Privacy Policy

1. Scope of This Policy

This Privacy Policy applies to personal information GRM Solutions collects through the Platform, our marketing website, sales and support interactions, and other related business activities. It applies to:

• Individuals who register for or use the Platform on behalf of a Customer organization, including administrators and other authorized users ("Authorized Users");
• Individuals whose personal information is submitted to GRM Solutions by a Customer in connection with the Customer's use of the Platform (for example, personnel names referenced within a continuity plan); and
• Visitors to our marketing website and individuals who contact us for sales, support, or other inquiries.

Capitalized terms not defined in this Privacy Policy have the meanings given to them in the Terms of Service. As described in Section 13, GRM Solutions acts in different capacities depending on the type of personal information at issue.

2. Information We Collect

2.1 Information You Provide Directly

We collect personal information that you or your organization provide when you:

• Register for an account, including name, business email address, job title, organization name, and password;
• Complete risk assessments, build continuity or recovery plans, or otherwise input content into the Platform, which may include names, titles, and contact information of your organization's personnel, vendors, or emergency contacts ("Customer Data");
• Purchase a subscription, including billing contact name, billing address, and payment-related information (processed by our third-party payment processor as described in Section 6);
• Communicate with us for sales, support, or account administration, including the content of those communications; or
• Interact with the AI Chat Tool or other AI-assisted features, including the prompts, questions, and information you submit to those features.

2.2 Information Collected Automatically

When you access the Platform, we and our service providers automatically collect certain information, including:

• Device and connection information (IP address, browser type, operating system, device identifiers);
• Usage data (pages and features accessed, actions taken within the Platform, timestamps, session duration); and
• Information collected through cookies and similar tracking technologies, as described in Section 7.

2.3 Information from Third Parties

We may receive personal information about you from third parties, such as: single sign-on (SSO) or identity providers used by your organization; our payment processor, in connection with billing; and integration partners that your organization has elected to connect to the Platform, as described in Section 6 of the Terms of Service.

3. How We Use Information

We use personal information for the following purposes:

• To provide, operate, maintain, and support the Platform, including hosting and displaying Customer Data and generating outputs from AI-assisted features;
• To create and manage accounts, authenticate users, and administer subscriptions, billing, and renewals;
• To communicate with you about the Services, including service-related notices, security alerts, and support responses;
• To improve, test, and develop the Platform, including its templates, scoring models, and AI-assisted features, generally using aggregated or de-identified data as described in the Terms of Service;
• To market and promote GRM Solutions' products and services, including Plan & Recover and related offerings, where permitted and subject to your choices described in Section 10;
• To detect, investigate, and prevent fraud, abuse, security incidents, and violations of the Terms of Service; and
• To comply with applicable legal obligations, respond to legal process, and establish, exercise, or defend legal claims.

4. AI Features and Automated Processing

Certain Platform features, including InsuraCast™, AI Insights, and the AI Chat Tool, use artificial intelligence and machine learning technologies, including models provided by third-party AI providers, to process information you submit and generate outputs such as draft plan content, risk scores, and recommendations. Information submitted to these features may include Customer Data and other personal information you choose to include in your inputs.

We and our AI service providers may use submitted information to generate the requested output and, in de-identified or aggregated form, to maintain, improve, and evaluate the performance of these features, consistent with the Terms of Service. We do not use Customer Data to train third-party foundation models in a manner that would make your Customer Data available to other customers of those third-party providers, except as may be separately disclosed to you.

You are responsible for exercising discretion about the personal information you choose to input into AI-assisted features, particularly sensitive categories of information (see Section 9). AI Output may be retained as part of your plan documents in accordance with Section 8.

5. Cookies and Tracking Technologies

We and our service providers use cookies, web beacons, local storage, and similar technologies to operate the Platform, remember preferences, maintain login sessions, analyze usage, and, where applicable, support marketing activities on our public website. We use the following general categories of cookies:

• Essential cookies, necessary for login, security, and core functionality;
• Functional cookies, used to remember settings and preferences; and
• Analytics cookies, used to understand how visitors and users interact with our website and Platform.

You can control cookies through your browser settings; disabling certain cookies may affect the functionality of the Platform. Where required by applicable state law, we will provide an appropriate mechanism for managing cookie-based tracking on our public-facing website.

6. How We Share Information

We do not sell personal information to third parties for monetary consideration. We may share personal information in the following circumstances:

• Service Providers: With vendors who perform services on our behalf, such as cloud hosting, payment processing, customer support tools, analytics, email delivery, and AI model providers, under contractual obligations to protect personal information and use it only to provide services to us;
• Within Your Organization: With other Authorized Users and administrators within your own Customer account, consistent with the access permissions configured by your organization;
• Business Transfers: In connection with a merger, acquisition, financing, reorganization, or sale of assets, subject to standard confidentiality protections;
• Legal Obligations: Where required to comply with applicable law, regulation, legal process, or governmental request, or to protect the rights, property, or safety of GRM Solutions, our users, or others; and
• With Your Consent: In other circumstances where you have directed or consented to the disclosure.

We may disclose de-identified or aggregated information that does not identify you or any individual, without restriction, consistent with the Terms of Service.

7. Third-Party Services

The Platform may integrate with or link to third-party services selected by your organization (for example, identity providers or data integrations) or used by GRM Solutions to operate the Platform (for example, cloud infrastructure, payment processing, and AI model providers). Information you submit to or through those integrations is subject to the applicable third party's own privacy practices. GRM Solutions is not responsible for the privacy practices of independent third parties.

8. Data Retention

We retain personal information, including Customer Data, for as long as reasonably necessary to provide the Platform and fulfill the purposes described in this Privacy Policy, generally for 90 days following termination of an account, unless a longer retention period is required to comply with legal obligations, resolve disputes, enforce our agreements, or as otherwise described in the Terms of Service. We may retain de-identified or aggregated data indefinitely.

9. Data Security

We maintain administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, disclosure, alteration, and destruction, appropriate to the nature of the information processed. These measures may include encryption of data in transit, access controls, and routine monitoring. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

Because Customer Data may include personal information about your own personnel, vendors, or other individuals that you choose to input into the Platform, you are responsible for ensuring that such submissions are appropriate and, where the information is sensitive (for example, government identification numbers, health information, or financial account numbers), for limiting submission of such categories of information unless necessary for your continuity, recovery, or risk management planning purposes.

10. Your Choices

You have certain choices regarding the personal information we collect and use:

• Account Information: You may review and update certain account information directly within the Platform or by contacting us at support@planandrecover.com;
• Marketing Communications: You may opt out of marketing emails by following the unsubscribe instructions included in those emails; this will not affect transactional or service-related communications necessary for your use of the Platform; and
• Cookies: You may manage cookie preferences through your browser settings, as described in Section 5.

11. U.S. State Privacy Rights

Depending on your state of residence, you may have certain rights regarding your personal information under applicable state privacy laws, which may include laws such as the California Consumer Privacy Act, as amended by the California Privacy Rights Act (CCPA/CPRA), the Virginia Consumer Data Protection Act, the Colorado Privacy Act, the Connecticut Data Privacy Act, the Utah Consumer Privacy Act, and other comparable state privacy statutes that may take effect from time to time (collectively, "State Privacy Laws"). This Section applies to personal information for which GRM Solutions acts as a "business" or "controller" under applicable State Privacy Laws — generally, information about our own website visitors, Authorized Users, and business contacts, rather than Customer Data submitted by a Customer, as described in Section 13.

11.1 Categories of Information Collected

In the preceding twelve (12) months, we have collected the categories of personal information described in Section 2, which may include identifiers (such as name and email address), commercial information (such as subscription and billing details), internet or network activity information, and, where applicable, professional or employment-related information (such as job title and employer).

11.2 Your Rights

Subject to certain exceptions and verification requirements under applicable State Privacy Laws, you may have the right to:

• Confirm whether we are processing your personal information and access that information;
• Correct inaccurate personal information;
• Delete personal information we have collected about you;
• Obtain a copy of your personal information in a portable format;
• Opt out of the sale or sharing of personal information, or of targeted advertising and certain profiling, to the extent applicable (see Section 12); and
• Not receive discriminatory treatment for exercising your privacy rights.

11.3 Exercising Your Rights

You may submit a request to exercise these rights by emailing support@planandrecover.com with the subject line "Privacy Rights Request," or by another method we make available. We will verify your request using information associated with your account or other reasonably available means before responding. You may designate an authorized agent to submit a request on your behalf, subject to verification. We will respond to verifiable requests within the timeframes required by applicable State Privacy Laws.

11.4 California Shine the Light

California residents may separately request information regarding our disclosure, if any, of certain personal information to third parties for their own direct marketing purposes during the preceding calendar year. GRM Solutions does not share personal information with third parties for their own direct marketing purposes.

12. Do Not Sell or Share My Personal Information

GRM Solutions does not sell personal information for monetary consideration. Depending on how certain analytics or advertising-related cookies are configured on our public marketing website, such activity could be considered "sharing" or a "sale" under certain State Privacy Laws' broad definitions of those terms. Where applicable, you may opt out of such activity using the cookie controls described in Section 5 or by contacting us at support@planandrecover.com. We do not use or disclose sensitive personal information for purposes other than those necessary to provide the Platform, and we do not currently use Customer-submitted personal information for cross-context behavioral advertising.

13. Business Customers and Customer Data

Plan & Recover is a business-to-business platform. With respect to Customer Data — personal information that a Customer or its Authorized Users input into the Platform as part of their own continuity, recovery, crisis management, or risk management plans (for example, names and contact information of a Customer's own personnel or vendors) — GRM Solutions generally acts as a service provider or processor on behalf of the Customer, who acts as the business or controller responsible for that information. Individuals whose information appears within Customer Data and who wish to exercise privacy rights with respect to that information should generally direct their request to the relevant Customer organization. GRM Solutions will provide reasonable assistance to Customers in responding to such requests in accordance with the Terms of Service and any applicable data processing terms.

This Privacy Policy governs GRM Solutions' own collection and use of personal information about Authorized Users, billing contacts, and website visitors and inquirers, as described throughout this Policy.

14. Scope: United States Only

The Platform is intended for use by businesses and individuals located in the United States, and this Privacy Policy is written to address requirements under applicable U.S. federal and state law. We do not knowingly direct the Platform to individuals located outside the United States, and we make no representations that the Platform complies with the laws of any other country or region. If you access the Platform from outside the United States, you do so on your own initiative and are responsible for compliance with applicable local laws, and your information may be transferred to and processed in the United States.

15. Children's Privacy

The Platform is intended for business use by adults and is not directed to children. We do not knowingly collect personal information from individuals under the age of eighteen (18). If we become aware that we have inadvertently collected personal information from a child under 13 in a manner inconsistent with the Children's Online Privacy Protection Act (COPPA), we will take steps to delete that information. If you believe a child has provided us with personal information, please contact us at support@planandrecover.com.

16. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. If we make material changes, we will provide notice by posting the updated Privacy Policy on the Platform, updating the "Effective Date" above, and/or notifying you via email or in-app notice, consistent with Section 27 of the Terms of Service. Your continued use of the Platform after the effective date of any changes constitutes acceptance of the updated Privacy Policy.

17. Contact Us

If you have questions about this Privacy Policy or wish to exercise your privacy rights, please contact us at: