the section.

Summary of types of information we may receive and collect:

• Identifiers such as your IP, email, address, and name.
• Internet information such as identifiers.
• Professional or employment-related Information such as the company you work in and your job title.
• Geolocation data such as zip code.
• Inferences such as information based on how you use and interact with the Platform.

We will not collect additional categories of personal information without notifying you.

How we collect information: what are the sources of the personal information we collect?

We collect the above specified categories of personal information, either directly or indirectly,

For example, you directly provide your personal information when you submit requests via use of the Platform. You also provide personal information indirectly when you navigate this Site because personal information about you is automatically observed and collected. Finally, we may collect your personal information from third parties that work with us in connection with the Platform or with the functioning of this Platform and its features.

How we use the information we collect: sharing and disclosing of your personal information with third parties for a business purpose

We may disclose the personal information we collect about you to a third party for business purposes. In this case, we enter a written agreement with such third party that requires the recipient to both keep the personal information confidential and not use it for any purpose(s) other than those necessary for the performance of the agreement.

We may also disclose your personal information to third parties when you explicitly ask or authorize us to do so in order to use the functionality of the Platform.

To find out more about the purposes of processing, please refer to the relevant section of this Policy.

Sale of your personal information

Kronologic does not sell your information. This Policy will be updated if we change this.

What are the purposes for which we use your personal information?

We may use your personal information to allow the operational functioning of this Site, the Platform, and the features of both ("business purposes"). In such cases, your personal information will be processed in a fashion necessary and proportionate to the business purpose for which it was collected, and strictly within the limits of compatible operational purposes.

We may also use your personal information for other reasons such as complying with applicable laws and defending our rights before law enforcement and other competent authorities where our rights and interests are threatened or we suffer an actual damage.

We will not use your personal information for different, unrelated, or incompatible purposes without notifying you.

Your California privacy rights and how to exercise them

The right to know and to portability

You have the right to request that we disclose to you:

• the categories and sources of the personal information that we collect about you, the purposes for which we use your information and with whom such information is shared;
• in case of sale of personal information or disclosure for a business purpose;
• for disclosures for a business purpose, the personal information categories obtained by each category of recipient.

The disclosure described above will be limited to the personal information collected or used over the past 12 months.

If we deliver our response electronically, the information enclosed will be "portable", i.e., delivered in an easily usable format to enable you to transmit the information to another entity without hindrance, provided that this is technically feasible.

The right to request the deletion of your personal information

You have the right to request that we delete any of your personal information, subject to exceptions set forth by the law (such as, including but not limited to, where the information is used to identify and repair errors on this Application, to detect security incidents and protect against fraudulent or illegal activities, to exercise certain rights etc.).

If no legal exception applies, as a result of exercising your right, we will delete your personal information and direct any of our service providers to do so.

How to exercise your rights

To exercise the rights described above, you need to submit your verifiable request to us by contacting us via the details provided in this document.

For us to respond to your request, it's necessary that we know who you are. Therefore, you can only exercise the above rights by making a verifiable request which must:

• provide sufficient information so that we are able to verify your identity and that you are the individual about whom we collected personal information (or an authorized representative of that individual); and
• describe your request with sufficient detail so that we are able to understand, evaluate, and respond to it.

We will not respond to any request if we are unable to verify your identity and confirm that the personal information in our possession actually relates to you.

If you are not able to personally submit a verifiable request, you have the option to authorize a person registered with the California Secretary of State to act on your behalf.

If you are an adult, you may make a verifiable request on behalf of a minor under your parental control.

You can submit a maximum number of 2 requests over a period of 12 months.

How and when we are expected to handle your request

We will confirm receipt of your verifiable request within ten days and provide information about how we will process your request.

We will respond to your request within 45 days of its receipt. Should we need more time, we will explain to you why we need more time and how much more time we need. Please note that we may take up to 90 days to fulfill your request.

Our disclosure(s) will cover the preceding 12-month period. Should we deny your request, we will explain to you the reasons behind our denial.

We do not charge a fee to process or respond to your verifiable request unless such request is manifestly unfounded or excessive. In such cases, we may charge a reasonable fee or refuse to act on the request. In either case, we will communicate what we choose and explain the reasons behind it.