ADVANTEDGE

PRIVACY POLICY

Langston Digital LLC | advantedge.cloud

Effective Date: September 21, 2026 | Version 1.1

This Privacy Policy explains how Langston Digital LLC, operating as AdvantEdge, collects, uses, shares, and protects personal information. It covers the AdvantEdge platform (advantedge.services), the AdvantEdge marketing website (advantedge.cloud), and our related services. Please read it carefully. By using our services, you acknowledge the practices described here. This Privacy Policy is incorporated by reference into the AdvantEdge Terms of Service.

1. WHO WE ARE AND WHO THIS POLICY COVERS

Langston Digital LLC ("Langston Digital," "AdvantEdge," "we," "us," or "our") is a Virginia limited liability company that provides a multi-tenant field service management platform. This Privacy Policy applies to four categories of individuals:

• Subscribers: Businesses that purchase an AdvantEdge subscription, and the individuals who register on their behalf.
• Authorized Users: Employees, contractors, or agents of a Subscriber whom the Subscriber authorizes to use the platform.
• End-Customers: Individuals who book or receive services from a Subscriber through the AdvantEdge platform (for example, homeowners scheduling a car wash, lawn care visit, or plumbing service).
• Visitors: Anyone who visits the AdvantEdge marketing website at advantedge.cloud, including prospective customers and the general public.

2. OUR ROLE: CONTROLLER VS. PROCESSOR

Privacy laws distinguish between a "controller" (or "business," under California law) — the entity that decides why and how personal information is processed — and a "processor" (or "service provider") that processes information on behalf of a controller. AdvantEdge’s role differs depending on whose data is involved.

2.1 Subscriber, Authorized User, and Visitor Data. For information about Subscribers, Authorized Users, and Visitors, AdvantEdge acts as the controller. We decide what to collect, how to use it, and how to protect it.

2.2 End-Customer Data. For information about End-Customers (such as homeowners booking services), the Subscriber business acts as the controller and AdvantEdge acts as the processor. The Subscriber decides what End-Customer data to collect and how to use it. AdvantEdge processes that data only as needed to provide the platform.

2.3 What This Means for End-Customers. If you are an End-Customer and want to exercise privacy rights with respect to your personal information (such as access, deletion, or correction), you should generally direct your request to the Subscriber business that booked or provided your service. AdvantEdge will assist Subscribers in responding to such requests, and you may also contact us at privacy@advantedge.services if you cannot reach the Subscriber.

3. INFORMATION WE COLLECT

3.1 Information We Collect from Subscribers

• Account information: business name, primary contact name, email address, phone number, business address, industry/vertical, and subscription tier.
• Authentication credentials: usernames and hashed passwords (we never store passwords in readable form).
• Billing information: billing contact, billing address, and partial payment card details (full card numbers are tokenized and stored by Stripe, not by AdvantEdge).
• Communication and support records: messages exchanged with our support team, feedback, and survey responses.
• Configuration data: services offered, pricing, staff list, business hours, and other settings the Subscriber configures.

3.2 Information We Collect from Authorized Users

• Profile information: name, email address, phone number, role, and assigned permissions.
• Authentication credentials: usernames and hashed passwords.
• Device information: mobile device identifiers, push notification tokens (via Firebase), and operating system information.
• Location data: GPS coordinates when on a job, used to record time-on-site and to verify service delivery. Location data is collected only while an Authorized User is actively logged in and assigned to a booking.
• Activity logs: actions taken in the platform (bookings created, status changes, etc.), timestamps, and IP addresses.

3.3 Information We Process About End-Customers

AdvantEdge processes the following End-Customer information on behalf of Subscribers:

• Contact information: name, email address, phone number, and service address.
• Booking and service history: services booked, dates, staff assigned, completion status, and any photos or notes the Subscriber’s staff record on the job.
• Payment information: tokenized payment card details (handled by Stripe), transaction history, and tips.
• Loyalty and feedback: loyalty points balance, post-service reviews, and ratings.
• Communications: messages exchanged with the Subscriber via the platform, including booking confirmations and service updates.

3.4 Information We Collect from Marketing Site Visitors

• Automatically collected data: IP address, browser type, device type, operating system, referring URL, pages visited, and timestamps.
• Lead form data: when you submit a contact form, request a demo, or sign up for updates, we collect the information you provide (typically name, email, business name, and any message).
• Cookies and similar technologies: we use a limited set of cookies for site functionality and aggregate analytics. See Section 8 for details.

4. HOW WE USE INFORMATION

We use the information described above for the following purposes:

• To provide and operate the AdvantEdge platform, including authenticating users, processing bookings, sending notifications, and routing payments.
• To bill Subscribers and process subscription payments through Stripe.
• To communicate with Subscribers and Authorized Users about their accounts, including service updates, security alerts, and billing notices.
• To respond to inquiries, provide customer support, and resolve issues.
• To monitor, secure, and improve the platform, including detecting and preventing fraud, abuse, and security incidents.
• To develop new features and improve existing ones, including AI Suite features (see Section 7).
• To send marketing communications to Subscribers and prospective customers, where permitted by law. Recipients can opt out of marketing emails at any time.
• To comply with legal obligations, enforce our agreements, and protect our rights and the rights of others.

5. HOW WE SHARE INFORMATION

We share personal information in the limited circumstances described below. We do not sell personal information for monetary consideration, and we do not share personal information for cross-context behavioral advertising.

5.1 Service Providers and Sub-Processors

We engage trusted third-party service providers to help us operate the platform. These service providers process personal information only on our instructions and are contractually bound to protect it. Our current sub-processors are:

We may add or change sub-processors over time. A current list is maintained at advantedge.cloud/subprocessors and Subscribers will receive notice of material changes.

5.2 Sharing with Subscribers

End-Customer information is shared with the Subscriber business that booked the service. This is the core function of the platform: when an End-Customer books a service, the Subscriber needs the End-Customer’s information to deliver that service. Subscribers are responsible for handling End-Customer information in accordance with their own privacy policies and applicable law.

5.3 Legal and Safety Disclosures

We may disclose personal information when we reasonably believe disclosure is necessary to: (a) comply with applicable law, regulation, court order, subpoena, or government request; (b) enforce the AdvantEdge Terms of Service or other agreements; (c) protect the rights, property, or safety of AdvantEdge, our Subscribers, or others; or (d) detect, prevent, or address fraud, security, or technical issues.

5.4 Business Transfers

If Langston Digital is involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of all or part of its assets, personal information may be transferred to the successor entity. We will provide notice of any such transfer through email and/or a prominent notice on the platform.

5.5 With Your Direction

We may share personal information with other parties at the direction of the Subscriber or Authorized User, such as integrations with third-party tools the Subscriber chooses to enable.

6. DATA RETENTION

We retain personal information for as long as it is needed to provide the platform, comply with legal obligations, resolve disputes, and enforce our agreements. Specific retention practices include:

• Subscriber and Authorized User account data is retained while the account is active and for up to twelve (12) months after account closure, unless a longer period is required by law.
• End-Customer data is retained for as long as the Subscriber maintains an active subscription. Upon termination of the Subscriber’s account, End-Customer data is made available for export per the Terms of Service and then deleted in accordance with our standard retention schedule.
• Billing and transaction records are retained for at least seven (7) years to meet tax and accounting obligations.
• Marketing site analytics data is retained in aggregated form for up to twenty-four (24) months.
• Backups containing personal information may persist for up to ninety (90) days after deletion from the live system, after which they are overwritten.

7. AI SUITE FEATURES

AdvantEdge offers optional AI-powered features as part of the AI Suite add-on (the "AI Features"). These features include AI assistants for tasks such as customer support, copywriting, marketing, scheduling, and data analysis. The following terms apply when a Subscriber enables AI Features:

7.1 How the AI Features Work. When an Authorized User interacts with an AI Feature, the prompts, content, and context the user provides may be transmitted to a third-party large language model provider (currently Anthropic PBC) to generate the response. Responses are then displayed within the AdvantEdge platform.

7.2 Use by the Model Provider. Anthropic processes the data we send only to generate responses, in accordance with its commercial terms. Subscribers should review Anthropic’s applicable terms and privacy practices, available at anthropic.com, for additional information.

7.3 Use by AdvantEdge. AdvantEdge may use prompts, responses, and aggregated usage data from the AI Features to improve, evaluate, and develop our own AI Features and platform capabilities. We do not use Subscriber or End-Customer data to train foundation models operated by third-party providers.

7.4 Sensitive Information. Subscribers and Authorized Users should not enter Personal Health Information (PHI), financial account numbers, government identification numbers, or other highly sensitive data into AI Features. Inputs that contain such data are still processed by AI Features but should be avoided.

7.5 Opting Out. AI Features are an optional add-on. Subscribers who do not subscribe to the AI Suite will not have data processed through AI Features. Subscribers can disable specific AI Features at any time through their account settings.

7A. SMS COMMUNICATIONS AND MISSED-CALL TEXT-BACK

AdvantEdge offers a missed-call text-back feature that sends an automated SMS to a consumer who calls a business phone number provisioned through AdvantEdge and does not reach a live person. This section describes the personal information involved in that feature and how we handle it.

7A.1 Information Collected. When you call an AdvantEdge-provisioned business phone number, we automatically collect: your calling phone number, the time and date of the call, whether the call was answered, and any subsequent SMS content you send in reply. If the business enables call forwarding, we also process the destination number the call is forwarded to. Voice audio is not recorded or stored.

7A.2 How We Use It. The information collected under Section 7A.1 is used to (a) send you a single automated text response on the business's behalf, (b) log the interaction so the business can see incoming inquiries, (c) apply rate limits to prevent duplicate messages, and (d) provide the business with usage reporting for billing and compliance purposes.

7A.3 Third-Party Processor: Twilio. SMS and voice services are provided by Twilio, Inc., which acts as a service provider processor for message delivery. Twilio receives your calling number and message content only to route the SMS to your carrier. Twilio's privacy practices are available at twilio.com/legal/privacy.

7A.4 We Do Not Sell Your Number. We do not sell or share your phone number or SMS content with advertisers, marketers, or unrelated third parties. Sharing with Twilio is strictly for message delivery.

7A.5 Retention. SMS event records, including calling numbers and message bodies, are retained for two (2) years for compliance and audit purposes, then deleted. Businesses using AdvantEdge may view messages sent through their number for as long as their account is active.

7A.6 Your Choices. You can opt out of receiving further automated messages from any AdvantEdge-provisioned number at any time by replying STOP to any message. Full SMS terms, including opt-out mechanics, are published at advantedge.cloud/sms-terms.

8. COOKIES AND TRACKING TECHNOLOGIES

We use a limited set of cookies and similar technologies on the AdvantEdge marketing website and within the platform. Cookies are small text files placed on your device that help us recognize you and remember preferences.

8.1 Consent (EEA, UK, Switzerland, and other consent-requiring jurisdictions). Non-essential cookies (analytics, marketing) are not set on your device until you affirmatively grant consent through the cookie banner or preferences modal on our marketing website. You can change your consent at any time via the "Cookie preferences" link in the site footer.

8.2 Strictly Necessary Cookies. These cookies are required for the platform and website to function properly, including maintaining authenticated sessions, recording security events, and remembering your cookie preferences. They cannot be disabled. Consent is not required under Article 5(3) of the ePrivacy Directive and GDPR Recital 66.

8.3 Functional Cookies. These cookies remember preferences such as display settings and selected tenant context.

8.4 Analytics Cookies (consent-gated). We use Google Analytics (GA4, measurement ID G-EBBPSMDL3K) with IP anonymization enabled to understand aggregate usage patterns of the marketing website. Cookies set: _ga, _ga_<stream_id>, _gid, _gat. Retention: up to 2 years. Purpose: aggregate reporting on page views, sources, and engagement. Not used for cross-site behavioral advertising.

8.5 Marketing Cookies (consent-gated). We use the Meta Pixel (Facebook + Instagram, pixel ID 1557673682250980) to measure the performance of paid advertising campaigns and enable re-engagement audiences. Cookies set: _fbp, _fbc. Retention: up to 90 days. Purpose: attribution of ad-driven signups and remarketing audience membership.

8.6 Your Choices. (a) Use the cookie banner on your first visit or the "Cookie preferences" link in the footer to grant, withdraw, or update your consent. (b) Most browsers let you control cookies through their settings — disabling strictly necessary cookies may break parts of the platform. (c) We honor Global Privacy Control (GPC) signals from your browser as an opt-out of any "sale" or "sharing" of personal information, where applicable. (d) For Google Analytics specifically, you can install the Google Analytics Opt-out Browser Add-on. (e) For Meta Pixel, you can adjust ad preferences in your Meta account settings.

9. DATA SECURITY

We implement administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, use, alteration, and destruction. These safeguards include encryption of data in transit and at rest, role-based access controls, row-level security in our database, regular security reviews, vendor due diligence, and incident response procedures.

No security measure is perfect. While we work hard to protect personal information, we cannot guarantee absolute security. If you believe your account or personal information has been compromised, contact us immediately at security@advantedge.services.

10. YOUR PRIVACY RIGHTS

Depending on where you live, you may have specific rights regarding your personal information. The rights described below apply to information for which AdvantEdge is the controller. If you are an End-Customer, see Section 2.3 for guidance on exercising rights.

10.1 California Residents (CCPA / CPRA)

If you are a California resident, you have the following rights under the California Consumer Privacy Act and California Privacy Rights Act:

• Right to know what personal information we have collected, the sources, the purposes, and the categories of recipients.
• Right to access a copy of the specific personal information we have collected about you in the prior twelve (12) months.
• Right to delete personal information we have collected, subject to certain exceptions.
• Right to correct inaccurate personal information.
• Right to opt out of the "sale" or "sharing" of personal information. AdvantEdge does not sell personal information for monetary consideration, and we do not share personal information for cross-context behavioral advertising.
• Right to limit the use of sensitive personal information. AdvantEdge uses sensitive personal information (such as account credentials and precise location for Authorized Users on the job) only for permitted business purposes.
• Right to non-discrimination for exercising your privacy rights. We will not deny services, charge different prices, or provide a different level of service in retaliation for exercising your rights.

10.2 Virginia Residents (VCDPA)

If you are a Virginia resident, the Virginia Consumer Data Protection Act gives you the following rights:

• Right to confirm whether we are processing your personal data and to access that data.
• Right to correct inaccuracies in your personal data.
• Right to delete personal data provided by or obtained about you.
• Right to obtain a copy of personal data you previously provided in a portable, readily usable format.
• Right to opt out of (a) targeted advertising, (b) the sale of personal data, and (c) profiling in furtherance of decisions that produce legal or similarly significant effects. AdvantEdge does not engage in any of these activities with respect to Subscriber, Authorized User, or Visitor data.
• Right to appeal a refusal of a privacy request. If we deny your request, you may appeal by replying to our denial within sixty (60) days. If your appeal is also denied, you may contact the Virginia Attorney General at oag.state.va.us.

10.3 Other US State Residents

Residents of Colorado (CPA), Connecticut (CTDPA), Utah (UCPA), Texas (TDPSA), and other states with comprehensive privacy laws have rights similar to those described above, including the rights to access, delete, correct, and obtain a copy of their personal information, and to opt out of targeted advertising and the sale of personal information. We honor verified requests from residents of these states. Specific rights vary by state; we apply the protections required by the law of your state of residence.

10.4 European Union, United Kingdom, Switzerland, and EEA Residents (GDPR / UK GDPR)

If you are located in the EU, UK, Switzerland, or the wider European Economic Area, the General Data Protection Regulation (Regulation (EU) 2016/679) and the UK GDPR give you the following rights:

• Right of access (Art. 15) — obtain confirmation of whether we process your personal data and receive a copy of that data.
• Right to rectification (Art. 16) — request correction of inaccurate or incomplete personal data.
• Right to erasure / "right to be forgotten" (Art. 17) — request deletion of personal data where it is no longer necessary, you withdraw consent, you object to processing, or the data has been unlawfully processed.
• Right to restriction of processing (Art. 18) — request that we limit how we use your data while a claim is investigated.
• Right to data portability (Art. 20) — receive personal data you provided to us in a structured, commonly used, machine-readable format, and have it transmitted to another controller where technically feasible.
• Right to object (Art. 21) — object to processing based on our legitimate interests, including for direct marketing.
• Rights related to automated decision-making (Art. 22) — AdvantEdge does not use solely-automated decisions with legal or similarly significant effects.
• Right to withdraw consent (Art. 7(3)) — where processing is based on consent, withdraw at any time; withdrawal does not affect the lawfulness of prior processing.
• Right to lodge a complaint (Art. 77) — file a complaint with your local supervisory authority. UK residents may contact the Information Commissioner's Office (ico.org.uk).

Legal basis for processing under Article 6(1): (a) Contract — providing the platform to Subscribers and their Authorized Users; (b) Legitimate interest — securing the platform, preventing fraud, improving our services, and communicating essential service updates; (c) Consent — non-essential cookies (analytics, marketing) and any optional marketing communications; (d) Legal obligation — tax, accounting, and compliance record-keeping.

AdvantEdge has not appointed a Data Protection Officer as we do not meet the mandatory-DPO criteria under Article 37 GDPR. We have not appointed an EU or UK Representative under Article 27 as we do not offer the platform primarily to EU or UK data subjects. Data subjects in those jurisdictions who visit our marketing website may still exercise the rights above by contacting privacy@advantedge.services.

10.5 How to Exercise Your Rights

To exercise any of the rights above, contact us at privacy@advantedge.services with the following information:

• Your full name and the email address associated with any AdvantEdge account.
• The state, country, or region in which you reside.
• The specific right you are exercising and any relevant details (for example, the data you wish to access or delete).

We may need to verify your identity before responding, typically by confirming information already associated with your account. We will respond within forty-five (45) days for US residents and thirty (30) days for EU/UK residents, with a possible extension of an additional forty-five (45) or sixty (60) days respectively where reasonably necessary, and we will notify you of any extension.

You may also designate an authorized agent to submit a request on your behalf. We may require the agent to provide proof of authorization and may require you to verify your identity directly with us.

11. CHILDREN’S PRIVACY

AdvantEdge is a business platform and is not directed to children under sixteen (16). We do not knowingly collect personal information from children under sixteen. If you believe a child under sixteen has provided personal information to us, please contact privacy@advantedge.services and we will take appropriate steps to investigate and, where appropriate, delete the information.

12. INTERNATIONAL DATA TRANSFERS

AdvantEdge is based in the United States and our core infrastructure is located in the United States. If you access the marketing website or the platform from outside the United States, your information will be transferred to and processed in the United States, which may have different data protection laws than your country of residence.

Where personal data of EU, UK, Swiss, or EEA residents is transferred outside those jurisdictions, we rely on the following transfer mechanisms recognized under Chapter V of the GDPR:

12.1 EU–U.S. Data Privacy Framework (DPF), UK Extension, and Swiss–U.S. DPF. Our primary third-party processors that handle marketing-website analytics (Google) and advertising measurement (Meta) are certified under the DPF and the UK Extension. This provides an adequate level of protection for personal data transferred from the EEA, UK, and Switzerland to those companies in the United States.

12.2 Standard Contractual Clauses (SCCs) and UK International Data Transfer Addendum (IDTA). For processors that are not DPF-certified (including our infrastructure and delivery partners), we execute the European Commission's Standard Contractual Clauses (2021/914) and, where applicable, the UK's IDTA to provide contractual safeguards for the transfer.

12.3 Key Sub-Processors. The following third parties process personal data on our behalf:

• Supabase, Inc. — application database, authentication, and edge functions (United States). SCCs in place.
• Netlify, Inc. — marketing website hosting and CDN (United States). SCCs in place.
• Stripe, Inc. — payment processing (United States). SCCs + DPF-adjacent controls.
• Twilio, Inc. — SMS and voice routing (United States). SCCs in place. See Section 7A.3.
• Anthropic PBC — Claude language model API for AI Features (United States). Contractual terms in place. See Section 7.2.
• Resend, Inc. — transactional email delivery (United States). SCCs in place.
• Google LLC (Google Analytics) — website analytics (United States). EU–U.S. DPF certified.
• Meta Platforms, Inc. (Meta Pixel) — advertising measurement (United States, Ireland). EU–U.S. DPF certified.

You may request a copy of the applicable transfer mechanism for a specific processor by contacting privacy@advantedge.services.

13. CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will provide at least thirty (30) days’ advance notice by email to the registered account holder and/or by posting a prominent notice on the platform and at advantedge.cloud/privacy. The "Effective Date" at the top of this policy reflects the most recent revision. Your continued use of the platform after the effective date of any update constitutes acceptance of the revised Privacy Policy.

14. CONTACT US

If you have questions about this Privacy Policy, want to exercise privacy rights, or have any concerns about how we handle personal information, please contact us:

Langston Digital LLC

Operating as: AdvantEdge

Privacy: privacy@advantedge.services

Legal: legal@advantedge.services

Security: security@advantedge.services

Marketing site: advantedge.cloud

Application: advantedge.services

— END OF PRIVACY POLICY —