Privacy Policy

---

This Privacy Notice for Izba Labs Inc. ("Izba," "we," "us," or "our") describes how and why we may access, collect, store, use, and/or share ("process") your personal information when you use our services ("Services"), including when you:

• Visit our website at www.izba.ai or any website of ours that links to this Privacy Notice
• Use the Izba platform as an authorized user of one of our business customers ("Customer")
• Engage with us in other related ways, including sales, marketing, pilot programs, or events

Questions or concerns? Reading this Privacy Notice will help you understand your privacy rights and choices. If you do not agree with our policies and practices, please do not use our Services. If you have questions, please contact us at privacy@izba.ai.A note on scope: Izba is a B2B, multi-tenant SaaS platform. In many cases, our business customers ("Customers") act as the data controller for the information their authorized users submit to or process through the Service, and Izba acts as a service provider/processor on the Customer's behalf, governed by a separate data processing agreement. This Privacy Notice describes Izba's own practices as a business, including how we handle personal information about individuals who visit our website, register for or use the Service directly, or otherwise interact with us.

• What personal information do we process? When you visit, use, or navigate our Services, we may process personal information depending on how you interact with us, the choices you make, and the products and features you use.
• Do we process any sensitive personal information? We do not intentionally process sensitive personal information (e.g., racial or ethnic origin, health data, sexual orientation, religious beliefs) about individual visitors or users of our Services.
• Do we collect information from third parties? In limited cases, yes — for example, business-intelligence signals drawn from public data sources or from Customer-authorized system integrations (e.g., CRM, CS/CX tools), used strictly for the benefit of the Customer that authorized the connection.
• How do we process your information? We process information to provide, secure, and improve the Services, communicate with you, and comply with the law. We do not use customer data to train AI models without explicit consent.
• Do we share your information? We may share information with service providers who support our operations (cloud infrastructure, AI providers, analytics, communications tools) under contracts that restrict their use of your data.
• How do we keep information safe? We maintain technical and organizational security measures, including encryption, access controls, and an information security program aligned to ISO 27001, ISO 42001, and SOC 2 standards. No system is 100% secure.
• What are your rights? Depending on your location, you may have rights to access, correct, delete, or restrict use of your personal information.
• How do you exercise your rights? Contact us at privacy@izba.ai.

In Short: We collect personal information that you provide to us.

We collect personal information that you voluntarily provide when you register for an account, express interest in our products, participate in a pilot program, or otherwise contact us. The personal information we collect may include:

• Name
• Work email address
• Username and password (or SSO identifier, where authenticated via Google Workspace, Okta, or similar)
• Job title / employer (for business contacts)
• Content you submit through the Service (e.g., messages, feedback, support requests)

Sensitive Information: We do not process sensitive personal information (such as racial/ethnic origin, health, or biometric data) about our website visitors or Service users.

In Short: Some information, such as your IP address and device/browser characteristics, is collected automatically when you use our Services.

We automatically collect certain technical information when you visit or use the Services, including IP address, browser and device characteristics, operating system, language preference, referring URLs, and usage data (pages viewed, features used, timestamps). This is used to secure and operate the Services and for internal analytics.

• Log and Usage Data: Diagnostic, usage, and performance information recorded in server logs.
• Device Data: Information about the computer, phone, or device used to access the Services.

Where Izba's platform ingests data from a Customer's own systems (e.g., CRM, CS/CX tools, business communications) to generate account intelligence, signals, or recommendations, Izba processes that data as a service provider under the applicable order form and data processing terms with the Customer. Such data is not persisted beyond the short, configurable period required for processing, unless otherwise agreed with the Customer, and is not used to train AI models without explicit written consent from the Customer.

In Short: We process your information to provide, secure, and improve our Services, to communicate with you, and to comply with the law.

We process personal information to:

• Facilitate account creation, authentication, and account management
• Deliver and support the Services, including responding to inquiries
• Send administrative information (service updates, changes to terms/policies)
• Request feedback about your experience with the Services
• Protect the Services, including fraud monitoring, security incident detection, and abuse prevention
• Identify usage trends to improve the Services
• Comply with legal and contractual obligations, including those under our enterprise customer agreements
• Communicate with you regarding pilot programs, product updates, or new AI features (including advance notice where required)

Izba does not sell personal information and does not use personal information for targeted advertising.

In Short: We process personal information only where we have a valid legal basis to do so.

Izba's Services are currently offered and marketed to customers and users in the United States, and our Services are not currently directed to individuals in the European Economic Area (EEA), United Kingdom (UK), or Switzerland. Accordingly, this Notice does not include GDPR/UK GDPR-specific legal-basis disclosures at this time. If Izba's operations expand into those regions, this Notice will be updated to reflect the applicable legal bases and rights under GDPR/UK GDPR.

For individuals in the United States, we process personal information based on:

• Performance of a contract — to provide the Services you or your employer have signed up for
• Legitimate business interests — such as securing our Services, improving functionality, and internal analytics, where these interests do not override your rights
• Consent — where required, such as certain AI feature notifications or optional communications, which you may withdraw at any time
• Legal obligation — where necessary to comply with applicable law or respond to lawful requests

In Short: We share information only with service providers who support our operations, under contracts that restrict their use of your data, or as required by law.

We may share personal information with the following categories of third parties, each engaged under a contract designed to safeguard your information:

• Cloud infrastructure providers (Amazon Web Services)
• Third-party AI/LLM providers (e.g., OpenAI, Anthropic, Perplexity, AWS Bedrock, and inference hosting providers such as Groq or Cerebras) — used to power AI features within the Service. These providers do not use your data to train their own models, and Izba does not permit customer data to be used for third-party model training without explicit written consent.
• Identity and authentication providers (e.g., Google Workspace, and Okta for customer SSO/SCIM where enabled)
• Collaboration and communication tools (e.g., Slack, Confluence) used internally to support our operations
• Compliance and security tooling (e.g., our GRC platform, used for security monitoring and audit evidence)
• Analytics tools, used in a limited capacity for product and website usage insights

We do not share personal information with ad networks or data brokers, and we do not use online tracking technologies to serve targeted advertising.

We may also share information in connection with a business transfer (merger, acquisition, financing, or sale of assets), or where required to comply with law, legal process, or to protect the rights, property, or safety of Izba, our users, or others.

In Short: We use a limited set of cookies necessary for security, functionality, and basic analytics.

We use cookies and similar technologies to maintain the security of our Services and your account, remember preferences, and understand aggregate usage of our website and Service. We do not use cookies for third-party targeted advertising.

If our use of any analytics technology is later deemed a "sale" or "sharing" under applicable law, you may opt out as described in Section 13 below.

In Short: Yes. Our Services include AI-powered features, delivered in part through third-party AI providers, subject to strict data-use safeguards.

As part of the Services, Izba offers features powered by artificial intelligence, machine learning, and related technologies ("AI Products"), including:

• Account and executive-sponsor match recommendations
• Automated account briefings synthesized from public and Customer-authorized data sources
• Sentiment, risk, and opportunity signal detection
• Generated content and artifacts for customer operations
• Forecasting and trend analysis
• Agentic workflows supporting human-approved actions

Use of Third-Party AI Providers: Izba's AI Products are powered in part by third-party AI Service Providers, including OpenAI, Anthropic, Perplexity, AWS Bedrock, and inference hosting providers such as Groq or Cerebras. Depending on the specific feature, your input, output, and/or relevant personal information may be processed by these providers solely to deliver the AI Product to you.

Data Use Commitments:

• Izba does not use Customer input, output, or Confidential Information to train third-party foundation models.
• Izba does not share Customer input, output, or Confidential Information with third-party model providers for those providers' own training or model-improvement purposes.
• Izba will not use Customer data to fine-tune Izba's own private models without the Customer's prior written approval, and any such use will rely strictly on anonymized data.
• Izba provides advance notice of new AI features prior to release, consistent with our release-notes process.
• Izba maintains a "human in the loop" design principle for its AI Products: AI generates recommendations and signals; authorized human users review, validate, and authorize resulting actions.

You must not use AI Products in a manner that violates the terms of any underlying AI Service Provider.

In Short: Our infrastructure is located in the United States, and Customer Data is stored within the United States.

Izba's Services are hosted on Amazon Web Services in the US-West region (primary region). All Customer Data is stored and processed within the United States and maintained in a logically separated, multi-tenant environment. As our infrastructure expands, we may add availability zones within other US regions.

Izba's Services are not currently directed to, and this Notice does not address specific transfer mechanisms for, users located in the EEA, UK, or Switzerland. If this changes, we will update this Notice accordingly, including any applicable cross-border transfer safeguards.

In Short: We retain personal information only as long as necessary for the purposes described in this Notice, or as required by law or contract.

• Account and business contact information is retained for as long as you maintain an account or business relationship with Izba, and for a limited period thereafter as needed for legitimate business, legal, or contractual purposes.
• Customer Data processed to generate AI-driven signals and recommendations is retained only for the short, configurable period necessary to complete that processing, unless a longer period is agreed with the Customer.
• Where we no longer have an ongoing legitimate need to process personal information, we will delete or anonymize it, or, where deletion is not immediately possible (e.g., encrypted backups), we will securely isolate the information until deletion is feasible.

In Short: We maintain a structured information security program, including encryption, access controls, and incident response procedures.

Izba maintains administrative, technical, and physical safeguards designed to protect personal information, consistent with our ongoing information security program (which is being aligned to ISO 27001, ISO 42001, and SOC 2 Type II standards). These include, among others:

• Encryption of data at rest (AES-256, AWS KMS-managed keys) and in transit (TLS 1.2+)
• Role-based access controls and least-privilege principles
• Centralized logging and monitoring across our infrastructure
• A documented incident response plan with defined breach-notification procedures

No method of transmission or storage is 100% secure. In the event of a data breach affecting your personal information, we will notify affected individuals and any required regulatory authorities without undue delay and consistent with applicable law and any contractual commitments (including 48-hour notification commitments to enterprise customers, where applicable).

For questions about our breach notification process, contact security@izba.ai.

In Short: We do not knowingly collect data from, or market to, children under 18.

Izba's Services are intended for business use and are not directed to children. We do not knowingly collect personal information from individuals under 18 years of age. If we learn that we have inadvertently collected such information, we will take reasonable steps to delete it. If you believe a minor's data has been collected, contact us at privacy@izba.ai.

In Short: Depending on your location, you may have rights to access, correct, delete, or restrict processing of your personal information.

You may request to review, correct, or delete the personal information we hold about you by contacting privacy@izba.ai. We will respond consistent with applicable law.

Withdrawing consent: Where we rely on your consent (e.g., for certain AI feature communications), you may withdraw it at any time by contacting us; this will not affect the lawfulness of prior processing.

Marketing communications: You may unsubscribe from marketing emails at any time via the unsubscribe link or by contacting us. We may still send you service-related communications necessary for your account.

Account information: You may review, change, or request termination of your account by contacting us. We may retain limited information as needed to prevent fraud, resolve disputes, enforce our agreements, or comply with legal obligations.

Most browsers include a Do-Not-Track ("DNT") signal. Because no uniform industry standard for recognizing DNT signals currently exists, Izba does not respond to DNT signals at this time. If a legal or industry standard is adopted, we will update this Notice accordingly.

In Short: If you are a resident of California or another US state with a comprehensive privacy law, you may have rights to know, access, correct, delete, and limit use of your personal information, and to opt out of certain processing.

In the past twelve (12) months, we have collected the following categories of personal information:

• Identifiers: name, work email address, IP address, online identifiers, account username
• Personal information under the California Customer Records statute: name and contact information
• Commercial or professional information: job title, employer, and account/subscription information (for business contacts)
• Internet or network activity: browsing and usage data related to the Services

We have not sold or shared personal information with third parties for cross-context behavioral advertising in the preceding twelve (12) months. We disclose limited categories of personal information (primarily identifiers and internet/network activity) to our service providers as described in Section 4, for business purposes only.

Subject to certain exceptions, you may have the right to:

• Know whether we are processing your personal information
• Access your personal information
• Correct inaccurate personal information
• Request deletion of your personal information
• Obtain a copy of personal information you previously provided to us
• Opt out of the sale/sharing of personal information or use for targeted advertising (Izba does not currently engage in either)
• Non-discrimination for exercising these rights

How to exercise your rights: Contact us at privacy@izba.ai. We will verify your identity before processing your request. Authorized agents may submit requests on your behalf with appropriate written authorization.

We will honor the Global Privacy Control (GPC) signal where legally required.

California residents may request, once per year and free of charge, information about categories of personal information (if any) we disclosed to third parties for their direct marketing purposes in the prior calendar year. Izba does not disclose personal information to third parties for their own direct marketing purposes. To submit a request, contact privacy@izba.ai.

In Short: Yes, we will update this Notice as necessary to remain compliant with applicable law and to reflect changes in our practices.

We will indicate material updates by revising the "Last Updated" date above, and where required, will provide additional notice of material changes.

If you have questions or comments about this Notice, please contact us at:

Izba Labs Inc., 800 W. El Camino Real, Suite 180, Mountain View, CA 94040. Attn: Privacy Team. Email: privacy@izba.ai

Based on applicable law in your country or US state of residence, you may have the right to request access to, correction of, or deletion of your personal information, or to withdraw consent to our processing of it. To make such a request, contact us at privacy@izba.ai.

This Privacy Policy is a template prepared for internal review and adaptation by Izba Labs Inc. It is not a substitute for legal advice. Izba Labs should have this document reviewed by qualified legal counsel before publishing it as a binding, customer-facing policy, and before relying on it to satisfy specific regulatory obligations (e.g., CCPA/CPRA, or future GDPR applicability).