IPSYS ANALYTICS — PRIVACY POLICY

Effective Date: January 1, 2026 Last Updated: January 1, 2026 Document Version: 1.0

1. INTRODUCTION

IP System 3 LLC ("Company," "we," "us," or "our") respects your privacy and is committed to protecting the personal information you share with us. This Privacy Policy describes how we collect, use, disclose, and safeguard your information when you use the IPSYS Analytics platform, including the Smart Schedule Wizard and all related services, features, and applications (collectively, the "Service").

By accessing or using the Service, you consent to the collection, use, and disclosure of your information as described in this Privacy Policy. If you do not agree with this Privacy Policy, please do not access or use the Service.

2. INFORMATION WE COLLECT

2.1 Information You Provide to Us

Account Information

When you create an account, we collect:

• Full name
• Email address
• Company name
• Job title or role
• Phone number (optional)
• Billing address
• Payment information (processed by our payment provider)

Customer Data

When you use the Service, you may upload:

• XER files (Primavera P6 schedule exports)
• Project schedules and updates
• Activity descriptions and codes
• Resource assignments
• Baseline schedules
• Project names and identifiers

Communications

When you contact us, we collect:

• Email correspondence
• Support ticket content
• Chat messages
• Feedback and suggestions
• Survey responses

2.2 Information Collected Automatically

Usage Data

When you access the Service, we automatically collect:

• IP address
• Browser type and version
• Operating system
• Device information
• Pages visited and features used
• Time and date of access
• Referring website or source
• Click patterns and navigation paths

Cookies and Similar Technologies

We use cookies, web beacons, and similar technologies to:

• Maintain your session and preferences
• Authenticate your account
• Analyze usage patterns
• Improve Service performance
• Remember your settings

For more information, see Section 9 (Cookies and Tracking Technologies).

Log Data

Our servers automatically record:

• Access times and dates
• Features accessed
• Error logs and crash reports
• API requests and responses
• Performance metrics

2.3 Information from Third Parties

We may receive information from:

• Payment processors (transaction confirmations, not full card numbers)
• Authentication providers (if you use single sign-on)
• Analytics services (aggregated usage data)
• Marketing partners (with your consent)

3. HOW WE USE YOUR INFORMATION

3.1 Providing the Service

We use your information to:

• Create and manage your account
• Process your subscription and payments
• Provide access to Service features
• Analyze your uploaded schedule data
• Generate reports and insights
• Provide customer support
• Send transactional communications (receipts, confirmations, alerts)

3.2 Improving the Service

We use your information to:

• Analyze usage patterns to improve features
• Identify and fix technical issues
• Develop new features and functionality
• Optimize Service performance
• Conduct research and analysis

3.3 Derived Insights

We generate anonymized, aggregated insights from Customer Data to:

• Improve the accuracy of our analytical models
• Develop industry benchmarks
• Enhance pattern recognition capabilities
• Build institutional knowledge that benefits all users

Important: Derived Insights contain no information that could identify you, your company, your projects, or any individual. See our Terms of Service for more details on Derived Insights.

3.4 Communications

We use your information to:

• Send service-related announcements
• Provide product updates and new feature notifications
• Send marketing communications (with your consent)
• Respond to your inquiries and support requests
• Request feedback or participation in surveys

3.5 Security and Compliance

We use your information to:

• Protect against unauthorized access
• Detect and prevent fraud
• Enforce our Terms of Service
• Comply with legal obligations
• Respond to legal requests

3.6 Legal Basis for Processing (GDPR)

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, our legal bases for processing your information include:

Contractual Necessity: Processing necessary to perform our contract with you (providing the Service).

Legitimate Interests: Processing for our legitimate business interests, such as improving the Service, preventing fraud, and marketing (where not overridden by your rights).

Consent: Processing based on your consent (e.g., marketing communications). You may withdraw consent at any time.

Legal Obligation: Processing necessary to comply with applicable laws.

4. HOW WE SHARE YOUR INFORMATION

4.1 We Do NOT Sell Your Information

We do not sell, rent, or trade your personal information or Customer Data to third parties for their marketing purposes.

4.2 Service Providers

We share information with third-party service providers who perform services on our behalf:

Provider	Purpose	Data Shared
Supabase	Database hosting and authentication	Account data, Customer Data
Vercel	Application hosting	Usage data, logs
Stripe	Payment processing	Billing information
Anthropic (Claude API)	AI-powered analysis	Anonymized schedule data for analysis
Email Service Provider	Transactional and marketing emails	Email address, name
Analytics Provider	Usage analytics	Anonymized usage data

These providers are contractually obligated to protect your information and may only use it to provide services to us.

4.3 Business Transfers

If we are involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any change in ownership or use of your information.

4.4 Legal Requirements

We may disclose your information if required to do so by law or in response to valid requests by public authorities (e.g., court order, subpoena, government request). We will notify you of such requests unless prohibited by law.

4.5 Protection of Rights

We may disclose your information to:

• Enforce our Terms of Service
• Protect our rights, privacy, safety, or property
• Protect the rights, privacy, safety, or property of our users or others
• Investigate potential violations

4.6 With Your Consent

We may share your information with third parties when you have given us explicit consent to do so.

5. DATA RETENTION

5.1 Active Accounts

While your account is active, we retain:

• Account Information: For the duration of your subscription
• Customer Data: For the duration of your subscription
• Usage Data: For up to 24 months
• Communications: For up to 36 months or as needed for support

5.2 After Account Termination

Upon termination of your subscription:

Deleted within 30 days:

• Customer Data (uploaded files, project records, analysis history)
• Account credentials and access permissions

Retained for legal/business purposes:

• Billing records: 7 years (tax and accounting requirements)
• Communications related to disputes: As long as necessary
• Anonymized usage statistics: Indefinitely

Retained indefinitely:

• Derived Insights (anonymized, aggregated data that cannot identify you)

5.3 Data Deletion Requests

You may request deletion of your personal information at any time by contacting support@ipsysanalytics.com. We will complete deletion within 30 days, except for information we are required to retain by law.

6. DATA SECURITY

6.1 Security Measures

We implement industry-standard security measures to protect your information:

Technical Safeguards:

• Encryption of data in transit (TLS 1.3)
• Encryption of data at rest (AES-256)
• Secure authentication with password hashing
• Multi-tenant architecture with strict data isolation
• Row-Level Security (RLS) policies in our database
• Regular security assessments and vulnerability scanning
• Automated security monitoring and alerting

Administrative Safeguards:

• Access controls limiting personnel access to data
• Employee security training
• Confidentiality agreements with all personnel
• Incident response procedures

Physical Safeguards:

• Data hosted in secure, SOC 2 compliant data centers
• Physical access controls at data center facilities

6.2 Security Incidents

In the event of a security incident affecting your personal information, we will:

• Notify you within 72 hours of becoming aware of the incident
• Provide information about the nature and scope of the incident
• Describe the measures we are taking in response
• Notify relevant regulatory authorities as required by law

6.3 Your Responsibilities

You are responsible for:

• Maintaining the confidentiality of your account credentials
• Using strong, unique passwords
• Notifying us immediately of any unauthorized account access
• Ensuring the security of devices you use to access the Service

7. YOUR RIGHTS AND CHOICES

7.1 Access and Portability

You have the right to:

• Access the personal information we hold about you
• Receive a copy of your personal information in a portable format
• Export your Customer Data from the Service

7.2 Correction

You have the right to correct inaccurate or incomplete personal information. You can update most Account Information directly through your account settings.

7.3 Deletion

You have the right to request deletion of your personal information. We will delete your information unless we have a legal obligation to retain it.

7.4 Restriction and Objection

You have the right to:

• Restrict processing of your personal information in certain circumstances
• Object to processing based on legitimate interests
• Object to processing for direct marketing purposes

7.5 Withdrawal of Consent

Where we rely on your consent to process personal information, you have the right to withdraw consent at any time. This will not affect the lawfulness of processing before withdrawal.

7.6 Marketing Communications

You can opt out of marketing communications at any time by:

• Clicking "unsubscribe" in any marketing email
• Updating your communication preferences in account settings
• Contacting us at support@ipsysanalytics.com

Note: You cannot opt out of transactional communications related to your account and subscription.

7.7 Exercising Your Rights

To exercise any of these rights, contact us at:

• Email: privacy@ipsysanalytics.com
• Mail: IP System 3 LLC, Five Greentree Centre, 525 NJ-73, Suite 104, Marlton, NJ 08053

We will respond to your request within 30 days (or sooner if required by applicable law). We may need to verify your identity before processing your request.

8. REGIONAL PRIVACY RIGHTS

8.1 California Residents (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):

Right to Know: You have the right to know what personal information we collect, use, disclose, and sell.

Right to Delete: You have the right to request deletion of your personal information.

Right to Correct: You have the right to correct inaccurate personal information.

Right to Opt-Out: You have the right to opt out of the sale or sharing of your personal information. We do not sell or share your personal information.

Right to Non-Discrimination: We will not discriminate against you for exercising your privacy rights.

Categories of Personal Information Collected:

• Identifiers (name, email, IP address)
• Commercial information (subscription, payment history)
• Internet activity (usage data, browsing history within Service)
• Professional information (job title, company)
• Inferences (preferences derived from usage)

Categories of Personal Information Disclosed for Business Purposes:

• Identifiers (to service providers for hosting, payment processing)
• Commercial information (to payment processor)

To exercise your California privacy rights, contact us at privacy@ipsysanalytics.com or call (856) 446-3111.

8.2 European Economic Area, United Kingdom, and Switzerland (GDPR)

If you are located in the EEA, UK, or Switzerland, you have rights under the General Data Protection Regulation (GDPR):

• Right of access
• Right to rectification
• Right to erasure ("right to be forgotten")
• Right to restriction of processing
• Right to data portability
• Right to object
• Rights related to automated decision-making

Data Controller: IP System 3 LLC is the data controller for your personal information.

Data Transfers: Your information may be transferred to and processed in the United States. We use Standard Contractual Clauses approved by the European Commission to protect your information during international transfers.

Supervisory Authority: You have the right to lodge a complaint with your local data protection authority.

8.3 Other Jurisdictions

We comply with applicable privacy laws in all jurisdictions where we operate. If you have questions about your rights under local law, contact us at privacy@ipsysanalytics.com.

9. COOKIES AND TRACKING TECHNOLOGIES

9.1 Types of Cookies We Use

Essential Cookies: Required for the Service to function. These cannot be disabled.

• Session management
• Authentication
• Security features
• Load balancing

Functional Cookies: Remember your preferences and settings.

• Language preferences
• Display settings
• Feature preferences

Analytics Cookies: Help us understand how you use the Service.

• Page views and navigation paths
• Feature usage
• Error tracking
• Performance metrics

Marketing Cookies: Used to deliver relevant advertisements (if applicable).

• We currently do not use marketing cookies
• If we do in the future, we will update this policy

9.2 Managing Cookies

You can control cookies through your browser settings. Most browsers allow you to:

• View what cookies are stored
• Delete cookies individually or all at once
• Block third-party cookies
• Block all cookies

Note: Disabling essential cookies may prevent the Service from functioning properly.

9.3 Do Not Track

Some browsers offer a "Do Not Track" (DNT) feature. We currently do not respond to DNT signals, as there is no industry standard for compliance. However, you can manage your privacy preferences as described in this section.

10. CHILDREN'S PRIVACY

The Service is not intended for children under the age of 16 (or the applicable age of consent in your jurisdiction). We do not knowingly collect personal information from children.

If we become aware that we have collected personal information from a child without parental consent, we will take steps to delete that information promptly.

If you are a parent or guardian and believe your child has provided us with personal information, please contact us at privacy@ipsysanalytics.com.

11. THIRD-PARTY LINKS AND SERVICES

The Service may contain links to third-party websites or services that are not operated by us. This Privacy Policy does not apply to those third-party sites.

We encourage you to review the privacy policies of any third-party sites you visit. We are not responsible for the privacy practices of third parties.

12. CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors.

How We Notify You:

• We will post the updated Privacy Policy on our website
• We will update the "Last Updated" date at the top of this policy
• For material changes, we will provide notice through the Service or by email

Your Continued Use: Your continued use of the Service after any changes to this Privacy Policy constitutes acceptance of the updated policy.

We encourage you to review this Privacy Policy periodically.

13. CONTACT US

If you have questions, concerns, or requests regarding this Privacy Policy or our privacy practices, please contact us:

IP System 3 LLC Five Greentree Centre 525 NJ-73, Suite 104 Marlton, NJ 08053

Email: privacy@ipsysanalytics.com Phone: (856) 446-3111

Data Protection Inquiries: For GDPR-related inquiries, please include "GDPR Request" in your subject line.

Response Time: We will respond to your inquiry within 30 days.

14. SUMMARY

What We Collect	How We Use It	How Long We Keep It
Account info (name, email, company)	Provide Service, billing, support	Duration of subscription + 7 years for billing records
Customer Data (XER files, schedules)	Analyze and generate insights	Deleted within 30 days of termination
Usage data (pages visited, features used)	Improve Service, analytics	Up to 24 months
Payment info	Process payments	Handled by Stripe; we don't store full card numbers
Communications	Support, feedback	Up to 36 months
Derived Insights (anonymized)	Improve platform for all users	Indefinitely (cannot identify you)

Your Key Rights:

• Access your data
• Correct inaccuracies
• Delete your data
• Export your data
• Opt out of marketing
• Withdraw consent

Our Commitments:

• We do NOT sell your personal information
• We do NOT share Customer Data with other customers
• We encrypt your data in transit and at rest
• We delete your data when you leave
• We notify you of security incidents

By using IPSYS Analytics, you acknowledge that you have read and understood this Privacy Policy.