What we do with your information, and what we never will.

1. Relationship to customer agreements

For a customer that purchases or uses Limestone Products, capitalized terms including “Platform,” “Module,” “Products,” “Service,” “Service Order,” “Authorized Users,” “Licensed Users,” “Participants,” “Customer Data,” and “Customer Confidential Information” have the meanings stated in the applicable LimestoneBiz or LimestoneGov Master Services Agreement.

This Privacy Policy provides general public notice of Limestone’s information practices. It does not:

• order a Product or Module;
• amend a Master Services Agreement;
• modify a Service Order;
• replace a signed data-processing or regulated-data addendum; or
• create a customer-specific security, retention, or compliance commitment.

When Limestone processes Customer Data under a Master Services Agreement, the applicable signed amendment, Service Order, Master Services Agreement, schedules, and addenda govern that processing.

If this Privacy Policy conflicts with an applicable customer agreement concerning Customer Data, the applicable customer agreement controls to the extent of the conflict. Applicable privacy law continues to control where it cannot lawfully be modified by contract.

2. Limestone's privacy roles

Limestone handles Personal Information in two principal capacities.

3. Personal Information we collect

“Personal Information” means information that identifies, relates to, describes, or can reasonably be linked with an individual or household.

Personal Information does not include aggregated or de-identified information that cannot reasonably be linked to an individual, household, or identified customer.

Depending on how you interact with Limestone, we may collect the following categories.

4. Sensitive and regulated information

Customers and users should minimize the Personal Information submitted through the Services.

Unless the parties first complete an appropriate written assessment, sign any required addendum, and confirm that the Service is properly configured, users must not submit specially protected or regulated information, including:

• protected health information;
• complete payment-card information;
• criminal-justice information;
• tax information subject to special safeguards;
• government-classified information;
• biometric identifiers;
• authentication secrets;
• export-controlled information; or
• other information subject to a specialized security or regulatory framework.

The standard LimestoneBiz and LimestoneGov agreements do not, by themselves, establish compliance with:

• HIPAA;
• PCI DSS;
• CJIS;
• FedRAMP;
• IRS Publication 1075;
• government-classified-data requirements; or
• a customer-specific security standard.

Additional assessment, configuration, and contractual terms may be required before regulated information is introduced.

5. How we use Personal Information

Limestone may use Personal Information to:

• provide, configure, host, operate, and maintain the Services;
• implement purchased Products and Modules;
• create and administer accounts;
• authenticate users and enforce permissions;
• process authorized transactions;
• provide support and training;
• investigate errors and incidents;
• monitor service reliability and availability;
• respond to inquiries and requests;
• communicate about services, renewals, security, and updates;
• process billing and maintain business records;
• provide AI-enabled functions;
• generate requested emails, summaries, records, or workflow actions;
• prevent fraud, abuse, unauthorized access, and security incidents;
• enforce applicable agreements;
• satisfy legal, contractual, accounting, and regulatory obligations;
• establish, exercise, or defend legal claims;
• improve the Services;
• develop features using aggregated or de-identified information;
• manage vendors and subprocessors; and
• accomplish another purpose disclosed when information is collected or authorized by the individual or customer.

For Customer Data, Limestone and its subprocessors process the information only as reasonably necessary to:

• provide the Service;
• secure the Service;
• support the Service;
• improve the Service;
• follow documented customer instructions;
• comply with applicable law; or
• enforce the applicable agreement.

Limestone may use aggregated and de-identified statistics that do not identify a customer, an individual, or Customer Confidential Information.

6. AI-enabled functions

7. AI-assisted telephone and messaging services

Limestone may use an AI-assisted agent to:

• answer calls;
• identify the purpose of a call;
• collect contact information;
• route a request;
• schedule follow-up;
• create a support or sales record;
• prepare or send a requested email;
• summarize a conversation; or
• initiate another authorized workflow.

When appropriate, callers will be informed that they are interacting with an automated or AI-assisted system.

When a call is recorded or transcribed, Limestone will provide notice or obtain consent as required by applicable law.

A caller who does not wish to continue with an AI-assisted interaction may request a person or use another available contact method.

8. How we disclose Personal Information

Limestone may disclose Personal Information in the following circumstances.

9. Cookies, analytics, and advertising

Limestone may use essential cookies and similar technologies necessary for authentication, security, preferences, session management, and core functionality.

Today, the public websites at limestonetg.com, limestonegov.com, and limestonebiz.com set no cookies and use no analytics, advertising pixels, or third-party tracking scripts. If Limestone introduces analytics or other nonessential technologies, we will update this Privacy Policy and, where required by applicable law, request consent before activating them.

Cookie controls are also available through your browser. If nonessential cookies are introduced, Limestone will provide a cookie-preference tool where required by law. Blocking essential cookies may prevent portions of the Services, such as signing in to a customer portal, from functioning properly.

Limestone does not sell Personal Information for money or other valuable consideration.

Limestone does not share Personal Information for cross-context behavioral advertising.

If these practices change, Limestone will update this Privacy Policy and provide any legally required notice, consent, or opt-out mechanism.

Where required by law, Limestone will process legally recognized browser-based opt-out preference signals, such as the Global Privacy Control.

Some browsers transmit “Do Not Track” signals. Because no common industry standard for responding to them has been adopted, the Services do not currently respond to Do Not Track signals; Limestone does honor legally recognized opt-out preference signals, such as the Global Privacy Control, where required by law.

Limestone does not currently offer financial incentives in exchange for Personal Information.

10. Public-sector customers and records

LimestoneGov provides software and technology services to public-sector organizations.

Customer Data and Service records associated with a public-sector customer may be subject to:

• public-records laws;
• open-meeting and transparency requirements;
• government retention schedules;
• audit requirements;
• litigation holds;
• accessibility requirements;
• procurement requirements;
• archival obligations; or
• other laws governing public information.

The applicable public-sector customer determines whether a record must be retained, disclosed, corrected, restricted, exported, or deleted.

A public-sector customer should identify in its Service Order or a signed addendum:

• its adopted records-retention schedule;
• mandatory public-records requirements;
• audit requirements;
• accessibility requirements;
• security requirements;
• data-location requirements;
• breach-notification requirements; and
• other customer-specific legal obligations.

Limestone will retain and dispose of Customer Data and responsive Service records according to the identified schedule and applicable law, subject to the applicable agreement and technical limitations disclosed before execution of the Service Order.

Requests concerning records controlled by a government customer should normally be directed to that agency. Limestone will reasonably assist the agency as required by applicable law and agreement.

11. Data retention and return

Limestone retains Personal Information only as long as reasonably necessary to:

• provide and support the Services;
• fulfill the purposes described in this Privacy Policy;
• maintain security and audit records;
• follow customer instructions;
• comply with an agreement;
• satisfy legal, tax, accounting, and regulatory obligations;
• resolve disputes; and
• enforce agreements.

Customer Data is retained during the applicable service term and handled after expiration or termination according to the applicable customer agreement.

Unless a signed agreement states otherwise:

• access to the Service ends upon expiration or termination;
• a customer may request one commercially reasonable export of Customer Data in a commonly used format at any time before deletion;
• Limestone will not delete Customer Data earlier than sixty days after expiration or termination unless the customer requests earlier deletion or applicable law requires otherwise; and
• backup copies may remain until overwritten through ordinary retention cycles.

For a public-sector customer, the retention schedule identified in the Service Order or signed addendum may impose additional requirements.

After an applicable retention period, Personal Information is deleted, de-identified, or isolated from ordinary use, subject to backup cycles and legal obligations.

12. Data security

Limestone maintains administrative, technical, and organizational safeguards appropriate to the nature of the Services and information involved.

These safeguards may include:

• role-based access and least-privilege practices;
• unique administrative credentials;
• multi-factor authentication where supported;
• encryption in transit using current industry-standard transport protection;
• encryption at rest across Limestone's hosting infrastructure;
• logging and monitoring;
• vulnerability remediation and patching;
• personnel confidentiality obligations;
• backup and recovery practices;
• secure development practices; and
• documented incident-response procedures.

No transmission or storage system can guarantee absolute security.

Customers remain responsible for their own:

• access approvals;
• Authorized Users;
• endpoint protection;
• identity controls;
• credentials;
• retention requirements;
• user training; and
• prompt reporting of suspected credential compromise.

If you believe Personal Information has been accessed improperly, contact Limestone or your organization’s administrator promptly.

Where required by applicable law, Limestone will notify affected individuals and regulators of a qualifying security breach.

When a security incident affecting Customer Data is confirmed, Limestone’s default practice is to notify affected customers without unreasonable delay, targeting notice within 72 hours after confirmation.

Customer-specific security incident notification obligations are governed by the applicable Master Services Agreement, Schedule C, Service Order, and any signed addendum.

13. Privacy rights and requests

Depending on your residence and applicable law, you may have the right to:

• confirm whether Limestone processes your Personal Information;
• access Personal Information about you;
• correct inaccurate Personal Information;
• request deletion;
• obtain a portable copy of certain information;
• opt out of the sale of Personal Information;
• opt out of targeted advertising;
• opt out of qualifying automated profiling;
• withdraw consent for certain processing;
• limit certain uses of sensitive Personal Information;
• appeal the denial of a request; and
• exercise privacy rights without unlawful discrimination.

Because Limestone does not currently sell Personal Information or share it for cross-context behavioral advertising, certain opt-out requests may not require a change to our practices. We will nevertheless review and respond to valid requests as required by law.

14. California privacy disclosures

To the extent the California Consumer Privacy Act, as amended, applies to Limestone, this section supplements the remainder of this Privacy Policy for California residents.

During the preceding 12 months, Limestone may have collected:

• identifiers and contact information;
• customer and commercial information;
• internet and electronic-network activity;
• professional information;
• approximate location;
• audio, electronic, or visual information;
• account credentials;
• communications;
• Customer Data;
• sensitive information submitted through an approved workflow; and
• inferences generated to provide requested AI-enabled functionality.

The sources of this information are described in Section 3. The purposes are described in Section 5. Categories of recipients are described in Section 8.

Limestone does not use or disclose sensitive Personal Information for the purpose of inferring characteristics about an individual outside purposes permitted by applicable law.

Limestone does not knowingly sell or share the Personal Information of individuals under 16.

California residents may exercise applicable rights through the methods in Section 13.

15. Children's privacy

The general-audience Services are intended for organizations and adult business users. They are not directed to children under 13.

Limestone does not knowingly collect Personal Information directly from children under 13 through its general-audience websites or Services.

If Limestone learns that it collected Personal Information directly from a child under 13 without appropriate authorization, we will take reasonable steps to delete it.

A government, educational, or other customer may use a separately configured Service in a context involving minors. In that situation:

• the customer is responsible for identifying the applicable legal requirements;
• the customer is responsible for required notices and authority or consent;
• Limestone will process the information according to the applicable agreement and law; and
• additional contractual and technical safeguards may be required.

A parent or guardian who believes a child directly provided Personal Information to Limestone may contact privacy@limestonetg.com.

16. Third-party websites and services

The Services may contain links to third-party websites, applications, or services.

Limestone does not control and is not responsible for the privacy or security practices of third parties. We encourage users to review a third party’s privacy notice before providing information.

17. International processing

Limestone is based in the United States.

Personal Information may be processed in the United States and other locations where Limestone or its service providers operate.

Where required, Limestone will use appropriate contractual or legal mechanisms for international transfers.

Unless otherwise expressly agreed, the Services are designed primarily for organizations and users in the United States.

18. Changes to this Privacy Policy

Limestone may update this Privacy Policy to reflect changes in:

• the Services;
• Products and Modules;
• subprocessors;
• technology;
• legal requirements; or
• information practices.

When the policy is updated, Limestone will revise the “Last Updated” date.

If a change materially affects how previously collected Personal Information is used, Limestone will provide additional notice or obtain consent when required by law.

Limestone will not materially expand the use of previously collected Personal Information solely through a retroactive policy change where additional notice or consent is legally required.

Changes to this Privacy Policy do not amend an executed Service Order or Master Services Agreement. Contract amendments must follow the amendment process stated in the applicable agreement.

19. Contact Limestone

Questions, concerns, accessibility requests, and privacy inquiries may be directed to: