Lollipop Privacy Policy

Updated September 24, 2025

1. Scope of This Policy

Culture Software Solutions, Inc. ("Lollipop," "we," "us," "our") respects your privacy and values your trust. The purpose of this Privacy Policy is to inform you of the treatment and handling of personal information that we may learn about you from using our website at www.trylollipop.com (the "Site"), from purchasing products and services from us or engaging with our content, or by use of any of our services (collectively, the "Service"). If you have any questions regarding this information or our privacy practices, please contact us via the methods set out in the How to Contact Us section at the end of this Privacy Policy.

You may print a copy of this Privacy Policy by clicking here [INSERT LINK THAT LAUNCHES PRINTABLE VERSION].

2. Agreement to Terms

By using or accessing our Service in any manner, you acknowledge that you accept the practices and policies outlined below and the policies outlined in our Terms of Use, and you hereby consent that we may collect, use, and disclose your personal information as described in this Privacy Policy. If you do not agree with the terms of this Privacy Policy and our Terms of Use, then you should immediately discontinue use of the Service without providing us with any personal information.

3. Information We Collect

We may collect the following categories of personal information (a) directly from you (such as when you create an account, interact with the Service, or when you contact us), (b) from third parties, such as when your employer provides us with your workplace contact information to grant you access to the Service; (c) from the device and browser that you use to access the Service, and (d) from cookies and similar technologies.

Identifiers

We may collect your first name, last name, email address, account username and password, postal address, and phone number.

Professional and/or Employment Information

We may also collect your work contact information (such as email and phone number) and company name.

Health Information

We may collect information relating to your health and wellbeing, including descriptions of your moods and state of mind. This information is used to track individual and group sentiment in the workplace.

PLEASE NOTE THAT WE DO NOT COLLECT—AND YOU SHOULD NOT SUBMIT—MEDICAL INFORMATION. LOLLIPOP IS NOT A HEALTH CARE PROVIDER AND THE INFORMATION THAT YOU SUBMIT TO US IS NOT CONSIDERED PROTECTED HEALTH INFORMATION (PHI) UNDER THE HEALTH INSURANCE PORTABILITY AND ACCOUNTABILITY ACT (HIPAA).

User-generated Content

We collect the information and content of communications that you share through the Service. This may include your survey answers (including descriptions of moods and state of mind), and any information you choose to provide when you contact us. Although we want you to check in to let us know how you are feeling, Lollipop is not a replacement for your employer's Human Resources (HR) department. If you believe that you are being harassed or discriminated against at your workplace, you should not report that information through the Service. All reports of workplace harassment and discrimination should be reported directly to your employer's HR department and/or other personnel designated by your employer.

Inferences

We may also draw inferences from the information that we collect that reflect your preferences, characteristics, psychological trends, behavior, and attitudes.

Device Information

We may collect device information when you use our Service. Device information may include your device type, browser type, online and/or unique identifiers, IP address, and geolocation information.

Internet Activity

We may collect information concerning your interaction with the Service, including when you access the Site and your browsing activity on the Site (such as which pages you visit, in what order, and for how long). This may also include "traffic data" or tracking information provided by the Site's host or similar providers (e.g., Google Analytics) that may be helpful for marketing purposes or for improving the Service.

Information that is Not Personal Information

We may create aggregated, de-identified or anonymized data from the personal information we collect, including by removing information that makes the information personally identifiable to a particular user. We may use such aggregated, de-identified or anonymized information and share it with third parties for our lawful business purposes, including to analyze, build and improve the Service and promote our business, provided that we will not share such information in a manner that could identify you.

SENSITIVE PERSONAL INFORMATION NOTICE:

The health and wellbeing information you provide, including mood descriptions, constitutes sensitive personal information under California law. You have the right to limit our use of this information to purposes necessary for providing our services. To exercise this right, contact privacy@trylollipop.com. Residents of California should review the California Privacy Rights Addendum attached hereto.

For enterprise customers, your employer is responsible for obtaining necessary consents and providing required notices for workplace wellness programs. Individual employee rights may be exercised directly with us or through your employer's designated privacy contact.

We do not currently collect biometric identifiers (such as fingerprints or facial recognition data). If we expand to collect biometric information in the future, we will provide separate notice and obtain specific consent as required by applicable state laws, including Illinois' Biometric Information Privacy Act.

You are not required to provide all personal information identified in this Privacy Policy to use our Service or to interact with us, but certain functionality will not be available if you do not provide certain personal information. For example, if you do not provide certain personal information, we may not be able to register your account or respond to your requests.

4. Cookies

We store certain information that gets collected automatically at our end through cookies and other similar technologies. A cookie is a small string of information that a website that you visit transfers to your browser for identification purposes. Cookies can be used to follow your activity while using a website or across websites, and that information helps companies understand your preferences and tendencies, as well as improve and personalize your website experience. Some cookies are necessary to operate a website, while others can be functional, or analytical, (as discussed in more detail below). Cookies on the Site are generally divided into the following categories:

Strictly Necessary Cookies. These are required for the operation of the Site. They include, for example, cookies that enable you to log into password-protected portions of the Site. These cookies are session cookies that are erased when you close your browser.
Analytical/Performance Cookies. These allow us to recognize and count the number of visitors to the Site and understand how such users navigate through the Site (e.g., when and which pages are visited, in what order the pages are visited, and where a user is located). We also use Google Analytics for part of this process. For more information about Google Analytics, please visit www.google.com/policies/privacy/partners/. Google provides users with the ability to prevent their data from being used by Google Analytics—learn more by going to https://tools.google.com/dlpage/gaoptout.
Functional Cookies. These improve the functional performance of the Site and make it easier for you to use. For example, cookies are used to remember that you have previously visited the Site and asked to remain logged into it (e.g., this saves your username). These cookies qualify as persistent cookies because they remain on your device for use during your next visit to the Site. You can delete these cookies as detailed below.

You can also prevent the use of certain cookies by modifying your Internet browser settings, typically under the sections "Help," "Internet Options," or "Settings." If you disable or delete certain cookies in your Internet browser settings, you may still access our Site, however, you might not be able to access or use important functions or features of our Site, and you may, for example, be required to re-enter your log-in details.

Do-Not-Track Signals

At this time, we do not recognize automated "do-not-track" browser signals.

5. Children's Privacy

The Service is not intended for users under the age of 16 and Lollipop does not knowingly collect personal information from individuals under the age of 16. If you are aware of, or suspect that, someone under the age of 16 is using the Service without permission, please notify us immediately by contacting us as detailed in the How to Contact Us section below. If you have questions or concerns about the Internet and privacy for your child, we encourage you to check out the FTC Guidelines for protecting your child's privacy online.

6. Our Use of Personal Information

We collect and use your personal information for the following purposes:

Providing employee wellness services as reasonably necessary for the employment relationship;
Generating workplace sentiment reports for management decision-making;
Detecting security incidents and protecting against fraudulent activity;
Complying with legal obligations including workplace safety requirements;
Internal quality assurance and service improvement; and
Communications directly related to your account and services
Administering promotions, events, or surveys;
Analyzing use of the Site;
Keeping track of login credentials and click stream data; and
Detecting security incidents and protecting against malicious, deceptive, fraudulent, or illegal activity, or prosecuting those responsible.

We do not use your personal information for cross-context behavioral advertising. We do not sell or share personal information for cross-context behavioral advertising purposes.

We use artificial intelligence to analyze aggregated, de-identified employee wellness data to provide empathetic response suggestions to managers. AI systems do not make employment decisions or recommendations. All AI-generated guidance is advisory only and subject to human oversight. Managers are trained that AI suggestions should not influence employment decisions, performance evaluations, or disciplinary actions.

7. Our Disclosure of Personal Information

We may share your personal information with the following third parties:

Service providers, including Cloud infrastructure providers (Amazon Web Services, Microsoft Azure) - data hosting and storage
Analytics providers (Google Analytics) - website usage analysis
Communication providers (SendGrid, Twilio) - email and text notifications
Customer success and support tools for service delivery
Your employer or designated workplace contacts for workplace wellness reporting
Advisers and financial institutions, including auditors, notaries, business continuity support service providers, and legal, tax, and risk and compliance advisors.
With third parties in connection with a change to the control or financial status of the company, including a corporate restructuring, sale, acquisition, financing, reorganization, bankruptcy, receivership, transfer, assignment of assets, or business merger or divestiture.
Government bodies, dispute resolution organizations, law enforcement agencies, or third parties in connection with legal compliance or protection of rights.

8. Your Privacy Choices

If you no longer want to receive our newsletters, emails, or other marketing communications, you may unsubscribe at any time by following the unsubscribe options in the communication itself or by emailing us at support@trylollipop.com.

To opt-out of text messages, you may text "STOP" in reply to any Lollipop marketing text message.

Please note that you cannot unsubscribe from certain correspondence from us, including messages relating directly to your account or purchases placed through the Site.

You may request to review, amend, or have us delete certain personal information that we hold about you. To make a request you can email us at support@trylollipop.com. We may request you verify your identity by providing us with your user email address and account password. You may also request we delete your user account.

You may exercise privacy rights by: (1) contacting us directly at privacy@trylollipop.com; or (2) submitting requests through your employer's designated privacy contact. For enterprise accounts, we may require verification through your employer before processing certain requests. You have the right to: review personal information we maintain about you; correct inaccurate information; request deletion of your account and personal data; and opt-out of certain data processing activities. California residents have additional rights which are outlined in the California Privacy Rights Addendum attached to these Terms.

9. Security

We maintain reasonable technical and organizational measures to protect personal information from loss, misuse, alteration, or unintentional destruction. We have implemented various security measures to protect both the personal information and the general information that we receive from you through the Service. Whenever you give out personal information online there is a risk that third parties may intercept and use that information. Although we seek to protect your personal information and privacy, we cannot guarantee the security of any information you disclose online. To the extent permitted under applicable law, we assume no liability or responsibility for disclosure of your information due to errors in transmission, unauthorized access by third parties, or other causes beyond our control.

You play an important role in keeping your information secure. You should not share your username or password with anyone. If you have reason to believe that your account is no longer secure, please contact us immediately at support@trylollipop.com or at the contact information in the How to Contact Us section below.

PRIVACY IMPACT NOTICE:

Our processing of employee wellbeing data involves potential privacy risks due to the sensitive nature of mental health information and workplace power dynamics. We've implemented safeguards including voluntary participation, limited access controls, data minimization, and employee rights protections to address these risks.

10. Additional Disclosures for Residents of California

If you are a California resident, in accordance with Cal. Civ. Code § 1789.3, you may report complaints to the Complaint Assistance Unit of the Division of Consumer Services of the California Department of Consumer Affairs by contacting them in writing at 1625 North Market Blvd., Suite N 112 Sacramento, CA 95834, or by telephone at (800) 952-5210. Please see the California Privacy Rights Addendum to these Terms.

11. Additional Disclosures for Residents of Canada

This section contains additional disclosures for residents of Canada. As noted above, you may view and/or update certain information associated with your account (e.g., name, email address, password) by logging into your account. If you wish to request access to or correction of other personal information, or to opt-out of the processing of your personal information or request that we delete your personal information, you may contact us at privacy@trylollipop.com with the subject line "Canada Privacy" so that we can get your email to the right team. You may also contact us for information about how foreign-based service providers process your personal information or if you have any questions or complaints about the manner in which we treat your personal information.

We retain identifiable personal information for as long as necessary to fulfill the purposes for which the information was collected, typically no longer than 2 years after account termination. Aggregated, de-identified data may be retained indefinitely for statistical and research purposes as described in our SaaS Agreement.

Links to Other Websites

For your convenience, we may link to third-party sites and services, or otherwise display third-party content through our Site to provide increased value to our visitors. We have no control over these linked sites, each of which has separate privacy and data collection policies and practices independent from us. As such we have no responsibility or liability for these independent policies or actions and are not responsible for the privacy practices or the content of any such websites. Please note that these other sites may send their own cookies to users, collect data, or solicit personal information, and we encourage you to review their policies before engaging with these third-party sites.

12. Effective Date and Changes to This Privacy Policy

This Privacy Policy is effective as of the date at the top of this policy. Lollipop has the discretion to update this Privacy Policy at any time. When we do, we will revise the effective date at the top of this page. We encourage users to frequently check this page for any changes and to stay informed about how we are helping to protect the personal information we collect, especially before you provide information, and particularly personal information, directly to us through the Service. In the event of a material change to this Privacy Policy, we will provide a message through our website or via email informing you of the change.

13. How to Contact Us

If you have any questions about this Privacy Policy or our Service, please contact us at privacy@trylollipop.com.