Privacy Notice 

Effective Date: May 1, 2026

1. Scope 

Waypoint Metrics, Inc. (“Waypoint,” “we,” “our,” “us”) is a leader in location data analytics. We work with our Partners to collect information about individuals from applications installed on their devices, and we use that information to create and deliver analytics insights to our Customers (our “Services”). 

We believe that openness and transparency about our data practices are critical to ensuring that we collect accurate information that aligns with the expectations of our stakeholders. This Privacy Notice (“Notice”) is intended to serve as an easy-to-understand guide to our data collection, use, and disclosure practices. Please read this Notice to learn what we are doing with your Personal Information, how we protect it, and what privacy rights you may have under applicable data protection and privacy laws. 

In the context of this Notice, Waypoint acts as a “Data Controller” or “business” for the Personal Information that we process for the purpose of providing the Services. This means that we typically determine the purpose of and means for processing your Personal Information, as set forth in this Notice. 

2. Sources of Personal Information 

Waypoint collects Personal Information from four (4) categories of individuals: Device Users, Customers, Partners, and Website Users (“you”, “your”). We process your Personal Information differently depending on which category you fall under at a given time. Moreover, certain individuals will fall under more than one category simultaneously. For example, Partners may also be Website Users, whenever they use our Website. When reading this Notice, you should therefore consider each of the different ways in which this Notice might apply to you. 

2.1 Device Users 

Device Users are individuals who use Partner applications from which Waypoint collects Personal Information to provide its Services. Device Users may also include individuals whose Personal Information is purchased by Waypoint from third-party data aggregators or brokers. 1

2.2 Website Users 

Website Users are individuals who visit our Website, located at www.waypointmetrics.com, and include any related domains, subdomains, and pages. 

2.3 Customers 

A Customer is any person or organization that purchases Services from Waypoint. Typically, our Customers are advertisers, media, data analytics providers, government authorities or their representatives or contractors, city planning commissions, transportation authorities, academic researchers, financial services providers, and any other enterprise contracting our Services. 

2.4 Partners 

Partners are third-party mobile application developers or third-party data aggregators from whom we collect Personal Information to provide Services to our Customers. 

3. Personal Information We Collect 

We collect the following information about you (we refer to this information as Personal Information, or Information, throughout this Notice): 

3.1 Device Users 

We collect the following Personal Information about Device Users who use Partner applications or from third-party data aggregators or brokers:

3.2 Website Users

We collect the following Personal Information from individuals that use our Website:

3.3 Customers and Partners

We collect the following Personal Information from our application Partners and from the Customers to whom we sell our Services:

4. How We Collect Your Personal Information 

4.1 Device Users 

The majority of the Device User Information we collect is purchased from our Partners. They collect Information directly from Device Users through those Partner’s applications installed on devices. The categories of Partner applications through which we collect Personal Information include, for example, the following: 

● Weather applications 

● Shopping applications 

● Utilities applications 

● Sports applications 

● Gaming applications 

● Lifestyle applications 

● Education applications 

● Health & Fitness applications 

● Maps & Navigation applications 

● Music & Audio applications 

● Social applications 

We may also purchase Device User Information from data aggregation companies. 

4.2 Website Users 

We collect Information directly from Website Users to the extent you directly interact with us, or in the provision of our Services. We collect Information about Website Users over time when you use this Website. We may have third parties collect Personal Information in this way. We do this to understand the visitors to our site and better communicate with them – no information collected passively from our Website is incorporated into our Services. 

4.3 Customers and Partners 

We collect information directly from Partners and Customers to the extent you directly interact with us or in the provision of our Services. 

5. How We Use Your Personal Information 

5.1 Device Users 

We Combine Information. As part of the Services we provide to our Customers, we combine all Information we receive about you into one data set, which we may further customize based on the needs of our Customers. For example, we may combine Personal Information that we have collected about you from our Partners (described in Section 2.4 above) with Information we have purchased from data aggregators. We may also combine Information we have collected from you with Personal Information we purchase. 

We Draw Inferences from Your Data. As part of the Services we provide to our Customers, we use all available Information we collect to draw inferences about Device User location and movement patterns and to create custom reports for our Customers. We build these inferences into the Services that we sell to our Customers. 

We Use Your Data for Research. We use Device User Personal Information for the following purposes related to marketing and research, as part of the Services we provide to our Customers: 

● Segmentation and Ad Targeting. We use location information, personal identifiers, inferences, commercial, demographic, and device information for research purposes. This information is used to better predict and draw insights about consumer, market, or scientific trends related to human movement patterns. These movements may include retail visitation, commute patterns, or visitation that could infer shopping behavior. These measures may be used to target advertising or inform marketing programs, measure them, or optimize media exposure based on real-world activities or trends. 

● Trend Analysis. We utilize aggregated location information, commercial information, and inferences to create trend-level analysis on consumer behavior, commercial activity, commodity generation and distribution, and general economic insights. These analyses are used individually and in conjunction with each other to provide trend activity and economic measurements of markets, consumer behavior, and how that may affect a business or stock price. 

Smart Cities Aggregated Traffic Patterns and Research. We use aggregated Device User location information to draw insights about consumer, market or scientific trends related to human movement patterns. We may use or license this information to real estate professionals, city planners, transit authorities, or smart city companies, augmented with inferences, demographic, and commercial information to create more specific segments. For example, we may infer whether an aggregate group of Device Users drive vs walk to determine whether to put a bus stop in an area or to understand the flow of traffic over time to help a customer determine whether to purchase real estate. 

Security. We use Device User Personal Information for the following purposes related to security as part of the Services we provide to our Customers: 

● Asset Management. We use location information over time to track Device movement to maintain the location and utilization of equipment for our enterprise Customers. This enables us to track and detail where equipment and assets are, the estimated utilization and maintenance schedule, use life of each piece of equipment, and future cost analysis for upgrades or replacements. 

● Facility Security. We use aggregated location information to create location perimeters and 6

determine risk based on activity and incursion into those spaces. We also look at overall security and threat potential across multiple facilities and industries. We may measure the regular inhabitants of a location and determine any anomalous behaviors or Devices. 

● External Threat Analysis. We may use location information, personal identifiers, Device information, commercial information, and inferences to do complex analysis on threats, both physical and cyber, for enterprises and their facilities, national, state, or local public authorities, individuals and their security teams, and other organizations. 

Publisher Insights and App Analytics. We use Device User Personal Information (specifically application usage information) to provide our Partners with an analytics and measurement product based on Device activity within their apps. We also use Application Usage information to determine app usage in a specific geographic region. 

5.2 Website Users 

Provide, Maintain or Improve Our Website and Services. We use Device information and internet or network activity Information from Website Users to provide, maintain, and improve our Website and Services. 

5.3 Customers and Partners 

Providing Services. We may use your contact information to provide our Services, contact you, and respond to your requests. We also use your payment information to send and receive funds to and from you. 

Marketing Purposes. We use personal identifiers to send Partners and Customers information about our products or Services. We also use personal identifiers to tell Partners and Customers about new features or updates. 

Security and Fraud Prevention. We use personal identifiers, device information, payment information, and internet and network activity information to protect our Website or Services, our company, and others and to prevent fraud, theft, and misconduct. 

Transactional Purposes. We use your personal identifiers to contact you about this Notice or our terms. 

We use your Information as otherwise permitted by law. 

6. How We Disclose Your Personal Information 

6.1 Device Users

Waypoint discloses Device Users’ Personal Information to the following categories and types of recipients: 

● Customers. We disclose Device User information, including personal identifiers, location information, commercial information, demographic information, device information, and inferences, through the provision of our Services to Customers. This includes the sale of our Services, which we produce using combined Personal Information, and includes inferences, marketing and research, government/smart cities, security, attribution, or publisher insights, as described in detail above. Customers may use your data for the same purposes for which Waypoint uses your data, in addition to other purposes determined by the Customers, such as understanding movement patterns, conducting analytics, or to serve targeted ads. 

●Our Customers may include advertisers, media, data analytics providers, government authorities or their representatives or contractors, city planning commissions, transportation authorities, academic researchers, financial services providers, and any other enterprise requiring our Services. 

● Partners. We provide application analytics created from Device User information with our Partners that initially provided us with your Information. This information can be specific to an individual Device User or aggregated information. Our Partners may include mobile application developers and data aggregation Partners. 

6.2 Device Users, Website Users, Customers, and Partners 

Waypoint discloses Personal Information from Device Users, Website Users, Customers, and Partners with the following categories and types of recipients: 

● Service Providers: We have business relationships with other businesses that provide us with certain services, when we believe that business is trustworthy and when we have confirmed that its privacy practices are consistent with ours (“Service Providers”). For example, we may contract with Service Providers to provide certain services, such as: 

o hosting and maintenance; 

o infrastructure services providers; 

o customer relationship management software providers; 

o visual representation providers; 

o collaboration tool providers; 

o payment software or processing providers; 

o B2B marketing providers. 

We only provide our Service Providers with the information necessary for them to perform these services on our behalf. Each Service Provider must agree to use reasonable security procedures and practices, appropriate to the nature of the information involved, in order to protect your Personal Information from unauthorized access, use, or disclosure. Service Providers are prohibited from using Personal Information other than as specified by us. 

● Affiliates: We may share Personal Information with businesses controlling, controlled by, or under common control with Waypoint. 

● Corporate Transactions: If Waypoint is merged, acquired, or sold, or in the event of a transfer of some or all of our assets, we may disclose or transfer any Personal Information in connection with such transaction to the extent permitted by law. You will have the opportunity to opt out of any such transfer if, in our discretion, it will result in the handling of your Personal Information in a way that differs materially from this Notice. 

● Compliance with Laws and Law Enforcement: We cooperate with government and law enforcement officials and private parties to enforce and comply with the law. We may disclose Personal Information and any other information about you to government or law enforcement officials or private parties if we are compelled by law or regulation, or where we deem it appropriate. This may also include responding to legal requests (including court orders and subpoenas), assisting in protecting the safety, property, or rights of our company or of any third party, or complying with the law. To the extent that we must disclose your Personal Information to comply with official investigations or legal processing started by governmental and/or law enforcement officials, we may not be able to ensure that such recipients will maintain the privacy and security of your Personal Information. 

The following table describes, in the last twelve months, the categories of information we have disclosed to third parties for business purposes, and the categories of those third parties. It also describes the categories of information we sell or share to third parties, and the categories of those third parties. 

Some of these third parties may be located outside of the United States. However, when the Personal Information is protected by the GDPR, before transferring your Personal Information to these third parties, we will either ask for your explicit consent or require the third party to maintain at least the same level of privacy and security for your Personal Information that we do. We remain liable for the protection of your Personal Information that we transfer or have transferred to third parties through our designated data transfer mechanism, such as StandardContractual Clauses (“SCCs”) as approved by the European Commission under Article 46.2 ofthe GDPR, except to the extent that we are not responsible for the event that leads to any unauthorized or improper processing. 

7. Lawful Basis For Processing 

7.1 Device Users 

Consent: In some instances, we rely on Device User consent to process your Personal Information. Where a valid consent is gathered from a Device User, either through Waypoint’s own consent solution or a consent solution implemented by a Waypoint Partner or affiliate, we may rely on it to process location information and other Personal Information collected from a Device or a Device User as described in this Notice. 

Withdraw consent: If we are processing your Personal Information based upon your consent, you have the option to withdraw that consent at any time, which can be done by visiting https://www.waypointmetrics.com/opt-out. When you withdraw your consent, we will terminate any processing activities that are based upon your consent. Please note, however, that the withdrawal of your consent will not affect processing done previously based on that consent, and that processing activities based on another lawful basis, such as our legitimate interests, may continue. 

Legitimate Interests: We may also rely on our legitimate interests to process your Personal Information as described above, and as necessary to provide the Services, so long as they are not overridden by your own rights and interests. When we rely on legitimate interests as a lawful basis of processing, you have the right to ask us more about how we decided to choose this legal basis. To do so, please use the contact details listed below. 

Legal Obligation: We may process Personal Information based on a legal obligation to which we may be subject, to protect the vital interests of you or another person, or because such processing is in the public interest. 

7.2 Website Users, Customers, and Partners 

Performance of a Contract: We process Personal Information of Customers and Partners as necessary to provide Services or as otherwise required to enter into or meet our contractual obligations. Customers and Partners have the right to refuse to provide Personal Information for this purpose. However, such refusal will compromise Waypoint’s ability to provide its Services and to communicate updates regarding its Services. 

Legitimate Interests: We rely on our legitimate interests to process Personal Information, so long as they are not overridden by your own rights and interests. This includes processing Personal Information for purposes such as security, assisting law enforcement, or detecting fraud, or, when you are using our Website or as our Customer, for marketing purposes or transactional purposes. When we rely on legitimate interests as a lawful basis of processing, you have the right to ask us more about how we decided to choose this legal basis. To do so, please use the contact details listed below. 

Legal Obligation: We may process Personal Information based on a legal obligation to which we may be subject, to protect the vital interests of you or another person, or because such processing is in the public interest. 

8. Your Privacy Rights 

As part of complying with applicable privacy laws in the jurisdictions in which we operate and subject to where you live, and subject to potential legal exceptions, we provide Device Users, Website Users, Customers, and Partners with the rights listed below regarding their Personal Information. To exercise your rights, you may submit a request to us by completing our webform here. 

Right to be Informed: If this right applies to you under applicable laws, this means that you have the right to obtain from us information regarding our data processing activities that concern you such as how we collect and use your Personal Information, how long we will keep it, and who it will be shared with, among other things. We are informing you of how we process your Personal Information with this Notice. 

Right of Access: You have the right to request a copy of the specific pieces of your Personal Information that Waypoint processes. 

As part of the right of access, you also have the right to receive information about: (1) the purposes of processing; (2) the categories of Personal Information concerned, (3) the recipients or categories of recipients to whom Waypoint has or will disclose your Personal Information; (4) the anticipated retention period for your Personal Information or the criteria used to determine that period; (5) information about your other rights; (6) information about the source of your Personal Information if Waypoint did not collect it directly from you; and (7) whether Waypoint uses your Personal Information to engage in automated decision-making, including profiling, to produce legal or similarly significant effects. 

Under some circumstances, we may deny your access request. In that event, we will respond to you with the reason for the denial. 

Right to Correct: If this right applies to you under applicable laws, it gives you the right to ask us to correct without undue delay anything that you think is wrong with the Personal Information we have on file about you, and to complete any incomplete Personal Information. 

Right to Erasure: You have the right to make a request to erase or delete Personal Information Waypoint has collected about you. We will delete your Personal Information per your request and will also communicate your deletion request to our Service Providers and direct them to delete your Personal Information. 

Sometimes we can delete your Information, but other times it is not possible for either technical or legal reasons. If that is the case, we will consider if we can limit how we use it. We will also inform you of our reason for denying your deletion request, if applicable. 

Right to Withdraw Consent: If you previously provided your consent to one of the Partners that we rely on to process your Personal Information, you have the right to withdraw that consent at any time. If you withdraw your consent, our use of your Personal Information before you withdraw it is still lawful. 

If you have given consent for your details to be shared with a third party and wish to withdraw this consent, please also contact the relevant third party to change your preferences. 

Right to Object: You have the right to object to the processing of your Personal Information as described in this Notice. 

We will stop processing the relevant Personal Information unless: (i) we have compelling legitimate grounds for the processing that override your interests, rights, or freedoms; or (ii) we need to continue processing your Personal Information to establish, exercise, or defend a legal claim. 

If we have received your Personal Information in reliance on the Data Privacy Framework, you may also have the right to opt out of having your Personal Information shared with third parties and to revoke your consent to our sharing your Personal Information with third parties. You may also have the right to opt out if your Personal Information is used for any purpose that is materially different from the purpose(s) for which it was originally collected or which you originally authorized. 

Right to Restrict Processing: You have the right to request that Waypoint restrict the processing of your Personal Information as described in this Notice in certain circumstances. This means that Waypoint can continue to retain your Personal Information but cannot continue to actively use it. This right applies in certain instances, such as when you believe that the Personal Information that Waypoint holds about you is inaccurate, or the processing activities are unlawful. 

Right to Data Portability: You have the right to request the Personal Information we hold and to have it transferred to another data controller of your choice if this right does not adversely affect the rights and freedoms of others. We will provide your Personal Information in a structured, commonly used, and machine-readable format. When you request this information electronically, we will provide you with a copy in electronic format. 

Right Related to Automated Decision Making: We sometimes use computers to study your Personal Information, but we do not make legal or similarly significant decisions using automated decision-making technologies. 

Right to Opt-Out of Sale and Sharing for Targeted Advertising. You have the right to opt out of the sale of your personal information, as well as the right to opt out of the sharing of your personal information for targeted advertising. Upon receiving a valid opt-out of sale or sharing request, we will stop and refrain from selling any of your Personal Information or sharing it for targeted advertising. To exercise the right to opt out, you may submit a request to us by completing our webform here. You may also set up your browser to send a Global Privacy Control (GPC) signal, though we do not currently sell or share data for targeted advertising using browser-based tools. For more information, please visit https://globalprivacycontrol.org. Separate from the GPC, because there is no common understanding about what a "Do Not Track" signal means, we don’t respond to those signals in any particular way. 

Right to Limit Use of Sensitive Personal Information. California residents may exercise their right to limit the use of sensitive personal information by submitting a request to us via our webform here. 

Right to Non-Discrimination. We will not discriminate against you for exercising any of your privacy rights. 

Right to Lodge Complaints: Applicable laws may give you the right to lodge a complaint with a supervisory authority if you are not satisfied with how we process your Personal Information. If the GDPR applies to our processing of your Personal Information, you can lodge a complaint in the Member State of the European Union of your habitual residence, place of work, or the alleged violation of the GDPR. 

How Can You Exercise Your Privacy Rights? 
To exercise any of the rights described above, please submit a request by either:

1. Submit a webform at Waypoint Metrics - Your Privacy Choices

2. Call us at +1 877-792-9764 

3. Contact us by email at privacy@Waypointmetrics.com

Verification of Your Identity 

To correctly respond to your privacy rights requests, we need to confirm that You made the request. Consequently, we may require additional information to confirm that you are who you say you are. 

We will only use the Personal Information you provide us with in a request to verify your identity or authority to make the request. 

Verification of Authority 

If you submit a request on behalf of somebody else, we will need to verify your authority to act on behalf of that individual. When contacting us, please provide us with proof that the individual gave you signed permission to submit this request, a valid power of attorney on behalf of the individual, or proof of parental responsibility or legal guardianship. Alternatively, you may ask the individual to directly contact us by using the contact details above to verify their identity with Waypoint and confirm with us that they gave you permission to submit this request. 

Response Timing and Format of Our Responses 

We will confirm the receipt of your request within ten (10) business days, and, in that communication, we will also describe our identity verification process (if needed) and when you should expect a response, unless we have already granted or denied the request. 

If we cannot satisfy a request, we will explain why in our response. We will not charge a fee for processing or responding to your requests. However, we may charge a fee if we determine that your request is excessive, repetitive, or manifestly unfounded. In those cases, we will tell you why we made that determination and provide you with a cost estimate before completing your request. 

Each of these rights can be exercised by using the contact details below or by making your request at https://www.waypointmetrics.com/opt-out. Depending on the request, we may ask for additional information to verify your identity and jurisdiction. 

9. Data Retention 

9.1 Website Users, Customers, and Partners 

We retain Customer and Partner Personal Information for as long as needed to provide you with Services you have requested. We will also retain and process Personal Information as necessary to comply with our legal obligations, resolve disputes and enforce agreements. 

9.2 Device Users 

We retain Personal Information for twenty-four (24) months from the date of collection, in part so that we may analyze annual trends in Device User activity, at which time we either delete it or render the information fully de-identified. We use our best efforts to ensure that the data we retain is kept up to date and accurate. We may keep Personal Information for a longer period of time only where we have a legal or business need to do so, such as for auditing, corporate record-keeping, compliance, accounting, security, or bug-prevention purposes. 

10. Dispute Resolution 

Waypoint commits to resolve complaints about our collection or use of your Personal Information. EU individuals with inquiries or complaints regarding our Privacy Notice should first contact Waypoint at: 

Waypoint Metrics 

1763 Columbia Rd. NW, 
Suite 175 PMB 678149 
Washington, DC 20009 
privacy@waypointmetrics.com

11. How We Secure Your Information 

We maintain commercially reasonable physical, electronic, and procedural safeguards to secure your information from loss, misuse and unauthorized access, disclosure, alteration, and destruction. However, we are unable to guarantee that security measures we take will not be penetrated or compromised or that your Information will remain secure under all circumstances. 

12. Notice of Processing in the United States 

Please be aware that your Personal Information and communications may be transferred to and maintained on servers or databases located outside your state, province, or country. If you are located outside of the United States, please be advised that we process and store all information in the United States. The laws in the United States may not be as protective of your privacy as those in your location and may be deemed by your country to have inadequate data protection. We will only transfer your Personal Information to the United States when there are appropriate safeguards in place. These may include the implementation of the Standard Contractual Clauses. If you do not want your Personal Information transferred to the United States, please do not use this Website. See section 8 of this Notice entitled “Your Privacy Rights” for instructions on how to exercise your rights. 

13. Managing Your Information Preferences 

You can review, correct, update, or change your Personal Information or opt out of receiving certain e-mails by changing the relevant settings in your account or by e-mailing us at privacy@waypointmetrics.com. You can also opt out of receiving marketing e-mails from us by following the link provided at the bottom of all marketing e-mails you receive from us. However, you cannot opt out of receiving all e-mails from us, such as e-mails about the status of your account. If you have questions or concerns regarding this Notice, please e-mail us at that same address. 

14. Children’s Information 

We do not knowingly collect Personal Information of minors under the age of 16 or collect data from Partners who target minors under the age of 16. If you are either a minor under the age of 16 or a parent or legal guardian of a child under the age of 16 and you believe we have collected or processed your or your child’s data, please contact us using the information below. 

15. Changes to this Notice 

We may change the terms of this Notice from time to time. If we make any material changes, we will post the revised Notice on this Website. We will also update the “Effective” date. We encourage you to periodically review this page for the latest information on our privacy practices. 

16. How to Contact Us 

If you have questions about this Notice, please contact Waypoint via e-mail at privacy@waypointmetrics.com with “PRIVACY NOTICE” in the subject line or by mailing us at the following address: 

Waypoint Metrics 

1763 Columbia Rd. NW, 
Suite 175 PMB 678149 
Washington, DC 20009 

privacy@waypointmetrics.com

We will investigate your question, respond to your inquiry, and attempt to resolve any concerns regarding your privacy question. Please allow up to four (4) weeks for us to reply. 

16.1 Data Protection Officer 

We have appointed VeraSafe as our Data Protection Officer (DPO). While you may contact us directly, VeraSafe can also be contacted on matters related to the processing of Personal Information. VeraSafe’s contact details are: 

VeraSafe LLC 

100 M Street S.E., Suite 600 
Washington, D.C. 20003 
USA 
Email: experts@verasafe.com

16.2 EU Representative 

Waypoint has appointed VeraSafe as its representative in the European Union for data protection matters pursuant to Article 27 of the GDPR. If you are in the EU, you may contact VeraSafe in addition to Waypoint on matters related to the processing of your Personal Information. To make such an inquiry, please contact VeraSafe at: 

VeraSafe Ireland Ltd. 

Unit 3D North Point House 
North Point Business Park 
New Mallow Road, Cork T23AT2P 
Ireland
Contact form: https://www.verasafe.com/privacy-services/contact-article-27-representative/

16.3 UK Representative 

Waypoint has appointed VeraSafe as its representative in the United Kingdom for data protection matters pursuant to Article 27 of the UK GDPR. If you are in the UK, you may contact VeraSafe in addition to Waypoint on matters related to the processing of your Personal Information. To make such an inquiry, please contact VeraSafe at: 

VeraSafe United Kingdom Ltd. 

Albert Embankment 
SE1 7TL London 
United Kingdom 
Contact form: https://www.verasafe.com/privacy-services/contact-article-27-representative/