Privacy Policy

Effective Date: June 1, 2026 - Last Updated August 16, 2026

This Privacy Policy describes how Bold Intermedia LLC (d/b/a ProcessPath, “ProcessPath”, “we”, “our” or “us”) collects, stores, uses, and discloses personal information in connection with our Services.ProcessPath provides a simple, cloud-based task and ticket tracking platform (the “Platform”) designed for growing teams. Our Platform enables users to create, assign, route, track, and manage tasks and workflows through tickets, checklists, real-time updates, notifications, and related features, offered via our website (processpath.io), web application, and future mobile or API access (collectively, the “Services”).We process personal information in the following primary capacities:(i) Customer Data: Personal information that we collect, process, and manage on behalf of our business customers (“Customers”), submitted to the Platform by Customers and their authorized users (including tickets, checklists, comments, assignments, status updates, and other content created within workspaces). We process such Customer Data on behalf and under the instructions of the respective Customer in our capacity as a “data processor” (or “service provider” under applicable U.S. privacy laws). For more information, please refer to Section 9 below.This Privacy Policy describes ProcessPath’s independent privacy and data processing practices as a “data controller” (or “business”) with respect to the Platform, our website, and other Services we provide directly. It does not apply to the processing of Customer Data. If you have questions or requests regarding Customer Data, please contact your Account Administrator(s) (“Account Admin”) directly.(ii) User Data: Personal information concerning our Customers’ Account Admins, authorized users of the Platform (including team members and invited external collaborators such as vendors or contractors), billing contacts, and other individuals who directly engage with ProcessPath concerning their account.(iii) Prospect Data: Data relating to visitors of our websites (including processpath.io and waitlist.processpath.io), participants in our waitlist or beta programs, individuals who attend or express interest in our events or communications, and other prospective customers or users (“Prospects”) who interact with our marketing, content, emails, or communications.This Privacy Policy describes our practices regarding:

- Data Collection & Processing
- How We Use Personal Information
- Data Location and Retention
- Data Disclosures
- Cookies and Tracking Technologies
- Communications
- Data Security
- Your Privacy Rights
- Data Controller/Processor
- Additional Notices

If you are a Customer, User, or Prospect, please read this Privacy Policy carefully and make sure that you fully understand it.You are not legally required to provide us with any of your personal information, and may do so (or avoid doing so) at your own free will. If you prefer not to provide us with your personal information, or to have it processed by us or our service providers, please refrain from visiting or interacting with our Sites or using our Services.You may also choose not to provide us with “optional” personal information (i.e., fields not marked as required on forms), but please keep in mind that without it we may not be able to provide you with the full range of our Services or the best experience.Any capitalized but undefined term in this Privacy Policy shall have the meaning given to it in our Terms of Service (“Terms”).1. Data Collection & ProcessingWhen we use the term “personal information” in this Privacy Policy, we mean information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, to an individual. It does not include aggregated, anonymized, or de-identified information that is maintained in a form that is not reasonably capable of being associated with or linked to an individual.We collect or generate the following categories of personal information in relation to the Services:Usage and device information concerning our Users and Prospects: Connectivity, technical, and usage data, such as IP addresses and approximate general locations derived from such IP addresses, device and application data (type, operating system, browser version, language settings), user-customized IDs (where personal information is included), activity logs, cookies and similar tracking technologies, and recorded activity (sessions, clicks, feature usage, ticket creations, assignments, status changes, checklist completions, and other interactions) on our Platform and Sites.We collect and generate this information automatically, including through analytics tools (including cookies and pixels). This helps us understand how often Prospects or Users visit or use the Sites and Platform, which pages or features they engage with, how they arrived (e.g., via referral, ad, or email), and how they interact with tickets, workflows, and other functionality.Contact and profile information concerning our Customers, Users, and Prospects: Name, email address (primary for account creation and password-less authentication via magic links or similar), phone number (if provided), position or role, workplace or organization, profile picture (if added), authentication information, contractual and billing details (for paid plans), and any other information submitted when signing up, logging in, creating or updating a User Profile or workspace, inviting team members or external collaborators, or joining our waitlist or beta programs.We collect this information directly from you, from your employer or organization (our Customer), from other Users or colleagues on the same account, or through tools commonly used for professional connections and lead generation.Communications with our Customers, Users, and Prospects: Personal information contained in forms, inquiries, support requests (including ticket-related support), interactions via email or other channels, registrations for events or webinars we may host or sponsor in the future, participation in surveys, feedback, or testimonials; expressed preferences or needs relevant to our engagement; and any recordings, transcripts, or documentation from support interactions (if applicable and with notice).For purposes of the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA), in the last twelve (12) months we have collected the following categories of Personal Information: Identifiers; Professional or Employment-Related Information; Internet or Other Electronic Network Activity Information; Customer Records Information; Geolocation Information (approximate); and Inferences drawn from the above. We do not collect or use sensitive personal information as defined under the CCPA/CPRA for purposes that would require additional disclosures or opt-in consent.2. How We Use Personal InformationWe use personal information for the following purposes. Where applicable under U.S. privacy laws (including the CCPA/CPRA), our legal bases or justifications for processing include: performing or fulfilling our contracts with you or our Customers; your consent (where required, such as for certain marketing or optional features); our legitimate business interests (such as improving the Services, ensuring security, understanding usage patterns, growing our business through marketing, and protecting against fraud); and compliance with legal obligations.Customer and User personal information

- To facilitate, operate, enhance, secure, and provide our Services, including ticket creation, assignment, routing, real-time updates, notifications, workflows, checklists, and collaboration features (contractual necessity / legitimate interests);
- To invoice, process payments, and manage subscriptions for paid plans (contractual necessity / legitimate interests);
- To personalize and improve your experience on the Platform, including recognizing returning users, remembering preferences, and providing relevant features or recommendations (contractual necessity / legitimate interests).

Customer, User, and Prospect personal information

- To provide assistance, technical support, and customer service; to diagnose and resolve issues; and to train our staff (contractual necessity / legitimate interests);
- To understand how Users and Prospects interact with the Services (including ticket and workflow usage patterns), to analyze performance, identify improvements (such as bottleneck detection in higher-tier plans), and enhance the overall user experience and value of the Platform through basic usage analytics (legitimate interests);
- To create aggregated, statistical, anonymized, or de-identified data that we or others may use to improve Services, for business intelligence, or other lawful purposes (legitimate interests);
- To facilitate and optimize our marketing, advertising, and sales efforts, including delivering relevant messages about new features, best practices for task management, events, or special offers. This may include contextual or interest-based advertising based on usage data or Prospect interactions (legitimate interests; consent where required for certain channels or tracking);
- To contact you with important Services-related messages (e.g., account updates, billing, security alerts, ticket notifications) as well as promotional or informational messages that may interest you (contractual necessity / legitimate interests; consent for promotional where required);
- To support and enhance data security, prevent fraud, errors, unauthorized access, or illegal activity, and protect the integrity of our Services and users (contractual necessity / legitimate interests; legal obligation);
- To explore growth opportunities, including potential partnerships, resellers, or integrations that help us deliver better experiences to Customers and Users (legitimate interests);
- To facilitate events, webinars, contests, promotions, or community activities we may offer (legitimate interests);
- To publish feedback or testimonials you voluntarily submit (with your permission where appropriate) on our Sites or marketing materials (legitimate interests; consent);
- To comply with our contractual, legal, and regulatory obligations, and to maintain records as required by law (legal obligation);
- For any other lawful purpose with your consent or as otherwise permitted.

With respect to personal data we obtain from Google OAuth API Scopes, used in our Google sign-in integration (“Integrated Google Services”), our use of such personal data and data aggregated, anonymized, or derived therefrom (“Restricted personal data”), is limited to the following purposes, in adherence with the Limited Use requirements as detailed in Google API Services Data Policy:

- Facilitating, operating, supporting, providing and improving user-facing features that are prominent in the Integrated Google Services (contractual necessity / legitimate interests);
- Troubleshooting or security purposes (such as investigating a bug or abuse), subject to prior consent where required (contractual necessity / legitimate interests);
- Compliance with applicable law and regulations (legal obligation);
- For our internal operations, provided that the Restricted personal data have been aggregated and anonymized (legitimate interests);
- Transfer to third parties solely to the extent necessary to provide or improve the Integrated Google Services, to comply with laws, or in connection with a change in control (contractual necessity / legitimate interests; legal obligation); or
- Otherwise in strict accordance with your affirmative agreement.

We do not use personal information for purposes that are incompatible with the above without providing additional notice or obtaining consent where required.3. Data Location and RetentionData Location: We and our authorized Service Providers maintain, store, and process Customer Data and User account data in the United States. We protect that information in accordance with this Privacy Policy, industry-standard security practices, and applicable U.S. privacy laws.The Services are offered only to customers and users located in the United States. We do not offer the Services in the European Economic Area, the United Kingdom, Switzerland, or other jurisdictions that require GDPR or similar cross-border transfer frameworks. ProcessPath is not GDPR-compliant. We do not provide GDPR data-subject rights, Standard Contractual Clauses, Binding Corporate Rules, or an EU/UK data processing addendum.Some advertising and analytics Service Providers we use (including Meta and Google) may receive limited technical and event data as described in Section 5, and may process that data on their own systems, which can be located outside the United States.Data Retention: We retain personal information for as long as reasonably necessary to:

- Provide and improve our Services and maintain our relationship with you or our Customers;
- Comply with legal, contractual, accounting, or tax obligations;
- Resolve disputes, enforce our agreements, or protect against fraud or other risks; and
- Fulfill the purposes described in this Privacy Policy.

To determine appropriate retention periods, we consider the nature and sensitivity of the information, the potential risk of harm from unauthorized use or disclosure, the purposes for which we process it, applicable legal requirements, and any data retention features offered in your specific subscription plan (for example, certain plans may include extended retention or Compliance Vault capabilities). All data is generally deleted 90 days after account cancellation, subject to any legal or contractual obligations.When personal information is no longer needed, we will delete it, anonymize it, or take other appropriate steps in accordance with our data retention practices. Customer Data is retained in accordance with our agreements with the Customer and their instructions. If you have questions about our retention practices, please contact us at [email protected].4. Data DisclosuresWe may disclose personal information in the following circumstances:Service Providers: We engage trusted third-party companies and individuals (“Service Providers”) to perform services on our behalf or to help us operate and improve the Services. These include Google Cloud (cloud hosting and infrastructure), Stripe (billing and payment processing), LogRocket (session recording and analytics), Mailgun (email delivery and transactional messaging, including password-less authentication and notifications), Google Analytics (website measurement on processpath.io), Meta Platforms, Inc. (Facebook/Instagram Pixel and Conversions API, used to measure and optimize ads we run for ProcessPath), along with other providers of content delivery networks (CDNs), data and cybersecurity services, fraud prevention, web and product analytics, support tools, marketing and lead generation services, customer relationship management (CRM) systems, and professional advisors (legal, accounting, compliance).Our Service Providers have access to personal information only as needed to perform their functions and are contractually obligated to protect it and use it only for the purposes we specify.Customers and other Users: Your personal information (including your User Profile, activity, and communications) may be disclosed to the Customer (your employer or organization) that owns the workspace or account you are part of, as well as to other authorized Users within that account or workspace. Account Admins have visibility into user activity, ticket assignments, and related data for administration, oversight, and support purposes. This includes situations where you interact with support on behalf of your team.Invited external collaborators (vendors, contractors, etc.) may have their basic profile and activity information visible to the inviting team. Any content you submit to shared workspaces (tickets, comments, checklists) is visible to authorized members of that workspace.Note that the Customer acts as the data controller for Customer Data and for much of the usage within their workspaces. ProcessPath is not responsible for how Customers or Account Admins further use, disclose, or monitor information within their accounts.Integrations and Application Providers: If you or your Account Admin enable future integrations, use our Tickets API (available in higher-tier plans), or connect with third-party services (such as email-to-ticket functionality), the relevant third-party provider may receive or exchange certain information necessary for the integration to function. We do not store passwords for third-party services. If you do not wish your data shared in connection with an integration, please contact your Account Admin or disable the integration.Feedback and Recommendations: If you submit public feedback, a review, or testimonial, we may display it on our Sites or in marketing materials (with appropriate attribution unless you request otherwise). If you invite others to use ProcessPath via email or link, we may use the contact details you provide to send the invitation on your behalf; your name and email may appear in that message.Community and Public Forums: If we offer public blogs, forums, or community features in the future, any information you post (including associated profile information) may be visible to others. Due to the public nature of such features, content may remain visible even after account changes. Contact us if you wish to request removal of your information from publicly accessible areas we control.Legal Compliance and Safety: We may disclose personal information if we believe in good faith it is necessary to: comply with applicable laws, regulations, legal process (subpoena, court order, etc.), or governmental requests; investigate, prevent, or take action regarding suspected illegal activity, fraud, security issues, or violations of our Terms; protect the rights, property, or safety of ProcessPath, our Users, Customers, or the public; or in connection with a change in control (merger, acquisition, or sale of substantially all assets). In the event of a change in control that materially affects your personal information, we will provide notice as appropriate.We may also disclose personal information with your explicit consent or after successfully rendering it non-personal and anonymous.For purposes of the CCPA/CPRA, in the past twelve (12) months we may have disclosed the categories of Personal Information listed in Section 1 to the types of third parties described above (primarily Service Providers, advertising and analytics partners, and Customers). We do not sell personal information for money. We use Meta advertising tools to measure and optimize ads we run for ProcessPath; those tools receive limited cookie and event data as described in Section 5. We do not sell your information to data brokers, and we do not allow unaffiliated third parties to use our Sites to advertise their own products to you.5. Cookies and Tracking TechnologiesOur Sites and Platform use cookies, anonymous identifiers, pixels, local storage, and similar technologies to operate securely and effectively, analyze performance and usage, remember preferences (such as theme or session state), authenticate users (password-less flows), and support marketing and analytics efforts.Google Analytics. Our marketing website (processpath.io) uses Google Analytics 4 to understand how visitors use the site (for example, pages viewed and which trial buttons are clicked). Google may set cookies such as _ga and related identifiers. Google’s use of this information is described in Google’s privacy policy.Meta (Facebook and Instagram) Pixel and Conversions API. Our marketing website uses the Meta Pixel. On each visit, the Pixel may set a first-party cookie named _fbp. If you arrive from a Facebook or Instagram ad, Meta may also set a fbc cookie (or we may receive an fbclid value in the page URL). These cookies and related identifiers help Meta recognize the browser and attribute ad activity.We use this information to measure and improve ProcessPath ads on Facebook and Instagram. Typical browser events include PageView on landing-page visits and, when the visit came from a Meta ad, InitiateCheckout when you click a trial or signup button. If you then create a company account and that signup is attributable to a Meta ad, we may also send a CompleteRegistration event to Meta from our servers (Meta’s Conversions API). We do this so we can tell which ads led to real signups. We do not send CompleteRegistration to Meta for signups that are not Meta-attributed.The Pixel and Conversions API may receive information such as cookie identifiers (fbp, _fbc), a click ID (fbclid), approximate technical data (such as IP address and browser type), and a hashed email used only for event matching. We do not use these tools to sell your information to third parties.You can limit advertising cookies through your browser settings and through Meta’s ad preferences (facebook.com/settings and accountscenter.facebook.com). Blocking cookies may affect how we measure ads, but it does not prevent you from using the Services.Essential cookies and technologies are necessary for core functionality like secure login sessions, ticket interactions, and preventing fraud. Analytics and performance cookies help us understand how features are used so we can improve the Platform. Marketing or advertising cookies (if used) help us measure campaign effectiveness and show relevant content.You can control cookies through your browser settings (most browsers allow you to block or delete cookies). Note that disabling certain cookies may affect the functionality or performance of the Platform (e.g., staying logged in or using certain features).We currently do not respond to “Do Not Track” browser signals in a special way, but you can use browser controls or opt-out tools provided by analytics providers where available. For more details on our specific use of cookies and tracking technologies, please refer to any Cookie Policy we publish or contact us directly.6. CommunicationsWe communicate with you via email, in-app notifications, and (where applicable) other channels.Services Communications: We send important messages necessary for the operation of your account and the Services, such as ticket updates and notifications, account security alerts, billing and subscription notices, password-less login links, critical Platform changes, and responses to your support requests. You generally cannot opt out of these transactional or service-related communications, as they are integral to using ProcessPath.Promotional Communications: We may send you information about new features, product updates, tips for effective task and workflow management, events, special offers, or other content we believe will be valuable to you as a User, Customer, or Prospect. You can opt out of promotional emails at any time by clicking the “unsubscribe” link in those messages, updating your notification preferences in your account settings (when available), or contacting us at [email protected] or [email protected].7. Data SecurityWe implement reasonable and appropriate technical, organizational, and physical security measures designed to protect personal information against unauthorized access, alteration, disclosure, or destruction. These include encryption in transit (HTTPS/TLS) and at rest where appropriate, access controls, secure authentication (password-less design reduces risks associated with stored credentials), monitoring, and regular security assessments.Our password-less authentication approach (primarily magic links or equivalent) is designed to minimize the risks associated with traditional password storage and management.While we take security seriously and follow industry best practices, no system is 100% secure. We cannot guarantee the absolute security of personal information. In the event of a data breach that poses a risk to your personal information, we will notify affected individuals and relevant authorities as required by applicable law.For more information about our security practices, please contact us or visit any Trust Center or security documentation we may publish.8. Your Privacy RightsWe respect your privacy rights under applicable U.S. state privacy laws. The rights available to you depend on your state of residence and the specifics of your interaction with us.California Residents (CCPA/CPRA)
If you are a California resident, you have the following rights (subject to certain exceptions and verification):

- Right to Know: Request disclosure of the categories and specific pieces of personal information we have collected about you in the preceding 12 months, the categories of sources, the business or commercial purposes for collecting or selling it (if applicable), and the categories of third parties to whom we disclosed it.
- Right to Delete: Request that we delete personal information we have collected from you, subject to exceptions (e.g., information necessary to complete a transaction, detect security incidents, comply with legal obligations, or exercise free speech).
- Right to Correct: Request correction of inaccurate personal information we maintain about you.
- Right to Opt-Out of Sale or Sharing: We do not sell your personal information. We do not share your personal information for cross-context behavioral advertising. Should our practices change, we will honor opt-out requests via a “Do Not Sell or Share My Personal Information” link or mechanism and update this Policy.
- Right to Limit Use and Disclosure of Sensitive Personal Information: We do not use or disclose sensitive personal information for purposes other than those permitted by law or with your consent where required.
- Right to Non-Discrimination: We will not discriminate against you for exercising any of these rights (e.g., by denying goods/services, charging different prices, or providing a different level or quality of services).

Other U.S. State Privacy Laws
Residents of states with comprehensive privacy laws (such as Virginia, Colorado, Connecticut, Utah, and others that may enact similar laws) may have comparable rights to access, delete, correct, opt-out of targeted advertising or profiling, and appeal decisions. We will honor applicable rights and provide reasonable methods to exercise them.How to Exercise Your Rights
To exercise your rights, please submit a request by emailing [email protected] or [email protected]. Please provide sufficient information for us to verify your identity and the nature of your request (we may ask you to confirm via email or log into your account). We will respond within the timeframes required by applicable law (typically 45 days, with possible extension).You may designate an authorized agent to submit requests on your behalf. For CCPA requests, the agent must provide written authorization or a power of attorney; we may still verify your identity directly.Requests related to Customer Data or activity within a specific workspace should be directed to your Account Admin or the Customer who controls that workspace, as ProcessPath processes such data as a service provider/processor on their behalf.We may retain certain information as needed to process your request, comply with legal obligations, or for legitimate internal purposes (e.g., records of how requests were handled).If you have concerns about how we handle your request, you may contact us to appeal or, where available under applicable state law, contact your state attorney general or relevant regulatory body.9. Data Controller / ProcessorU.S. privacy laws such as the CCPA/CPRA distinguish between “businesses” or “controllers” (who determine the purposes and means of processing personal information) and “service providers” or “processors” (who process personal information on behalf of a business/controller).

- ProcessPath (Bold Intermedia LLC) is the data controller (business) for User Data, Prospect Data, and personal information we collect and process for our own purposes (e.g., account management, Platform improvement, marketing, and security). We are responsible for the practices described in this Privacy Policy to the extent we act as controller.
- ProcessPath acts as a data processor (service provider) with respect to Customer Data — the information Customers and their Users submit to and generate within the Platform (tickets, workflows, comments, user assignments, etc.). We process this data only in accordance with the Customer’s instructions, our Terms, any applicable Data Processing Addendum or agreement, and applicable law. The Customer remains the controller (business) for such data and is responsible for providing appropriate notices, obtaining any required consents from their users or data subjects, and responding to data subject rights requests related to Customer Data.

Our Customers are solely responsible for determining how they use the Platform, ensuring that individuals whose information is processed through their workspaces have received proper notice and any required consents, and for complying with all applicable laws regarding the collection and use of that data.If you wish to exercise rights with respect to data processed on behalf of a Customer, please contact that Customer’s Account Admin directly.10. Additional NoticesUpdates and Amendments: We may update this Privacy Policy from time to time by posting a revised version on our website or within the Platform. The “Last Updated” date at the top will reflect the effective date of the current version. For material changes, we will provide prominent notice (e.g., email to affected users or in-app banner) as appropriate under the circumstances. Your continued use of the Services after changes become effective constitutes acceptance of the updated Policy.Accessibility: Upon request, we can make this Privacy Policy available in an accessible format. Please contact [email protected] for assistance.Geographic availability and GDPR. ProcessPath is offered only within the United States. If you are located outside the United States, please do not use the Sites or Services. We are not GDPR-compliant and do not represent that the Services meet the requirements of the GDPR, UK GDPR, or Swiss data-protection law. We do not appoint an EU or UK representative, and we do not offer GDPR-specific rights (such as data portability under Article 20 or restrictions on international transfers). Privacy rights described in this Policy are those available under applicable U.S. law.Third-Party Websites, Services, and Integrations: Our Services may contain links to third-party websites, or integrate with third-party services (e.g., email providers for inbound tickets, future APIs, payment processors, or analytics tools). These third parties have their own privacy policies and terms. We are not responsible for their practices. We encourage you to review the privacy policies of any third-party services you use in connection with ProcessPath.Children’s Privacy: Our Services are not directed to, and we do not knowingly collect personal information from, children under the age of 13 (or the applicable age of consent in your jurisdiction). We comply with the Children’s Online Privacy Protection Act (COPPA) and similar laws. If you believe we may have collected personal information from a child under 13, please contact us immediately at [email protected] so we can take appropriate action, including deletion of the information (except where retention is required by law).No Sale of Personal Information: As described throughout this Policy, we do not sell personal information as that term is defined under the CCPA/CPRA or similar state laws.Contact Us: If you have any questions, concerns, or complaints about this Privacy Policy or our privacy practices, or if you wish to exercise your privacy rights, please contact us at:[email protected]
or
[email protected]You may also reach us by mail at:
Bold Intermedia LLC
Attn: Privacy
13423 Blanco Rd #3210
San Antonio, TX 78250
United StatesWe will respond to inquiries as promptly as reasonably possible.Thank you for using ProcessPath. We are committed to protecting your privacy while helping teams work more effectively and with less stress.