SmartAlex United States State Privacy Notice

Version 1.0 · Effective July 8, 2026 · THERCSGROUP PTE. LTD. (trading as SmartAlex, Singapore Reg. No. 202543608D)

1. Purpose and scope

This United States State Privacy Notice (the "Notice") is issued by THERCSGROUP PTE. LTD., trading as SmartAlex ("SmartAlex", "we", "us", "our"), the operator of the SmartAlex platform, websites, applications, and APIs (the "Services").

This Notice is a United States overlay. It supplements our general Privacy Policy and applies to residents of United States states that have enacted comprehensive consumer privacy laws, to the extent those laws apply to our processing of personal data. Where a term such as personal data, consumer, controller, business, processor, or service provider is defined by an applicable state law, that definition governs for residents of that state.

California has its own dedicated notice. If you are a California resident, please read the California Privacy Notice, which sets out the specific disclosures and rights that apply under California law. This Notice covers the broader multi-state picture and does not replace the California Privacy Notice.

This Notice does not itself expand the geographic reach of any law. A given state law applies only where its own scope and thresholds are met.

2. Which laws this Notice covers

A growing number of United States states have enacted comprehensive consumer privacy laws. This Notice is written to help residents of those states understand how we handle personal data. The principal laws currently in this group are listed below. This list evolves as new laws take effect and as existing laws are amended, and whether any particular law applies to a given processing activity depends on that law's own thresholds and exemptions.

Other states may enact comparable laws over time. Where a state law applies to us and grants rights beyond those described here, we will honour those rights as required.

3. Our roles

Our role depends on the personal data in question and on how it reaches the Services.

• Customer data. In most cases, the SmartAlex customer that uses the Services is the business or controller for the personal data it collects and processes through the Services, including data about its own contacts, callers, and end users. In that context, SmartAlex acts as a service provider or processor and handles that personal data on the customer's behalf, under the customer's instructions and our Data Processing Addendum.
• Our own data. SmartAlex is the business or controller for the personal data it processes for its own purposes, such as account administration, billing, security, support, and its own marketing. This Notice, together with the Privacy Policy, describes how we handle that data.

If you are an end user or contact of a SmartAlex customer and you wish to exercise rights over data that the customer controls, you should generally direct your request to that customer. We will support our customers in responding to such requests as required by applicable law and the Data Processing Addendum.

4. Your rights

Subject to the applicable state law and its exceptions, residents of the states covered by this Notice generally have some or all of the following rights in relation to personal data for which SmartAlex is the controller or business:

• The right to know or access the personal data we process about you and to obtain information about how it is used.
• The right to correct inaccurate personal data.
• The right to delete personal data, subject to legal exceptions.
• The right to data portability, that is, to obtain a copy of certain personal data in a portable and, where feasible, readily usable format.
• The right to opt out of the sale or sharing of personal data and of targeted advertising, where the applicable law provides such a right.
• The right to opt out of certain profiling in furtherance of decisions that produce legal or similarly significant effects, where the applicable law provides such a right.

To exercise any of these rights, please contact us at privacy@getsmartalex.com. We will not discriminate against you for exercising your rights, and we will not deny you goods or services, charge you a different price, or provide a different level of quality solely because you exercised a right.

Where a state law provides a right to appeal our refusal of a request, you may appeal by replying to our decision or by contacting us at the address above. We will respond to appeals within the period required by the applicable law and will inform you of any further options available to you, including how to contact the relevant state authority.

5. Sale, sharing, and targeted advertising

SmartAlex does not sell personal data for money, and we do not sell personal data as that term is defined under the applicable state consumer privacy laws. We also do not share personal data for cross-context behavioural or targeted advertising in a manner that would require an opt out under those laws.

Where an applicable law requires us to honour a browser or device-based opt-out preference signal (such as a recognised universal opt-out mechanism) as a valid request to opt out of sale, sharing, or targeted advertising, we will treat such a signal as such a request to the extent required. Because our current practices do not involve selling or sharing as defined by these laws, the practical effect of such signals on our own processing is limited, but we will continue to honour them as the law requires and update this Notice if our practices change.

6. Sensitive data

We limit our processing of sensitive data (as defined by the applicable state law) to what is necessary to provide, secure, and support the Services and to meet our legal obligations. Where an applicable law requires your consent before we process sensitive data, or gives you a right to limit its use, we will obtain that consent or honour that limit as required. We do not use sensitive data for targeted advertising or to sell it.

7. Service-provider and processor commitments

When SmartAlex acts as a service provider or processor for a customer, we process the customer's personal data only for the purposes set out in our agreement with that customer and in the Data Processing Addendum, and in accordance with the customer's documented instructions. We do not retain, use, or disclose that personal data for any purpose other than performing the Services, except as permitted or required by applicable law. We do not sell or share that personal data, and we do not combine it with personal data from other sources except as permitted by law and the applicable agreement.

We engage subprocessors to help deliver the Services under written terms consistent with these commitments. Our current subprocessors are listed in the Subprocessor List.

8. Authorized agents and verification

You may use an authorized agent to submit a rights request on your behalf where the applicable law permits. Where we use an authorized agent, we may require the agent to provide proof that you gave the agent signed permission to act for you, and we may ask you to verify your own identity directly or to confirm that you authorised the agent.

To protect your personal data, we will take reasonable steps to verify the identity of any person making a request before we act on it. Verification may involve matching information you provide against information we already hold. If we cannot verify a request to the standard required by the applicable law, we may decline it and will explain why. We do not use verification information for any purpose other than verifying the request.

9. Relationship to other documents

This Notice should be read together with our other legal documents:

• California-specific disclosures and rights are set out in the California Privacy Notice.
• Our general privacy practices are described in the Privacy Policy.
• Where SmartAlex processes customer personal data as a service provider or processor, the Data Processing Addendum governs that processing.
• The subprocessors we use are listed in the Subprocessor List.

If there is any conflict between this Notice and a mandatory requirement of an applicable state law as it applies to a resident of that state, that law governs for that resident.

10. Updates and contact

We may update this Notice from time to time to reflect changes in our practices, in the Services, or in the applicable laws. We will revise the version and effective date below when we do. Where an applicable law requires advance notice of material changes, we will provide it.

For questions about this Notice or to exercise your rights, contact our privacy team at privacy@getsmartalex.com. For legal notices, contact legal@getsmartalex.com.

This Notice is issued by THERCSGROUP PTE. LTD. (UEN 202543608D), 160 Robinson Road, #14-04 Singapore Business Federation Center, Singapore 068914, and is governed by the laws of the Republic of Singapore.

11. Version and effective date

This United States State Privacy Notice is version 1.0 and is effective from 8 July 2026.