California & U.S. State Privacy Supplement

1. Applicability and roles

This supplement forms part of the Privacy Policy. Depending on your state, Cove's role, the activity, applicable thresholds and exemptions, you may have the rights below. It does not state that every U.S. privacy law applies to Cove, every customer, or every record.

When Cove processes data for a business customer, that customer may be responsible for your request, and Cove assists as required by law and the applicable agreement. Separate duties can apply to a processor/service provider even where Cove does not meet a law's business/controller thresholds for its own activities.

2. Categories, sources, purposes, recipients, and retention

Depending on the workflow, categories may include identifiers and contact details; account/authentication information; commercial and billing information; internet/device and session activity; professional information; audio, messages and other communications; inferences such as AI summaries or lead scores; and customer-selected insurance, financial, health or other sensitive information.

Sources include you, business customers and their vendors, imported lists and spreadsheets, forms, communications participants, connected providers, automated website activity, and customer-directed professional/public sources. Purposes include CRM operations, communications, scheduling, AI, account/billing administration, support, security, consent evidence, analytics and customer-directed advertising attribution.

Recipients include authorized customer users and communication recipients, infrastructure/communications/AI/payment/email providers, connected platforms, analytics/advertising providers, advisers, and legally authorized recipients. The relevant category, recipient and use depend on the feature; not every recipient receives every category.

The Notice at Collection maps categories to purposes and recipients. Privacy Policy sections 2, 4, 5, 6, and 10 provide further details and retention criteria. The register identifies known providers and integrations.

3. California rights

If California law applies to the relevant processing, you may request to know the categories and specific pieces of personal information, sources, purposes and categories of recipients, including relevant disclosures, sales or sharing; access or obtain a portable copy; correct inaccurate information; and delete information subject to lawful exceptions.

Where applicable, you may opt out of sale or sharing for cross-context behavioral advertising and limit uses or disclosures of sensitive personal information beyond legally permitted purposes. These rights depend on the actual activity and statutory requirements. We will not unlawfully discriminate against you for exercising applicable rights.

Collected information can include health information or communication contents supplied by customers. The presence of sensitive information does not automatically mean that every use triggers a right to limit; the purpose, role and applicable exceptions matter.

4. Other U.S. state rights

Depending on your state and applicable law, you may have rights to confirm processing, access information, obtain a portable copy, correct inaccuracies, delete information, and opt out of sale, targeted advertising, or profiling used for decisions with legally or similarly significant effects. Certain sensitive-data processing may require consent or provide withdrawal or limitation rights.

Not all lead scoring or workflow recommendations are such consequential profiling. Cove does not represent that it makes insurance eligibility or underwriting decisions on your behalf. Customer decisions and uses of data require their own assessment.

Where an appeal right applies, reply to the denial or email legal@covecrm.com with the original request reference and the reason for your appeal. We will review and respond within the applicable legal period and provide information about further complaint options where required. You may also contact your state attorney general or privacy regulator.

5. Advertising choices and universal opt-out signals

Legal definitions of sale, sharing and targeted advertising can include disclosures without payment. Customer-directed integrations and provider arrangements must be assessed by purpose and contractual role, rather than assuming every transfer either is or is not a statutory sale or sharing.

You may email support@covecrm.com or legal@covecrm.com to request an applicable opt-out or sensitive-information limitation and identify the relevant activity. Email is a request channel, not an automatic browser-tracking switch. This page does not establish that an email-only method satisfies every law's technical requirements.

Where applicable law requires recognition of a qualifying universal opt-out signal, such as Global Privacy Control (GPC), that obligation remains applicable. Cove does not currently implement an automatic GPC response, a Your Privacy Choices control, or a tracking-preference center. The cookie banner does not block optional technologies. These limitations do not waive your rights or constitute a claim that all required mechanisms have been implemented.

6. Request process and authorized agents

Send requests to support@covecrm.com or legal@covecrm.com. Identify the right, the relevant account or business customer if known, and the information needed to locate your records. Do not include passwords or unnecessary sensitive documents.

We may use account information or other proportionate evidence to verify access, correction or deletion requests. We will not require verification where prohibited, including for applicable opt-outs. An agent may act with evidence of authority; direct verification or confirmation may be requested where permitted. A valid power of attorney is handled according to applicable law.

We will respond, explain permitted exceptions or denials, and notify you of any lawful extension within the applicable timeframes. Where information is held on a customer's behalf, we may direct the request to that customer or assist it. No charge will be imposed for exercising rights except as expressly permitted by law.