Copp Oak Advisors Privacy Notice

Effective date: October 4, 2026 Last updated: October 4, 2026

1. Who we are and what this Notice covers

Copp Oak LLC, a Virginia limited liability company doing business as Copp Oak Advisors ("Copp Oak," "we," "us," or "our"), provides technology and AI-transformation consulting, software tools, and authorized connector and integration services.

This Privacy Notice explains how we collect, use, disclose, retain, and protect personal information in connection with https://coppoak.com, our consulting practice, and the Copp Oak services identified on the Service Schedule.

"Personal information" means information that identifies, relates to, describes, or can reasonably be linked to an individual, including information associated with a reasonably linkable account, device, or pseudonymous identifier.

Services covered. This Notice covers our website at https://coppoak.com, our consulting services, and each Copp Oak software service and connector listed on our Service Schedule at https://coppoak.com/legal/services, which shows each service's current status (demonstration, sandbox, beta, or production). Booking, payment, and energy-enrollment features are active only when the Service Schedule lists them as production, and the applicable addendum then supplements this Notice.

A service-specific addendum supplements this Notice for the service it identifies. Descriptions of optional functionality do not mean that the functionality is available or that we collect the associated information when it is disabled.

This Notice does not replace a separate privacy notice provided by your employer, a service operator, your financial institution, a payment processor, an AI-assistant platform you choose, or another independently operated service.

2. When we act for ourselves and when we act for a business customer

We determine the purposes of processing information used to operate our own website and customer relationships, administer our contracts, maintain our own legally permitted consent and fee records, respond to requests, and protect our services.

For certain consulting engagements and business services, we process information on a business customer's documented instructions. For that processing, the customer determines the permitted purposes, and our agreement with that customer—including any applicable Data Processing Addendum—governs our work.

A business customer's administrator may be able to manage authorized users, connections, permissions, and customer-controlled records. The applicable service identifies those capabilities.

Where a request concerns information we process only for a business customer, we will identify or route the request to that customer when appropriate and assist it as required. We remain responsible for responding concerning information for which we determine the purposes of processing.

3. Information we collect and where it comes from

We collect only information relevant to the active service you use and the permissions you grant.

Category	Examples and sources	Main purposes
Contact and relationship information: Name, business name, role, business or personal contact details you provide, and information about your inquiry or engagement.	Responding to inquiries; providing consulting and support; administering the relationship.
Consulting materials and support submissions: Authorized business documents, project requirements, correspondence, and attachments you or your organization submit.	Performing the agreed engagement; troubleshooting; maintaining necessary project and support records.
Authorized spend information: merchant/vendor, amount, currency, date, category, cadence, seat count, and subscription details (last four card digits only where a service expressly enables them). Sources: your uploads and specifically authorized financial-data connections.	Organizing spend, identifying potential waste or savings, preparing proposals, and explaining calculations.
Energy service information (only where an energy service is active): utility name, service address, rate or plan, usage history, bill amounts, and the utility account or service-point number needed to identify your account for a quote or enrollment you request. Sources: bills you upload and information you provide.	Comparing offers; preparing and submitting enrollments you authorize.
Connector and agent interaction information: The instructions, tool arguments, selected content, outputs, and error information actually transmitted to our connector by you or the AI platform you use.	Processing your request; returning results; enforcing permissions; troubleshooting.
Session and permission information: Session identifiers, hashed owner references, connection identifiers, permission scopes, and authorization status.	Separating sessions and customer environments; managing connections; applying access controls.
Approval and outcome records: Proposal identifiers, the terms and data-sharing disclosures shown, approval or rejection, timestamps, receipt hashes, action status, and customer-reported outcomes. Providers and Operators may also be sources of outcome information (for example, enrollment status or whether an appointment took place).	Recording instructions, preventing duplicate actions, explaining what occurred, and resolving disputes.
Booking and operator information: Customer contact details, service address, requested work, availability, selected appointment, time zone, operator identity, and relevant CRM, calendar, job, or invoice identifiers.	Preparing and confirming requested appointments; communicating status; supporting attribution and reconciliation.
Payment and reconciliation metadata: Payment-provider reference, transaction amount and currency, invoice reference, payment or refund status, application fee, and dispute or adjustment status.	Billing, permitted fee calculations, refunds, reconciliation, and accounting.
Technical and security information: IP address, request time, device/browser information, limited request metadata, error codes, and security events. Sources: our systems and hosting or security providers.	Delivering the service, maintaining reliability, detecting misuse, and investigating security incidents.
Optional analytics information: Only the information identified in the active Cookie/Analytics Module.	The limited analytics purposes described there, subject to your choices.

We do not ordinarily receive your entire conversation with an AI assistant merely because you invoke our connector. We receive the information the host platform or you actually send to the connector. Review the host platform's privacy practices and the content being transmitted.

We may generate service-related observations, such as a possible duplicate subscription or a potential appointment match. These are used to provide the feature you request, not to infer sensitive personal traits or make eligibility decisions described in Section 5.

4. Information you should not submit

Do not submit passwords, bank or portal login credentials, one-time passcodes, recovery codes, full financial-account numbers, complete payment-card numbers, card security codes, government identifiers, protected health information, or other authentication secrets through our website forms, connector conversations, CSV uploads, support attachments, or consent and outcome records.

Savings Scout does not request raw email bodies. Ordinary correspondence that you send directly to Copp Oak for consulting or support is different from importing an email inbox into Savings Scout.

The utility account or service-point number needed for an energy quote or enrollment you request is not a prohibited account number, but provide it only at the step that asks for it.

Where payment functionality is enabled, payment details are entered through the designated payment provider's interface. We receive only the payment information identified in the applicable Service Schedule, not complete card details or card security codes.

Where a financial-data or business-system connection is enabled, authentication occurs through the approved connection process. The selected credential-custody arrangement is described in the Connector Addendum. Connecting an account does not authorize you to paste secrets into an AI conversation.

A provider may collect information directly under its own notice to establish an account, authenticate you, or meet its legal obligations. That does not mean Copp Oak receives that information.

We do not intentionally collect restricted information through an unsupported feature. When we discover that it has been submitted inadvertently, we will restrict access and delete, redact, or otherwise handle it as required by law and our applicable contractual obligations.

A feature requiring sensitive information not covered by this Notice will not be enabled without the necessary additional notice, legal assessment, permissions, and safeguards.

5. How we use information

We use personal information to:

Provide the requested service. This includes consulting, organizing authorized data, producing analyses and drafts, presenting proposals, returning connector results, and carrying out specifically confirmed transactions through enabled features.

Manage authorizations and records. We record relevant permissions, approvals, rejections, receipts, and statuses; apply service limits; prevent duplicate execution; and distinguish estimates from reported or independently supported outcomes.

Support bookings, payments, and legitimate fee reconciliation. Where enabled, we use the minimum necessary appointment, job, invoice, and payment information to administer the transaction and determine fees under the applicable agreement.

Communicate with you. We respond to inquiries and send requested results, service notices, transaction confirmations, and administrative communications. If you give us or an Operator a phone number for an appointment or request, you agree to receive calls and texts at that number about that appointment or request, such as confirmations, reminders, and status updates, from Copp Oak or the Operator, which may be sent using automated technology. We send information about our own services only to people who have asked for it or where otherwise permitted by law, and you may unsubscribe using the method in each message.

Protect the service and comply with obligations. We investigate misuse, secure systems, resolve disputes, maintain required business records, and comply with applicable law.

We do not use personal information for targeted advertising, cross-context behavioral advertising, or profiling to make decisions producing legal or similarly significant effects, such as credit, insurance, employment, housing, or healthcare eligibility.

Analysis you request of your own spending or booking requirements is part of providing that service. It is not an authorization to build an advertising profile or infer sensitive characteristics.

AI training. We do not use your financial information, consulting materials, booking details, or private connector content to train or fine-tune any AI model, ours or anyone else's. We may use de-identified, aggregated statistics (for example, typical prices for a software category) to measure and improve our services. We require model providers that process information for us to agree not to use it to train their models. The independent AI platform you choose is governed by its own terms and privacy practices; this Notice does not control that platform's independent processing.

6. How we disclose information

We disclose personal information only for the purposes described below and subject to applicable restrictions.

Providers working for us. We use hosting and delivery, security, support tooling, payment processing, scheduling, and integration brokering where enabled. These providers receive the information needed for their assigned work and are subject to appropriate contractual restrictions. Our current provider schedule is available at https://coppoak.com/legal/subprocessors.

Business customers. When we provide a service for an organization, we disclose customer-controlled information to that organization and its authorized administrators as described in the applicable service.

Providers or operators you select. Before we transmit personal information to a provider for a referral, enrollment preparation, appointment, or other proposed transaction, we identify the recipient, purpose, and relevant information and request the applicable approval. We do not distribute your request to an undisclosed group of providers.

To show you prices before you choose, we may send Providers non-identifying parameters such as ZIP code, usage amounts, plan type, or seat counts, without your name or contact details.

Connected services and your AI platform. We exchange the information needed for the connection and return requested results to the interface you use, within the permissions you grant. The connection process and relevant addendum explain these exchanges.

Professional advisers and necessary legal recipients. We may disclose information to advisers bound by appropriate confidentiality duties and when reasonably necessary to comply with law or legal process, investigate fraud or security incidents, protect rights or safety, or establish, exercise, or defend legal claims. Where notice is legally permitted and appropriate, we will provide it.

Business transfers. In a financing, merger, acquisition, restructuring, or transfer of relevant business assets, information may be disclosed subject to appropriate confidentiality and use restrictions. A successor must continue to protect the information consistently with this Notice unless a change is otherwise lawfully permitted.

Routine processing by providers necessary to deliver a service you request is distinct from sending your information to a proposed commercial recipient. The latter requires the applicable proposal or transaction approval. Disclosures required by law or reasonably necessary for security are not conditioned on obtaining advance approval that would prevent us from meeting those obligations.

7. Our no-sale and no-advertising position

We do not sell personal information or share it for cross-context behavioral advertising, as those terms are defined by applicable U.S. privacy laws. We do not disclose personal information to data brokers or advertisers for their independent advertising or profiling purposes.

How we make money. Providers and Operators may pay us when you choose to proceed with them, for example a referral fee when you enroll with a supplier, or a fee when an appointment you booked takes place. We send your information to a Provider or Operator only when you direct us to, by approving a specific Proposal that names the recipient and the information to be shared. These are disclosures you direct, not sales of your information. Recipients may use your information only to respond to your request, provide the product or service you chose, and meet their legal obligations, and not to sell it or use it for unrelated marketing. Each Proposal tells you whether we will be paid if you proceed and who pays us.

We do not require you to agree to a sale of personal information or targeted advertising to use a free savings connector. Declining a proposal does not itself create a fee or prevent you from considering other proposals.

8. Cookies, similar technologies, and embedded services

We currently use no optional cookies, analytics, advertising pixels, cross-site tracking, or session-replay tools. If that changes, we will update our Cookie/Analytics Module and this Notice before the change takes effect and offer the choices the law requires.

The applicable Cookie/Analytics Module forms part of this Notice.

In the OFF configuration, we do not use optional analytics, advertising pixels, cross-site tracking, or session-replay tools. Necessary hosting, security, session, and preference functions may still process the technical information identified in this Notice.

An embedded booking, authentication, or payment service may process information when you activate or interact with it. We identify the relevant service and applicable choices before enabling a new, nonessential data flow.

9. How long we retain information

We keep personal information only for the purposes described in this Notice and for the periods selected below. We consider the sensitivity of the information, the service requested, applicable law, and restrictions imposed by the source of the information.

• Optimizer sandbox session records: Process-local records expire within one hour of session creation and are not retained across process restarts. This rule applies to the session store, not automatically to separate hosting, security, or support records.
• Production raw uploads and source payloads: deleted from active systems after processing and in all events within 24 hours, or sooner if a source provider requires. We do not write their contents to technical logs. Any copy captured in a system backup is removed in the normal backup cycle described below.
• Normalized production spend records and working proposals: while the connection is active plus 30 days.
• Authorization and consent records (the confirmation summary shown, your approval or rejection, how and when it was given, and the resulting status): 5 years from the action, because these records prove what you authorized. We keep only these minimal fields for that period, and we may decline to delete them while they are needed to document authorization, comply with law, or establish or defend legal claims.
• Working proposals and customer-reported outcomes: up to 24 months, subject to valid deletion requests.
• Operational appointment and job details: 90 days after completion or cancellation. The minimum fields needed to calculate, reconcile, and support fees (booking and referral identifiers, appointment date, attended status, collected amount, and fee) are kept as billing records for 7 years.
• Minimal contractual, billing, tax, and reconciliation records: 7 years from the relevant transaction or end of the engagement, only to the extent reasonably necessary and lawfully permitted. This does not authorize retaining complete connected-system records for that period.
• Consulting work files: the engagement term plus 90 days, with any necessary final deliverable or contract archive retained for 7 years for the executed contract record.
• Support correspondence: 24 months after resolution.
• Routine technical logs: 90 days.
• Security-incident records: 24 months after resolution, unless a specific legal preservation obligation applies.
• Privacy-request records: 24 months, limited to information needed to document and implement the request.
• Backup copies: Removed through the normal backup cycle within 30 days, subject to a specific lawful preservation requirement. Deleted information in backups is not used for ordinary business purposes.

We may retain a limited record longer when required by law or reasonably necessary to resolve an identified dispute, investigate an incident, prevent deletion requests from being inadvertently reversed, or establish or defend a legal claim. We restrict that record to the purpose justifying retention and do not use the exception to retain an entire dataset indefinitely.

Source-provider restrictions continue to apply. Transforming information into a hash, summary, or derived record does not automatically remove those restrictions.

Disconnecting an integration stops future access through that connection, subject to technical processing already in progress. It does not necessarily delete previously received information or records held independently by the source provider. You may separately request deletion.

10. Security

We maintain administrative, technical, and organizational safeguards appropriate to the nature of the information and the services we provide.

Our safeguards include limiting access to people and systems that need it, multi-factor authentication on administrative accounts, encryption in transit, encryption at rest provided by our hosting providers, separation of customer sessions and data, keeping secrets out of chat and logs, removing credentials and account numbers from logs, monitoring for security events, applying security updates, and following a written incident-response plan.

No system can be guaranteed completely secure. This does not limit our obligation to maintain appropriate safeguards or provide notices required by applicable breach-notification laws.

Report a suspected security issue to ben@coppoak.com. Do not include passwords, access tokens, full account numbers, or other secrets in the report.

11. Your privacy rights and choices

We offer individuals in the United States a baseline ability to request access to, correction of, and deletion of personal information we control, subject to applicable exceptions. Additional rights may apply under the laws of Virginia, California, or another state.

Depending on applicable law and the processing involved, you may request:

Access and information. Confirmation whether we process your information; access to that information; and information about relevant categories, sources, purposes, recipients, and disclosures. Where required, this includes identification of specific third-party recipients.

Correction. Correction of inaccurate information, taking into account its nature and use.

Deletion. Deletion of information we hold about you, subject to lawful exceptions.

Portability. A copy in a reasonably usable format, and transfer to another controller where required and technically feasible.

Opt-outs and sensitive-information controls. Opting out of sale, targeted advertising, cross-context behavioral advertising, or qualifying significant-decision profiling; withdrawal of consent; and limits on, or other choices concerning, sensitive information where applicable. Our current no-sale and no-targeted-advertising practices are described above.

Review and appeal. An explanation and appeal when we decline a request, and any additional review or contest rights required for regulated automated decision-making. We do not currently use our services to make the eligibility decisions identified in Section 5.

These rights concern personal information about individuals. They do not automatically authorize disclosure of another person's information or an organization's confidential records.

How to submit a request

Email privacy@coppoak.com with the subject line "Privacy Request."

Specify the service involved and the right you wish to exercise. You do not need to create an account.

We use reasonable methods to verify requests that require authentication, using information proportionate to the request and already available where possible. We do not ask for bank passwords, one-time passcodes, full account numbers, or complete government-identification documents through the request channel.

Opt-out requests and recognized opt-out preference signals are not subjected to identity-verification requirements that applicable law prohibits.

An authorized representative may submit a request where permitted by law. We may request appropriate evidence of authority and, where permitted, confirmation from you. An AI-generated assertion of authority alone is not sufficient, but you may use an accessible AI interface to communicate a valid request or authorization.

Timing and appeals

We acknowledge requests within ten business days where required and respond to access, correction, deletion, and portability requests within 45 calendar days, or sooner where applicable law requires. We may extend a response period only as permitted by law and will explain the reason and additional period.

We implement opt-out and consent-withdrawal requests within the applicable legal deadline, which may be shorter than 45 days.

To appeal a decision, reply to our response with "Privacy Appeal" or contact ben@coppoak.com. We respond to appeals within 45 calendar days, or sooner where required. When an appeal is denied, we explain the decision and provide the applicable method for contacting your state attorney general or other relevant regulator.

We do not charge for requests unless a charge is permitted by law, and we explain any permitted charge in advance. We do not unlawfully discriminate against you for exercising privacy rights. A request to delete or stop processing information necessary for a feature may make that feature unavailable; we will explain that consequence rather than impose a penalty.

Opt-out preference signals

We honor legally recognized opt-out preference signals, including Global Privacy Control where applicable. Because we do not sell information or use it for targeted advertising, there may be no such processing to stop. The Cookie/Analytics Module explains any additional treatment of those signals.

California category disclosures

The applicable rows in Section 3 identify the personal-information categories we collect, including identifiers, commercial information, internet or network activity, professional information, submitted communications, and service-related inferences.

Section 6 identifies the categories of recipients for business-purpose disclosures, and Section 9 identifies retention periods or criteria.

We do not knowingly sell or share the personal information of individuals under 16. We do not use sensitive personal information to infer characteristics about individuals or for purposes that require offering a right to limit under applicable law. Any materially different practice requires an updated notice and the applicable controls before it begins.

12. Children

Our services are intended for adults who are at least 18 and legally able to enter the relevant agreement. They are not directed to children.

We do not knowingly collect personal information from children under 13 through our services. Do not submit a child's personal information through a feature that is not designed and authorized to receive it. Contact ben@coppoak.com if you believe a child has provided information so we can investigate and take appropriate action.

13. Processing locations

We are based in Virginia and store information primarily in the United States. Some service providers, including AI model providers, may process information in other countries. Where they do, we require the safeguards the law requires.

14. Changes to this Notice

We update this Notice when our practices change. The revised Notice will identify its effective date.

For a material change, we provide appropriate advance notice through website notice and, where we have your email for the affected service, by email, except where an immediate change is required by law or necessary for security. We obtain additional consent where required before using information for a materially different purpose.

Posting a revised Notice does not itself supply consent that applicable law requires us to obtain separately.

15. Contact us

Copp Oak LLC, a Virginia limited liability company doing business as Copp Oak Advisors Attn: Privacy c/o Republic Registered Agent LLC, 2807 N Parham Rd Ste 320, Henrico, VA 23294 Email: ben@coppoak.com Privacy requests: privacy@coppoak.com (subject line "Privacy Request"; no account or form required)