Privacy Policy

Last Updated: August 11, 2026

Northwoods Software Development, Inc. (“Northwoods,” "Company," "we," "our," or "us") respects your privacy and is committed to protecting it through our compliance with this Privacy Policy. This Privacy Policy describes how we collect, use, retain, disclose, and otherwise process personal information when you access or use the CMPAUDIT platform, including our website, web applications, and related services that link to this Privacy Policy (collectively, the "Services").

This Privacy Policy applies only to information we collect:

• Through the Services.
• In communications, including email, text, chat, and other electronic messages, between you and the Services.
• Through website URLs, audit configuration settings, communications, and other information you voluntarily upload or submit through the Services; and
• Through other interactions with us that reference or are governed by this Privacy Policy.

This Privacy Policy does not apply to information collected:

• Through any website, application, or service that does not link to this Privacy Policy;
• By any third party, including through any third-party website, application, or service that may be linked to or integrated with the Services; or
• By third-party providers, such as payment processors or authentication providers, except to the extent we receive personal information from or share personal information with those providers as described in this Privacy Policy.

Please read this policy carefully to understand our policies and practices regarding your personal information and how we treat it. By interacting with our Services or providing us with your personal information, you acknowledge that you have read and understand this Privacy Policy. If you do not agree with our policies and practices, you should not access or use the Services.

We may update this Privacy Policy from time to time. Your continued use of the Services after any revisions become effective constitutes acceptance of any such revision to this Privacy Policy.

The Services are intended for users located in the United States. If you access the Services from outside the United States, you understand that your information may be processed in the United States. We do not intentionally offer the Services to individuals located in the EEA, UK, or Switzerland.

Children's and Minors' Data

Our Services are intended only for individuals who are at least eighteen (18) years of age. We do not knowingly collect, use, or disclose personal information from anyone under the age of 18. If we become aware that we have collected personal information from an individual under the age of 18, we will take appropriate steps to delete such information and may suspend or terminate any associated account, unless we are required by applicable law to retain the information.

The Personal Information That We Collect or Process

"Personal information" is information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with you or your household. Personal information does not include publicly available information or information that has been deidentified or aggregated so that it can no longer reasonably be associated with you.

The types and categories of personal information we may collect include:

• Account information, including name, email address, username, password (stored in encrypted or hashed form), authentication information, confirmation that you satisfy our minimum age requirement, company or organization name, and other information you provide when creating or maintaining your account. If you choose to sign in using a third-party authentication provider, we may receive certain profile information from that provider.
• Account activity and preferences, including your subscription and account history, account settings, audit history, report history, audit configuration settings, communication preferences, and records of your interactions with the Services.
• Subscription and payment information, including your subscription plan, billing status, transaction history, and other information relating to your subscription. If payment information is submitted through a third-party payment processor, that information is collected and processed by the applicable processor and is not stored by us.
• Communications, including information you provide when contacting us for customer support, responding to surveys, submitting feedback, using optional chat or AI-assisted features, or otherwise communicating with us.
• Information submitted for processing, including website URLs, audit configuration information, support communications, and other information you submit through the Services in connection with generating reports, analyses, recommendations, or other functionality.
• Device and usage information, including your IP address, browser type, operating system, device identifiers, device configuration, pages visited, interactions with the Services, referral information, cookie identifiers, and other information regarding how you access and use the Services.

Some information that you voluntarily submit through the Services may contain personal information beyond what is reasonably necessary for us to provide the Services. We ask that you provide only the information reasonably necessary to use the Services. To the extent information you submit contains additional personal information, we process that information only as reasonably necessary to provide the Services, comply with applicable law, protect our legal rights, or as otherwise described in this Privacy Policy.

We also collect:

• Statistics or aggregated information. Statistical or aggregated information does not directly identify a specific individual, but we may derive statistical or aggregated information from the personal information we collect. For example, we may use this information to understand how users interact with the Services, improve the Services, measure the effectiveness of features, and generate reports regarding use of the Services.
• Technical information. Technical information includes information about your internet connection, device, browser, and your interactions with the Services, such as your IP address, browser type, operating system, clickstream information, pages and features accessed, dates and times of access, page interaction information (such as scrolling, clicks, and mouse-overs), and other usage details collected through cookies and similar technologies.

If we combine or connect statistical, aggregated, or technical information with personal information so that it directly or indirectly identifies an individual, we treat the combined information as personal information.

How We Collect Your Personal and Other Data

You Provide Information to Us

We collect information about you when you interact with our Services. For example, we collect information when you create, update, or maintain an account; sign in using a third-party authentication provider, such as Google; provide information relating to your account, the websites or digital properties you wish to evaluate, audit configuration settings, or other information through the Services; select or modify your audit, communication, or account preferences; purchase, renew, modify, or cancel a subscription; contact us for customer support; respond to surveys or requests for feedback; or otherwise communicate or interact with us through the Services.

Automatically Through Our Services

As you navigate through and interact with our Services, we may use automatic data collection technologies to collect information that may include personal information. Information collected automatically may include usage details, IP addresses, operating system, and browser type, and information collected through cookies, server logs, web beacons, analytics tools, and other similar technologies, including details regarding your interactions with the Services, such as the pages, content, and features you access and use, the dates and times of your visits, clickstream information, and other usage and diagnostic information.

Using automatic collection technologies helps us operate, maintain, secure, improve, and personalize the Services and better understand how users interact with the Services.

The technologies we use for this automatic data collection may include:

• Cookies. A cookie is a small file placed on your device when you interact with the Services. You may refuse to accept or disable cookies by activating the appropriate setting on your browser or device. However, if you select this setting, you may be unable to access certain features of the Services.
• Web Beacons. Some parts of the Services and our emails may contain small electronic files known as web beacons (also referred to as clear gifs, pixel tags, and single-pixel gifs) that permit the Company, for example, to count users who have visited those parts or opened an email and for other related statistics (for example, recording the popularity of certain content and verifying system and server integrity).
• Other similar web-tracking and analytical technologies provided by third parties.

To the extent applicable law provides you with the right to opt out of certain uses of cookies or similar technologies, you may exercise those rights as described in the "Your Rights and Choices About Your Information" section below. Please note that some features of the Services may not function properly if you disable certain cookies or similar technologies.

When you interact with the Services, there are third parties that may use automatic collection technologies to collect information about your or your device. These third parties may include:

• Analytics providers;
• Authentication providers;
• Payment processors;
• Hosting providers;
• Artificial intelligence and machine learning service providers; and
• Other service providers that help us operate, secure, and improve the Services.

These third parties may use tracking technologies to collect information about your use of the Services and your interactions with the Services. The information they collect may be associated with your personal information and may be used in accordance with their own privacy policies and the services they provide to us.

We do not control these third parties' tracking technologies or privacy practices. If you have any questions about how a third party collects or uses your information, you should review the applicable third party's privacy policy.

Information from Service Providers and Other Sources

We may receive personal information about you from other sources and combine that information with the information we collect directly from you. For example, we may receive personal information from service providers that we engage to perform services on our behalf, such as authentication providers, payment processors, analytics providers, hosting providers, artificial intelligence service providers, email or other communications service providers, and security or fraud prevention service providers. We may also receive information from other third parties at your direction or with your authorization, such as when you choose to sign in to the Services using a third-party authentication provider. We use information received from these sources only as described in this Privacy Policy.

How We Use Your Information

We use information that we collect about you or that you provide to us, including any personal information, to:

• Provide, operate, maintain, and improve the Services and the content, features, functionality, and information made available through the Services.
• Create and manage your account and authenticate your identity.
• Fulfill any other purpose for which you provide it.
• Use automated technologies, including artificial intelligence and machine learning technologies, to analyze information submitted through the Services, generate reports, provide analyses and recommendations, identify patterns, improve the Services, and provide certain features and functionality.
• Process and manage subscriptions, payments, billing, renewals, cancellations, and related customer support.
• Provide notices regarding your account, subscription, billing, reports, audit activity, and changes to the Services.
• Analyze, develop, maintain, improve, optimize, secure, and troubleshoot the Services.
• Process information submitted through the Services, including information relating to websites, digital properties, audit configurations, and other information you provide in order to generate reports, analyses, recommendations, and other functionality made available through the Services.
• Communicate with you about our Services, including regarding customer support, technical issues, security incidents, billing, account administration, and, where permitted by applicable law, send you newsletters, promotional communications, feature announcements, and other marketing materials.
• Carry out our obligations and enforce our rights arising from any contracts entered into between you and us, including for billing and collection.
• Comply with legal obligations and protect our legal rights.
• In any other way we may describe when you provide the information.
• For any other purpose with your consent.

The usage and technical information we collect, whether associated with your personal information or not, helps us improve the Services and deliver a better and more personalized experience by enabling us to:

• Estimate our audience sizes and usage patterns.
• Store information about your preferences, allowing us to customize the Services according to your individual needs and interests.
• Maintain, improve, optimize, and secure the functionality and performance of the Services.
• Recognize you when you return to our Services.

You may opt out of receiving marketing communications from us at any time by following the unsubscribe instructions included in our communications, adjusting your communication preferences (if available), or contacting us as described below. For more information, see "Your Rights and Choices About Your Information."

Who We Disclose Your Information To

We may disclose aggregated information or deidentified information that does not identify any individual without restriction.

We may also disclose personal information that we collect or you provide as described in this Privacy Policy:

• To our subsidiaries and affiliates.
• To contractors, service providers, and other third parties that perform services on our behalf or otherwise support the operation of the Services, including providers of hosting, authentication, payment processing, analytics, artificial intelligence and machine learning services, website-auditing infrastructure, customer communications, website auditing and data collection services, security, and other business operations. We require such third parties to protect personal information and use it only for the purposes for which we disclose it to them.
• To a buyer or other successor in the event of a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of Northwoods’ assets, whether as a going concern or as part of bankruptcy, liquidation, or similar proceeding, in which personal information held by Northwoods is among the assets transferred.
• For any other purpose disclosed by us when you provide the information.
• With your consent or at your direction.
• To our professional advisors, including attorneys, accountants, auditors, insurers, and other advisors, where reasonably necessary to operate our business, comply with legal obligations, or protect our legal rights.

We may also disclose your personal information:

• To comply with any court order, law, or legal process, including to respond to any government or regulatory request.
• To enforce or apply our Terms of Use and other agreements, including for billing and collection purposes.
• To protect the rights, property, or safety of the Company, our users, or others, including to detect, investigate, prevent, or respond to fraud, security incidents, or other unlawful activity.

The categories of personal information we may disclose include:

• Account information;
• Information submitted for processing;
• Account activity and preferences;
• Subscription and payment information;
• Communications;
• Device and usage information.

Your Rights and Choices About Your Information

This section describes the choices available to you regarding certain uses and disclosures of your personal information and the rights you may have under applicable state privacy laws, depending on where you live.

Choices That Are Always Available to You

• Cookies and Other Tracking Technologies. You can set your browser to refuse all or some browser cookies or other tracking technology files, or to alert you when these files are being sent. If you disable or refuse cookies or similar technologies, some features of the Services may become unavailable or may not function properly. Some browsers include a "Do Not Track" ("DNT") setting that can send a signal to online services indicating that you do not wish to be tracked; one of those DNT technologies is the Global Privacy Control (“GPC”) signal. Our services are set to recognize and, to the extent possible, honor the GPC signal. At this time, we are not capable of recognizing and honoring all DNT signals. To the extent applicable law provides you with the right to opt out of certain uses of cookies or similar technologies, you may exercise those rights as described below or by contacting us using the information provided in this Privacy Policy.
• Updating Account Information. You may update certain account information, website information, audit configuration settings, and communication preferences through your account or by contacting us using the contact information provided below. Because portions of the Services rely on the accuracy of the information you provide, we encourage you to keep this information current so that we can provide the Services.
• Marketing Communications. If you do not wish to receive newsletters, product updates, or other marketing communications from us, you may opt out at any time by following the unsubscribe instructions included in those communications, updating your communication preferences, or contacting us using the information provided below. Even if you opt out of marketing communications, we may still send you transactional or administrative communications relating to your account, subscription, billing, security, or the Services.

Your State Privacy Rights

Depending on your state of residence, you may have certain rights regarding your personal information under applicable law. These rights may vary depending on where you live and are subject to certain exceptions and limitations under applicable law. Where required, we may take reasonable steps to verify your identity before responding to your request.

Subject to applicable law, your rights may include:

• Right to Know: The right to request any or all of the following information relating to your personal information we have collected, used, disclosed, sold, or shared (and in some instances our disclosure of such information):
• The categories of personal information we have collected about you.
• Our business purpose for collecting that personal information.
• The categories of third parties with whom we disclose that personal information.
• The specific pieces of personal information we have collected about you.
• The categories of sources of the personal information we have about you.
• Right to Request Deletion: The right to request that we delete any of your personal information that we collected from you and retained, subject to certain exceptions.
• Right of Portability: The right to request a copy of your information in an accessible format.
• Right to Correct: The right to correct inaccurate personal information that we maintain about you.
• Right to Opt-Out of the Sale or Sharing of Your Personal Information: The right to direct us not to sell or share personal information we have collected about you, including disclosures to third parties for targeted advertising or cross-context behavioral advertising, as those terms may be defined under applicable law.
• Right to Limit the Use and Disclosure of Sensitive Personal Information: The right to request that we limit certain uses and disclosures of sensitive personal information, where required by applicable law.
• Right to Non-Discrimination: The right not to receive discriminatory treatment for exercising these rights.
• “Shine the Light:” California Civil Code Section 1798.83 permits you to request information regarding the disclosure of your personal information to a third party for the third party's direct marketing purposes.

To exercise any privacy rights available to you under applicable law, please submit a request by:

• Emailing us at cmp-support@nwsdigital.com
• Calling us at 414-914-9102

We may not be able to fulfill your request or provide you with personal information if we cannot verify your identity or authority to make the request and confirm the personal information relates to you. We may request additional information from you when appropriate and, in certain circumstances to verify your identity, we may request up to three pieces of personal information about you. We reserve the right to take additional steps as necessary to verify your identity if we have reason to believe a request is fraudulent. If you do not agree with how we responded to your request, you may ask us to review our decision by contacting us through the above noted method.

Where required, we endeavor to respond to requests within 30 days of receipt or within such other time as may be required by law. If we require more time (up to 90 days), we will inform you of the reason and extension period in writing. Where we are required to or opt to provide a written response, we will deliver the written response by mail or electronically, as you direct us. The response we provide will also explain the reasons we cannot or will not comply with a request, if applicable. For data portability requests, we will select a format to provide your personal information that is readily useable and should allow you to transmit the information from one entity to another entity without hindrance.

If you wish to appeal a decision we have made regarding your consumer request, you can submit your appeal by using the contact information provided above.

How We Protect Your Personal Information

We use commercially reasonable administrative, physical, and technical measures designed to protect your personal information from accidental loss or destruction and from unauthorized access, use, alteration, and disclosure. However, no website, system, electronic storage method, or online service can be guaranteed to be completely secure, and we cannot guarantee the security of your personal information transmitted to, through, using, or in connection with the Services. In particular, email and other electronic communications sent to or from the Services may not be secure. Please carefully consider what information you send to us through these communication channels. Any transmission of personal information is at your own risk.

The safety and security of your personal information also depends on you. You are responsible for maintaining the confidentiality of your account credentials, using appropriate security measures to protect your devices and accounts, and promptly notifying us if you believe your account or personal information has been compromised.

How We Retain Your Personal Information

We retain the categories of personal information described in this Privacy Policy for as long as reasonably necessary to fulfill the purposes described in this Privacy Policy or as otherwise permitted or required by applicable law, including to provide and maintain the Services, manage your account, generate reports and analyses, manage user accounts and subscriptions, maintain audit and report history, comply with our legal obligations, resolve disputes, enforce our agreements, and protect the security and integrity of the Services. In determining how long to retain personal information, we consider the nature and sensitivity of the personal information, the purposes for which it was collected and processed, our legal and business obligations, the potential risks associated with retaining the information, and applicable legal requirements. At the end of the applicable retention period, personal information will be deleted, destroyed, or deidentified in accordance with applicable law.

Changes to Our Privacy Policy

We may update this Privacy Policy from time to time, and we will provide notice of any material changes as required by applicable law. The "Last Updated" date at the top of this Privacy Policy indicates when it was most recently revised. We will post the updated Privacy Policy on the Services and may also notify you of material changes by email, through your account, or by other reasonable means. We encourage you to review this Privacy Policy periodically to stay informed about our privacy practices.

Contact Information

To exercise your rights or ask questions or comment about this Privacy Policy or our privacy practices, please contact us at:

Northwoods Software Development, Inc.

1572 E. Capitol DriveShorewood, WI 53211

cmp-support@nwsdigital.com

414-914-9102