Privacy Policy

We collect the following categories of personal data when you use our services, depending on your interactions with us:

• Identification & Contact Data such as your name, username, business or home address, email address, phone number, and account credentials used to create or manage an account.
• Transaction & Account Data including purchase and subscription records, billing confirmations from our payment processor (we do not store full card numbers), and your in-product settings or preferences.
• Usage & Technical Data generated when you use our Sites, apps, or AI-powered features, including device and browser identifiers, IP-based approximate location, pages viewed, links clicked, session length, performance and crash diagnostics, and basic attribution (for example, which campaign link brought you to our site).
• Communications Data contained in messages you send to us (support requests, feedback, surveys) and content you post through our services (for instance, a profile photo or short video).
• Special Category / Sensitive Data only where you choose to provide it or where a specific feature requires it—such as health or biometric information, precise geolocation, financial account details, or information about minors. We collect and use this category only with an appropriate legal basis (including explicit or separate consent where required) and solely for the purpose disclosed at the time.

We may collect personal data from a variety of sources. This includes:

• Directly from you. You provide information when you register, purchase, complete a form or survey, upload content, or contact support. This can include your contact details and login information; profile fields you choose to add (such as role, age group, or preferred pronouns); the text, prompts, or files you submit to AI features so those features function; and any attachments you upload. For payments, we receive processor-issued tokens or confirmations, not full card numbers. In limited cases—only if you supply it—we may process your own professional revenue figures; most revenue data we handle relates to organizations rather than an identifiable person.
• Automatically from your device/use. When you visit our Sites or apps, we receive technical and usage signals your device or browser ordinarily shares, such as IP address (which indicates an approximate location), device and browser type, operating system and language, referral and exit pages, timestamps, pages viewed, links selected, session duration, load times, search terms, and crash/error diagnostics. If you interact with AI features, we process the inputs you provide so the feature works as intended.
• Cookies and similar technologies (consent where required). We use cookies, SDKs, and pixels to keep you signed in, remember settings like language, secure the service, and understand what is working. Our emails may include simple beacons so we can gauge opens or link clicks and avoid unnecessary resends. You can manage non-essential cookies in our banner or your browser; some features may not function without them.
• From other people and trusted partners. A colleague or member may share your business contact details to invite you to an event or make a referral; the person sharing should have a lawful basis and, where required, direct you to this policy. We also receive data from providers who help with operations and safety—such as address corrections from shippers, billing confirmations from payment processors, fraud-prevention risk signals, analytics or attribution aggregates about feature usage or campaign performance, customer-support tooling, and, where appropriate, public sources (for example, company registries) to validate business details. Where legally permitted and necessary (for fraud prevention or assessing eligibility for a financing option), we may obtain limited credit-reference information. If you join through or participate in a partner program, benefit offering, or co-sponsored program, we may receive information from the relevant partner organization to verify eligibility, administer the program, or maintain accurate records.
• Combining information. Where the law allows, we combine information from these sources—such as merging duplicate accounts, troubleshooting issues, enhancing security, keeping records accurate, or improving service quality.

We do not require sensitive or special-category data for core services. If you choose to share such data—including via optional AI features—we will process it only with an appropriate legal basis and for the specific purpose disclosed at collection (for example, explicit consent under GDPR Article 9(2) or separate consent under PIPL for sensitive personal information). If you withhold consent for these items, only the related optional feature will be unavailable; other features will continue to work.

We use personal data to provide and improve our services. Depending on what you’re doing, we rely on your consent, our contract with you, or our legitimate interests. Where the law requires consent (for example, for non-essential cookies, certain marketing, or sensitive/special-category data), we will ask first. You may withdraw consent at any time; withdrawing won’t affect processing already carried out.

For safety, reliability, and abuse prevention, we log technical and usage data associated with AI features (e.g., timestamps, error/abuse signals, and performance diagnostics). In limited cases, and under confidentiality obligations, authorized personnel may review a sample of minimized or de-identified prompts/outputs to investigate abuse, resolve incidents, or improve reliability. Many AI features do not require personal data; if you include personal data in a prompt, it may appear in the output you receive.

We retain AI prompts/outputs and related logs for the period necessary to operate and secure the feature and as set out in our Data Retention Policy. Where feasible, you may request deletion of prompts/outputs associated with your account; we may retain minimal suppression or audit records to honor your choices and protect the Service.

Many AI features do not require you to include personal data; if you choose to include personal data, it may appear in the Outputs. We may de-identify Prompts and Outputs and retain the de-identified data for analytics, safety, and monitoring in support of operating, securing, and fixing the feature.

We do not make decisions based solely on automated processing that produce legal or similarly significant effects about you without human involvement. If that ever changes, we will provide specific notice and explain your rights, including the ability to obtain human review, express your view, and contest the decision.

We may share personal data with our AI service providers solely to deliver these features, under contracts that require them to act on our instructions and protect your data.

We will retain your personal data for the duration necessary for the purpose of its processing, including the provision of AI-related services and/or to meet any applicable legal obligations. Please see our Data Retention Policy, accessible at for more information.

We take reasonable and appropriate technical and organizational measures to safeguard your personal data against any breach, unauthorized or illegal access, alteration, disclosure, or deletion. This measure may include identity verification, encryption, access control, malicious code resistance, and regular security audits.

We share personal data only as described below and only for the purposes needed to provide and improve our services. Where the law requires it (for example, partner marketing, non-essential cookies/SDKs, sensitive/special-category data, or cross-border transfers under PIPL), we obtain your consent first. All recipients must implement appropriate technical and organizational measures consistent with this Policy and applicable law. This does not limit our own obligations to you

This section covers transfers to our affiliates/franchisees, members, business partners, and service providers when they are located outside your country. When your personal data is transferred outside your country, we apply safeguards designed to ensure a level of protection essentially equivalent to that required by applicable law.

EEA/UK/Switzerland. If you are located in the EEA, the UK, or Switzerland, we rely on:

• Adequacy decisions where available (EU/UK/CH).
• Standardized transfer tools where adequacy is not available, including the EU Standard Contractual Clauses (SCCs), the UK IDTA/Addendum, and the Swiss FDPIC addendum, as applicable.
• Transfer impact assessments and supplementary measures (for example, encryption in transit and at rest, strict access controls, minimization/pseudonymization, and contractual limits on onward disclosure).
• If you are a resident of China, we will obtain separate consent before we share, transfer, or store (export) personal data. The name and contact details of overseas recipients, the purpose and method of processing, the categories of personal information exported, the retention period, and our transfer mechanism are set out in our Vendor & SDK Register below. We use an approved export path (e.g., CAC security assessment, certification, or the China Standard Contract filing) as legally required. You may withdraw consent at any time; doing so may limit features that rely on the export.

Onward transfers to vendors/sub-processors. Any overseas service providers that process personal data on our behalf must act on our instructions, implement appropriate security measures, and agree to equivalent protections for any onward disclosures.

We maintain the following third-party tools. This list reflects the current core set and may change; when it does, we will update this register and, where required, notify you or seek consent again.

Where we process your personal data, you have a number of rights over how the data is processed and can exercise these rights at any point. We have provided an overview of these rights below. You can exercise your rights by emailing us at [*].

• The right to be informed. You have the right to be provided with clear, transparent, and easily understandable information about how we use your personal data and your rights. Therefore, we’re providing you with the information in this Policy.
• The right to withdraw consent. Where we rely on consent, you can withdraw it at any time; this will not affect processing already carried out.
• The right to access and rectification.You have the right to access, correct, or update your personal data at any time. We understand the importance of this, and should you want to exercise your rights, please email us at compliance@coreconnectcircle.com.
• The right to data portability. The personal data you have provided us with is portable. This means it can be moved, copied, or transmitted electronically under certain circumstances.
• The right to be forgotten. Under certain circumstances, you have the right to request that we delete your data. If you wish to delete the personal data we hold about you, please let us know and we will take reasonable steps to respond to your request in accordance with legal requirements. If the personal data we collect is no longer needed for any purposes and we are not required by law to retain it, we will do what we can to delete, destroy, or permanently de-identify it.
• The right to restrict processing. Under certain circumstances, you have the right to restrict the processing of your personal data.
• The right to object. Under certain circumstances, you have the right to object to certain types of processing, including processing for direct marketing (i.e., receiving emails from us notifying you or being contacted with varying potential opportunities).
• You have the right to complain to a data protection authority about our collection and use of your personal information. You may lodge a complaint with a supervisory authority where you live or work, or where the alleged infringement occurred. Contact details for data protection authorities in the EEAhere, in the UK here, and in Switzerland here.
• Rights related to automated decision-making. You have the right not to be subject to a decision which is based solely on automated processing and which produces legal or other significant effects on you. In particular, you have the right: to obtain human intervention, express your point of view, and contest the decision.

• Right to access and copy of data.
• Right to transfer.
• Right to correct or supplement.
• Right to deletion in certain circumstances.
• Right to limit or withdraw consent.
• Right to request details of processing (including for automated decision-making, and can refuse such decision) and of handling rules.
• Right to deregister accounts.
• Right to make a complaint to the Cybersecurity Administration of China (CAC).

If you have an online account with us, you can review and update your personal information online by logging into your account. You can also review and update your personal information and exercise your other rights by contacting us. More information about how to contact us is provided below. You can close your account at any time by emailing us at legal@coreconnectcircle.com. If you close your account, we may still retain certain information associated with your account for analytical purposes and record-keeping requirements per our Data Retention section above, as well as to prevent fraud, collect any fees owed, enforce our Terms of Service, or take other actions otherwise permitted by law. In addition, if certain information has already been provided to third parties as described in this Privacy Policy, retention of that information will be subject to those third parties’ policies.

Our Sites, apps, and communications may include links to, or integrations with, websites, apps, or services that are not owned or controlled by us (for example, an advertisement, a search result, an embedded video/map, social-sharing buttons, single-sign-on, or a checkout hosted by a payment provider). If you follow those links or interact with those features, your personal data may be collected directly by the third party and processed under that party’s own privacy policy, not this one.

Except where a third party acts as our service provider (processor) under contract (see “How we share personal data” and our Vendor & SDK Register), those third parties typically act as independent controllers of any data you provide to them. We do not endorse, control, or take responsibility for their content, security, or privacy practices. Before you use any third-party website or feature, review its privacy and cookie notices and settings, including any choices about advertising, analytics, and tracking.

Some areas of our Sites allow you to post information about yourself (e.g., your name and email address), communicate with others, upload content, and post comments. These postings are governed by our Terms of Service. Any personal data you voluntarily disclose in these areas may be visible to others with access to your content and may be collected and used by them. Please exercise discretion and caution. Once posted, you may not be able to edit or delete the data.

Our Site is designed and intended for use by adults. We do not knowingly collect personal data from children under the age applicable in your jurisdiction (for example, under 16 in the EEA; under 14 in China). If we discover that we have collected personal data from a child without consent from a parent or guardian where such consent should have been obtained, we will delete that personal data as soon as practical.

Core Connect Circle, LLC complies with the EU-U.S. Data Privacy Framework (EU-U.S. DPF) and the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF) as set forth by the U.S. Department of Commerce. Core Connect Circle, LLC has certified to the U.S. Department of Commerce that it adheres to the EU-U.S. Data Privacy Framework Principles (EU-U.S. DPF Principles) with regard to the processing of personal data received from the European Union and the United Kingdom in reliance on the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF. Core Connect Circle, LLC has certified to the U.S. Department of Commerce that it adheres to the Swiss-U.S. Data Privacy Framework Principles (Swiss-U.S. DPF Principles) with regard to the processing of personal data received from Switzerland in reliance on the Swiss-U.S. DPF. If there is any conflict between the terms in this privacy policy and the EU-U.S. DPF Principles and/or the Swiss-U.S. DPF Principles, the Principles shall govern. To learn more about the Data Privacy Framework (DPF) program, and to view our certification, please visit . Core Connect Circle’s U.S. subsidiaries adhering to the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF are: Core Connect Circle , LLC, Core Connect Circle Franchising, LLC, Core Connect Circle , LLC, Core Connect Circle Holdings LLC, Core Connect Circle Holdings, LLC, Core Connect Circle Intermediate Holdings, LLC, Core Connect Circle International Holdings CTB, LLC, Corporate Connections Franchising, LLC, Corporate Connections Global, LLC, Prosperity Brands, LLC, and Scion Social Holdings LLC.

Under the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF, you have the following rights:

• Right to choose (opt out) whether your personal information is (i) to be disclosed to a third party or (ii) to be used for a purpose that is materially different from the purpose(s) for which it was originally collected or subsequently authorized by you, through clear, conspicuous, and readily available mechanisms to exercise choice.
• Right to access personal information about you that we hold and the right to correct, amend, or delete that information where it is inaccurate, or has been processed in violation of the Principles, except where the burden or expense of providing access to you would be disproportionate to the risks to your privacy in the case in question, or where the rights of persons other than you would be violated.

Additional information on the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF can be viewed at . The Federal Trade Commission (FTC) has jurisdiction over Core Connect Circle’s compliance with the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF. Core Connect Circle will annually renew its EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF self-certification to help ensure the treatment of all personal data continues to be accurate and processed in accordance with the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF principles. In cases of onward transfer to third parties of EU, UK, and Swiss Personal Data received pursuant to the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and Swiss-US DPF, Core Connect Circle is potentially liable. All questions or complaints regarding the processing and use of personal data should be directed to legal@coreconnectcircle.com. You may also contact Core Connect Circle’s Data Protection Officer by email at dpo@coreconnectcircle.com.

In compliance with the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF and the Swiss-U.S. DPF, Core Connect Circle , LLC commits to refer unresolved complaints concerning our handling of personal data received in reliance on the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF and the Swiss-U.S. DPF to JAMS, an alternative dispute resolution provider. If you do not receive timely acknowledgment of your DPF Principles-related complaint from us, or if we have not addressed your DPF Principles-related complaint to your satisfaction, please visit for more information or to file a complaint. The services of JAMS are provided at no cost to you.

You may have the option to select binding arbitration for the resolution of your complaint under certain circumstances, provided you have taken the following steps: prior to initiating an arbitration claim: (1) raised the claimed violation directly with Core Connect Circle and afforded us the opportunity to resolve the issue within the timeframe set forth in section (d)(i) of the Supplemental Principle on Dispute Resolution and Enforcement; (2) made use of the independent recourse mechanism under the Principles, at no cost to you; and (3) raised the issue through your Data Protection Authority (DPA) to the US Department of Commerce and afforded the US Department of Commerce an opportunity to use best efforts to resolve the issue within the timeframes set forth in the Letter from the Department’s International Trade Administration, at no cost to you.

If you have any questions or concerns about Core Connect Circle’s Privacy Policy or data processing or if you would like to make a complaint about a possible breach of local privacy laws, please do so by contacting us by email, telephone, or mail as follows:

Core Connect Circle’s Data Protection Officer can be contacted at the above address or phone number, or by email at dpo@coreconnectcircle.com.

If you are a resident of China, please contact us at:

We will update this Privacy Policy when necessary to reflect customer feedback and changes in our products and services. When we post changes to this statement, we will revise the “last updated” date at the top of this Policy. We recommend that you check our Sites from time to time to inform yourself of any changes in this Policy. We will not reduce your rights under this Policy without your consent.