Privacy Policy

Effective Date: January 15, 2026 Last Updated: August 1, 2026 Version: 2.0

Plain-English Summary

Before the legal text, here is what this policy says in plain language:

1. Who we are: Aligned Strategy Partners, LLC, a Tennessee limited liability company doing business as RoadmapIQ ("we," "us," "our"). We operate the website alignwithsp.com, the RoadmapIQ™ software-as-a-service product, and related coaching and consulting services.
2. What we collect: Information you provide when you sign up, use the RoadmapIQ™, or contact us; information about prospects you research using the RoadmapIQ™; technical information from your use of the Service; and information from third parties you authorize us to access.
3. Why we collect it: To deliver the Service, secure your account, generate the AI-assisted outputs you request, communicate with you, comply with law, and protect our legal rights.
4. Who we share it with: A defined list of subprocessors (named in Section 7) and only as needed to operate the Service. Some subprocessors are connected by you using your own credentials (currently HighLevel/LeadConnector); for those subprocessors, you are establishing the legal relationship directly. We do not sell personal information.
5. Your rights: You may access, correct, delete, port, or restrict your personal information; opt out of marketing; object to certain processing; and lodge complaints. Mechanisms are in Section 10.
6. AI use: We use Google Gemini models, accessed through the Lovable AI Gateway, to process the inputs you submit to the Service. You may also choose to use AI-enabled browsers (such as Comet by Perplexity or Claude in Chrome) alongside the Service to execute actions on third-party platforms; those tools operate under your account, not ours. Section 8 explains both.
7. Multi-tenant data isolation: The Service is a multi-tenant SaaS platform. Your organization's data is segregated from every other organization's data by enforced database-layer controls. Section 14 explains how.
8. Daily Digest emails (opt-in): If you opt in, we send you a daily summary of your action queue and lead activity from an alignwithsp.com sending address; questions or replies go to support@alignwithsp.com. Section 8.2 explains the data flow.
9. How to reach us: Email support@alignwithsp.com for any privacy request. We respond within 30 days.

The legally operative text follows.

1. Identity of the Controller

The data controller responsible for the personal information described in this Policy is:

Aligned Strategy Partners, LLC, a limited liability company organized under the laws of the State of Tennessee, United States, doing business as RoadmapIQ (collectively, "Controller," "we," "us," or "our").

Mailing address: 116 Agnes Rd Ste 200 Knoxville, TN 37919 United States

Contact email (privacy and general inquiries): support@alignwithsp.com Privacy Officer: Shakita Trigg, reachable at support@alignwithsp.com

For Canadian residents under the Personal Information Protection and Electronic Documents Act (PIPEDA), the designated Privacy Officer is the individual reachable at the email address above.

2. Scope of This Policy

This Policy applies to personal information collected by the Controller through:

(a) the website alignwithsp.com and any subdomain (collectively, the "Site"); (b) the RoadmapIQ™ software-as-a-service application (the "Service"); (c) coaching, consulting, and training services delivered under the RoadmapIQ or Aligned Strategy Partners brand (the "Services"); and (d) communications between you and the Controller through email, chat, scheduling tools, and similar channels.

This Policy does not apply to third-party websites or services that may be linked from the Site or Service. Each such third party operates under its own privacy policy. Where you connect a third-party service to the Service using your own credentials (a "Customer-Managed Subprocessor"; see Section 7), the third-party service operates under its own privacy policy and your direct relationship with that service.

3. Categories of Personal Information We Collect

The Controller collects the following categories of personal information:

3.1 Information You Provide Directly

3.2 Information We Collect Automatically

3.3 Information About Prospects (RoadmapIQ™ Use)

The RoadmapIQ™ processes information about third parties (sales prospects) at the direction of subscribed users. This may include:

(a) names, business email addresses, business phone numbers, job titles, employer information, and publicly available professional profiles; (b) public engagement signals (e.g., posts, comments, reactions visible on professional networks); and (c) AI-generated lead scores, outreach drafts, and analytical briefs derived from the foregoing.

Important: When a subscribed user uses the Service to research a prospect, the subscribed user is the controller of that prospect data for the purposes of the user's outreach activities. The Controller acts as a processor in respect of that prospect data. The subscribed user is responsible for the lawfulness of any outbound communication and for compliance with applicable anti-spam and privacy laws (CAN-SPAM, CASL, GDPR, PIPEDA, and others as applicable). This responsibility is reinforced in our Terms of Service and Acceptable Use Policy.

3.4 Information from Third Parties

We may receive personal information from:

(a) integration partners you authorize through Customer-Managed Subprocessors (e.g., contact records, message metadata, webhook events from your connected HighLevel/LeadConnector account; calendar metadata if connected); (b) payment processors (Stripe) confirming transaction status; (c) subprocessors that return processed outputs to us (e.g., AI inference results from Google Gemini accessed through the Lovable AI Gateway); and (d) email infrastructure providers returning delivery, bounce, and complaint events for emails we send to you.

3.5 Sensitive Personal Information

The Service is not designed to process the following categories of "sensitive personal information" as defined under California Consumer Privacy Act (CCPA), GDPR, or PIPEDA: government identifiers; precise geolocation; racial or ethnic origin; religious or philosophical beliefs; union membership; genetic, biometric, or health data; sexual orientation; or contents of mail, email, or text messages not directed to the Controller.

Do not submit sensitive personal information to the Service. If you submit such information, you do so at your own risk and consent to its processing as described in this Policy.

4. Sources of Personal Information

We collect personal information from the following sources:

(a) Directly from you when you register, subscribe, communicate with us, or use the Service. (b) Automatically through your interaction with the Site and Service (cookies, server logs, application telemetry). (c) From third parties you authorize us to access through Customer-Managed Subprocessors (e.g., HighLevel CRM data accessed via your provided API key). (d) From subprocessors that return processed outputs to us. (e) From publicly available sources as part of prospect research features, at the explicit request of subscribed users.

5. Purposes of Processing

We process personal information for the following purposes:

We do not use personal information for automated decision-making that produces legal or similarly significant effects on individuals without human oversight. RoadmapIQ™ outputs (including lead scores, outreach drafts, and daily action queue items) are advisory only and are subject to user review before any action is taken.

6. Disclosure of Personal Information

We disclose personal information only as described below.

6.1 To Subprocessors

See Section 7 (Subprocessors) for the complete list. Each subprocessor is bound by contract or by its own published terms to use personal information only as needed to deliver its service to us, to maintain confidentiality, and to apply security safeguards.

6.2 Through Customer-Managed Subprocessors

Where you have connected a Customer-Managed Subprocessor (currently HighLevel) using your own credentials, we transmit personal information to that subprocessor at your direction and on your behalf. The subprocessor processes such information under its agreement with you, not with us. See Section 7.

6.3 To Comply with Law

We may disclose personal information when we believe in good faith that disclosure is required by law, regulation, court order, or other legal process, or is necessary to:

(a) protect the rights, property, or safety of the Controller, our users, or others; (b) enforce our Terms of Service or Acceptable Use Policy; (c) detect or prevent fraud, security incidents, or abuse; or (d) cooperate with law enforcement in a lawful investigation.

We will, to the extent legally permitted, notify affected users of any such disclosure unless prohibited from doing so.

6.4 In a Business Transition

If we are involved in a merger, acquisition, financing, reorganization, sale of assets, or similar transaction, personal information may be transferred as part of that transaction. We will notify affected users by email or prominent Site notice before personal information becomes subject to a different privacy policy.

6.5 With Your Consent

We may disclose personal information to other parties with your direct consent.

6.6 De-Identified or Aggregated Data

We may share de-identified or aggregated information that cannot reasonably be used to identify an individual, for purposes including industry analysis, marketing, and Service improvement.

We do not sell personal information within the meaning of the California Consumer Privacy Act, and we do not "share" personal information for cross-context behavioral advertising.

7. Subprocessors

The Controller engages the following subprocessors to deliver the Service. This list is current as of the Effective Date and reflects the actual integrations wired into the production application as of April 24, 2026. The most current list is maintained in Section 7 of this Privacy Policy.

Customer-managed subprocessors

Some subprocessors above are connected to the Service by the Customer through credentials the Customer provides (currently: HighLevel). For these subprocessors:

• The Customer establishes the legal relationship directly with the subprocessor and is bound by the subprocessor's own Terms of Service and Data Processing Agreement
• The Customer's data resides in the subprocessor's tenant under the Customer's account
• The Company processes data through the subprocessor only to the extent the Customer's credentials authorize
• The Customer can revoke the credentials at any time, immediately terminating the Company's access to the subprocessor on the Customer's behalf
• The Company is not the data controller for activity that occurs entirely within the Customer's subprocessor tenant

Subprocessors marked above as "Customer-managed subprocessor" follow this model. All other listed subprocessors are engaged directly by the Company.

Subprocessors NOT used by the Service

The Company does not engage the following third parties as subprocessors. Their absence is intentional and material to our data flow:

• AI providers we do not use directly: OpenAI, Anthropic, Cohere, Mistral, AWS Bedrock — all AI processing is routed through Lovable's AI Gateway to Google Gemini models only
• Email/SMS providers we do not use directly: Mailgun, SendGrid, Postmark, Resend, Twilio (Twilio is used indirectly only through the Customer's own HighLevel account)
• Lead enrichment providers we do not use: Clearbit, Apollo, Hunter, ZoomInfo, Lusha
• Product analytics providers we do not use: Segment, PostHog, Mixpanel, Amplitude, Heap

If you observe data flows that suggest any of the above are in use, please contact support@alignwithsp.com — we treat such reports as security incidents.

AI-enabled browsers (customer-side): Some Customers choose to use AI-enabled browsers (Comet by Perplexity, Claude in Chrome, etc.) alongside the Service. These tools operate on the Customer's own machine under the Customer's own account with the third-party vendor; they are not subprocessors of the Company. See Section 8.1.

We require each Company-engaged subprocessor to maintain confidentiality and apply administrative, technical, and physical safeguards appropriate to the data processed. Where a subprocessor is located outside the United States or Canada, we rely on the subprocessor's published cross-border transfer mechanisms (including, where applicable, Standard Contractual Clauses, Google Cloud's Data Processing Addendum, or equivalent).

Notice of Change: We will provide at least 30 days' notice of the addition of a new Company-engaged subprocessor that processes personal information of subscribed users, by email and on the subprocessors page, allowing customers to object before the change takes effect. Customer-Managed Subprocessor changes are at the Customer's discretion and do not require notice from us.

8. Use of Artificial Intelligence

The Controller uses artificial intelligence ("AI") to deliver core Service functionality, including lead scoring, outreach-message generation, daily action queue generation, and pipeline-brief generation.

Routing architecture: All AI inference requests are routed through the Lovable AI Gateway (ai.gateway.lovable.dev), which forwards requests to Google Gemini models (google/gemini-2.5-flash and google/gemini-3-flash-preview). The Controller does not maintain direct API relationships with OpenAI, Anthropic, or other model providers as of the Effective Date.

Inputs: When you submit a prompt, search query, lead criteria, service-offering description, or other input to the RoadmapIQ™, that input may be transmitted through the Lovable AI Gateway to Google's Gemini infrastructure for processing. Your Rules of Engagement (a structured object you configure that includes ICP definition, voice and tone preferences, daily caps, blocklist, and similar rules) is included as a system-prompt prefix on every AI call so that outputs are consistent with your strategy.

Outputs: AI-generated outputs (lead scores, outreach drafts, daily action queue items, briefs) are returned to the Service for your review. Outputs are advisory only. They may contain inaccuracies, fabrications, or biased content. You are responsible for reviewing every AI output before using it for any business purpose, including outbound communication, decision-making, or external publication.

Per-organization AI cost metering: The Service records the input and output token count, model identifier, and estimated cost of every AI call made on behalf of your organization. Daily and monthly token caps are enforced at the Service edge to prevent runaway cost. You can view your organization's AI usage in Settings.

Vendor commitments we rely upon:

(a) Lovable — Lovable's gateway terms govern transmission of inference requests to underlying model providers. Lovable's published policies are referenced in Section 7. (b) Google Cloud / Vertex AI Gemini commercial terms — under Google Cloud's commercial AI terms applicable to Gemini API usage, Google does not use customer prompts or generated outputs to train its general-purpose models. The applicable terms are the Google Cloud Service Specific Terms and the Vertex AI / Generative AI service terms.

These vendor commitments are subject to the vendors' own terms and may change. We monitor vendor terms and will update this Policy if material changes occur.

No legal, financial, or medical advice: AI outputs from the Service do not constitute legal advice, financial advice, medical advice, or any other professional advice. Consult a qualified professional for matters requiring such advice.

8.1 AI-Enabled Browser Tools (Customer Choice)

Customers may choose to operate the Service alongside an AI-enabled browser (such as Comet by Perplexity, Claude in Chrome, or similar tools) to execute actions on third-party platforms (such as LinkedIn) on the Customer's behalf. When the Customer does so:

• The AI-enabled browser operates under the Customer's own account on the third-party platform; the Company does not act as agent for or on behalf of the Customer in those interactions
• Data the Customer copies between the Service and the AI-enabled browser (for example, an action prompt copied to the browser's command interface) is processed by the AI-enabled browser's vendor under that vendor's privacy policy and terms of service
• The Company does not transmit Customer data to AI-enabled browsers or their vendors directly; any such transmission occurs through the Customer's own use of those tools
• The Customer is responsible for the AI-enabled browser vendor's terms of service, including any usage caps, content policies, and acceptable-use restrictions
• The Customer is responsible for compliance with each third-party platform's User Agreement (including, for LinkedIn, Section 8.2 of the LinkedIn User Agreement governing automated access)

8.2 Daily Digest Emails (Opt-In)

The Service offers an opt-in Daily Digest email feature. Customers who choose to enable it receive a periodic summary of their action queue, lead activity, and Rules-of-Engagement performance from an alignwithsp.com sending address. Questions or replies about the Daily Digest should be directed to support@alignwithsp.com.

• Opt-in default OFF: No Daily Digest is sent unless the Customer explicitly enables it in Settings → Notifications → Daily Digest
• Double opt-in: After enabling the toggle, the Customer receives a confirmation email; Daily Digest sends only begin after the Customer confirms via that email
• One-click unsubscribe: Every Daily Digest includes a one-click unsubscribe link compliant with RFC 8058, IETF List-Unsubscribe standards, and the Gmail/Yahoo February 2024 bulk-sender requirements; the unsubscribe takes effect immediately
• Sender domain isolation: Daily Digest emails are sent from the dedicated subdomain digest.alignwithsp.com, separate from transactional, support, privacy, and legal mail, so deliverability of the Customer's other Service-related email is not affected by Digest subscription state
• Complaint-rate monitoring: The Service monitors complaint rates per organization on a rolling 7-day basis and automatically disables Daily Digest sends for an organization when complaint rates exceed industry-recognized thresholds; the Customer is notified
• Tier-based content: Daily Digest content varies by Subscription tier (e.g., a Tier 2 Operator digest includes AI-generated reasoning per action, a weekly recap, and richer engagement signals; a Tier 1 Founder digest includes a top-5 action summary). A Tier 3 bundle digest is planned for June 2026 release
• Engagement tracking: Daily Digest emails include open and click tracking pixels and tracked links so that we and the Customer can measure engagement; the Customer can disable open/click tracking in Settings

The data summarized in a Daily Digest is the Customer's own organizational data; no other Customer's data is included in any Customer's Digest. The Company does not share Daily Digest content with third parties except as needed to send the email through the Customer's chosen delivery channel (currently Workspace SMTP through digest.alignwithsp.com).

9. Data Retention

We retain personal information only as long as necessary for the purposes described in this Policy, subject to the following minimum and maximum retention periods:

After the applicable retention period, personal information is deleted, anonymized, or, where deletion is not technically feasible (e.g., backups), placed beyond use and securely destroyed at the next regular backup-rotation cycle.

We may retain personal information longer where required by law or to assert, exercise, or defend legal claims.

10. Your Rights

You have rights under applicable privacy law. The specific rights available depend on where you live. We honor the following rights for all users regardless of jurisdiction, except where prohibited by law:

10.1 Universal Rights Honored

We will respond to verifiable rights requests within 30 days of receipt. Where the request is complex or we receive numerous requests, we may extend the response window by an additional 60 days, with notice to you.

We may need to verify your identity before fulfilling a request. The verification process is proportional to the sensitivity of the information requested.

10.2 California Residents (CCPA / CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (collectively, "CCPA"):

(a) Right to know the categories and specific pieces of personal information we have collected about you, the categories of sources, the business or commercial purposes for collection, and the categories of third parties to whom we disclose information. (b) Right to delete personal information we have collected from you, subject to enumerated exceptions. (c) Right to correct inaccurate personal information. (d) Right to opt out of "sale" or "sharing" of personal information. We do not sell or share personal information within the meaning of CCPA. (e) Right to limit use and disclosure of "sensitive personal information." We do not collect sensitive personal information for purposes that would trigger this right. (f) Right to non-discrimination for exercising any CCPA right.

To exercise CCPA rights, email support@alignwithsp.com with the subject line "CCPA Request." You may designate an authorized agent in writing to make a request on your behalf; we may require verification of the agent's authority and your identity.

10.3 Canadian Residents (PIPEDA and Provincial Equivalents)

If you are a Canadian resident, you have rights under the federal Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial laws (including Quebec's Law 25, Alberta's PIPA, and British Columbia's PIPA):

(a) Right of access to your personal information and information about its use and disclosure. (b) Right of correction of inaccurate personal information. (c) Right to challenge our compliance by contacting our Privacy Officer at support@alignwithsp.com. (d) Right to withdraw consent at any time, subject to legal or contractual restrictions and reasonable notice. (e) Right to lodge a complaint with the Office of the Privacy Commissioner of Canada (https://www.priv.gc.ca) or the relevant provincial commissioner.

For Quebec residents under Law 25, you also have the right to data portability and the right to be informed of automated decision-making affecting you. We do not engage in automated decision-making that produces legal or similarly significant effects without human review.

10.4 Lodging a Complaint

You may lodge a complaint with the supervisory authority in your jurisdiction:

• United States — California: California Privacy Protection Agency (cppa.ca.gov)
• United States — Other states: State attorney general's office
• Canada — Federal: Office of the Privacy Commissioner of Canada (priv.gc.ca)
• Canada — Quebec: Commission d'accès à l'information (cai.gouv.qc.ca)
• Canada — Alberta: Office of the Information and Privacy Commissioner of Alberta (oipc.ab.ca)
• Canada — British Columbia: Office of the Information and Privacy Commissioner for British Columbia (oipc.bc.ca)

We encourage you to contact us first at support@alignwithsp.com so we have the opportunity to address your concern directly.

11. Children's Privacy

The Service is not directed to children under the age of 18. We do not knowingly collect personal information from children under 18. If we learn that we have collected personal information from a child under 18 without verifiable parental consent, we will delete that information promptly. If you believe we have collected information from a child under 18, contact us at support@alignwithsp.com.

For Canadian residents, the Service is not directed to individuals under the age of majority in their province of residence (18 in most provinces; 19 in some).

12. Cookies and Similar Technologies

The Site and Service use cookies and similar technologies. We use the following categories:

Daily Digest emails (Section 8.2) include open- and click-tracking pixels and tracked links. The Customer can disable open/click tracking in Settings → Notifications.

Most browsers allow you to control cookies via browser settings. Disabling strictly necessary cookies will impair Service functionality. You can manage tracking-related preferences via the Global Privacy Control (GPC) signal where applicable; we honor GPC for purposes of CCPA opt-out signals.

13. International Data Transfers

The Controller is located in the United States. Personal information processed by us, including information of Canadian residents, is transferred to and processed in the United States. By using the Service, you understand and consent to this transfer.

Where personal information is transferred from Canada to the United States, we rely on the lawful transfer mechanisms recognized under PIPEDA, including the customer's consent and our contractual safeguards with subprocessors.

If we engage subprocessors located outside the United States or Canada (including Lovable's European Union infrastructure or Google's global Cloud regions), we rely on those subprocessors' published transfer mechanisms (including Standard Contractual Clauses where they apply to processing of EU/UK data, and Google Cloud's Data Processing Addendum) and require contractual confidentiality and security commitments.

Customer-Managed Subprocessors operate under their own published cross-border transfer disclosures, which the Customer should review separately.

14. Security

We implement administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, alteration, disclosure, or destruction. These include:

(a) encryption of personal information in transit using industry-standard TLS; (b) encryption of personal information at rest where supported by the underlying subprocessor (Supabase storage, Stripe payment infrastructure); (c) role-based access control with least-privilege principles, including row-level security ("RLS") in the production Supabase database that enforces per-user data isolation on top of the public anon key; (d) Supabase service-role key restricted to backend edge functions; never exposed to client-side code, frontend bundles, or .env files distributed to users; (e) two-factor authentication required for super-admin accounts; (f) super-admin role assignment controlled by a database trigger (auto_assign_super_admin) limiting super-admin status to an explicit allowlist of email addresses; (g) regular review of access logs and security telemetry; (h) subprocessor due-diligence and contractual security commitments; (i) password storage using salted, one-way cryptographic hashing (Supabase Auth); (j) regular software and dependency updates; (k) backup and disaster recovery procedures (Supabase managed backups); (l) employee and contractor training on data protection.

14.1 Multi-Tenant Data Isolation

The Service operates as a multi-tenant SaaS platform. Each Customer's data is segregated by an organization_id tenant boundary enforced at every layer of the stack:

• Database layer: Postgres Row-Level Security (RLS) policies on every Customer-data table restrict reads and writes to rows where organization_id matches the requesting user's organization. Cross-tenant access is structurally impossible from authenticated client requests.
• Application layer: All edge functions resolve the calling user's organization context before any data write and scope all queries by that organization.
• Privileged operations: Background jobs (scheduled tasks, webhook ingestion, billing reconciliation, daily action queue generation, daily digest sending) run with elevated database privileges, with all cross-tenant operations recorded in an immutable audit log accessible only to authorized Company personnel.
• Credential encryption: Customer-provided third-party integration credentials (e.g., HighLevel API keys) are encrypted at rest using a per-row symmetric key, with the master key held in Supabase Vault. Decryption is permitted only via a SECURITY DEFINER database function callable solely by the Service's edge functions. Customer-readable views expose only non-sensitive metadata (connection status, last validated timestamp, last 4 characters of the API key) and never the encrypted credential.
• Billing-field protection: Subscription tier, status, daily send limits, AI token caps, and feature flags are protected by a three-layer enforcement model (security-definer canonical-state function, RLS policy comparison, and a backstop trigger) that prevents Customers from modifying their own billing state.
• Audit logging: Every super-admin mutation and every decryption of a Customer credential is recorded with caller, target, and timestamp in an immutable audit log retained for 7 years.

14.2 Limitations of the security model

No security model is absolute. The Service relies on the integrity of underlying providers (Supabase, Lovable, Google Cloud) and on Customer practice (strong passwords, multi-factor authentication, careful sharing of API credentials). The Service cannot prevent compromises arising from Customer credential leakage, Customer endpoint malware, or vulnerabilities in third-party connected services outside the Company's control.

No system is fully secure. We cannot guarantee that personal information will not be accessed, disclosed, altered, or destroyed by breach of any of our safeguards. We will notify affected users and applicable regulators of a security incident in accordance with applicable law.

15. Anti-Spam and Outbound Communications (CAN-SPAM, CASL, and Other Laws)

The Service includes features that allow subscribed users to send outbound communications to prospects through the GoHighLevel/LeadConnector Customer-Managed Subprocessor. The subscribed user is the legal sender of record for those communications and is responsible for compliance with all applicable anti-spam laws, including but not limited to:

• the United States CAN-SPAM Act (15 U.S.C. § 7701 et seq.);
• Canada's Anti-Spam Legislation (CASL, S.C. 2010, c. 23) and related regulations, which require express or implied consent prior to commercial electronic messages;
• the U.S. Telephone Consumer Protection Act (47 U.S.C. § 227) and FCC regulations governing SMS;
• A2P 10DLC carrier registration requirements for SMS in the United States;
• the EU ePrivacy Directive (where applicable); and
• state, provincial, and other jurisdictional anti-spam and consumer-protection laws.

The Controller's own marketing communications to you, the user, comply with CAN-SPAM (including a functioning unsubscribe mechanism in every commercial email and accurate sender identification) and CASL (express or implied consent and required identification information). You may opt out of our marketing communications at any time by clicking the unsubscribe link in any email we send or by emailing support@alignwithsp.com. Service-related notices (account, security, billing) are operational messages and are not subject to opt-out. Daily Digest emails (Section 8.2) are sent only with your opt-in consent and may be unsubscribed at any time via the one-click link in any Digest email or in Settings → Notifications.

The Controller does not pool Customer outbound traffic through any shared delivery infrastructure. Outbound delivery to prospects flows through the Customer's own HighLevel tenant under the Customer's own sending domain, phone numbers, and HighLevel subscription.

16. Third-Party Links and Integrations

The Site and Service may contain links to or integrations with third-party websites and services (including LinkedIn, Stripe, Google Workspace, GoHighLevel, and others identified in Section 7). This Policy does not apply to those third parties. We encourage you to review the privacy policies of any third party you interact with through the Service.

17. Changes to This Policy

We may update this Policy from time to time. The "Last Updated" date at the top reflects the most recent revision. For material changes, we will:

(a) post a prominent notice on the Site at least 30 days before the change takes effect; (b) email registered users at the address on file at least 30 days before the change takes effect; and (c) where required by law, request renewed consent.

Continued use of the Service after the effective date of an updated Policy constitutes acceptance of the updated Policy.

18. Dispute Resolution and Governing Law

This Policy is governed by the laws of the State of Tennessee, United States, without regard to conflict-of-laws principles. For Canadian residents, this provision does not displace mandatory rights under PIPEDA or applicable provincial privacy legislation.

You agree to first contact us at support@alignwithsp.com with any privacy-related dispute and to give us 30 days to attempt to resolve the matter informally before lodging a regulatory complaint or initiating legal action, except where applicable law permits or requires immediate complaint or action.

19. Contact

For all privacy matters, including rights requests, consent withdrawal, complaints, or general questions:

Email: support@alignwithsp.com

Mail: Aligned Strategy Partners, LLC dba RoadmapIQ 116 Agnes Rd Ste 200 Knoxville, TN 37919 United States

Privacy Officer (PIPEDA): Shakita Trigg, reachable at support@alignwithsp.com

We aim to respond to all privacy inquiries within 30 days.

Definitions

• "AI-Enabled Browser" means a web browser application that incorporates an integrated AI assistant capable of executing user-directed actions on web pages, including but not limited to Comet (by Perplexity), Claude in Chrome (by Anthropic), and successor or similar tools.
• "Connected Third-Party Service" or "Customer-Managed Subprocessor" means a third-party software service the Customer connects to the Service via Customer-provided credentials (API key, OAuth token, or equivalent), including without limitation the Customer's HighLevel/LeadConnector account.
• "Daily Action Queue" means the prioritized list of suggested actions the Service generates for the Customer each day, based on the Customer's Rules of Engagement and the Service's analysis of the Customer's lead and engagement data.
• "Daily Digest" means the opt-in periodic email summary of the Customer's organizational data sent from an alignwithsp.com sending address, as described in Section 8.2.
• "Personal information" has the meaning given in CCPA and PIPEDA, and means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular individual or household.
• "Process" or "processing" means any operation performed on personal information, including collection, recording, organization, storage, alteration, retrieval, consultation, use, disclosure, transmission, restriction, erasure, or destruction.
• "Rules of Engagement" means the configuration the Customer provides to the Service governing the Customer's outbound and engagement strategy, including ICP definition, daily volume caps, voice and tone preferences, blocklist, and engagement priorities.
• "Subprocessor" means a third party engaged by the Controller to process personal information on the Controller's behalf, as listed in Section 7. A "Customer-Managed Subprocessor" is a Subprocessor that the Customer connects to the Service using credentials the Customer provides.
• "Service" means the RoadmapIQ™ software-as-a-service product and related features.

↑ Back to top