Effective October 14, 2026

1. What this policy covers

This policy explains how Leverege, Inc. ("Leverege," "we," "us") handles personal information collected through our website at leverege.com, and through our business communications, marketing, and recruiting.

It does not cover:

• Information we handle for our customers as part of our products. In those cases we act on our customers' instructions, and their privacy notice governs.
• iotforall.com, which has its own privacy notice.

For information collected through leverege.com, Leverege is the controller: we decide how it is used, and we are responsible for it.

2. How to reach us

Leverege, Inc., 9200 Corporate Blvd, Suite 430, Rockville, MD 20850, United States

Privacy contact: privacy@leverege.com

Privacy officer: Calum McClelland, COO & Information Security Officer

3. What we collect

When you contact us. Your name, business email, company, job title, phone number, and whatever you write to us. When you submit a form, we also record the page you submitted it from and the page that referred you there. If you apply for a job, we collect whatever you include in your application.

Automatically, for every visitor. Server logs, IP address, and the information needed to keep the site secure and to remember your cookie choice. This is necessary for the site to work.

Analytics and embedded video. Depending on where you are, these run only if you agree, or unless you turn them off. See Section 4.

We do not collect government ID numbers, financial account details, precise location, biometric data, or information about your health, race, ethnicity, religion, sexual orientation, or union membership through this website, and we do not try to infer any of it.

4. Cookies, analytics, and embedded video

Necessary cookies. This site always sets the cookies it needs to function: security and bot protection (Cloudflare), load balancing, and remembering your cookie choice (CookieYes). These cannot be switched off.

What we don't use. We use no advertising, marketing, retargeting, or cross-site tracking technologies on this site. The only optional technologies are Google Analytics and embedded YouTube videos, described below.

How your choice works depends on where you are

• European Economic Area, the United Kingdom, Switzerland, Quebec, and California: analytics and embedded video are off until you agree through our cookie banner. Closing or ignoring the banner counts as "no." You can change your choice at any time with the floating Cookie Settings icon.
• Everywhere else, including the rest of the United States and the rest of Canada: analytics and embedded video are on by default, and you'll see a notice the first time you visit. You can turn them off at any time with "Turn off analytics" on the notice, or with the floating Cookie Settings icon.

Your choice is stored on your browser and applies right away. It does not undo what already happened. If you clear your cookies or use a different browser, you'll be asked again.

Record of your choice. When you use the banner or Cookie Settings, CookieYes, our consent provider, records your choice so we can show we respected it. The record holds a random consent ID, the date and time, your country, an anonymized IP address, and the categories you accepted or declined. It does not contain your name or email.

Google Analytics

We use Google Analytics 4, provided by Google LLC acting on our instructions as our service provider, to see how the site is used so we can improve it.

It collects:

• a pseudonymous identifier stored in a cookie on your device
• your IP address, which Google uses only to derive your country and region, and does not store or report
• your general device type, browser, and operating system
• where you came from
• the pages you view and the links and forms you use

This information is pseudonymous, not anonymous.

We have not enabled Google Signals, user-provided data collection, granular location and device data collection, ads personalization, advertising features, or the User-ID feature. Google Analytics therefore does not record your city, precise location, device model, or full browser details. We have turned off Google's data-sharing settings, and this property is not linked to any Google Ads account. Your activity is not tied to your Google account or followed across your devices, and we receive no demographic or interest information about you. We look at this data in aggregate and do not try to identify individual visitors.

You can also block Google Analytics on every site using Google's browser add-on at https://tools.google.com/dlpage/gaoptout.

Embedded YouTube videos

A video loads only when you press play, and pressing play is your agreement to load that video from YouTube. If you have turned off or declined embedded video, or your browser sends a Global Privacy Control signal, pressing play opens the video on YouTube in a new tab instead.

‍

Browser privacy signals

We do not sell or share personal information, or use it for targeted advertising. Even so, if your browser sends a Global Privacy Control (GPC) signal, we treat it as a request to turn off analytics and embedded video, and we apply it automatically. We do not respond to Do Not Track.

Cookie list

• _cfuvid (Cloudflare): security and rate limiting. Necessary. Lasts for the session.
• cookieyes-consent (CookieYes): remembers your cookie choice. Necessary. Lasts 1 year.
• _ga, _ga_<ID> (Google Analytics): distinguishes visits for analytics. Lasts 13 months.
• VISITOR_INFO1_LIVE, VISITOR_PRIVACY_METADATA, YSC, __Secure-YNID, __Secure-ROLLOUT_TOKEN, __Secure-YEC, ytidb::LAST_RESULT_ENTRY_KEY (YouTube): play embedded video, and serve YouTube's own purposes. Last from the session up to 6 months; browser storage remains until cleared.

The current list, with exact durations, is always in Cookie Settings.

5. Why we use it and on what basis

The legal bases below apply if you are in the EEA or the UK, where we are required to identify a legal basis for each use.

• Run and secure the website (technical data, necessary cookies): legitimate interests. Necessary cookies do not require consent.
• See how the site is used (analytics data): your consent.
• Play embedded videos (technical data sent to YouTube when you press play): your consent, given by pressing play.
• Reply to your enquiry or demo request (contact and enquiry information): legitimate interests.
• Send you marketing you asked for (contact information): your consent.
• Consider your job application (recruiting information): steps toward a contract, at your request; your consent if we keep it for future roles.
• Meet legal obligations and handle legal claims (any of the above): legal obligation where EU or UK law requires it; otherwise legitimate interests.

Where we rely on legitimate interests, we have weighed them against your interests, rights, and freedoms, and concluded that yours do not override ours and that the use is necessary. Ask us if you want more information about that, or if you want to object.

We make no automated decisions about you, and we do no profiling with legal or similarly significant effects.

6. Who else sees it

We do not sell personal information, and we do not share it for cross-context behavioral or targeted advertising.

We disclose it only to:

• Service providers that host, secure, and support our website, email, and internal systems. These include website hosting, Cloudflare (security), CookieYes (consent management), and Google LLC (Google Analytics). Each acts only on our instructions, under contract. We use no third-party marketing platform or applicant tracking system; we keep subscriber records and job applications in systems we run ourselves.
• YouTube (Google LLC), only if you press play on an embedded video. YouTube receives that information as an independent business, under its own privacy policy.
• Authorities or others where the law requires it, to establish or defend legal claims, or to protect anyone's rights or safety.
• A buyer or successor, if we are acquired or merge, subject to this policy.

Email privacy@leverege.com if you want the full list of providers we use.

7. Where it goes

We are in the United States and process personal information here. It may also be handled in other countries where our service providers operate.

When you give us information directly, that is a direct collection, not a transfer: it comes from you, not from an exporter in Europe. Our onward disclosures to service providers are transfers. For those we rely on the European Commission's Standard Contractual Clauses, through our providers' data processing terms, plus the UK International Data Transfer Addendum where it applies. We have assessed those transfers and added safeguards where needed. Ask us for a copy.

8. How long we keep it

• Analytics data: 14 months for visit-level data. Aggregated reports that do not identify anyone may be kept longer.
• Server and security logs: 30 days.
• Your cookie choice: 1 year, then we ask again. The record of your choice is kept for 1 year.
• Contact and enquiry records: three years after we last hear from you.
• Marketing subscribers: until you unsubscribe, then two years so we don't email you again.
• Job applications: two years after the hiring decision.

We keep personal information only as long as we need it for the purposes above, or as the law requires, and we collect no more than is reasonably necessary.

9. Your rights

The rights you have depend on where you live. We comply with the rights the law of your own jurisdiction gives you. Depending on that law, you may be able to ask us to:

• Confirm whether we hold information about you, and tell you what we collect, use, and disclose
• Give you a copy, in a portable, commonly used format
• Correct anything wrong or incomplete
• Delete your information
• Restrict or stop what we're doing, including objecting to uses based on legitimate interests
• Withdraw your consent, including for cookies and marketing
• Stop marketing to you, at any time, for any reason
• De-index or stop circulating information about you

Wherever you are, you can turn off analytics and embedded video at any time, withdraw cookie consent, and unsubscribe from marketing.

Not every other right on this list is available everywhere, and some are subject to conditions or exceptions under the law that applies to you.

We do not sell or share personal information, use it for targeted advertising, use sensitive personal information, or make automated decisions about you. There is nothing to opt out of on any of those.

We will never treat you worse for exercising a right.

How to ask. Email privacy@leverege.com or write to the address in Section 2. Tell us where you live, so we can identify which rights apply. We will check who you are, usually by asking you to confirm something we already hold. An authorized agent may act for you with proof. We reply within the time the applicable law requires.

If we say no. We will tell you why, including if the right you asked about is not available where you live. Where the law gives you a right of appeal, reply with "Privacy Appeal" in the subject line and we will reconsider. If we maintain our decision, we will tell you where to escalate.

Complaints. You can contact the privacy or data protection authority where you live at any time, whether or not you come to us first.

10. Regional notes

United States

This section is our notice at collection and our privacy notice under the California Consumer Privacy Act and other U.S. state privacy laws. In the past 12 months we have collected the categories below, from the sources and for the purposes in Sections 3–5. We have disclosed each category only for business purposes, to the recipients in Section 6, and we keep each for the periods in Section 8.

• Identifiers (name, email, phone, IP address, cookie identifier): disclosed to service providers.
• Professional or employment information (company, job title, job application contents): disclosed to service providers.
• Internet or network activity (pages viewed, links used, referring page, browser and device): disclosed to service providers (Google Analytics), and to YouTube if you press play.
• Approximate location (country and region derived from IP address): disclosed to service providers.

We have not sold or shared personal information, used it for cross-context behavioral or targeted advertising, or used or disclosed sensitive personal information, in the past 12 months, and we do not do so. We do not knowingly collect personal information of consumers under 16. We do not disclose personal information to third parties for their own direct marketing.

California. Analytics and embedded video are off until you agree through our cookie banner (Section 4).

California residents can use the rights in Section 9 to know, delete, correct, and limit, and can use an authorized agent. We honor Global Privacy Control.

Residents of other states with comprehensive privacy laws may use the rights in Section 9, including the right to appeal. Nevada residents: we do not sell covered information.

Quebec

Google Analytics and embedded YouTube videos, described in Section 4, include functions that can identify, locate, or profile you: they store an identifier on your device and record the pages you view. These functions are off by default. They turn on only if you choose "Accept," and you can turn them off again via the floating Cookie Settings icon. We ask for your consent separately for each purpose, in plain language. Your information is communicated outside Quebec, including to the United States, and we have completed a privacy impact assessment of that. Our person in charge of the protection of personal information is named in Section 2. Une version française de la présente politique est disponible ici.

Elsewhere in Canada

We rely on your implied consent for analytics and embedded video, which involve only non-sensitive information and are described here and in our notice before they run. You can withdraw that consent at any time via the floating Cookie Settings icon, and we rely on implied consent for the necessary processing in Section 3. We rely on your express consent for marketing email.

Switzerland

Swiss law does not require prior consent for cookies, but we ask for it anyway. Analytics and embedded video are off until you agree, and you can change your choice at any time via the floating Cookie Settings icon.

European Economic Area and United Kingdom

Leverege is established only in the United States, and has no office, branch, or representative in Europe.

• In the EEA, analytics and embedded video run only with your consent.
• In the UK, analytics and embedded video also run only with your consent.

The legal bases in Section 5 apply to our use of your information. You can exercise any of the rights in Section 9 by contacting us directly at privacy@leverege.com.

11. Security

We use administrative, technical, and physical safeguards to protect personal information, including encryption in transit, access controls, and vendor review. No system is perfectly secure, and we cannot guarantee otherwise.

12. Children

This site is for businesses and professionals. We do not knowingly collect information from anyone under 18. If you think a child has given us something, email privacy@leverege.com and we will delete it.

13. Changes

We may update this policy. The revised version will appear here with a new effective date. If a change materially affects how we use information we already hold, we will give additional notice and get your consent where required. Where your cookie choice depends on consent, material changes to our cookie practices will trigger a fresh request through the banner.

14. Language

This policy is available in English and in French. Both versions have equal force.

‍