Privacy Policy.

We collect information in the following categories:

Account Data. When you create an account, we collect your name, email address, company name, and workspace configuration preferences. This data is necessary to provide and manage the Service.

Tracking Data. When your end users interact with websites or landing pages that use Vortex tracking scripts, we collect click identifiers, referral source parameters, browser user-agent strings, IP addresses (hashed via SHA-256), conversion events, and form submission data. All personally identifiable information (PII) is hashed before storage -- we never store raw PII from tracked end users.

Usage Data. We automatically collect information about how you interact with our dashboard, including pages viewed, features used, API calls made, and session duration. This data is used solely to improve the Service.

We use the information we collect to:

• Deliver the Service. Process tracked events, score leads, detect duplicates, and route qualified leads to configured destinations including CRM systems and advertising platform APIs. • Provide Analytics. Generate dashboards, reports, and AI-powered insights about your marketing funnel performance. • Improve the Platform. Analyze aggregate usage patterns to develop new features, improve existing functionality, and optimize performance. • Communicate with You. Send account-related notifications, security alerts, and (with your consent) product updates. • Ensure Security. Detect fraud, prevent abuse, and maintain the integrity of the Service.

We take data security seriously and implement multiple layers of protection:

• Encryption at Rest. All data is encrypted at rest using AES-256 encryption. • Encryption in Transit. All communication between clients and our servers uses TLS 1.3. • PII Hashing. All personally identifiable information from tracked end users is hashed using SHA-256 before storage. We never store raw email addresses, phone numbers, or names from lead forms. • Access Controls. Role-based access control (RBAC) ensures team members only access data relevant to their workspaces and permissions. • Infrastructure. Our infrastructure is hosted on SOC 2 compliant cloud providers with automated backups, monitoring, and incident response procedures.

Vortex integrates with third-party advertising and analytics platforms to deliver its core functionality. When you configure integrations, we transmit conversion event data to:

• Meta (Facebook/Instagram). Via the Conversions API (CAPI) for server-side event tracking and conversion optimization. • Google Ads. Via Google Ads API for offline conversion imports and enhanced conversions. • TikTok. Via the TikTok Events API for server-side conversion reporting.

Data sent to these platforms is limited to what is necessary for conversion reporting and optimization, typically consisting of hashed identifiers and event metadata. Each platform's own privacy policy governs their use of this data.

We do not sell, rent, or share your data with any third parties for their own marketing purposes.

Our tracking script (vortex.js) uses first-party cookies to:

• Store Click Identifiers. We store advertising click IDs (such as fbclid, gclid, ttclid) in first-party cookies to enable accurate attribution across sessions. • Session Tracking. We generate a session identifier to group page views and events within a single visit. • Visitor Identification. We set a persistent first-party cookie to recognize returning visitors, enabling cross-session attribution.

These cookies are strictly first-party and are not shared with or accessible to third-party domains. They are essential for the core functionality of the Service and cannot be disabled while using Vortex tracking.

Our marketing website may use separate analytics cookies, which are subject to standard cookie consent mechanisms.

Data retention periods are configurable per workspace:

• Lead and Event Data. Retained for the duration configured in your workspace settings, with a default of 12 months. You may configure shorter retention periods based on your compliance requirements. • Account Data. Retained for the duration of your active account, plus 30 days after account deletion to enable recovery. • Aggregated Analytics. Anonymized, aggregated data may be retained indefinitely for statistical analysis and product improvement.

You may request deletion of your data at any time by contacting us or using the data management features in your workspace settings.

Depending on your jurisdiction, you may have the following rights regarding your personal data:

• Right of Access. Request a copy of the personal data we hold about you. • Right to Rectification. Request correction of inaccurate personal data. • Right to Erasure. Request deletion of your personal data, subject to legal retention obligations. • Right to Data Portability. Receive your data in a structured, commonly used, machine-readable format. • Right to Restrict Processing. Request that we limit how we process your data. • Right to Object. Object to processing of your personal data for certain purposes. • Right to Withdraw Consent. Where processing is based on consent, withdraw that consent at any time.

We comply with the General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA), and other applicable data protection laws. To exercise any of these rights, contact us at privacy@vortextrk.com.

Vortex operates globally and may transfer your data to servers located outside your country of residence. When we transfer data internationally, we ensure appropriate safeguards are in place, including:

• Standard Contractual Clauses (SCCs) approved by the European Commission. • Data processing agreements with all sub-processors. • Technical measures including encryption and access controls.

By using the Service, you acknowledge that your data may be processed in jurisdictions with different data protection laws than your own.

Vortex is a business-to-business platform designed for professional use. The Service is not intended for individuals under the age of 16. We do not knowingly collect personal data from children under 16. If we become aware that we have collected personal data from a child under 16, we will take steps to delete that information promptly.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will:

• Update the "Last Updated" date at the top of this page. • Notify active users via email or in-app notification. • Where required by law, obtain your consent before applying material changes.

We encourage you to review this page periodically to stay informed about how we protect your data.

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

• Email: privacy@vortextrk.com • General inquiries: support@vortextrk.com • Postal address: Vortex, Tel Aviv, Israel

We will respond to all privacy-related inquiries within 30 days.