1. Who We Are and What This Policy Covers

10spring ("10spring," "we," "us," "our") is a business-to-business marketing and revenue operations agency operated by 10spring LLC.

This Privacy Policy explains how we collect, use, disclose, and protect personal information in connection with:

• Our website at https://10spring.io and related domains we operate (the "Site");

• Our newsletters, research publications, and marketing communications;

• Any free tools we make publicly available (the "Free Tools"); and

• Our sales and business development activities.

This policy does not cover client data we process on behalf of our clients. When we operate marketing, analytics, or CRM systems on behalf of a client, we act as a service provider or processor under that client's instructions and under our written services agreement with them. The client's own privacy policy governs that data. See Section 8.

2. Information We Collect

2.1 Information you provide directly

• Contact and business information. Submitted through forms: name, business email address, company name, job title, phone number (optional), website URL.

• Qualification information. You choose to provide: company stage or size, approximate revenue or funding stage, current marketing budget range, services of interest, and a free-text description of your situation.

• Self-reported attribution. We ask every person who contacts us how they heard about us, and we retain your answer.

• Engagement communications. Emails, meeting notes, call recordings where you have been notified and, where required, have consented.

• Free Tool inputs. A domain name and the search prompts or queries you enter, plus an email address if you request a full report.

2.2 Information collected automatically

• Device and connection data. IP address, browser type and version, operating system, device type, language settings, referring URL.

• Usage data. Pages viewed, time on page, scroll depth, clicks, navigation paths, and forms started or completed.

• Campaign parameters. UTM values and similar tracking parameters appended to links you follow to reach the Site.

• Cookies and similar technologies. See Section 3.

2.3 Information from third parties

• Business data enrichment. We may supplement information you provide with publicly available or commercially available business information, such as company size, industry, funding stage, and technology stack, obtained from data providers.

• Company-level website identification. We may use services that identify the organization associated with a visitor's IP address. We do not use services that attempt to identify individual visitors by name or contact details without their knowledge.

• Partner and referral sources. If a partner, client, or contact refers you to us.

• Publicly available sources. Including your company website, public social profiles, and public filings.

3. Cookies, Analytics, and Tracking Technologies

We use the following categories of technology on the Site:

• Category: Strictly necessary; Purpose: Site delivery, security, form function; Examples: Hosting and CDN cookies, form anti-spam.

• Category: Analytics; Purpose: Understanding aggregate site usage; Examples:Google Analytics 4, Google Search Console.

• Category: Behavioral analytics; Purpose: Understanding how visitors interact with pages; Examples: Microsoft Clarity, Hotjar, Full Story.

• Category: Marketing and CRM; Purpose: Recognizing returning visitors, attributing inquiries, delivering and measuring advertising; Example:HubSpot tracking code, LinkedIn Insight Tag, Google Ads tags.

3.1 Your choices

You can set your browser to refuse cookies or alert you when cookies are being sent. Some parts of the Site may not function properly if you do.

We do not currently respond to Global Privacy Control (GPC) and similar browser-based opt-out preference signals.

4. How We Use Information

We use personal information to:

• Respond to inquiries and provide information you request;

• Evaluate whether our services are a fit for your organization and prepare proposals;

• Deliver our newsletter, research reports, and marketing communications you have opted into;

• Operate, secure, improve, and measure the performance of the Site and Free Tools;

• Understand which marketing channels and content generate qualified inquiries;

• Comply with legal obligations and enforce our agreements; and

• Create aggregated and de-identified statistics as described in Section 5.

We do not use personal information collected through the Site to make automated decisions producing legal or similarly significant effects.

5. Aggregated and De-Identified Data (Including Published Research)

We publish original research and industry benchmarks. This research may draw on aggregated, de-identified data derived from the Site, the Free Tools, and, where our client agreements expressly permit it, from client engagements.

Before any such data is used for research or benchmarking:

• It is aggregated across multiple organizations;

• Direct identifiers are removed;

• We do not attempt to re-identify it, and we contractually prohibit downstream recipients from doing so; and

• We do not publish figures that could reasonably identify a specific organization.

We will not publish a named client's results without that client's written permission.

6. How We Share Information

We do not sell personal information for money. See Section 9 for how state privacy laws define "sale" and "sharing" more broadly than money changing hands.

We share personal information with:

• Service providers and subprocessors who perform functions on our behalf, under contracts restricting their use of the information. Our current categories include: CRM and marketing automation (HubSpot), analytics and dashboards (Google, Databox), advertising platforms (LinkedIn, Google), email delivery, scheduling, cloud hosting and storage, document and e-signature services, payment processing (Stripe/Mercury), and AI service providers (see our AI Policy).

• Professional advisors: lawyers, accountants, insurers, under confidentiality obligations.

• Authorities, where required by law, subpoena, or to protect our rights, safety, or property.

• A successor entity, in connection with a merger, acquisition, financing, or sale of assets.

7. Advertising and Retargeting

We advertise on third-party platforms, including LinkedIn, Google, and other social media platforms. These platforms may place cookies or similar identifiers on your device so that we can show relevant content to people who have visited the Site, and so we can measure whether our advertising works. These platforms also use this data for their own purposes under their own privacy policies.

8. Client Data (Where We Act as a Service Provider)

In delivering services, we access and process personal information contained in our clients' systems. For example, contacts in a client's CRM, visitors to a client's website, or recipients of a client's campaigns.

For that information:

• Our client is the controller or business, and we act as the processor or service provider;

• We process it only per the client's documented instructions and our services agreement;

• We do not sell it, and we do not use it for our own purposes except as expressly permitted (see Section 5);

• We work within client-owned accounts wherever practicable, and the client retains ownership and administrative control;

• On termination, we return or delete client data and transfer administrative access per the services agreement; and

• Individuals whose information appears in a client's systems should direct privacy requests to that client. If we receive such a request directly, we will forward it to the relevant client.

9. Your Privacy Rights

As of 2026, twenty US states have comprehensive consumer privacy laws in effect. 10spring is located in Ohio, which does not currently have such a law; however, residents of states that do, including California, Colorado, Connecticut, Texas, Virginia, and others, may have rights under their state's law where it applies to us.

Depending on your location and applicable law, you may have the right to:

• Access the personal information we hold about you;

• Correct inaccurate personal information;

• Delete personal information;

• Obtain a portable copy of information you provided;

• Opt out of targeted advertising, of the sale or sharing of personal information, and of certain profiling; and

• Not be discriminated against for exercising these rights.

To make a request, email legal@10spring.io with the subject "Privacy Request." We will verify your identity before responding, generally by confirming control of the email address associated with the information, and will respond within the timeframe required by applicable law. You may designate an authorized agent where the law permits. If we deny your request, you may appeal by replying to our response; several state laws require us to provide an appeal mechanism.

10. Marketing Communications

We send email only to people who have requested information, subscribed, or engaged with us in a business context, and we honor unsubscribe requests promptly. Every marketing email includes an unsubscribe link and our physical mailing address, as required by the CAN-SPAM Act.

We do not send unsolicited cold outreach to purchased or scraped contact lists, and we do not sell lead lists.

You may unsubscribe at any time using the link in any email or by emailing legal@10spring.io. We may still send transactional or relationship messages, such as invoices or responses to your inquiries.

11. Data Retention

We retain personal information for as long as needed for the purposes described in this policy:

• Data: Inquiries that do not become clients; Retention: 12-36 months from last contact.

• Data: Newsletter subscribers; Retention: Until unsubscribe, then suppression-list only

• Data: Free Tool submissions; Retention: 12 months

• Data: Client engagement records; Retention: Term of engagement plus 7 years for tax, legal, and professional records.

• Data: Site analytics; Retention: Per platform defaults

• Data: Aggregated, de-identified data; Retention: Indefinitely

12. Security

We use administrative, technical, and physical safeguards appropriate to the sensitivity of the information, including access controls, multi-factor authentication on business systems, encryption in transit, least-privilege and read-only credentials for third-party integrations where feasible, and vendor review.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

13. International Transfers

We are based in the United States and process information here. If you access the Site from outside the United States, you understand that your information will be transferred to and processed in the United States, which may have different data protection rules than your jurisdiction.

14. Children

The Site and our services are directed to businesses and are not intended for anyone under 18. We do not knowingly collect personal information from children. If you believe a child has provided us with information, contact us, and we will delete it.

15. Third-Party Sites

The Site links to third-party websites and resources. We are not responsible for their privacy practices. Review their policies before providing information.

16. Changes to This Policy

We may update this policy. When we do, we will revise the "Last updated" date below and, for material changes, provide more prominent notice [e.g., a Site banner or email to subscribers]. Your continued use of the Site after changes take effect means you accept the updated policy.

17. Contact Us

10spring Email: legal@10spring.io

Last updated: 08/01/2026