Effective Date: March 15, 2026 | Version 1.0

This Privacy Policy describes how BreakoutConnect ("Company," "we," "us," or "our") collects, uses, shares, and protects information about users of the BreakoutConnect platform. By using the Service, you consent to the practices described in this policy.

This Policy applies to all users of the Service, including client administrators, event operators, technicians, crew members, and speakers who interact with the platform through any interface, including web browsers, QR code portals, and the Companion application.

1. Information We Collect

1.1 Information You Provide Directly

• Account registration data: name, email address, company name, job title, phone number, and password credentials;
• Billing information: credit card details and billing address (processed by Stripe; Company does not store raw card numbers);
• Event and room configuration data including room names, session schedules, presenter information, and equipment assignments;
• Crew member profiles: name, contact information, skills, availability, and employment classification;
• Files and attachments: PDF setup documents, floor plans, equipment lists, presenter materials, and audio-visual configuration files;
• Communications: messages sent through the platform's chat and notification systems;
• Support requests and correspondence with Company's support team.

1.2 Information Collected Automatically

• Log data: IP address, browser type, operating system, referring URLs, pages visited, time spent on pages, and click patterns;
• Device information: device type, screen resolution, language settings, and hardware identifiers;
• Usage telemetry: feature usage patterns, session duration, API calls, and error reports;
• WebSocket and real-time data: connection timestamps, room status updates, and coordination events;
• Cookies and similar tracking technologies (see Section 7).

1.3 Information from Third Parties

• Payment processors (Stripe): transaction confirmations, payment status, and fraud signals;
• Email service providers (SendGrid): email delivery status and open receipts;
• SMS providers (Twilio, grasshopper): message delivery status;
• Cloud infrastructure providers (DigitalOcean, AWS): system health metrics and storage metadata.

1.4 Information We Do Not Intentionally Collect

We do not intentionally collect sensitive personal information such as government identification numbers, health information, biometric data, financial account numbers other than payment card data processed by Stripe, or personal data of children under the age of thirteen (13). If you believe we have inadvertently collected such data, please contact us immediately at privacy@breakoutconnect.com.

2. How We Use Your Information

We use information collected for the following purposes, each grounded in a lawful basis:

2.1 Service Delivery (Contractual Necessity)

• Creating and maintaining your account and Subscription;
• Providing real-time event coordination, room status monitoring, and crew communication features;
• Processing payments and sending billing communications;
• Storing and retrieving files associated with your events;
• Enabling QR code-based presenter help requests and SOS notifications;
• Delivering push notifications and in-platform alerts;
• Authenticating users and enforcing access controls.

2.2 Service Improvement (Legitimate Interest)

• Analyzing usage patterns to improve platform features and user experience;
• Debugging, testing, and resolving technical issues;
• Conducting security monitoring and fraud prevention;
• Developing aggregated and anonymized analytics.

2.3 Communications (Legitimate Interest / Consent)

• Sending transactional emails: account confirmations, password resets, invoices, and service notices;
• Sending operational notifications about scheduled maintenance or service changes;
• With your consent, sending product updates, feature announcements, and marketing communications; you may opt out at any time.
• Customer data is not shared with 3rd parties for promotional or marketing purposes.
• Mobile opt-in and consent are never shared with anyone for any purpose. Any information sharing that may be mentioned elsewhere in this policy excludes mobile opt-in data.
• BREAKOUT CONNECT LLC Messaging Terms and Conditions

1. The messaging program consists of general conversational messaging to answer questions and provide support to customers.

2. You can cancel the SMS service at any time. Just text 'STOP' to the phone number from which you received messages. After you send the SMS message ' STOP' to us, we will send you an SMS message to confirm that you have been unsubscribed. After this, you will no longer receive SMS messages from us. If ' you want to join again, just sign up as you did the first time and we will start sending SMS messages to you again.

3. If you are experiencing issues with the messaging program you can reply with the keyword HELP for more assistance, or you can get help directly at

hello@breakoutconnect.com.

4. Carriers are not liable for delayed or undelivered messages.

5. As always, message and data rates may apply for any messages sent to you from us and to us from you. Message frequency will vary based on '

communication needs. If you have any questions about your text plan or data plan, it is best to contact your wireless provider.

6. If you have any questions regarding privacy, please read our privacy policy contained in the rest of this document/page.

2.4 Legal Compliance

• Complying with applicable laws, regulations, and lawful government requests;
• Enforcing our Terms of Service and other agreements;
• Protecting the rights, property, and safety of Company, its users, and the public.

3. How We Share Your Information

We do not sell your personal information. We share information only in the following circumstances:

3.1 Service Providers (Sub-processors)

We engage trusted third-party vendors to assist in providing the Service. These vendors access personal data only to perform services on our behalf and are contractually bound to protect your data:

• Stripe — payment processing and billing management;
• SendGrid — transactional and notification email delivery;
• Twilio — SMS notification delivery;
• Amazon Web Services (S3) — file storage and content delivery;
• DigitalOcean — cloud infrastructure and database hosting;
• Google Fonts CDN — web font delivery (no personal data shared).
• Grasshopper - Customer Communication for support

3.2 Business Transfers

In the event of a merger, acquisition, restructuring, sale of assets, or bankruptcy involving Company, your information may be transferred to the successor entity as part of that transaction. We will notify you by email and/or prominent notice on the platform before your information becomes subject to a materially different privacy policy.

3.3 Legal Requirements

We may disclose your information if required to do so by law, subpoena, court order, or other governmental authority, or if we believe disclosure is necessary to: (a) comply with legal obligations; (b) protect and defend our rights or property; (c) prevent or investigate wrongdoing in connection with the Service; or (d) protect users or the public from harm.

3.4 With Your Consent

We may share your information with third parties when you have given explicit consent for us to do so.

4. Data Retention

We retain personal information for as long as necessary to provide the Service and fulfill the purposes described in this Policy, or as required by law:

• Active account data is retained for the duration of the Subscription plus thirty (30) days following termination;
• Activity logs and audit trails are retained for twelve (12) months;
• Billing records and invoices are retained for seven (7) years to satisfy tax and accounting obligations;
• Backup data may persist for up to ninety (90) days after deletion from production systems;
• Legal hold: data subject to litigation hold or regulatory inquiry may be retained longer than standard periods.

When data is no longer required, we securely delete or anonymize it using industry-standard methods.

5. Data Security

We implement a layered security architecture to protect your information:

• Encryption at rest using AES-256-GCM for sensitive data fields;
• Encryption in transit using TLS 1.2 or higher for all data exchanged between clients and servers;
• Password hashing using bcrypt with a work factor of 12 rounds;
• JWT-based authentication with short-lived tokens and secure session management;
• Role-based access controls limiting data access to authorized personnel and systems;
• Web application security protections including CSRF prevention, input sanitization, rate limiting, and HTTPS enforcement via HSTS;
• Regular security assessments and dependency vulnerability scanning.

Despite these measures, no internet transmission or electronic storage is completely secure. You assume some risk by transmitting data over the internet and acknowledge that Company cannot guarantee absolute security. In the event of a confirmed data breach affecting your data, Company will notify you in accordance with applicable breach notification laws.

6. Your Privacy Rights

6.1 General Rights

Subject to applicable law and verification of your identity, you may have the following rights regarding your personal data:

• Access: request a copy of the personal data we hold about you;
• Correction: request correction of inaccurate or incomplete data;
• Deletion: request deletion of your personal data, subject to our retention obligations;
• Restriction: request that we limit the processing of your data in certain circumstances;
• Portability: receive your data in a structured, machine-readable format;
• Objection: object to processing based on legitimate interests;
• Withdraw Consent: where processing is based on consent, withdraw that consent at any time without affecting prior processing.

6.2 California Residents — CCPA/CPRA Rights

If you are a California resident, the California Consumer Privacy Act (as amended by the California Privacy Rights Act) grants you the following additional rights:

• Right to Know: the categories and specific pieces of personal information collected, the sources of collection, the business purposes for collection, and the categories of third parties with whom we share information;
• Right to Delete: request deletion of personal information we have collected from you, subject to certain exceptions;
• Right to Correct: request correction of inaccurate personal information;
• Right to Opt-Out: we do not sell personal information and do not share personal information for cross-context behavioral advertising;
• Right to Non-Discrimination: we will not discriminate against you for exercising CCPA rights;
• Right to Limit Use of Sensitive Personal Information: we do not use sensitive personal information beyond the purposes authorized by the CPRA.

To exercise your California rights, submit a verifiable request to privacy@breakoutconnect.com. We will respond within forty-five (45) days and may extend that period by an additional forty-five (45) days with notice. You may designate an authorized agent to submit requests on your behalf with appropriate verification.

6.3 European Economic Area, United Kingdom, and Switzerland — GDPR Rights

If you are located in the EEA, UK, or Switzerland, you have rights under the General Data Protection Regulation (GDPR) and applicable national law. Our lawful bases for processing are: (a) performance of a contract; (b) legitimate interests; (c) compliance with legal obligations; and (d) consent. You have the right to lodge a complaint with your local supervisory authority.

For cross-border data transfers from the EEA, we rely on Standard Contractual Clauses (SCCs) or equivalent transfer mechanisms as approved by the European Commission.

6.4 Exercising Your Rights

To exercise any privacy rights, contact us at privacy@breakoutconnect.com or through the privacy settings within your account dashboard. We will verify your identity before processing requests and will not charge a fee unless requests are manifestly unfounded or excessive.

7. Cookies and Tracking Technologies

7.1 Types of Cookies Used

• Essential cookies: necessary for authentication, session management, and platform security. These cannot be disabled.
• Functional cookies: remember your preferences such as language settings and dashboard configurations.
• Analytics cookies: help us understand how users interact with the Service using aggregated, anonymized data.
• No third-party advertising or cross-site tracking cookies are used on the BreakoutConnect platform.

7.2 Cookie Management

You can control cookies through your browser settings. Disabling essential cookies may impair platform functionality. We do not respond to browser Do Not Track (DNT) signals at this time, as no industry standard exists for their interpretation.

8. Children's Privacy

The Service is not directed to individuals under the age of thirteen (13). We do not knowingly collect personal information from children under 13. If we learn that we have inadvertently collected personal information from a child under 13, we will promptly delete it. If you believe a child under 13 has provided personal information to us, please contact privacy@breakoutconnect.com.

9. Third-Party Links and Services

The Service may contain links to third-party websites or services, including event management platforms, equipment vendor portals, and industry resources. This Privacy Policy does not apply to third-party websites. We encourage you to review the privacy policies of any third-party services you access through the platform. Company is not responsible for the privacy practices or content of third-party services.

10. Changes to This Privacy Policy

We may update this Privacy Policy periodically to reflect changes in our practices, applicable law, or the Service. Material changes will be communicated by: (a) email notification to the account's primary contact address at least thirty (30) days before the change takes effect; (b) prominent in-platform notification; and (c) posting the updated Policy at breakoutconnect.live/privacy with a new effective date.

Your continued use of the Service after the effective date of a material change constitutes acceptance of the updated Policy. If you disagree with any changes, you may terminate your Subscription as set forth in the Terms of Service.

11. Data Breach Response

In the event of a data security incident affecting your personal information, Company will:

• Promptly investigate and contain the incident;
• Notify affected Clients without undue delay, and within seventy-two (72) hours of confirmed breach discovery where required by law;
• Provide details of the nature of the breach, categories of data affected, likely consequences, and measures taken or proposed;
• Cooperate with regulatory authorities as required by applicable law;
• Take corrective action to prevent recurrence.

12. Contact Us

For questions, concerns, or requests relating to this Privacy Policy or our data practices, please contact:

Privacy Officer — Inspired Technical Management LLC

d/b/a BreakoutConnect

Email: privacy@breakoutconnect.com

Website: breakoutconnect.com/privacy

For EU/EEA inquiries and GDPR-related requests, please include "GDPR Request" in the subject line of your email. For CCPA requests, include "CCPA Request." We will acknowledge receipt within five (5) business days.

Appendix A: Sub-Processor List

The following third-party sub-processors may process personal data on behalf of BreakoutConnect as of the effective date of this Policy. This list is subject to change with notice as described in the Terms of Service.

Payment Processing

• Stripe, Inc. — United States — stripe.com/privacy

Email Communications

• Twilio Inc. (SendGrid) — United States — sendgrid.com/policies/privacy

SMS Communications

• Twilio Inc. — United States — twilio.com/legal/privacy

Cloud Infrastructure & Database

• DigitalOcean, LLC — United States — digitalocean.com/legal/privacy-policy

File Storage

• Amazon Web Services, Inc. (S3) — United States — aws.amazon.com/privacy

Web Fonts

• Google LLC (Google Fonts CDN) — United States — policies.google.com/privacy

This Privacy Policy was last reviewed and approved by Inspired Technical Management LLC d/b/a BreakoutConnect on March 15, 2026.

ragraph is that it has a more-or-less normal distribution of letters. making it look like readable English.