COVERITY.IO

PRIVACY POLICY

Effective Date: October 10, 2026
Last Updated: October 10, 2026

1. INTRODUCTION

This Privacy Policy (the “Policy”) describes the practices of [Full Legal Name of Coverity Operating Entity], doing business as Coverity.io (“Coverity,” “Company,” “we,” “us,” or “our”), with respect to the collection, receipt, access, use, processing, disclosure, retention, and protection of Personal Information in connection with the websites, software applications, platforms, products, and services operated or provided by Coverity (collectively, the “Services”).

This Policy applies to Coverity’s publicly accessible websites, customer and administrative portals, desktop and mobile applications, application programming interfaces, and integrated services, including its customer relationship management, transaction coordination, document management, electronic signature, notarial coordination, appointment scheduling, professional collaboration, communications, and workflow automation services.

This Policy applies to all persons who access or use the Services, including individual account holders, representatives of subscribing organizations, professional service providers, customers, transaction participants, document recipients, and visitors to Coverity-operated websites.

By using the Services, individuals acknowledge the privacy practices described herein. Where applicable law requires affirmative consent for particular processing activities, such consent shall be obtained separately. Use of the Services shall not, by itself, be construed as consent to processing for which applicable law requires a distinct affirmative authorization.

This Policy forms part of the disclosures applicable to the Services and should be read together with Coverity’s Terms of Service and any applicable commercial agreement, data processing agreement, or supplemental privacy notice.

2. DEFINITIONS

For purposes of this Policy:

“Personal Information” means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with an identified or identifiable individual, as defined under applicable law.

“Customer” means an individual or legal entity that maintains an account with Coverity or subscribes to the Services.

“Authorized User” means an individual permitted by a Customer or by Coverity to access or use specified Services.

“Customer Data” means information, documents, records, communications, and other content submitted to, generated within, or processed through the Services on behalf of a Customer.

“Connected Account” means an account maintained with a third-party provider, including Google or Microsoft, that a user or organization authorizes Coverity to access through a supported integration.

“Third-Party Provider” means an entity providing external account services, cloud infrastructure, communications, payment processing, document processing, identity verification, or other services used in connection with the Services.

“Processing” means any operation performed upon Personal Information, whether automated or otherwise, including collection, access, consultation, recording, organization, storage, alteration, transmission, retrieval, use, disclosure, restriction, or deletion.

3. CAPACITY AND RESPONSIBILITY FOR PROCESSING

3.1. Coverity processes certain Personal Information for its own business and operational purposes, including account administration, authentication, subscription management, customer support, service security, regulatory compliance, and the maintenance and improvement of the Services.

3.2. Where Coverity processes Customer Data on behalf of a Customer organization, that Customer generally determines the purposes for which such information is submitted and the individuals authorized to access it. In such circumstances, Coverity acts as a service provider or processor to the extent provided by applicable law and the governing agreement.

3.3. Customers are responsible for establishing the lawful basis for submitting Personal Information concerning third parties to the Services and for providing any notices or obtaining any consents required in connection with such submissions.

3.4. Coverity’s access to and processing of Customer Data shall remain subject to applicable contractual restrictions, authorization controls, and legal requirements. Nothing in this Policy shall be interpreted as granting Coverity or any user unrestricted access to Customer Data or to information belonging to another Customer.

4. CATEGORIES AND SOURCES OF PERSONAL INFORMATION

4.1. In connection with the Services, Coverity may collect and process the following categories of Personal Information:

(a) Identification and Contact Information: Names, addresses, telephone numbers, email addresses, employer or organizational affiliations, business contact details, and other identifying information.

(b) Account and Authentication Information: Account identifiers, authentication credentials or credential-derived information, account preferences, role assignments, access permissions, authentication records, and Connected Account identifiers.

(c) Professional Information: Professional affiliations, licensing information, notarial commission information, credentials, service qualifications, and geographic service areas.

(d) Transaction and Business Information: Information relating to real estate transactions, contractual engagements, professional matters, service requests, appointments, property addresses, transaction participants, deadlines, instructions, and workflow activity.

(e) Documents and Records: Contracts, disclosures, forms, correspondence, electronic records, identification materials, financial or legal documents, and other information submitted, generated, received, or processed through the Services.

(f) Electronic Signature Information: Signature representations, signer identities, consent records, document identifiers, timestamps, transaction histories, authentication evidence, and associated audit information.

(g) Communications Information: Message content, sender and recipient identities, email addresses, telephone numbers, transmission records, message identifiers, delivery status, and information associated with communications initiated or facilitated through the Services.

(h) Scheduling Information: Calendar entries, event details, appointment dates and times, locations, descriptions, attendee information, availability data, event identifiers, and synchronization information.

(i) Financial and Commercial Information: Subscription details, billing records, invoices, payment transaction identifiers, charges, credits, and related commercial records.

(j) Technical Information: Internet Protocol addresses, device characteristics, browser information, session identifiers, application versions, diagnostic records, access logs, security events, and service usage information.

(k) Sensitive Personal Information: Information included within authorized documents or transactions that may be classified as sensitive under applicable law, including certain financial, identification, or other confidential records.

4.2. Coverity may obtain such information directly from individuals, from Customers and their Authorized Users, from persons participating in transactions, from Connected Accounts, from service providers acting on behalf of Coverity or its Customers, and through the operation of the Services.

4.3. The categories of Personal Information actually processed in any particular instance depend on the Services selected, the functionality enabled, the permissions granted, and the information submitted by the relevant individual or Customer.

5. PURPOSES OF PROCESSING

5.1. Coverity processes Personal Information as reasonably necessary to perform, administer, secure, and maintain the Services, including to establish and manage accounts; authenticate users; administer subscriptions; facilitate customer relationship management; coordinate transactions and professional services; process documents and electronic signatures; schedule appointments; facilitate authorized communications; maintain audit records; provide technical support; investigate fraud or misuse; and comply with applicable legal obligations.

5.2. Coverity may process operational information to maintain service reliability, diagnose errors, evaluate performance, address security vulnerabilities, and develop or improve its products, subject to applicable law, contractual obligations, and any provider-specific restrictions described in this Policy.

5.3. Coverity shall not use Personal Information obtained through a Connected Account for an undisclosed purpose materially unrelated to the functionality for which access was authorized.

5.4. Coverity does not sell information obtained through Google or Microsoft account integrations and does not use connected mailbox contents or calendar information for cross-context behavioral advertising.

6. THIRD-PARTY ACCOUNT INTEGRATIONS

6.1. General Authorization

6.1.1. Certain Services permit users to connect accounts maintained with Third-Party Providers, including Google Workspace, Gmail, Google Calendar, Microsoft 365, Microsoft Outlook, and other supported services.

6.1.2. Access to a Connected Account is established through an authorization mechanism supported by the applicable provider, including OAuth 2.0 or Microsoft identity authorization services.

6.1.3. By authorizing a connection, the user or an authorized organizational administrator permits Coverity to access and process information within the scope of the permissions granted for the purpose of providing the enabled integration functionality.

6.1.4. Coverity does not require users to disclose their Google or Microsoft account passwords to establish an OAuth connection.

6.1.5. Third-Party Providers may issue access tokens, refresh tokens, or other authorization credentials. Such credentials are processed for the purpose of maintaining the authorized connection and performing operations permitted by the applicable authorization.

6.1.6. Authorization to connect one category of service, including electronic mail, does not independently authorize access to unrelated categories of information unless the applicable permissions separately permit such access.

6.2. Electronic Mail Integration

6.2.1. The Services permit Authorized Users to compose, initiate, schedule, and transmit electronic mail communications through their own Connected Accounts, where the relevant functionality is supported and enabled.

6.2.2. In performing such operations, Coverity may access or process the sender’s account identity, designated recipients, message subject, message body, attachments included in the outgoing communication, relevant message identifiers, and transmission or delivery information.

6.2.3. Communications transmitted through a Connected Account may include transaction notices, document requests, appointment confirmations, scheduling updates, business correspondence, workflow notifications, reminders, or other messages initiated or authorized by the user.

6.2.4. Coverity may submit such communications to the applicable Third-Party Provider for transmission through the user’s mailbox. The provider may store transmitted messages, including copies within the user’s Sent Items or equivalent folder, in accordance with the provider’s own operation and retention practices.

6.2.5. Coverity’s outbound electronic mail integration is not intended to provide generalized mailbox surveillance or unrestricted inspection of existing correspondence. The ability to transmit messages through a Connected Account does not, of itself, require Coverity to retrieve, index, analyze, or modify previously received messages.

6.2.6. Unless separately disclosed and authorized in connection with an additional feature, Coverity does not access existing mailbox contents for unrelated purposes, collect historical mailbox conversations, or modify or delete existing messages.

6.2.7. Records of communications generated or transmitted through the Services may be maintained within Coverity to the extent reasonably necessary to document workflow activity, establish delivery or transaction history, provide customer support, or satisfy applicable contractual or legal requirements.

6.3. Calendar Integration

6.3.1. Where enabled, the Services permit Authorized Users to connect calendars maintained with Google, Microsoft, or another supported provider for purposes of appointment scheduling, availability determination, transaction coordination, event synchronization, and related workflow functionality.

6.3.2. Such integration may require both read and write access to calendar information. Subject to the permissions granted by the user or organizational administrator, Coverity may retrieve existing calendar entries, examine event details, determine availability, create new events, modify existing events, synchronize changes, and cancel or delete events.

6.3.3. Calendar information accessible through an authorized integration may include event titles, descriptions, dates, times, recurrence information, locations, attendees, organizer information, availability status, event identifiers, and other information contained within the calendar records made accessible by the applicable authorization.

6.3.4. Coverity may read existing calendar entries to identify scheduling conflicts, determine availability, associate appointments with relevant transactions, or maintain synchronization between the Connected Account and the Services.

6.3.5. Coverity may create, update, or delete calendar events in response to an authorized user action, a change in an appointment or transaction managed through the Services, or an enabled synchronization rule.

6.3.6. A Connected Account’s calendar may contain information unrelated to a Coverity transaction. Such information may nevertheless be technically accessible within the scope of the permissions granted. Coverity shall restrict its use of that information to the scheduling, synchronization, and other authorized functionality for which the access is required.

6.3.7. Coverity does not sell calendar information, disclose it for unrelated advertising purposes, or use it to create behavioral or commercial profiles unrelated to the Services.

6.3.8. Changes made through Coverity to a Connected Account’s calendar may be reflected in the original calendar and in other applications or devices synchronized with that account. Cancellation or modification of an event may also result in notifications being transmitted to event attendees by the applicable calendar provider.

6.4. Organizational Accounts

6.4.1. Where a Connected Account is managed by an employer or other organization, the availability and scope of an integration may be subject to that organization’s administrative permissions, security policies, and authorization decisions.

6.4.2. A user or organization may revoke or restrict permissions through the applicable provider’s account or administrative controls.

6.4.3. Coverity shall not interpret a grant of delegated account access as authorization to disregard applicable tenant restrictions, organizational permissions, or contractual limitations.

7. GOOGLE API SERVICES

7.1. Coverity may access Google Account information, Gmail functionality, and Google Calendar information through Google APIs, subject to the user’s authorization and the scopes granted.

7.2. Google Account information may be used to identify and maintain the authorized connection. Gmail information may be processed to compose and send outbound communications through the user’s account. Google Calendar information may be read, created, modified, synchronized, or deleted to support the scheduling functionality described in Section 6.

7.3. Coverity’s access to Google user data shall be limited to the data and operations necessary to provide the functionality disclosed to and authorized by the user.

7.4. Coverity’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.

7.5. In accordance with those requirements, Coverity shall not use Google user data for personalized advertising, sell such information to data brokers, or use Google user data to develop, improve, or train generalized artificial intelligence or machine learning models.

7.6. Coverity shall not permit human access to information obtained through Google APIs except where permitted under Google’s Limited Use requirements, including where the user has affirmatively authorized access to specific information, where access is necessary for security purposes, where required by law, or for internal operations involving appropriately aggregated and anonymized information as permitted by Google policy.

7.7. Disclosure or transfer of Google user data to third parties shall be limited to purposes permitted under the Google API Services User Data Policy, including the provision or improvement of authorized user-facing functionality with the requisite consent, security purposes, applicable legal obligations, or qualifying corporate transactions subject to Google’s applicable requirements.

7.8. Users may review or revoke authorization previously granted to Coverity through Google’s account connection controls at:

https://myaccount.google.com/connections

Google’s Privacy Policy is available at:

https://policies.google.com/privacy

8. MICROSOFT 365 AND MICROSOFT GRAPH

8.1. Coverity may integrate with Microsoft 365, Microsoft Outlook, and other supported Microsoft services through Microsoft identity authorization and Microsoft Graph APIs.

8.2. Depending on the functionality enabled and the permissions granted, Coverity may process Microsoft account identification information, transmit outbound email communications through an authorized mailbox, and read, create, update, synchronize, or delete calendar events.

8.3. Such access shall be exercised in accordance with the permissions granted by the user or the applicable Microsoft 365 tenant administrator and shall be used to provide the corresponding authorized Services.

8.4. Coverity does not use Microsoft mailbox or calendar information obtained through such integrations for unrelated advertising, commercial data brokerage, or training of generalized artificial intelligence models.

8.5. Microsoft account holders and organizational administrators may manage application permissions through the applicable Microsoft account, Microsoft 365, or Microsoft Entra administrative interfaces.

8.6. Microsoft’s Privacy Statement is available at:

https://privacy.microsoft.com/privacystatement

9. DOCUMENTS, TRANSACTIONS, AND CONFIDENTIAL INFORMATION

9.1. The Services permit Customers and Authorized Users to upload, prepare, generate, exchange, execute, store, and otherwise process documents that may contain confidential, proprietary, financial, legal, or sensitive Personal Information.

9.2. Coverity processes such information for the purpose of providing the document, transaction, coordination, and related Services authorized by the relevant Customer.

9.3. Access to Customer documents and transaction records is subject to applicable account permissions, organizational relationships, transaction participation, and other authorization controls.

9.4. A Customer’s use of the Services does not confer upon other Customers or unrelated users any right to inspect or obtain that Customer’s confidential information.

9.5. Documents and transaction information may be disclosed to designated recipients, signers, notaries, professional representatives, and other authorized participants where such disclosure is necessary to perform the requested Services.

9.6. Coverity may retain transaction records, electronic signature evidence, timestamps, delivery confirmations, and associated audit information where reasonably necessary to maintain transaction integrity, demonstrate execution, resolve disputes, or satisfy applicable legal or contractual obligations.

9.7. Coverity is not responsible for the independent privacy practices of recipients who lawfully receive information from a Customer or Authorized User and subsequently process that information outside the Services.

10. AUTOMATED PROCESSING AND ARTIFICIAL INTELLIGENCE

10.1. Certain Services may incorporate automated processing, artificial intelligence, or machine-assisted functionality to support scheduling, document workflows, information organization, communications, transaction coordination, and other user-directed operations.

10.2. Such functionality may process information contained within the applicable workflow to the extent necessary to perform an authorized task.

10.3. The use of automated processing shall not expand the rights of a user, system component, or service provider to access information otherwise restricted by applicable permissions, contractual limitations, or law.

10.4. Information obtained from Google APIs shall remain subject to Google’s Limited Use requirements, including the restrictions applicable to training generalized artificial intelligence or machine learning models.

10.5. Coverity does not use Microsoft 365 mailbox or calendar information to train generalized artificial intelligence models.

10.6. Automated functionality may assist professional decision-making but does not independently confer legal, notarial, professional, or regulatory authority upon the Company or the software.

10.7. Where an automated feature involves an external processing provider, any disclosure of Personal Information to that provider shall be subject to the applicable contractual restrictions, authorization requirements, and provider-specific data-use limitations.

11. DISCLOSURE TO THIRD PARTIES

11.1. Coverity may disclose Personal Information to the extent reasonably necessary for the provision and operation of the Services, including to:

(a) Authorized Users and persons designated to participate in a transaction or workflow;

(b) Third-Party Providers engaged to provide infrastructure, hosting, storage, communications, document processing, payment processing, security, identity verification, and related operational services;

(c) Professional service providers engaged in a transaction or service requested by a Customer;

(d) Governmental authorities, courts, regulators, or other persons where disclosure is required by applicable law or valid legal process; and

(e) Successors or counterparties in a qualifying corporate transaction, subject to applicable law and provider-specific restrictions.

11.2. Coverity shall not disclose Customer Data to unrelated third parties for independent commercial exploitation.

11.3. Third-Party Providers processing Personal Information on Coverity’s behalf shall be subject to applicable confidentiality, security, data-use, and contractual requirements appropriate to the services provided.

11.4. The restrictions imposed by Google or another Connected Account provider shall continue to apply to the relevant information notwithstanding any more general provision of this Policy.

12. INFORMATION SECURITY

12.1. Coverity employs administrative, technical, and organizational safeguards designed to protect Personal Information against unauthorized access, acquisition, disclosure, alteration, destruction, and other unlawful or unauthorized processing.

12.2. Such safeguards include, as applicable, measures relating to authentication, access control, encryption in transit, protection of stored information, credential management, logging, monitoring, vulnerability remediation, personnel access restrictions, and incident response.

12.3. Access to information shall be restricted according to legitimate operational requirements and the applicable permissions of the relevant user, organization, or service component.

12.4. Coverity shall apply appropriate safeguards to Connected Account authorization credentials and restrict their use to the purposes for which access was granted.

12.5. No method of electronic transmission or storage provides an absolute guarantee against unauthorized access or loss. Accordingly, Coverity does not warrant that the Services are immune from all security incidents.

12.6. Users and Customer organizations remain responsible for maintaining the confidentiality of their authentication credentials, administering their authorized personnel, and promptly notifying Coverity of suspected unauthorized account activity.

13. RETENTION OF PERSONAL INFORMATION

13.1. Coverity retains Personal Information for the periods reasonably necessary to fulfill the purposes for which it was collected, provide the Services, maintain appropriate business and transaction records, comply with applicable legal obligations, resolve disputes, and enforce contractual rights.

13.2. The applicable retention period or retention criteria depend upon the category of information, the nature of the Services, the requirements of the relevant Customer relationship, and applicable law.

13.3. Account information may be retained during the account relationship and for an additional period where necessary for lawful administrative, security, accounting, or dispute-resolution purposes.

13.4. Transaction documents, electronic signature records, notarial records, and associated evidence may be subject to different retention periods based on the nature of the record and applicable legal obligations.

13.5. Authorization credentials associated with Connected Accounts shall be retained only for so long as necessary to maintain an authorized integration or satisfy a lawful and applicable retention requirement.

13.6. Following disconnection or revocation of an integration, Coverity shall cease using the affected authorization for subsequent provider operations and shall delete or invalidate associated credentials in accordance with applicable technical procedures.

13.7. Revocation of authorization shall not, by itself, require deletion of previously generated transaction records, communications already transmitted, electronic signature evidence, or records lawfully retained for independent purposes.

13.8. Upon expiration of the applicable retention period, Personal Information shall be deleted, de-identified, or otherwise disposed of in accordance with applicable law and Coverity’s retention procedures, subject to lawful exceptions.

14. INDIVIDUAL PRIVACY RIGHTS

14.1. Subject to applicable law, individuals may have rights to request access to Personal Information, correction of inaccurate information, deletion of eligible information, information concerning disclosures, or withdrawal of previously granted consent.

14.2. Requests may be submitted using the contact information specified in Section 21.

14.3. Coverity may undertake reasonable measures to verify the identity or authority of a person submitting a request before disclosing, modifying, or deleting Personal Information.

14.4. Where information is controlled by a Customer organization and Coverity processes such information on the Customer’s behalf, Coverity may refer the request to that Customer or otherwise assist in responding as required by applicable law or contractual obligations.

14.5. Coverity may decline, restrict, or defer a request where permitted or required by applicable law, including where information must be retained for legal compliance, transaction evidence, security, the protection of rights, or other recognized exceptions.

15. CALIFORNIA PRIVACY RIGHTS

15.1. To the extent applicable, California residents may exercise rights available under the California Consumer Privacy Act, as amended by the California Privacy Rights Act, and implementing regulations (collectively, the “CCPA”).

15.2. Such rights may include the right to know the categories and specific pieces of Personal Information collected, the right to request correction or deletion, the right to obtain information concerning certain disclosures, and the right to exercise applicable choices concerning the sale, sharing, or use of sensitive Personal Information.

15.3. Coverity does not sell information obtained through Google or Microsoft account integrations and does not share such information for cross-context behavioral advertising.

15.4. Coverity shall not unlawfully discriminate against individuals for exercising privacy rights conferred by applicable law.

15.5. Requests will be evaluated in accordance with applicable verification procedures, statutory response periods, and legally permitted exceptions.

15.6. Information concerning the categories of Personal Information collected, their sources, purposes, disclosures, and retention criteria is set forth in the relevant sections of this Policy. Where required, Coverity will provide a supplemental Notice at Collection identifying the applicable information categories and retention periods or criteria at or before collection.

16. COOKIES AND SIMILAR TECHNOLOGIES

16.1. Coverity may use cookies, local storage, session identifiers, and comparable technologies in connection with the operation of its websites and applications.

16.2. Such technologies may be used for authentication, session continuity, security, user preferences, service diagnostics, and analytics.

16.3. To the extent that nonessential tracking technologies are employed, Coverity will provide notices and consent or opt-out mechanisms as required by applicable law.

16.4. Information obtained through a Connected Account shall not be used to create unrelated advertising profiles through such technologies.

17. LOCATION INFORMATION

17.1. Certain Services involving notarial appointments, professional dispatch, scheduling, or service coverage may process addresses, geographic areas, and location-related information.

17.2. Where a supported application requests access to a device’s location, such access shall be subject to applicable device permissions and disclosures.

17.3. Location-related information shall be used for the provision of relevant Services, including determining service coverage, identifying appropriate providers, and coordinating appointments.

17.4. Coverity does not sell device location information obtained through its Services to location-data brokers.

18. INTERNATIONAL PROCESSING

18.1. Personal Information may be processed in jurisdictions in which Coverity or its authorized Third-Party Providers maintain operations or infrastructure.

18.2. Where applicable data protection law imposes conditions upon cross-border transfers, Coverity shall employ the contractual or legal mechanisms required for such transfers.

18.3. Customer organizations remain responsible for assessing any additional restrictions applicable to their submission of regulated or jurisdiction-specific information to the Services.

19. CHILDREN’S INFORMATION

19.1. The Services are intended primarily for professional and commercial use and are not directed to children under thirteen years of age.

19.2. Coverity does not knowingly solicit Personal Information directly from children under thirteen in the absence of legally required authorization.

19.3. Information concerning minors may be contained in documents or records submitted by Authorized Users as part of legitimate transactions. Such information shall be processed in accordance with the applicable service purpose and this Policy.

20. AMENDMENTS TO THIS POLICY

20.1. Coverity reserves the right to revise this Policy to reflect changes in law, regulatory requirements, security practices, products, services, or data-processing activities.

20.2. The effective date or last-updated date appearing above shall identify the applicable published version.

20.3. Where a material change requires additional notice or affirmative consent under applicable law, Coverity shall provide such notice or seek such consent before engaging in the affected processing.

20.4. Changes to the purposes for which Google API information is accessed or used shall be subject to the applicable Google API Services User Data Policy requirements, including notice and consent obligations.

20.5. A previously granted Connected Account authorization shall not be interpreted as consent to materially different, undisclosed uses of information.

21. CONTACT INFORMATION AND PRIVACY REQUESTS

Questions concerning this Policy, requests to exercise privacy rights, reports of suspected misuse of Personal Information, and requests regarding Connected Account data may be directed to Coverity using the following contact information:

Legal Entity: Coverity Solutions Inc
Business Name: Coverity.io
Website: https://coverity.io
Customer Portal: https://portal.coverity.io
Privacy Contact: sales@coverity.io
Business Mailing Address: 2604 Sandstone Ct, Palmdale, CA 93551

Coverity may require reasonable verification of identity or authority before acting upon requests involving Personal Information.

Nothing in this Policy shall limit rights that cannot lawfully be waived under applicable data protection law.

END OF PRIVACY POLICY