TEALTECH PRIVACY POLICY

Last Updated: June 1, 2026

1. Privacy at a Glance

Teal Corporation (“Teal,” “we,” “us,” or “our”) operates the TealTech platform, including related websites, applications, tools, features, APIs, and services (the “Platform”). This Privacy Policy explains how we collect, use, share, store, and protect Personal Information in connection with the Platform.

What we collect	Account information, business contact information, organization details, Platform usage data, device and log data, support communications, Organization Data, and Assessment Outputs.
How we use it	To provide, secure, support, maintain, and improve the Platform; generate Assessment Outputs; respond to requests; create Aggregated Data for analytics and benchmarking; comply with law; and send service communications.
How data may be shared	With your Licensee or Participating Organization; with service providers; in business transactions; when required by law; and as described in this Policy.
No sale or targeted advertising	We do not sell Personal Information, share it for targeted or cross-context behavioral advertising, or sell Sensitive Personal Information or biometric data.
Analytics	We use Microsoft Clarity and similar tools for usage analytics, heatmaps, session replay, troubleshooting, security, support, and Platform improvement.
Sensitive information	The Platform is designed for business and organizational information. Do not submit Sensitive Personal Information about identifiable individuals unless expressly requested or authorized.
International processing	Teal is based in the United States. Personal Information collected through the Platform is stored and processed in the United States.

2. Who This Policy Applies To

This Policy applies to Personal Information collected through or in connection with the Platform, including information collected from:

• users who create accounts or access the Platform;

• representatives, employees, contractors, and other personnel of organizations that use the Platform;

• individuals whose Personal Information is submitted to the Platform as part of Organization Data; and

• visitors who access the Platform without creating an account.

By accessing or using the Platform, you acknowledge that you have read and understand this Policy. If you use the Platform on behalf of an organization, that organization may have its own privacy notices. This Policy does not replace those notices. Contact that organization directly if you have questions about how it collects or uses your Personal Information before providing it to TealTech.

3. Key Terms

“Aggregated Data” means information derived from Platform use, Organization Data, Assessment Outputs, or other Platform data that has been aggregated, anonymized, or de-identified so that it does not identify, and cannot reasonably be used to identify, any individual, user, Licensee, Participating Organization, or non-public business information attributable to any of them.

“Assessment Outputs” means scores, reports, analyses, recommendations, summaries, benchmarks, roadmaps, and other outputs generated through the Platform based on Organization Data or user inputs.

“Licensee” means an organization that has entered into an agreement or order with Teal to sponsor, designate, fund, administer, or otherwise obtain access to the Platform.

“Organization Data” means data, content, materials, records, files, documents, responses, certifications, responses, documents, and other information submitted to or through the Platform by or on behalf of a Licensee, Participating Organization, or User. Organization Data does not include Aggregated Data, Assessment Outputs, Teal IP (as defined in the Platform Terms of Service) , or information independently created by Teal.

“Participating Organization” means an organization that uses the Platform, including any supplier, vendor, affiliate, subsidiary, business division, portfolio company, customer, client, or other entity invited or authorized to use the Platform in connection with a Licensee’s ESG, sustainability, supply-chain, audit-readiness, or similar program.

“Participating Organization Documents” means documents, files, certifications, evidence, or other supporting materials uploaded by a Participating Organization within that Participating Organization’s own account or tenant.

“Personal Information” means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked to an identified or identifiable individual.

“Sensitive Personal Information” means Personal Information treated as sensitive under applicable law, such as government identification numbers, financial account information, precise geolocation data, biometric data, health information, information about children, citizenship or immigration status, payment card information, DEI data, information revealing racial or ethnic origin, religious or philosophical beliefs, political opinions, trade union membership, sex life, or sexual orientation, or sensitive workforce data, in each case to the extent tied to an identifiable person.

4. Information We Collect

We collect the following categories of information depending on how you use the Platform.

Information You Provide Directly

• Account information, such as name, email address, username, password, role, title, and account preferences;

• Business contact information, such as employer, organization name, business email, business phone number, and mailing address;

• Organization information, such as organization name, industry, size, and other details submitted during Platform use;

• Support communications, such as messages and attachments you provide when contacting us; and

• Organization Data submitted to or through the Platform.

Information Collected Automatically

• Log data, such as access times, pages or screens viewed, actions taken, referring URLs, and activity data;

• Device information, such as browser type, operating system, device type, and device identifiers;

• IP address and approximate location information; and

• Usage information, such as features accessed, navigation paths, clicks, scrolls, session activity, and similar interaction data.

Information from Other Sources

We may receive information from a Licensee, Participating Organization, service provider, or other third party involved in providing or supporting the Platform.

5. How We Use Information

We use Personal Information to:

• create, administer, and manage user accounts;

• authenticate users and manage access permissions;

• provide, operate, maintain, and support the Platform;

• process Organization Data and generate Assessment Outputs;

• monitor, secure, and protect the Platform against unauthorized access, fraud, and abuse;

• troubleshoot issues and respond to support requests;

• create and use Aggregated Data for analytics, benchmarking, and product improvement;

• enforce Teal’s Terms of Service and other applicable agreements;

• investigate suspected misuse, fraud, security incidents, or unauthorized activity;

• comply with legal obligations and legal process;

• evaluate or complete mergers, financings, acquisitions, reorganizations, divestitures, or asset sales; and

• send service-related, administrative, security, legal, and operational communications.

Where Teal acts as an independent controller, Teal processes Personal Information based on legitimate interests, contractual necessity, consent, or legal obligation, depending on the activity. Where Teal processes Organization Data on behalf of a Licensee or Participating Organization, Teal generally acts as a processor or service provider and processes that data in accordance with the applicable agreement and documented instructions.

Personnel access. Teal personnel may access Organization Data and Assessment Outputs only as required to provide technical support and troubleshooting, operate and maintain the Platform, monitor and protect against security incidents, create Aggregated Data, comply with applicable law, and enforce Teal’s agreements. Access is limited on a need-to-know basis, subject to confidentiality obligations and access controls, and logged for security and audit purposes.

6. How Information Is Shared

We do not sell Personal Information. We do not share Personal Information for targeted advertising or cross-context behavioral advertising. We do not sell Sensitive Personal Information or biometric data. We may share Personal Information as follows:

• With your organization. If you use the Platform through a Licensee or Participating Organization, we may make account information, usage information, Organization Data, Assessment Outputs, and related Platform information available to that organization depending on your role, the applicable agreement, and Platform settings. This refers to sharing with the organization you are associated with; access by sponsoring Licensees is described separately below.

• With sponsoring Licensees. If a Licensee sponsors or administers access for Participating Organizations, that Licensee may access Assessment Outputs, assessment responses, scores, ratings, risk analyses, aggregated data, and Platform-level analytics relating to those Participating Organizations in accordance with the applicable agreement and Platform configuration.

• Limits on supporting documents. Licensees do not receive access to Participating Organization Documents unless that access is specifically enabled with the Participating Organization’s knowledge and agreement or is otherwise authorized through applicable written terms.

• With service providers. We use service providers for hosting, storage, analytics, support, security, communications, and similar functions. These providers may receive Personal Information only as needed to perform services for Teal and are required to protect it.

• For legal and safety reasons. We may disclose Personal Information when we reasonably believe disclosure is required or permitted by law, legal process, governmental request, or to protect the rights, property, or safety of Teal, users, organizations, or third parties.

• In business transactions. We may share or transfer Personal Information in connection with a merger, financing, acquisition, reorganization, divestiture, bankruptcy, or sale of assets.

• With your direction or consent. We may share Personal Information when you or the applicable organization directs or authorizes us to do so.

• Aggregated Data. We may use and disclose Aggregated Data for any lawful business purpose.

If our practices change regarding sale of Personal Information, targeted advertising, or advertising cookies, we will update this Policy and provide any notice or choice required by applicable law before implementing those changes.

7. Cookies, Analytics, and Microsoft Clarity

We use cookies and similar technologies to support authentication, security, functionality, performance, analytics, and Platform improvement. These technologies may include:

• strictly necessary cookies required for login, session management, security, and Platform operation;

• functional cookies used to remember preferences and settings; and

• performance and analytics technologies used to understand how users interact with the Platform and to identify technical or usability issues.

We may use Microsoft Clarity and similar analytics tools to collect usage analytics, behavioral metrics, heatmaps, session replay recordings, device and browser information, clicks, scrolls, navigation paths, and usage events. We use this information to monitor Platform performance, detect and respond to security issues, troubleshoot problems, provide support, and improve the Platform. Microsoft Clarity is provided by Microsoft Corporation, and information collected through Clarity may be processed by Microsoft in accordance with the Microsoft Privacy Statement.

Where technically supported, we configure analytics and session-replay tools to avoid intentional collection of passwords, uploaded documents, sensitive free-text assessment responses, and other content not reasonably necessary for analytics, security, troubleshooting, support, or Platform improvement. Users should avoid submitting Sensitive Personal Information in free-text fields unless the Platform expressly requests it.

We do not currently use third-party advertising cookies on the Platform, serve targeted advertisements through the Platform, or permit third parties to place advertising cookies on the Platform for interest-based advertising.

You may manage cookies through your browser settings, device settings, or Platform controls where available. Blocking cookies may affect Platform functionality. Strictly necessary cookies cannot be disabled because they are required for the Platform to operate.

8. Sensitive Personal Information

The Platform is designed primarily for business, organizational, ESG, sustainability, supply-chain, and audit-readiness information. Users and organizations should not submit Sensitive Personal Information about identifiable individuals unless Teal or the applicable written agreement expressly requests or authorizes that submission.

Where possible, DEI, workforce, labor, health and safety, grievance, audit, and similar ESG-related information should be submitted in aggregated or organizational form rather than in a way that identifies specific individuals.

If a Licensee or Participating Organization submits Sensitive Personal Information through the Platform, that organization is responsible for having the required notices, rights, consents, and legal bases for doing so, except to the extent Teal is responsible under applicable law or a written agreement.

9. Security, Retention, and International Processing

Security

We use commercially reasonable administrative, technical, and organizational measures designed to protect Personal Information against unauthorized access, alteration, disclosure, destruction, loss, and misuse. These measures are proportionate to Teal’s size, resources, and the nature of the data processed and may evolve over time. Examples include access controls, authentication, encryption in transit and encryption at rest where supported by the underlying infrastructure and storage services, logging and monitoring, confidentiality obligations, vulnerability management, and incident response processes.

No method of electronic transmission or storage is completely secure. We cannot guarantee the absolute security of information transmitted to, from, or stored within the Platform. We will notify affected individuals and applicable regulatory authorities of any confirmed security breach involving Personal Information as required by applicable law.

Retention

We retain Personal Information for as long as reasonably necessary to provide, operate, support, secure, and improve the Platform; maintain accounts; comply with legal, contractual, and regulatory obligations; resolve disputes; and enforce agreements. Retention periods may vary based on the type of data, the purpose of processing, legal requirements, Platform settings, and applicable agreements.

Where Teal processes Organization Data on behalf of a Licensee or Participating Organization, retention, return, and deletion are governed by the applicable agreement and Platform settings. Aggregated Data may be retained and used indefinitely because it does not identify, and cannot reasonably be used to identify, any individual or organization.

International Processing

Teal is based in the United States. Personal Information collected through the Platform is stored and processed in the United States. Teal does not currently anticipate transferring Personal Information from the European Economic Area, the United Kingdom, or Switzerland in connection with its current operations. If Teal’s operations change such that those transfers become necessary, Teal will update this Policy and applicable terms as appropriate and implement transfer terms or safeguards required by applicable law.

10. Your Privacy Rights

Depending on your jurisdiction and applicable law, you may have rights to:

• access or obtain a copy of your Personal Information;

• correct inaccurate or incomplete Personal Information;

• delete Personal Information, subject to applicable exceptions;

• receive a portable copy of certain Personal Information;

• restrict or object to certain processing; and

• withdraw consent where processing is based on consent.

To submit a privacy request, contact us at privacy@tealtech.io or by mail at Teal Corporation, PO Box 5001, Austin, Texas 78763.

We may need to verify your identity before processing a request. If your request relates to Organization Data or Assessment Outputs that we process on behalf of a Licensee or Participating Organization, we may route your request to that organization, as it is generally responsible for responding to requests about data for which it acts as the controller or business. We will respond to privacy requests within the time required by applicable law.

11. Children’s Privacy

The Platform is intended for business use and is not directed to children. Teal does not knowingly collect Personal Information from children under the age of 18, or under a lower age where that lower threshold applies under applicable law. If we learn that we have collected Personal Information from a child without valid consent, we will take reasonable steps to delete it. If you believe a child has provided Personal Information to Teal through the Platform, contact us at privacy@tealtech.io.

12. Third-Party Services

The Platform may contain links to or integrations with third-party services not owned or controlled by Teal. When you use a third-party service, that service’s privacy policy and terms apply. Teal is not responsible for the privacy, security, or practices of third-party services.

13. Changes to This Policy

We may update this Policy to reflect changes in our practices, the Platform, applicable law, or operational needs. When we make changes, we will post the revised Policy and update the “Last Updated” date. For material changes, we will provide notice through reasonable means, such as email, in-Platform notice, or a prominent Platform announcement. Your continued use of the Platform after the effective date of any updated Policy means that the updated Policy applies to your use of the Platform from that date forward.

14. Contact Information

For privacy questions or requests:

Email: privacy@tealtech.io

For legal inquiries:

Email: legal@tealtech.io

By mail:

Teal Corporation

PO Box 5001

Austin, Texas 78763