Privacy Policy.

• Residents who access or interact with content from one or more Customers using the Platform,
• Authorized Users designated by a Customer to manage or publish content,
• Visitors to Peny’s public website.

For purposes of this Policy, a “Customer” is a local government entity (such as a city, county, or other governing body) that subscribes to the Platform and manages its own account and Authorized Users.

“Authorized Users” are individuals designated by the Customer to manage or publish content on its behalf, such as employees, elected officials, or contractors.

This Policy does not apply to third-party websites, tools, or services linked to or accessed through the Platform. Peny is not responsible for the privacy practices of such third parties.

This Policy also applies to content submitted by individuals through the Platform (“Resident Submissions”), such as questions, comments, forms, or public feedback (whether or not directed to a specific local government).

We may collect the following categories of information, depending on your role and how you use the Platform:

• Account and Contact Information: For Authorized Users and Customers, we may collect name, email address, phone number, job title, organization, and similar information provided during account setup or platform use. For Residents, we may collect name, email address, city, or other contact details only if voluntarily provided when submitting a question, comment, event, or other content through the Platform.
• Resident Submissions: Messages, forms, event suggestions, questions, or other content submitted by Residents through the Platform, including those directed to one or more Customers.
• Usage Data: Device type, IP address, browser type, operating system, and pages or features accessed. This includes logs, timestamps, and interaction data.
• Location Data: We may collect approximate location data based on IP address to help improve service functionality. If Residents or Authorized Users grant permission through their device settings, we may also collect precise, real-time geolocation data, such as GPS coordinates, to support location-based features (e.g., submitting a service request tied to a specific location). This location data is collected only with user consent and is used solely for the purpose of delivering or improving relevant services.
• Cookies and Tracking Technologies: See Section 7 for more information.

We do not knowingly collect information from individuals under the age of 13 without verifiable parental consent.

We use the information we collect for the following purposes:

• To provide, maintain, and improve the Platform and related services,
• To deliver notifications, confirmations, or responses related to submitted content,
• To communicate with Customers and Authorized Users,
• To respond to questions or feedback submitted by Residents,
• To analyze usage trends and improve system performance,
• To comply with legal obligations, including those related to public records or accessibility,
• To detect and prevent fraud, abuse, or technical issues.
• To support advertising features that allow local businesses to target general audiences based on anonymized or user-provided preferences (e.g., location or interests). We do not share names, email addresses, or physical addresses with advertisers.

We do not sell personal information.

AI-Generated Responses.

Some Platform responses may be generated by an AI assistant using content supplied or authorized by Customers. These responses are intended to improve public access to information but are provided solely for general informational purposes. They may be incomplete, outdated, or inaccurate depending on the available content and AI behavior.Peny does not independently verify the accuracy of AI-generated responses and disclaims any liability for reliance on them. Where applicable, Peny may display labels or visual cues to help users identify AI-generated content.

Residents are encouraged to verify critical or time-sensitive information by contacting the relevant city directly. Peny does not provide legal, financial, emergency, or official advice through automated tools.

We may share personal information in the following limited circumstances:

• With the applicable Customer: Resident Submissions may be visible to one or more Customers, depending on the nature and routing of the submission. Peny facilitates these interactions but does not control how each Customer may use, retain, or disclose such content.
• With service providers: We may share information with trusted third-party vendors who help us operate or improve the Platform (e.g., cloud hosting, analytics, customer support, security). These providers are contractually required to use personal data only as necessary to deliver services on Peny’s behalf.
• With local advertisers (non-personalized): We may allow local businesses to display promotional content on the Platform. Promotional targeting may use anonymized or user-provided attributes such as location, interests, or device type to identify general audience segments. We do not share your name, email address, or physical address with advertisers unless you explicitly opt in.
• For legal compliance: We may disclose information if required by law, regulation, subpoena, or valid governmental request.
• To protect rights and safety: We may share information to detect, investigate, or prevent security issues, fraud, or abuse, and to enforce our legal rights.

We do not sell personal information or share data with data brokers. Users will never receive unsolicited contact from advertisers via Peny unless they have explicitly agreed to such communications.

Access by Customers and Peny.

Resident submissions are generally visible to the Customer(s) they are directed to but are stored and managed within Peny’s shared platform environment. Peny retains access to all such content to operate the Platform and support Resident-Customer interactions. Peny may provide secure access to Resident submissions for Customers, but may also view or process Resident content directly where needed to support platform functions, enforce policies, or respond to user support or legal requests.

Peny does not use Resident content for unrelated purposes. Access is limited to authorized personnel, logged for accountability, and governed by internal controls and procedures.

Platform Insights and Aggregated Usage.

Peny may collect and analyze usage patterns, feature interactions, and anonymized or aggregated data across the Platform to improve service quality, enhance user experience, and better understand how Residents and Customers engage with the Platform. This may include submission frequency, feature usage trends, or general engagement metrics, but not information that identifies individual users.

We may also provide aggregate engagement reports to Customers to help them understand patterns of community interaction. These reports do not include personal information unless explicitly requested by the Customer and permitted under applicable law.

We retain personal information only as long as necessary to fulfill the purposes described in this Policy or to comply with applicable law.

• Retention: Data submitted through the Platform may be retained until deleted by the Resident, by Peny, or at the request of a Customer if the content falls under their domain. Certain submissions may also be retained to comply with records laws or internal system policies.
• Deletion: Residents or Customers may request deletion of certain content, subject to any legal, regulatory, or contractual obligations.
• Security: We use industry-standard safeguards, including encryption, access controls, and system monitoring, to protect data in transit and at rest.

While we strive to protect your data, no system can be guaranteed 100% secure. We encourage Customers and users to follow strong security practices, including safeguarding account credentials.

Resident Submissions and Control.

When you submit content through the Platform (such as questions, comments, or suggestions), your submission is hosted by Peny and may be shared with one or more Customers. These Resident Submissions are stored within Peny’s shared infrastructure and remain under Peny’s technical control unless and until they are formally incorporated into a city’s internal records (for example, converted into a work ticket or exported into another system). At that point, they become Customer Data and are governed by the applicable city’s retention, compliance, and public access rules.

Peny retains technical control over all Resident Submissions to ensure the Platform operates effectively and securely. While local governments may access or manage submissions directed to them, Peny may also access this content to maintain system functionality, enforce policies, support users, or comply with legal obligations.

Submissions are stored in a shared Platform environment and are not isolated per Customer. Peny does not use Resident content for unrelated purposes. Access is limited to authorized personnel, logged for accountability, and governed by internal controls and procedures.

If you wish to access, modify, or delete a submission, you may contact Peny directly or the Customer involved, if applicable. Peny will coordinate with the relevant party as needed. Resident requests to delete or correct a submission will be honored only to the extent legally permitted. Peny may be unable to delete content that has already been accessed, exported, or archived by a Customer subject to public records or legal retention obligations. While Peny will coordinate with the applicable Customer when appropriate, it cannot override legal requirements or Customer-controlled data policies.

Resident-submitted content remains hosted and controlled by Peny unless and until it is formally adopted into a Customer’s internal records (for example, when a city converts a submission into a service ticket or exports conversation transcripts). At that point, the resulting record becomes Customer Data, governed by the local government’s own compliance, retention, and public access rules. However, the original Resident Submission remains separate and under Peny’s technical control within the shared Platform.

• Public Records Requests: Some Resident content may be accessed or retained by Customers and may be subject to public records laws under their jurisdiction. Peny does not make legal determinations about what qualifies as a public record and is not responsible for compliance with such laws on behalf of any Customer. Peny is not a system of record or legal compliance service and does not guarantee the preservation, accessibility, or discoverability of content unless otherwise agreed or required by law. Customers are solely responsible for determining whether supplemental records systems or compliance tools are necessary to meet their obligations.
• User Requests: You may request access, correction, or deletion of your personal information. Requests should be submitted to the applicable Customer, which is the data controller.
• Customer Responsibilities: Customers are responsible for complying with applicable laws related to public records, privacy, and accessibility, including how data is collected, published, or archived on the Platform.

We will cooperate with Customers in good faith to assist with data-related requests or legal compliance.

If Peny receives a subpoena, court order, or other legal process seeking access to personal information, Customer Data, or Resident Submissions, Peny will notify the relevant Customer (unless prohibited by law) and provide a reasonable opportunity to object or seek protective relief before disclosure. Peny may charge reasonable fees for administrative costs incurred in responding to such requests.

We use cookies and similar technologies to improve your experience, understand how the Platform is used, and support optional features such as local promotions.

• Cookies: These are small text files stored on your device. They help remember your preferences, keep you signed in, improve navigation, and maintain session continuity across the Platform.
• Analytics: We use tools like Google Analytics to gather de-identified, aggregated data about how users interact with the Platform (e.g., which pages are visited, time spent, and navigation flows). These tools may use cookies or similar tracking methods.
• Promotions: In the future, we may use cookies to group users into non-identifiable segments (e.g., based on general location, behavior, or preferences) for relevant local promotions. These cookies will not include personally identifiable information such as names, email addresses, or physical addresses. You will not receive marketing messages or solicitations unless you opt in.

You can modify your browser settings to block or delete cookies at any time. Disabling cookies may affect certain features or functions of the Platform.

We do not use cookies to track you across unrelated websites, and we do not work with third-party ad networks.

We may update this Policy from time to time to reflect legal, technical, or operational changes. If we make material changes, we will provide notice via the Platform, by email, or other appropriate means.

Your continued use of the Platform after a Policy update constitutes your acceptance of the revised version. We encourage you to review this Policy periodically.

For questions or concerns about this Policy or our data practices, contact us at:

Peny, LLC‍

2326 Washington Boulevard, Ogden, UT 84401

privacy@penyapp.com

v.PP20250801