Effective date: January 1, 2026. This policy replaces the version last updated March 15, 2023.

Spruce Technology, Inc. (“Spruce,” “we,” “us,” or “our”) respects your privacy. This Privacy Policy explains what personal information we collect, how we use and share it, and the choices you have. It applies to:

• our websites, including www.sprucetech.com and its subdomains such as dex.sprucetech.com, and www.sprucetech.ai (together, the “Site”);
• our software products and mobile applications, including Employee Roster, Timecone, and Reviews360 (the “Products”); and
• our interactions with prospective clients, clients, partners, and job applicants.

Where a Product has its own privacy notice, that notice governs the Product and takes precedence over this policy for that Product. For example, the EmployeeRoster privacy policy is published at employeeroster.sprucetech.com. Personal information that we process on behalf of our clients under a services agreement is governed by that agreement, as described in “Information We Process for Our Clients” below.

Information We Collect

Information you provide to us. When you fill out a contact form, request information, register for a Product, or communicate with us, we may collect your name, email address, phone number, company or agency name, job title, and the contents of your message. If you apply for a position, our careers portal collects the information you submit in your application, such as your résumé, work history, and contact details.

Information collected automatically. Like most websites, we collect information your browser or device sends when you visit the Site or use the Products (“Log Data”). Log Data may include your IP address, browser type and version, device type, operating system, referring page, the pages you view, the date and time of your visit, and time spent on pages. We collect this information using cookies and similar technologies, described below.

Information from other sources. We may receive information about you from business partners, publicly available sources, or professional networking sites, for example to verify contact details or to understand the organizations we work with.

How We Use Information

We use personal information to:

• respond to your inquiries and provide the information or services you request;
• operate, maintain, secure, and improve the Site and the Products;
• evaluate job applications and communicate with candidates;
• send business communications, such as service updates, event invitations, or information about our capabilities, where permitted by law (you may opt out at any time);
• analyze how the Site and Products are used so we can improve them;
• detect, prevent, and respond to fraud, abuse, security incidents, and other harmful activity; and
• comply with legal obligations and enforce our agreements.

We do not sell personal information, and we do not use personal information for automated decision-making that produces legal or similarly significant effects about you.

Cookies and Analytics

Cookies are small text files stored on your device. We use cookies and similar technologies to keep the Site working properly, remember your preferences, and understand how visitors use the Site. We use Google Tag Manager and Google Analytics to collect aggregated usage statistics; Google’s use of this data is described in Google’s Privacy Policy, and you can opt out with the Google Analytics Opt-out Browser Add-on. Our forms are protected by Google reCAPTCHA, which is subject to Google’s Privacy Policy and Terms of Service. We use HubSpot to manage business contacts and to measure engagement with our Site and communications; HubSpot’s tracking code loads only after you accept analytics cookies, and its practices are described in HubSpot’s Privacy Policy.

You can manage analytics cookies and opt out of the sale or sharing of your personal information and of targeted advertising at any time through the “Your Privacy Choices” link in the footer of our Site. Most browsers also let you refuse or delete cookies through their settings. If you disable cookies, some parts of the Site or Products may not function as intended.

How We Share Information

We share personal information only as described here:

• Service providers. Vendors that perform services for us, such as website hosting, cloud infrastructure, analytics, applicant tracking, customer relationship management, and email delivery. They may access personal information only to perform those services and are contractually required to protect it.
• Professional advisors. Lawyers, auditors, insurers, and similar advisors, where necessary.
• Legal and safety. When required by law, subpoena, or government request, or when we believe disclosure is necessary to protect the rights, property, or safety of Spruce, our clients, or others.
• Business transfers. In connection with a merger, acquisition, financing, or sale of all or part of our business, subject to confidentiality protections.
• With your direction or consent.

Information We Process for Our Clients

Spruce provides technology, cybersecurity, and professional services to government agencies and other organizations. In delivering those services we may access or process personal information that belongs to our clients, including data about their employees, constituents, or customers (“Client Data”). We process Client Data only on the client’s documented instructions and for the purposes set out in our agreement with that client. We do not use Client Data for our own purposes, do not sell it, and do not share it except with subcontractors approved under the client agreement, who are bound by written confidentiality and data protection obligations at least as protective as our own. We return or securely destroy Client Data at the end of an engagement, in accordance with the client’s instructions and applicable records retention requirements. If you have questions about how a Spruce client handles your personal information, please contact that organization directly.

Data Security

We maintain administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, loss, misuse, or alteration. These include encryption of data in transit, access controls based on least privilege, multi-factor authentication for our systems, logging and monitoring, and security awareness training for our staff. No method of transmission or storage is completely secure, so we cannot guarantee absolute security, but we work to protect your information using commercially reasonable measures appropriate to its sensitivity.

Data Retention

We keep personal information for as long as needed to fulfill the purposes described in this policy, to comply with legal, accounting, or reporting obligations, to resolve disputes, and to enforce our agreements. When information is no longer needed, we delete it or de-identify it. Client Data is retained and destroyed according to the terms of the applicable client agreement.

Your Choices and Rights

You may opt out of marketing communications at any time by using the unsubscribe link in any message or by contacting us, and you may exercise cookie and do-not-sell choices through the “Your Privacy Choices” link in the Site footer. Depending on where you live, you may have the right to request access to, correction of, or deletion of your personal information, or to object to or restrict certain processing. To make a request, contact us using the information below. We will verify your identity before responding and will not discriminate against you for exercising your rights. If we decline a request, we will explain why, and you may appeal by replying to our response.

Children’s Privacy

The Site and Products are intended for business and professional use and are not directed to children under 16. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us and we will delete it.

Third-Party Links

The Site may link to third-party websites and services, including social media platforms and our careers portal. Those sites have their own privacy practices, which we do not control, and we encourage you to review their policies.

Changes to This Policy

We review this policy at least annually and whenever our practices, technology, or applicable law change. When we make changes, we will post the updated policy on this page and revise the effective date above. If a change is material, we will provide additional notice, such as a prominent statement on the Site or an email to affected users.

Contact Us

If you have questions about this Privacy Policy or our privacy practices, or wish to exercise your rights, please contact us:

Spruce Technology, Inc.
Attn: Privacy Officer
1149 Bloomfield Ave
Clifton, NJ 07012
Email: privacy@sprucetech.com
Phone: +1 862 225 9300