Legal

Privacy Notice

Effective Date: October 14, 2026
Last Updated: October 14, 2026

This Privacy Notice explains how Hedy Cyber, Inc. (“Hedy,” “we,” “us,” or “our”) collects, uses, discloses, retains, and otherwise processes personal information in connection with www.hedycyber.com, our business operations, and the provision of its services to its users (collectively, the “Services”).

Hedy provides secure communications, cybersecurity, and related solutions to U.S. government, Department of Defense, defense-industrial-base, cybersecurity, and enterprise customers. This Privacy Notice is intended for individuals who interact with Hedy in a business or professional capacity, including website visitors, customer and prospective-customer personnel, authorized users, government personnel, vendors, partners, and job applicants.

This Privacy Notice does not expand any customer’s or user’s right to use the Services or submit information to Hedy. Use of the Services remains subject to Hedy’s applicable Website and Service Terms and Conditions and any customer, government, order, or other written agreement.

1. Scope and Intended Audience

This Privacy Notice applies to personal information Hedy processes through:

• Websites and digital properties, including www.hedycyber.com;

• Business relationships, including communications with customers, prospective customers, government agencies, contractors, partners, suppliers, and professional advisers;

• The Services, including:

  • Hedy Software. Hedy provides network software (the “Software”) that its customers install on computers, servers, network appliances, virtual machines and end-user devices that the customer chooses (“Nodes”) that make up its network (the “Mesh Network”), and it encrypts traffic between those Nodes while routing communications according to the connectivity and access rules the customer configures.
  • Management Console. The Management Console is a web application the Customer designates to enroll and revoke Nodes, manage cryptographic keys, users, roles, groups, and routing, and monitor network status and performance, with optional support for single sign-on and programmatic access depending on the Customer’s license.
  • Client Applications. Client software for the operating systems listed in Hedy’s product documentation (the “Documentation”).
  • Professional and Support Services. As set out in an applicable order form or agreement, Hedy may provide professional and support services such as deployment and onboarding assistance, training, technical support, and Software updates.
  • Website. The informational content and materials Hedy publishes at hedycyber.com.

  In each case, to the extent Hedy determines the purposes and means of processing personal information;

• Customer administration and support, including account provisioning, identity and access management, technical support, implementation, training, and security operations;

• Events and marketing activities, including demonstrations, conferences, webinars, and business-development communications; and

• Recruiting, including applications for employment or other work with Hedy.

This Privacy Notice may apply differently depending on the capacity in which an individual interacts with us:

2. Information Outside This Privacy Notice

This Privacy Notice does not govern:

• Personal information processed solely on behalf of a customer where Hedy acts as a processor, service provider, contractor, or similar recipient under the customer’s instructions;
• Information governed by a separate written notice presented at or before collection;
• Information processed by third-party websites, products, or services that Hedy does not control;
• Information that is not personal information under applicable law, such as certain aggregated or deidentified information; or
• Classified or specially regulated information except as expressly authorized under a written agreement and an approved deployment or environment.

When Hedy processes personal information on behalf of a customer, the customer’s privacy notice, contract, agency policy, or other instructions generally govern the processing. Questions and requests concerning that information should ordinarily be directed to the relevant customer or agency.

3. Hedy’s Privacy Roles

Depending on the circumstances, Hedy may act in different privacy roles.

3.1 Hedy as a Controller or Business

Hedy generally determines the purposes and means of processing personal information associated with:

• Operation of Hedy’s public websites;
• Business-development and customer-relationship activities;
• Account, contract, billing, and vendor administration;
• Hedy’s own security, fraud-prevention, and compliance activities;
• Product and business planning using information Hedy is permitted to use for those purposes; and
• Recruiting and workforce administration.

In these contexts, Hedy may be considered a “controller,” “business,” or equivalent regulated entity under applicable privacy law.

3.2 Hedy as a Processor, Service Provider, or Contractor

Hedy may process Customer Data on behalf of a commercial or government customer under that customer’s instructions. In these contexts, Hedy may act as a “processor,” “service provider,” “contractor,” subcontractor, or similar recipient.

The relevant customer determines the purposes for which Customer Data is processed, subject to the applicable agreement and law. Hedy’s processing may be governed by:

• A customer or government contract;
• An order form or statement of work;
• Data-processing or security terms;
• Agency instructions and system rules;
• Applicable records-management requirements; or
• Other written customer directions.

If there is a conflict between this Privacy Notice and an applicable customer or government agreement concerning Customer Data, such agreement controls to the extent of the conflict.

4. Personal Information We Collect

The personal information Hedy collects depends on the individual’s relationship with Hedy, the Services used, the relevant deployment, and the choices made by the individual, customer, or government agency.

4.1 Information Provided Directly to Hedy

We may collect:

• Identity information, such as name, username, customer or employer, job title, department, and professional role;
• Business contact information, such as business email address, telephone number, mailing address, and other contact details;
• Account information, such as account identifiers, authentication-related information, assigned roles, permissions, and account preferences;
• Communications, including inquiries, correspondence, meeting information, demonstration requests, survey responses, support requests, and feedback;
• Customer and transaction information, such as contract contacts, purchase information, billing details, invoices, and payment-administration records;
• Event information, such as conference registration, webinar participation, attendance, and professional interests;
• Security and support information, such as identity-verification details, support communications, diagnostic information, and information submitted when reporting a vulnerability or incident;
• Job-application information, such as a résumé, work and education history, professional qualifications, references, interview information, work-authorization information, and other information provided during recruiting; and
• Other information that an individual chooses or is authorized to provide.

Please do not provide personal information that Hedy has not specifically requested or that you are not authorized to disclose.

4.2 Information Collected Through the Services

Depending on the relevant product and deployment, Hedy may collect and process:

• User and account identifiers, which may include email addresses used as user identifiers;
• Customer-assigned roles, permissions, and organizational information;
• Communications content, files, records, or other material submitted through the Services;
• Communications and network metadata;
• Configuration and administrative information;
• Authentication, access, and activity records;
• Device, browser, and operating-system information;
• Internet Protocol address and similar network identifiers;
• Service usage and interaction information;
• Diagnostic, performance, error, and crash data;
• Security events, audit logs, and suspected-threat information; and
• Support and troubleshooting data.

The categories above describe information that the Services may be capable of processing. They do not mean that every Hedy product, deployment, or customer environment collects every category.

In certain deployments, the systems or databases containing this information are managed by the customer rather than by Hedy, and Hedy may access them only as necessary to provide support. Any such access is processing on behalf of the customer and is governed by Sections 3.2 and 6 and the applicable customer agreement rather than by this Privacy Notice.

4.3 Information Collected Automatically

When an individual accesses a Hedy website or Service, Hedy and its authorized providers may automatically collect:

• Internet Protocol address;
• Browser type and version;
• Device type and operating system;
• Referring and exit pages;
• Pages or features viewed;
• Dates, times, and duration of activity;
• Approximate location derived from an Internet Protocol address;
• Cookie, device, or similar identifiers; and
• Information concerning interactions with Hedy’s websites, emails, or Services.

The information collected automatically varies based on infrastructure that the customer owns or controls. Hedy does not operate the customer’s Mesh Network, and customer traffic does not pass through infrastructure Hedy operates. The Software does not connect to servers operated by Hedy, and license validation happens offline.

4.4 Information Received from Customers and Government Agencies

Customers and government agencies may provide Hedy with:

• User and administrator information;
• Account-provisioning and identity information;
• Organization, agency, unit, or employer details;
• Access permissions and authorization attributes;
• Customer communications and content;
• Activity, security, network, or system records;
• Support and incident information; and
• Other information necessary to provide or support the Services.

Customers and agencies are responsible for determining whether they have authority to provide such information to Hedy and for giving required notices or obtaining required permissions.

4.5 Information Received from Other Third Parties

Hedy may obtain personal information from:

• Business partners, resellers, integrators, prime contractors, and subcontractors;
• Public-sector contracting and procurement sources;
• Event organizers and professional associations;
• Service providers and security vendors;
• Recruiting agencies, references, and professional networking sources;
• Publicly available sources; and
• Other parties with which Hedy or the individual has a lawful business relationship.

We may combine information received from different sources where permitted by applicable law and contract.

4.6 Sensitive Personal Information

Depending on the context, some information Hedy processes may be considered sensitive under applicable law, such as account credentials, precise location information, government identifiers, background-check information, information concerning citizenship or immigration status, or communications content.

Hedy does not intend to collect sensitive personal information through public website forms unless expressly requested. Do not submit sensitive, classified, controlled, or specially regulated information through a public website form or other unapproved channel.

Hedy uses and discloses sensitive personal information only as permitted by law, or as directed by the relevant customer or government agency.

5. How We Use Personal Information

Subject to applicable law, contracts, and customer instructions, Hedy may use personal information to:

• Provide, operate, configure, maintain, and support the Services;
• Create and administer accounts, identities, permissions, and access;
• Authenticate users and protect account and system security;
• Process requests, transactions, contracts, and billing;
• Communicate about the Services, business relationships, support requests, and administrative matters;
• Respond to inquiries, demonstrations, proposals, procurement processes, and requests for information;
• Diagnose errors, troubleshoot issues, and improve reliability and performance;
• Detect, investigate, prevent, and respond to security threats, misuse, fraud, and unlawful activity;
• Maintain audit, access, security, and compliance records;
• Develop and improve Hedy’s products, services, and business operations where permitted by contract and law;
• Conduct analytics concerning Hedy’s websites and business activities;
• Personalize website or business interactions;
• Send business-development or marketing communications, subject to applicable choices and law;
• Plan and conduct events, demonstrations, and training;
• Manage vendors, partners, contractors, and other business relationships;
• Recruit, evaluate, and communicate with applicants;
• Establish, exercise, or defend legal claims;
• Comply with legal, contractual, regulatory, records-management, national-security, and government-procurement obligations;
• Respond to valid legal process and lawful government requests;
• Support a merger, financing, acquisition, reorganization, bankruptcy, sale of assets, or similar transaction; and
• Carry out other purposes disclosed at the time information is collected or with appropriate authorization.

Where Hedy acts for a customer, Hedy also uses personal information as instructed or authorized by that customer and as reasonably necessary to provide and secure the contracted Services.

6. Customer-Controlled Data

“Customer Data” means information submitted to, stored in, transmitted through, or otherwise processed by the Services on behalf of a customer, as defined more specifically in the applicable customer agreement.

Customers control the Customer Data they and their authorized users provide to the Services. Subject to the applicable agreement, Hedy may process Customer Data to:

• Provide and support the Services;
• Follow documented customer instructions;
• Maintain the security, integrity, availability, and proper operation of the Services;
• Prevent or address technical problems, misuse, or security incidents;
• Comply with applicable law and binding legal requirements; and
• Perform other processing authorized by the customer agreement.

Hedy does not determine the lawfulness of a customer’s underlying collection or use of Customer Data. Customers are responsible for:

• Providing required privacy notices;
• Obtaining required consents or authorizations;
• Configuring the Services appropriately;
• Limiting access to authorized users;
• Giving Hedy lawful processing instructions; and
• Complying with applicable privacy, employment, communications-monitoring, records-management, export-control, and other requirements.

Individuals seeking to exercise rights concerning Customer Data should ordinarily contact the customer or agency that controls the relevant account or system. If Hedy receives such a request, Hedy may refer the requester to the customer or assist the customer as required by the applicable agreement and law.

7. Government, Defense, and Regulated Information

This public Privacy Notice does not authorize anyone to submit, transmit, store, or otherwise process specially regulated information through a Hedy website, product, support channel, demonstration environment, or other system.

Unless expressly authorized by a written contract and an approved deployment or environment, users must not provide Hedy with:

• Classified information;
• Controlled Unclassified Information (“CUI”);
• Federal Contract Information (“FCI”);
• Export-controlled technical data or defense articles;
• Government records subject to the Privacy Act or comparable requirements;
• Protected health information;
• Consumer financial information subject to specialized safeguards;
• Criminal justice information;
• Biometric identifiers or biometric information;
• Payment-card information;
• Information subject to special handling, dissemination, or access restrictions; or
• Other specially regulated or controlled information.

A statement that a product or environment is “approved” in this section means approved in writing by Hedy and the relevant customer for the specific contemplated use. It does not imply any certification, authorization, security clearance, government endorsement, or determination that the product satisfies a particular legal or contractual standard.

7.1 Controlling Government and Customer Requirements

When Hedy provides Services under a government or customer contract, processing may be subject to:

• The relevant government or customer contract;
• Data-processing and security terms;
• Agency instructions, policies, and system rules;
• Records-retention and disposition schedules;
• Applicable security and incident-reporting requirements;
• Applicable acquisition regulations and contract clauses, including relevant Federal Acquisition Regulation (“FAR”) or Defense Federal Acquisition Regulation Supplement (“DFARS”) provisions;
• Other applicable regulations regarding export restrictions, cybersecurity, data privacy, supply chain, anti-corruption, and other matters.

If any such requirement conflicts with this Privacy Notice, the applicable contract, written instruction, or legal requirement controls to the extent of the conflict.

7.2 Hedy’s Role as a Government Contractor or Service Provider

Hedy may process information as a contractor, subcontractor, processor, or service provider acting under the instructions of a government agency, prime contractor, or other customer. The customer or agency may determine:

• The purposes for which information is collected and used;
• The individuals permitted to access the system;
• Applicable monitoring and logging;
• Retention and records-management requirements;
• Required security controls and operating procedures;
• Whether and how individuals may exercise privacy rights; and
• Incident, legal-process, or individual-notification responsibilities.

Government or customer personnel should follow their organization’s policies, authorized-use notices, system-of-records notices where applicable, and instructions concerning the handling of information.

7.3 Government Access, Monitoring, and Records

Government customers may monitor, inspect, access, use, retain, preserve, disclose, or direct the processing of information in accordance with applicable law, contract, agency policy, and system rules. Users of government systems may have limited or no expectation of privacy as specified in the applicable government notices and policies.

Information processed for government customers may constitute a government record, contractor record, or other regulated record. Its retention, disclosure, transfer, and disposition may be controlled by the relevant customer or agency rather than by Hedy’s ordinary commercial practices.

7.4 Security Incidents and Required Disclosures

Hedy may investigate and respond to suspected security incidents and may preserve, access, or disclose relevant information as permitted or required by law, contract, or customer instruction. Incident reporting and notification responsibilities may be controlled by an applicable government or customer contract.

Hedy will provide incident or legal-disclosure notices where required of Hedy by applicable law or contract. Hedy may be unable to notify an affected individual directly when:

• Notice is prohibited, restricted, delayed, or controlled by law, legal process, or a government authority;
• The relevant customer or agency is responsible for notification;
• Notification could compromise an investigation, security activity, or national-security interest; or
• The applicable contract or agency instruction requires a different notification process.

Nothing in this Privacy Notice requires Hedy to disclose classified information, sensitive security information, investigative details, privileged material, or information that Hedy is legally or contractually prohibited from disclosing.

8. Cookies, Analytics, and Similar Technologies

Hedy and its authorized providers may use cookies, pixels, software development kits, local storage, log files, and similar technologies to:

• Operate and secure websites and Services;
• Maintain sessions and user preferences;
• Authenticate users;
• Understand website usage and performance;
• Diagnose errors;
• Measure communications or campaign effectiveness; and
• Support other purposes described at the point of collection.

Hedy uses cookies for authentication related purposes and may use analytics services provided by third parties from time to time.

Individuals may block or delete cookies through their browser controls, although doing so may impair certain functionality.

Because Hedy does not sell personal information or share it for cross-context behavioral advertising, Hedy does not currently respond to browser-based opt-out preference signals, including Global Privacy Control. Similarly, because there is no common industry standard for recognizing and responding to “Do Not Track” signals, Hedy does not currently respond to such signals.

9. How We Disclose Personal Information

Subject to applicable law, agreements, and customer instructions, Hedy may disclose personal information to the following categories of recipients.

9.1 Service Providers and Subprocessors

Hedy may disclose information to vendors that provide services such as:

• Cloud hosting and infrastructure;
• Communications and collaboration tools;
• Identity and access management;
• Cybersecurity, monitoring, and incident response;
• Website hosting and analytics;
• Customer support;
• Payment, accounting, and contract administration;
• Professional services;
• Recruiting and applicant management; and
• Other operational support.

Relevant providers may include AWS, GCP, Google Workspace, Vanta, Ramp, QuickBooks, Slack, Notion, Figma, OpenAI, Anthropic, Granola, and Attio, among others.

These providers are authorized to process information for specified purposes and are subject to applicable contractual restrictions.

9.2 Customers and Their Authorized Representatives

Hedy may disclose Customer Data and related account, usage, support, or security information to:

• The customer controlling the relevant account;
• Customer administrators;
• Government agencies;
• Prime contractors or authorized subcontractors;
• Authorized integration or implementation partners; and
• Other recipients designated by the customer.

An organization’s administrators may be able to access and manage user accounts, content, activity, logs, and related information, subject to the applicable agreement and product configuration.

9.3 Affiliates

Hedy may disclose personal information to its affiliates for purposes consistent with this Privacy Notice, subject to applicable contractual, legal, and security restrictions.

9.4 Professional Advisers

Hedy may disclose information to attorneys, auditors, insurers, accountants, financial advisers, consultants, and other professional advisers where reasonably necessary to obtain advice, protect Hedy’s interests, or operate the business.

9.5 Government, Law Enforcement, and Legal Recipients

Hedy may disclose information where it reasonably believes disclosure is necessary or appropriate to:

• Comply with applicable law, regulation, legal process, or a valid government request;
• Satisfy contractual reporting or cooperation obligations;
• Protect the rights, property, operations, or safety of Hedy, its customers, users, or others;
• Detect, investigate, prevent, or respond to fraud, misuse, security incidents, or unlawful activity;
• Enforce Hedy’s agreements and policies; or
• Establish, exercise, or defend legal claims.

Hedy may challenge or seek to narrow a request where Hedy determines that doing so is appropriate and legally permitted, but this Privacy Notice does not create an obligation to do so.

9.6 Corporate Transactions

Hedy may disclose or transfer information in connection with an actual or proposed financing, investment, merger, acquisition, consolidation, reorganization, sale of assets, bankruptcy, diligence process, or similar transaction. Recipients may include transaction counterparties, lenders, investors, and their professional advisers.

9.7 At a Customer’s or Individual’s Direction

Hedy may disclose personal information:

• As instructed by a customer or government agency;
• To integrations or third-party services enabled by an authorized user or administrator;
• With an individual’s authorization; or
• For another purpose disclosed when the information is collected.

Third-party services have their own privacy practices. Hedy is not responsible for a third party’s independent processing of information.

10. Sale, Sharing, and Targeted Advertising

Unless and until Hedy confirms otherwise after reviewing its technologies and vendor arrangements, Hedy’s intended position is that it does not sell personal information for monetary consideration.

Hedy does not sell personal information as “sale” may be defined under applicable state privacy laws. Hedy does not share personal information for cross-context behavioral advertising or process personal information for targeted advertising as those concepts may be defined under applicable law.

If Hedy engages in an activity treated as a sale, sharing, or targeted advertising, Hedy will provide legally required disclosures and opt-out mechanisms.

Hedy does not knowingly sell or share for cross-context behavioral advertising the personal information of individuals under 16.

11. Deidentified and Aggregated Information

Where permitted by law and contract, Hedy may create or receive information that is aggregated, deidentified, or otherwise not reasonably linkable to an identified or identifiable individual.

Hedy may use such information for lawful purposes, including security, analytics, service improvement, research, reporting, and business planning, subject to applicable customer agreements. Where required by law, Hedy will maintain deidentified information in deidentified form and will not attempt to reidentify it except to test whether its deidentification processes are effective or as otherwise permitted by law.

Nothing in this section grants Hedy rights in Customer Data beyond those provided in the applicable customer agreement.

12. Security

Hedy uses administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, acquisition, loss, misuse, alteration, or disclosure. The safeguards applied depend on the nature of the information, the relevant Service and deployment, applicable contractual requirements, and the risks associated with the processing.

No security measure, transmission method, network, system, or storage environment can be guaranteed to be completely secure. Hedy therefore cannot warrant that information will never be accessed, used, or disclosed in an unauthorized manner.

Users are responsible for:

• Maintaining the confidentiality of their credentials;
• Using only authorized systems and devices;
• Following applicable customer and agency security requirements;
• Promptly reporting suspected unauthorized access or security issues at: security@hedycyber.com; and
• Not attempting to circumvent security controls.

Descriptions of Hedy’s security practices, certifications, assessments, or authorizations, if any, will be provided only by Hedy through an email request submitted to: security@hedycyber.com. This Privacy Notice does not represent that Hedy has any particular certification, authorization, clearance, government approval, or compliance status.

13. Retention

Hedy retains personal information for as long as reasonably necessary to:

• Provide and support the Services;
• Maintain a business or customer relationship;
• Fulfill the purposes described in this Privacy Notice;
• Comply with legal, contractual, government, security, and records-management requirements;
• Resolve disputes;
• Enforce agreements;
• Maintain security, audit, and incident records; and
• Establish, exercise, or defend legal claims.

Retention periods vary depending on the type of information, sensitivity, context, customer instructions, deployment, legal requirements, and operational need.

Customer Data is retained and deleted in accordance with the applicable customer agreement, customer instructions, and technical capabilities. Government records may be subject to agency-controlled records schedules, preservation requirements, legal holds, or other government directions.

Deletion from active systems may not result in immediate deletion from backups, archives, security records, or systems subject to legal, contractual, technical, or records-management restrictions. Hedy may retain aggregated or deidentified information where permitted by law and contract.

14. Processing in the United States and Other Locations

Hedy is a United States company. Personal information may be processed in the United States and in certain foreign jurisdictions including locations where Hedy, its affiliates, customers, or service providers operate.

Privacy and data-protection laws in those locations may differ from those in an individual’s home jurisdiction. Where required, Hedy uses required safeguards for transfers of personal information across national borders.

Government or customer contracts may impose specific processing-location, access, or transfer restrictions. Any such requirements apply only to the products, environments, and information covered by the relevant agreement and do not constitute a general representation concerning all Hedy processing.

15. Privacy Rights and Choices

Depending on an individual’s location, relationship with Hedy, and applicable law, the individual may have the right to request that Hedy:

• Confirm whether Hedy processes the individual’s personal information;
• Provide access to or a copy of personal information;
• Correct inaccurate personal information;
• Delete personal information;
• Provide certain information in a portable format;
• Restrict or object to certain processing;
• Opt out of a sale, sharing, targeted advertising, or certain profiling;
• Limit certain uses or disclosures of sensitive personal information;
• Withdraw consent where processing is based on consent; or
• Provide information concerning categories of personal information, sources, purposes, and recipients.

These rights are not absolute. Hedy may decline or limit a request where permitted by law, including when Hedy cannot verify the request, the information is controlled by a customer, an exception applies, or retention is required or permitted.

15.1 Submitting a Request

To submit a privacy request, contact Hedy through:

• Email: privacy@hedycyber.com
• Mail: Hedy Cyber, Inc. 1010 Walnut Street, #1807, Cincinnati, Ohio 45202, Attn: Joe O’Brien

A request should identify the right the requester wishes to exercise and provide sufficient information for Hedy to evaluate and verify the request.

15.2 Verification

Hedy may verify a request by asking for information reasonably necessary to match the requester to Hedy’s records. The verification method will depend on the nature of the request, the sensitivity of the information, and the risk of unauthorized disclosure or deletion.

Hedy will not request more personal information than reasonably necessary for verification. If Hedy cannot verify a request to the degree required by law, Hedy may deny or limit the request.

15.3 Customer-Controlled Information

If personal information is processed on behalf of a customer or government agency, Hedy may direct the requester to that organization. Hedy may assist the customer in responding as required by the applicable agreement and law.

15.4 Authorized Agents

Where permitted by law, an individual may use an authorized agent to submit a request. Hedy may require:

• Proof that the individual authorized the agent;
• Verification of the individual’s identity;
• Direct confirmation that the individual authorized the request; and
• Evidence that the agent is properly registered, if applicable.

15.5 Appeals

If Hedy denies a request, an individual may have the right to appeal. An appeal may be submitted by email to privacy@hedycyber.com, referencing the original request and Hedy’s decision, within forty-five (45) days after receiving Hedy’s decision. The appeal should explain why the requester believes the decision should be reconsidered.

Hedy will respond within the period required by applicable law and, where required, provide information about how to contact the relevant regulatory authority.

15.6 Nondiscrimination

Hedy will not unlawfully discriminate or retaliate against an individual for exercising an applicable privacy right. This does not prohibit Hedy from taking actions permitted by law or from denying access to a Service when requested deletion or restriction makes the Service impossible or impracticable to provide.

16. California Privacy Disclosures

This section applies to California residents to the extent California privacy law governs Hedy’s processing and does not exempt the relevant information or activity.

16.1 Categories of Personal Information

During the preceding 12 months, Hedy may have collected the categories described below. The actual categories collected depend on the relationship, Service, and deployment.

Hedy collects and uses these categories for the purposes described in Sections 5 through 7 and discloses them to the categories of recipients described in Section 9.

16.2 Sale, Sharing, and Sensitive Information

Hedy’s practices regarding sale, sharing, and targeted advertising are described in Section 10. Hedy does not sell personal information and does not share personal information for cross-context behavioral advertising, as those terms are defined under the California Consumer Privacy Act, as amended. Accordingly, Hedy does not provide a “Do Not Sell or Share My Personal Information” opt-out at this time. Hedy also does not knowingly sell or share for cross-context behavioral advertising the personal information of individuals under 16 years of age.

Hedy’s practices regarding sensitive personal information are described in Section 4.6. Hedy uses and discloses sensitive personal information only for purposes that do not trigger the right to limit under the California Consumer Privacy Act, as amended, such as providing and securing the Services, verifying identity, preventing fraud and security incidents, and other purposes permitted by law or directed by the relevant customer or government agency. Because Hedy does not use or disclose sensitive personal information to infer characteristics about individuals or for other purposes requiring a right to limit, Hedy does not provide a “Limit the Use of My Sensitive Personal Information” option at this time.

16.3 California Requests

California residents may submit requests using the methods in Section 15. Hedy will process verifiable requests in accordance with applicable law. Information concerning the number of requests received, complied with, and denied is available at: privacy@hedycyber.com.

16.4 Direct Marketing Disclosures

California residents may have rights concerning the disclosure of personal information to third parties for their own direct-marketing purposes. Requests may be submitted via email to: privacy@hedycyber.com with “California Direct Marketing Request” in the subject line.

17. Marketing and Communications Choices

Individuals may opt out of promotional emails by using the unsubscribe mechanism included in the communication or by contacting Joe O’Brien at: job@hedycyber.com.

Even after an individual opts out of promotional communications, Hedy may continue to send:

• Transactional or service-related messages;
• Security notices;
• Contract and account communications;
• Responses to inquiries;
• Legally required notices; and
• Other nonpromotional communications.

18. Job Applicants

Hedy may process applicant information to:

• Review qualifications and suitability for a role;
• Communicate about an application;
• Schedule and conduct interviews;
• Verify application information and references;
• Conduct lawful background or eligibility checks;
• Comply with legal and government-contracting requirements;
• Maintain recruiting records;
• Improve recruiting operations; and
• Consider an applicant for current or future opportunities, subject to applicable choices and law.

Applicant information may be disclosed to professional advisers, background-check providers, government customers where required and authorized, and personnel involved in hiring decisions.

Applicant information is retained for the longer of (i) one year or (ii) as long as Hedy determines is reasonably necessary. If Hedy publishes a separate applicant privacy notice, that notice controls in the event of a conflict.

Applicants must not submit classified information, CUI, export-controlled technical data, protected health information, or other specially regulated information unless specifically requested through an authorized process.

19. Children’s Privacy

The websites and Services covered by this Privacy Notice are intended for business, professional, government, and enterprise use. They are not directed to individuals under 18, and Hedy does not knowingly collect personal information directly from individuals under 18 through its public websites.

If Hedy learns that it collected personal information directly from an individual under 18 in circumstances where collection was not authorized, Hedy will take appropriate steps to address the information. A parent or legal guardian who believes a minor has provided personal information to Hedy may contact Hedy via email at: privacy@hedycyber.com.

This section does not prevent a customer or government agency from processing information concerning minors through an expressly authorized Service and approved environment under an applicable written agreement.

20. Third-Party Services and Integrations

Hedy’s websites and Services may contain links to, interoperate with, or permit access to third-party websites, applications, integrations, and services. Hedy does not control and is not responsible for a third party’s independent privacy, security, or data-processing practices.

Before enabling a third-party integration or providing information to a third party, customers and users should review the third party’s terms and privacy notices. A customer’s decision to enable an integration may cause information to be transmitted to and processed by that third party.

21. Changes to This Privacy Notice

Hedy may update this Privacy Notice from time to time to reflect changes in its Services, practices, legal obligations, or business operations.

When Hedy makes changes, it will post the revised notice at https://hedycyber.com/privacy and update the “Last Updated” date. If required by law, Hedy will provide additional notice or obtain consent before a material change takes effect.

A prior version of this Privacy Notice may be requested by email to privacy@hedycyber.com.

22. Contact Hedy

Questions, concerns, or requests concerning this Privacy Notice or Hedy’s privacy practices may be directed to:

Hedy Cyber, Inc.
Attn: Joe O’Brien
Email: privacy@hedycyber.com

Security issues or suspected vulnerabilities should be reported to security@hedycyber.com rather than through a general privacy request channel.

If an inquiry concerns information controlled by a Hedy customer or government agency, Hedy may direct the individual to that organization.