Internal Application ("we", "us", or "our") is committed to protecting your personal information. This Privacy Policy explains what data we collect, why we collect it, how we use and store it, and your rights in relation to it. This policy applies to all visitors browsing our Directory and to anyone who submits a Custom Build request through internalapplication.com. It covers information collected through our website, during a Custom Build request, during payment, and through your use of the Platform. Please read this policy carefully. By accessing or using the Platform, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with our practices, please discontinue use of the Platform. This Privacy Policy should be read alongside our Terms and Conditions (internalapplication.com/legal/terms) and our Cookie Policy (internalapplication.com/legal/cookies). For any privacy-related questions or requests, you can contact us at hello@internalapplication.com.

We collect only the data necessary to operate the Directory and deliver Custom Builds. We do not collect sensitive personal data such as health information, political opinions, religious beliefs, or biometric data, and we do not require an account to browse the Directory. Directory Browsing: Browsing the Directory does not require an account. We collect only limited technical data, described under Usage & Activity Data below, needed to operate the website. Custom Build Request Data: When you submit a Custom Build request, we collect: - Your name and email address - Your business name and a description of your business - The requirements, features, or problem you want the Custom Build to address - Any other information you choose to include in your request We collect this information whether or not your project ultimately proceeds. Account & Identity Data: If your Custom Build project is confirmed, we may provision you with a client project account, handled by Clerk (clerk.com), a third-party authentication platform, so you can track project status and communicate with us. Clerk collects and manages your name, email address, and password (stored in encrypted form). We do not have access to your raw password at any point. Clerk's handling of your authentication data is governed by their own Privacy Policy, available at clerk.com/legal/privacy. Billing & Payment Data: Custom Build project fees are processed by Dodo Payments (dodopayments.com), our third-party payment processor and Merchant of Record. When you pay a project fee, Dodo Payments collects and manages your billing name and address, payment card or payment method details, and transaction details. We receive from Dodo Payments only a transaction confirmation, your payment status, and a customer reference ID. Dodo Payments' handling of your payment data is governed by their own Privacy Policy, available at dodopayments.com/legal/privacy. Usage & Activity Data: As you use the Platform, we automatically collect certain technical data to ensure the service runs correctly and to improve it over time, including pages viewed, listings clicked, session duration, and error or performance logs. We use Google Analytics to understand website usage and improve the Platform. Google may process this data according to its own privacy policy. This data is not sold by us.

We use the data we collect strictly for the following purposes: To provide and operate the Platform: - Displaying and maintaining the Directory - Evaluating, scoping, and responding to Custom Build requests - Managing your client project account and communicating with you about your Custom Build - Processing your one-time project fee payment To maintain and improve the Platform: - Analysing usage patterns to identify bugs, performance issues, and areas for improvement - Understanding which types of Custom Build requests we receive, to improve how we scope and deliver projects - Ensuring the security and integrity of the Platform To fulfil legal obligations: - Maintaining records required by applicable financial, tax, or regulatory laws - Responding to lawful requests from courts or government authorities - Enforcing our Terms and Conditions We do not use your personal data for: - Advertising or retargeting campaigns - Selling or renting your data to third parties - Automated profiling or decision-making that produces legal or similarly significant effects on you The legal basis for our processing activities (relevant for users in the EU/EEA under GDPR) is as follows: - Contract performance — processing necessary to respond to your Custom Build request or deliver an agreed project - Legitimate interests — processing usage data to maintain and improve the Platform, where this does not override your rights - Legal obligation — processing required to comply with applicable law

We take the security of your personal data seriously and implement appropriate technical and organisational measures to protect it against unauthorised access, loss, alteration, or disclosure. Our security practices include: - Encryption of data in transit using TLS (Transport Layer Security) - Encryption of passwords at rest using industry-standard hashing algorithms - Access controls ensuring only authorised personnel can access user and client data - Regular review of our data handling and security practices Data Storage Location: Your data is stored on secure servers. As Internal Application serves a global user base, your data may be stored or processed in countries outside your own. Where this involves transfers from the EU/EEA to countries without an adequacy decision, we ensure appropriate safeguards are in place in accordance with applicable data protection law. Data Retention: We retain your personal data only for as long as necessary to fulfil the purposes outlined in this policy, or as required by law: - Custom Build request data is retained for up to 2 years from submission if a project does not proceed, so we can follow up on your enquiry, after which it is deleted - Client account and project data is retained for the duration of your engagement and for up to 2 years afterward, to handle any post-project disputes or legal obligations - Billing records are retained for up to 7 years to comply with financial and tax regulations - Usage and activity data is retained for up to 12 months from the date of collection, after which it is anonymised or deleted When data is no longer required, we securely delete or anonymise it. Despite our best efforts, no method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security of your data.

We do not sell, trade, rent, or otherwise share your personal data with third parties for their own marketing or commercial purposes. We share your personal data with the following third-party service providers only, and solely to the extent necessary for them to perform their services: Clerk (Authentication): We use Clerk (clerk.com) to manage client project account creation, login, and session security. Your name, email address, and password are processed by Clerk on our behalf. Your authentication data is governed by Clerk's Privacy Policy at clerk.com/legal/privacy. Dodo Payments (Payments): We use Dodo Payments (dodopayments.com) as our payment processor and Merchant of Record. Dodo Payments independently collects and processes your billing details, payment card information, and transaction data to complete your project fee payment and manage tax compliance on our behalf. Dodo Payments' handling of your data is governed by their Privacy Policy at dodopayments.com/legal/privacy. Directory Listings: Submitting a Custom Build request or browsing the Directory does not share your personal data with any of the SaaS products listed in the Directory. If you separately choose to sign up for a listed product, that product's own privacy policy applies to any data you share with it directly. We do not share your data with advertising platforms, social media networks, or data brokers. Google Analytics receives usage data as described above. We may disclose your personal data if required to do so by law, court order, or governmental authority, or if we reasonably believe such disclosure is necessary to protect the rights, property, or safety of Internal Application, our users, or others.

Depending on your location, you may have certain rights regarding your personal data. We are committed to honouring these rights regardless of where you are based. You have the right to: Access — Request a copy of the personal data we hold about you. Correction — Request that we correct any inaccurate or incomplete personal data we hold about you. Deletion — Request that we delete your personal data. We will honour this request unless we are required to retain certain data by law (e.g. billing records) or for legitimate business reasons such as resolving disputes. Restriction — Request that we restrict the processing of your personal data in certain circumstances. Portability — Request that we transfer your personal data to you or to another service provider in a structured, machine-readable format, where technically feasible. Objection — Object to our processing of your personal data where we rely on legitimate interests as our legal basis. Withdraw Consent — Where our processing is based on your consent, you have the right to withdraw that consent at any time without affecting the lawfulness of prior processing. To exercise any of these rights, please contact us at hello@internalapplication.com. We will respond to all valid requests within 30 days and may ask you to verify your identity before processing your request. If you are located in the EU/EEA and are unsatisfied with our response, you have the right to lodge a complaint with your local data protection authority.

Internal Application is intended solely for use by individuals who are 18 years of age or older. We do not knowingly collect, solicit, or process personal data from anyone under the age of 18. If you are a parent or guardian and believe that a minor has provided us with personal data without your consent, please contact us immediately at hello@internalapplication.com. Upon verification, we will promptly delete the relevant data from our systems. We reserve the right to decline any Custom Build request, or terminate any client account, we discover to be associated with a person under the age of 18.

We may update this Privacy Policy from time to time to reflect changes in our data practices, legal obligations, or the features of the Platform. When we make material changes to this policy, we will: - Update the "Effective Date" shown at the top of this page - Notify any Client with an active project by email, or display a prominent notice on the Platform We encourage you to review this Privacy Policy periodically. Your continued use of the Platform after any update constitutes your acknowledgment of the revised policy. The most current version of this Privacy Policy will always be available at internalapplication.com/legal/privacy.

If you have any questions, concerns, or requests regarding this Privacy Policy or the way we handle your personal data, please contact us: Email: hello@internalapplication.com Website: internalapplication.com We aim to respond to all privacy-related enquiries within 5 business days. For formal data subject requests (access, deletion, portability, etc.), please email us with the subject line "Data Request" and include the email address used for your Custom Build request or client account so we can verify your identity and process your request efficiently.