SiteX Privacy Policy

SECTION A — INTRODUCTION

Sitex LLC, a South Carolina limited liability company doing business as SiteX ("Company," "we," "us," "our"), values your privacy. This Privacy Policy explains how we collect, use, disclose, store, and protect information when you use the SiteX mobile application, website, software, APIs, data layers, cost models, and related services (collectively, the "Service," as further defined in the Legal Glossary).

Sitex LLC owns the SiteX trademarks and service marks. Sitex Technologies LLC, a South Carolina limited liability company, owns the SiteX patents and pending patent applications, and licenses such patents to the Company. Except where the context expressly refers to Sitex Technologies LLC’s intellectual property rights or status as licensor, references in this Privacy Policy to the "Company," "we," "us," or "our" refer to Sitex LLC.

By accessing or using the Service, you consent to the practices described in this Privacy Policy and agree to the Terms of Use. If you do not agree, you must discontinue use of the Service.

This Privacy Policy is structured to address the disclosure expectations of applicable U.S. federal and state privacy laws, including the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA). Where specific statutory requirements differ from or supplement those described herein, those statutory requirements control to the extent they apply to your residence or jurisdiction. It aligns with third-party licensor obligations under the LightBox Master Services Agreement ("MSA") and Hexagon Derived Value Add Products Agreement ("DVAP").

Data Controller and Contact Information

Sitex LLC

PO Box 93

Otto, NC 28763

Email: privacy@sitexready.com

Phone: (864) 416-1195

Cross-Document References

This Privacy Policy should be read in conjunction with the Terms of Use, the End User License Agreement (EULA), the Cookie Policy, the Acceptable Use Policy, the Legal Glossary, the DMCA Policy, and the Legal Notices, which govern the contractual terms, permitted use, software licensing, and defined terms of the Service. Specifically: liability limitations follow the Terms of Use Section H; data use is subject to prohibitions in Terms of Use Section C; subscription billing rules are governed by Terms of Use Section D; and dispute resolution is governed by Terms of Use Section K.

The Service includes data and imagery licensed from third-party providers, including LightBox and Hexagon. The end-user restrictions required by those providers are reproduced in the Terms of Use (Section L) and summarized in Section J of this Policy; the Company’s own agreements with those providers govern the relationship between the Company and those providers, and you do not become a party to them by using the Service. You must also comply with the publicly available Hexagon Acceptable Use Policy at https://hxgncontent.com/global/acceptable-use-policy.

In-App Privacy Policy Access

A link to this Privacy Policy is available within the application settings. Users may access the current version of this Privacy Policy at any time through the in-app settings menu.

Scope of Policy

This Privacy Policy applies solely to the Service operated by Sitex LLC and does not apply to third-party websites, datasets, integrations, or external services that may be accessed through links or map layers within the Service. Users are encouraged to review the privacy policies of any third-party services they interact with.

SECTION B — INFORMATION WE COLLECT

We collect information that you provide directly, information collected automatically when you use the Service, information generated through your interactions with mapping and analysis tools, and information obtained from third-party providers. The following provides a meaningful description of the categories of data we collect, the sources of such data, and the third-party recipients, per CCPA/CPRA requirements.

Information You Provide Directly

• Account Information: name, email address, password, and authentication credentials.
• Project Inputs: parcel locations, GPS pins, hand-drawn paths, house pad locations, measurements, utility locations, notes, and annotations you manually enter (non-licensed user data only).
• Communications: emails, inquiries, feedback, or support requests submitted to the Company.
• Account Email Address: When you create an account, join a waitlist, request information, or sign up for communications through our website or the app, we collect your email address for account management, service communications, and marketing communications, subject to your right to opt out of marketing communications at any time as described in Section C.

Location Information (Including Precise Geolocation)

Pre-Collection Notice: Before the Service accesses your device location, the application will request your permission. You will be informed of the purpose of location collection before access is granted.

To function correctly, the Service may request access to your device's location services. We may collect GPS coordinates when you drop a pin or when the app needs to calculate distances; device-based location for utilities, driveway paths, or parcel identification; and coarse or fine location depending on your app permissions.

Precise Geolocation Disclosure: Under California law (CCPA/CPRA), precise geolocation constitutes sensitive personal information. Precise geolocation means location data derived from GPS, Wi-Fi, or cellular technology that can locate an individual or device within a geographic area equal to or less than the area of a circle with a radius of 1,850 feet. GPS accuracy varies depending on the device, satellite availability, obstructions, terrain, weather, and other environmental conditions, and may be materially less precise than the location displayed. When combined with licensed data (e.g., Hexagon imagery or LightBox parcels), no extraction or manipulation is permitted.

Opt-Out and Revocation: You may disable location access at any time through your device settings (iOS: Settings > Privacy & Security > Location Services; Android: Settings > Location). However, certain core features of the Service will not function without location access.

Device and Technical Information

We automatically collect: IP address, device model, operating system version, app version, browser type (if applicable); unique device identifiers and, if enabled by the applicable platform or SDK, advertising identifiers used for attribution, fraud prevention, analytics, or measurement (not for behavioral advertising or sale of personal information); crash logs; performance metrics, load times, analytics events, and in-app interaction logs; and information about how you navigate, interact with, and use the Service.

Usage Data and Derived Analytics

We collect information about parcels viewed, map layers toggled, tools used, utilities tagged, and workflows executed; generated terrain samples, routing requests, cost-estimation steps, and computational events; and app mode selections, zoom levels, and user-initiated actions.

The Service may create aggregated, anonymized analytics to improve accuracy, stability, and performance. Aggregated data does not identify you and excludes any processing of licensed Provider/Licensed Content beyond view-only display; no derivatives created.

Subscription and Payment Information

Subscriptions are processed through the Apple App Store or Google Play Store. We do NOT collect or store full payment card numbers. We receive limited information from the platform such as confirmation of purchase, subscription plan, and renewal or cancellation status.

We collect and maintain:

• Subscription and entitlement status
• Purchase history by product/SKU, including subscription plans and any historical one-time purchases, together with refund and chargeback status
• Offer display data (including offer variants, pricing experiments, conversion events, and feature flag status)

Data from Third-Party Providers

To deliver core features, the Service obtains publicly available or licensed data from the following sources, consisting of map layers, datasets, and geospatial content necessary for app functionality. When the Service renders maps or imagery, Mapbox and Hexagon may receive technical request information necessary to provide those services, which may include network information such as an IP address, the requested tile or geographic area, zoom level, request timestamp, and authentication or service-token information. We do not intentionally provide those providers with your SiteX account identity, contact information, payment information, or user-created project content. Hexagon requests may be made directly to Hexagon or routed through a Company-controlled caching proxy where implemented; any Company-controlled Hexagon cache is subject to a time-to-live of no more than fourteen (14) days. See Section D. Note, however, that licensed property records (such as LightBox parcel and assessor data) may themselves contain information relating to property owners or taxpayers, such as owner or taxpayer names and mailing or tax addresses; this information relates to the underlying real property and is not collected from you:

• USGS: elevation, 3DEP, terrain, and well data.
• FEMA NFHL: flood zone layers.
• Mapbox: maps, tiles, geocoding, and base layers.
• LightBox: parcel, zoning, and assessor attribute data (view-only, no extract).
• Hexagon: aerial imagery (view-only streaming).

Metadata such as tile requests and tile coordinates is limited to what is needed to render the map. We distinguish between transient network and request metadata, cached imagery content, cache keys and tile coordinates, and any user-linked usage history, and we retain each only as described in Section F. Technical map and imagery request information may be processed or logged as needed to render content, operate authorized caching, secure and troubleshoot the Service, and fulfill those retention purposes. The Company does not intentionally use this request information to build profiles of individual users. We do not share your account identity, contact information, payment data, or user-created content with these providers, and the technical request metadata used for map rendering is not used by us to identify you. See Section D.

Government and geospatial datasets such as elevation, terrain, well log, and flood hazard information are associated with geographic locations and are not personal data about you. Licensed property records, by contrast, may include limited personal information relating to property owners or taxpayers, as described above; the Company uses such information only to display property and parcel details within the Service on a view-only basis and does not use it to build profiles of those individuals.

The Service does not transmit personal user information to USGS or FEMA, nor do these agencies receive or process user data through this Service.

Cookies and Tracking Technologies

Our website uses a cookie-consent banner (Accept or Reject, with your choice stored in your browser's local storage), Google Analytics, local storage, and an email-signup tool to manage your consent choices, measure usage, and operate the website and its email signup. Google Analytics loads when you visit the website; if you select Reject, it is disabled for your subsequent activity. The website does not provide user accounts or login. We do not use the website for cross-context behavioral advertising. For complete information about the cookies we use, how they work, and how to manage your preferences, please refer to our Cookie Policy.

Do Not Track (DNT) Disclosure: The Service does not currently respond to Do Not Track browser signals. However, as stated above, we do not engage in cross-site tracking or behavioral advertising.

SECTION C — HOW WE USE INFORMATION

To Provide and Operate the Service

We use your information to display (view-only) licensed layers/attributes (e.g., parcel boundaries, elevation layers, flood zones, imagery, assessor attributes); save and load your project inputs such as pads, driveways, and utility pins (non-licensed); maintain account functionality, authentication, and subscription access; and ensure proper functionality of mapping, GPS, and analysis tools. Automated analyses are limited to permitted overlays and do not extract or create reusable derivative datasets from licensed content.

To Manage Subscriptions, Entitlements, and Access

We use your information to manage Full Subscription and Archive Plan status and enforce access controls.

We use your information to maintain accurate entitlement records, prevent fraud/abuse, investigate chargebacks/refunds, and provide customer support.

We use your information to measure conversions and optimize pricing and offer presentation (including A/B testing and feature-flag experimentation).

Automated Processing Disclosure

Disclosure: The Service uses deterministic, rule-based processing to generate informational planning outputs such as grading classifications, cost estimates, and hazard flags, without individualized human review at the time of generation. These outputs are informational only and do not constitute professional advice. The Service does not use automated processing to make decisions about your eligibility for employment, lending, housing, education, healthcare, or other similarly significant matters. The Service does not distribute underlying derived datasets or grant users rights to extract, manipulate, or reuse licensed provider data.

Types of Automated Determinations

• Driveway Route Overlays: The Service automatically calculates potential driveway paths based on terrain data, slope analysis, and parcel boundaries to display proposed route overlays (overlay only).
• Grading and Slope Classifications: Automated analysis of elevation data to classify terrain steepness and identify areas requiring grading work (display only).
• Preliminary Septic-Siting Indicators: display of preliminary location, slope, spacing, and user-input-based indicators relevant to potential septic placement; the Service does not evaluate soils, conduct a percolation test, determine regulatory approval, or determine whether a septic system is viable (view-only).
• Cost Estimations: Automated calculations of approximate costs for site preparation activities based on terrain analysis, material requirements, and distance factors (no derive).
• Hazard Flags: Automated identification of potential hazards including flood zones, steep slopes, wetland indicators, and other site constraints (from layers).

No Professional Advice: The automated or rule-based outputs generated by the Service, including cost estimates, preliminary route and siting indicators, routing overlays, elevation approximations, or preliminary septic-siting indicators, are provided solely for general informational and planning purposes. These outputs do not constitute surveying, engineering, environmental, zoning, legal, or financial advice, and may not be relied upon as a substitute for professional evaluations.

Opt-Out Limitation: Because this automated processing is how the Service produces its core planning outputs, the Service cannot generate those outputs without it. The processing described here is not used to make legal or similarly significant decisions about you. If you prefer not to use these automated planning features, you may choose not to use them, and you may contact us with questions about how they work.

To Improve Accuracy, Performance, and Feature Quality

We may use data to refine deterministic sampling algorithms and routing feasibility logic (non-licensed user data only); analyze performance trends, load times, error rates, and computational efficiency; enhance terrain modeling, elevation interpolation, and hydrological approximation (aggregated, no licensed processing); and develop new tools, layers, or workflows within the Service. Aggregated analytics do not identify individual users.

To Communicate with You

We may use your information to send account notifications, subscription confirmations or renewal reminders; respond to questions, feedback, and support requests; and notify you of updates, new features, or important service changes. You may opt out of non-essential communications.

To Send Marketing Communications

We use your email address to send you marketing communications about SiteX, including product updates, tips, newsletters, promotions, surveys, contests, and event invitations that may be of interest to you, as well as similar communications about our products and services. You may opt out of marketing communications at any time by clicking the unsubscribe link in any marketing email or by emailing privacy@sitexready.com with the subject line "Unsubscribe." Opting out of marketing emails will not affect your receipt of essential service-related communications described above. Marketing emails will identify the Company as the sender, include the Company’s mailing address, and provide a clear unsubscribe mechanism, consistent with the CAN-SPAM Act (15 U.S.C. § 7701 et seq.). Text message marketing, if any, is sent only with your separate prior express consent and may be revoked at any time by replying STOP or as instructed in the message.

To Protect Security and Prevent Misuse

We use information to detect fraud, abuse, unauthorized scraping, or attempts to extract protected datasets; ensure compliance with LightBox, Hexagon, Mapbox, USGS, FEMA, and other data-license requirements (e.g., no unauthorized tile requests); and investigate security incidents or enforce legal rights.

To Comply with Legal Obligations

We may use information to comply with applicable laws, respond to lawful requests (e.g., subpoenas), and protect rights, property, or safety. This includes complying with our obligations to our third-party data providers.

SECTION D — HOW WE SHARE INFORMATION

We do not sell personal information (as defined under CCPA/CPRA). We share information only as necessary and with safeguards:

• Service Providers: Limited to vendors (e.g., hosting, analytics) bound by data processing agreements (DPAs); no broader access.
• Email Service Provider (Mailchimp): We use Mailchimp (a service of Intuit Inc.) to manage email lists, send marketing communications, and track marketing email engagement (such as open and click activity). Mailchimp processes email addresses, engagement metadata, and unsubscribe status under their privacy practices and our data processing agreement with them. Mailchimp does not receive personal information beyond what is necessary to deliver marketing communications.
• Product Analytics Provider (Mixpanel): We use Mixpanel to understand how users navigate and use the Service. Mixpanel may receive product-analytics events such as user-journey and screen or feature usage, workflow progression, completion and conversion events, and error or performance events, and these events may be associated with a SiteX account identifier or email address. We do not provide Mixpanel with project names, drawn path geometry, parcel coordinates, or utility-marker locations.
• Licensed Providers (Mapbox and Hexagon): May receive the technical request information described in Section B that is necessary to provide map and imagery services. We do not intentionally provide them with your SiteX account identity, contact information, payment information, or user-created project content. LightBox data is delivered to the Company in bulk and is not queried on a per-user basis during normal Service use.
• Billing Platforms: Limited confirmations (e.g., purchase status) to Apple/Google.
• Legal Requirements: As required by law, regulation, or to protect rights (e.g., subpoenas; licensor audits).
• Business Transfers: In mergers/acquisitions, to successors bound by this Policy.
• Aggregated/Anonymized Data: Non-identifiable aggregates for research; no re-identification.
• With Consent: Only with explicit user consent.

Do Not Sell or Share: We do not sell or share personal information for cross-context behavioral advertising. California residents may submit opt-out requests to privacy@sitexready.com.

SECTION E — YOUR PRIVACY RIGHTS

We extend CCPA/CPRA (as defined in Section A) rights to all U.S. users. We also comply with applicable state privacy laws, including but not limited to the Virginia Consumer Data Protection Act (CDPA), Colorado Privacy Act (CPA), Connecticut Data Privacy Act (CTDPA), and other states with comprehensive privacy statutes, to the extent their requirements differ from or supplement CCPA/CPRA. Requests via privacy@sitexready.com; verification required (e.g., account match). Response within 45 days (extendable). No discrimination for exercising rights.

• Right to Know/Access: Request access to the categories, sources, and purposes, and the specific pieces, of personal information we maintain about you, including information collected beyond the preceding twelve (12) months where required by applicable law.
• Right to Delete: Request deletion of personal information (subject to exceptions, e.g., legal obligations; includes purge of temporary licensed caches).
• Right to Correct: Request correction of inaccurate personal information.
• Right to Opt-Out of Sale/Sharing: Not applicable (no sales/sharing); but honored if requested.
• Right to Limit Use of Sensitive Personal Information: We use precise geolocation only as needed to provide requested location-based features, maintain security, and fulfill the other purposes disclosed in this Policy. You may disable location access through your device settings, although doing so may prevent certain location-based features from functioning. We do not use sensitive personal information for purposes that would require a separate right to limit under applicable law.
• Rights Regarding Automated Processing: The automated processing in the Service produces informational planning outputs and is not used to make decisions about your eligibility for employment, lending, housing, education, healthcare, or other similarly significant matters. Where applicable law provides rights regarding automated decision-making used for such significant decisions, those rights apply to that type of processing, and the informational planning features of the Service are not conditioned on waiving any such right.
• Right to Portability: Receive personal information in structured format.
• Right to Non-Discrimination: No adverse action for rights exercise.
• Authorized Agents: Submit with proof of authorization.
• Response Time: Up to 45 days. Right to Appeal: If your request is denied in whole or in part, you may submit an appeal by emailing privacy@sitexready.com with the subject line “Privacy Rights Appeal.” We will respond to your appeal within 45 days. If we deny your appeal, you may contact your state attorney general to submit a complaint, as provided under the Virginia Consumer Data Protection Act (CDPA), Colorado Privacy Act (CPA), Connecticut Data Privacy Act (CTDPA), and other applicable state privacy statutes.
• Minors: No knowing collection from individuals under 18. The Service is intended for users 18 years of age or older.

SECTION F — DATA RETENTION AND STORAGE PRACTICES

We retain data only as necessary for purposes described, then securely delete/destroy.

• Account and Project Data (including user-generated project inputs such as pads, driveways, utility markers, and notes): Retained while the user has a recognized active access or preservation path under the Terms of Use. After all such access ends, it is deleted (generally within 30 days, subject to the termination provisions of the Terms of Use and EULA, legal holds, retention obligations, and licensor compliance requirements). This category does not include entitlement data, which is governed separately below.

If you no longer have any active access path recognized under Terms of Use Section D.1, including any Full Subscription, free trial, Partner-funded or complimentary access, Grandfathered Legacy Access under Terms of Use Section D.10, separate-agreement access, Archive Plan, or platform-recognized grace or account-hold entitlement, your other stored account and project data is retained for thirty (30) days and then deleted, except where longer retention is required by law, legal hold, or licensor obligations; the Archive Plan preserves your stored data, which remains inaccessible, until you cancel it, as described in Terms of Use Sections D.2A and D.11. After three (3) years of account dormancy (no login, subscription, purchase, or Service activity), the Company may delete personal data that is no longer needed and require reactivation, but does not cancel or void an active paid plan merely due to dormancy, as described in the Dormant Account policy in Terms of Use Section D.6A. Upon account termination, active entitlement data such as your subscription-access status may be deleted; purchase transaction history is retained for four (4) years as described below.

• Location Data: Revoking device location permission stops future collection through the device's location services. Coordinates and other location information already saved as part of a project are retained and deleted according to the Account and Project Data schedule above. Licensed-derived views are purged on termination per licensor terms.
• Usage and Analytics: Aggregated, deidentified statistics may be retained indefinitely. Identifiable analytics are retained only as long as reasonably necessary for the disclosed analytics, security, and support purposes, after which they are deleted or deidentified.
• Subscription Billing and Historical Purchase Transaction Records: Retained for four (4) years for accounting, audit, fraud prevention, legal compliance, dispute resolution, and support, and longer only where reasonably necessary for an audit, legal hold, tax matter, fraud investigation, chargeback, or unresolved dispute.
• Entitlement and Purchase Transaction History (including purchase confirmations, subscription plan changes, refund/chargeback records, and related transaction data): Retained for four (4) years for accounting, audit, fraud prevention, legal compliance, dispute resolution, and support, and longer only where reasonably necessary for an audit, legal hold, tax matter, fraud investigation, chargeback, or unresolved dispute. For clarity, this retention applies to historical transaction records and does not itself create or extend any entitlement.
• Grandfathered Legacy Access Eligibility Records: A limited record sufficient to establish that an account completed a qualifying purchase before the Legacy Cutoff Date (such as an account identifier, an indicator that a qualifying purchase occurred, and the date of that purchase) is retained for as long as the account holds Grandfathered Legacy Access under Terms of Use Section D.10, and for a reasonable period afterward to resolve disputes about eligibility. This record is retained separately from, and may outlast, the four (4)-year transaction-history retention described above, because Grandfathered Legacy Access does not expire on a fixed date and eligibility must remain verifiable for as long as the access continues. This record contains no payment card data.
• Communications: Retained for 3 years post-resolution.
• Legal Holds: Retained longer if required (e.g., disputes, licensor compliance).

Data Minimization: Collect/use only what's necessary; pseudonymize where possible.

Deletion Process: The Company uses reasonable deletion or deidentification procedures appropriate to the systems involved and provides confirmation where required by law or upon completion of a verified deletion request. This includes purging any temporary licensed caches.

User Deletion Certification: Upon termination of your account or the Company's licensor agreements, you must delete all cached or downloaded views of licensed content from your devices and, upon request, certify such deletion in writing.

Aggregated and Deidentified Utility Analytics: The Company may retain aggregated or sufficiently generalized statistics derived from utility-marking activity only where the information cannot reasonably be linked to a user, account, household, parcel, project, or precise location. The Company will not attempt to reidentify such information.

SECTION G — DATA SECURITY PRACTICES

We implement reasonable administrative, technical, and physical safeguards to protect personal information:

• Encryption: Encryption in transit and at rest where applicable.
• Access Controls: Role-based access controls and authentication safeguards; logging of access. Comply with Hexagon access gateways; virus scans per DVAP §3.3.
• Secure Storage: AWS-hosted infrastructure; no unnecessary retention.
• Device Security: You secure your device; we advise updates/antivirus.
• Vendor Management: Contracts require equivalent protections.
• Incident Response: Notify affected individuals, regulators, and law enforcement as and when required by applicable law, and notify our data providers as required by our agreements with them (including notifying Hexagon of any virus transmission affecting their systems); investigate promptly.
• Monitoring: Logs for suspicious activity; no method completely secure—use at your own risk.
• User Responsibilities: Protect credentials; log out; report issues.
• Limitations: No guarantee against all risks (e.g., public Wi-Fi).

SECTION H — AGE RESTRICTION AND CHILDREN'S PRIVACY

The Service is intended for individuals 18 years of age or older. We do not knowingly collect personal information from individuals under 18. If we learn that we have collected personal information from an individual under 18, we will delete it promptly. Parents/guardians: Contact privacy@sitexready.com to review/delete a minor’s data or deactivate their account.

SECTION I — INTERNATIONAL USERS AND DATA TRANSFERS

United States Data Storage

The Service is operated from the United States and is intended only for users located in the United States. We do not offer or direct the Service to individuals in the European Economic Area, the United Kingdom, or other jurisdictions outside the United States. If you nonetheless access the Service from outside the United States, you do so on your own initiative; your information will be transferred to, stored in, and processed in the United States; and you are responsible for compliance with any local laws that apply to you.

International Users

The Service is not directed to individuals outside the United States. To the extent anyone outside the United States accesses the Service, information is handled under this Privacy Policy and applicable law, and we apply the practices described in this Privacy Policy to the information we process.

Withdrawal of Consent

If you previously provided consent for processing (such as enabling device location), you may withdraw it at any time through device settings. Withdrawal does not affect the legality of processing already performed.

SECTION J — THIRD-PARTY PROVIDER LICENSING DISCLAIMERS

The Service incorporates data, imagery, and services from third-party providers. Your use of such content is subject to the following licensing terms and restrictions, which flow down from our agreements (no less stringent). Conflicts controlled by this Section; however, Section L (Licensor Compliance Addendum) supplements this Section J and, where conflicting, controls; and in the event of a conflict between Section L of this Privacy Policy and Terms of Use Section L, the Terms of Use shall govern with respect to third-party data licensing restrictions, intellectual property obligations, and attribution requirements. All third-party data integrated into the Service is provided “as is” and “as available” without warranties of any kind, express or implied.

LightBox Data

Parcel, zoning, and assessor attribute data is provided by LightBox. Data © LightBox. Use of LightBox Data is subject to the following restrictions:

• Users may not cache or retain LightBox Data on their devices beyond the current session.
• Downloading, scraping, storing, exporting, extracting, manipulating, or creating derivative datasets from LightBox Data is strictly prohibited; LightBox Data may not be made available in any bulk, raw, or manipulatable format.
• LightBox Data may only be used within the Service for its intended purpose and may not be extracted or redistributed.

Minimal permitted subsets (Land Use Description, Parcel ID, Parcel Address, Lot Size, Coordinates, Use Code, Zoning) may appear in static PDF exports; primary purpose must be Service content, not LightBox Data alone. Permitted copying: Parcel ID, Parcel Address, Coordinates, Tax Address only. Internal business only; no derive/sublicense beyond view-only per MSA. All IP rights remain with LightBox. No endorsement is implied.

Hexagon Imagery

Aerial imagery, orthophotography, and map tiles ("Hexagon Content") are licensed for view-only use per the Derived Value Add Products Agreement and End User Access Agreement. Hexagon imagery must display the attribution required under the Company's applicable Hexagon agreement and Hexagon's then-current published data-attribution guidelines. Your access to Hexagon Content is granted as a limited, non-exclusive, non-transferable sublicense for personal or internal business use only, not for resale, and is limited to a term of one (1) year, subject to automatic renewal contingent upon the Company's continued licensing from Hexagon. The Service may generate on-screen visualizations and limited, low-resolution map thumbnails within project outputs that incorporate Hexagon Content for documentation purposes only. Use of Hexagon Content is subject to the following restrictions:

• Except for the on-screen visualizations and limited, low-resolution thumbnails the Service is authorized to generate in project outputs, you may not download, copy, export, scrape, redistribute, or extract Hexagon Content.
• Hexagon Content may be requested directly from Hexagon or routed through a Company-controlled server-side proxy; where a Company-controlled cache is used, it has a time-to-live of up to fourteen (14) days, and Hexagon imagery may also be cached temporarily on a user’s device for personal offline use through the Mapbox SDK. The Company does not store Hexagon Content in bulk.
• No mosaic, stitch, tile, orthorectify, or creation of derivative datasets, databases, or extractable data products from Hexagon Content outside the application environment.
• Any permitted exports must include: Hexagon attribution as required under the Company's applicable Hexagon agreement and Hexagon's then-current published data-attribution guidelines in proximity to imagery.
• Users may not alter, obscure, or remove any Hexagon copyright notices displayed within the Service or in any permitted exports.
• Users may not transfer, store, or grant access to Hexagon Content on any electronic network for use by any person without prior written permission from Hexagon.
• Users must comply with the Hexagon Acceptable Use Policy at https://hxgncontent.com/global/acceptable-use-policy, as updated from time to time.

Hexagon Content is not for navigation, surveying, or derivative dataset creation. All intellectual property rights remain exclusively with Hexagon. No implied license is granted. Hexagon does not endorse this Service or any outputs generated by the Service. Sublicense: One-tier, view-only.

Native-Application-Only Access to Licensed Data. Access to Hexagon Content and any other Licensed Data subject to third-party streaming restrictions is limited to the native SiteX mobile application. The Company’s website and any browser-based experience are used only for legal notices, help content, marketing, and related informational functions, and do not display, host, cache, export, or expose Licensed Data or Hexagon imagery except as expressly authorized in a written agreement signed by the Company and, where required, the applicable provider.

Mapbox

Map tiles, geocoding, and base layers are provided by Mapbox. Use of Mapbox services is subject to the Mapbox Terms of Service. Required Attribution: © Mapbox © OpenStreetMap contributors.

USGS Data

Elevation, 3DEP, terrain, and well data is provided by the United States Geological Survey (USGS). USGS data is in the public domain and may be freely used. However, USGS provides this data without warranty, expressed or implied, as to accuracy, completeness, or fitness for any particular purpose.

FEMA National Flood Hazard Layer (NFHL)

Flood zone data is provided by the Federal Emergency Management Agency (FEMA) National Flood Hazard Layer (NFHL). NFHL data displayed within the Service is for informational purposes only. This is not an official Flood Insurance Rate Map (FIRM). FEMA does not endorse this Service or any outputs generated by the Service. Flood zone color coding, symbology, and legend conventions used in the Service follow standard practices derived from FEMA mapping guidelines for user familiarity; use of these conventions does not imply FEMA affiliation, endorsement, or certification. For official flood zone determinations, consult FEMA directly or obtain an official FIRM through your local floodplain administrator. The Service does not display, reproduce, or incorporate the official FEMA seal, logo, or insignia. Unauthorized use of federal agency seals and logos is prohibited under 18 U.S.C. §§ 506, 701, and 1017. See also 44 CFR Parts 59–78 for NFIP regulations. In accordance with FEMA’s NFHL metadata guidance, the Company acknowledges FEMA as the source of flood hazard data integrated into the Service.

SECTION K — CHANGES TO THIS PRIVACY POLICY

Right to Update or Modify This Policy

We may update, revise, or modify this Privacy Policy at any time to reflect new features or functionality within the Service; changes in data practices; updates required by law, regulation, or industry standards; and adjustments related to new third-party providers or data sources.

Notice of Changes

When we make material changes, we will notify users by one or more of the following: updating the effective date at the top of this Privacy Policy; posting a notice within the Service or on our website; and sending an email or in-app notification, where appropriate. Non-material changes (such as clarifications or formatting adjustments) may be made without separate notice.

Where changes to end-user restrictions are required by the Company’s data providers (for example, attribution updates), they may take effect immediately, with notice provided as practicable.

Effective Date of Changes

Changes become effective when posted unless otherwise stated. Material changes will be communicated through reasonable notice and, where required by law or designated by the Company, may require renewed affirmative acceptance; non-material changes may become effective upon posting. Your continued use of the Service after the effective date constitutes acceptance of the updated Privacy Policy only where renewed affirmative acceptance is not required. Changes shall not broaden user rights beyond licensor terms.

If You Disagree with Changes

If you do not agree with any changes to this Privacy Policy, you must stop using the Service and may request deletion of your information by contacting: privacy@sitexready.com.

SECTION L — LICENSOR COMPLIANCE ADDENDUM

This Addendum forms an integral part of this Privacy Policy and supplements for compliance with obligations required by Hexagon and LightBox. Where conflict exists between this Section L and other portions of this Privacy Policy, this Section L controls; however, in the event of a conflict between this Section L and Terms of Use Section L, the Terms of Use shall govern with respect to third-party data licensing restrictions, intellectual property obligations, and attribution requirements.

L.1 Prohibited Activities

• Except for the limited authorized static outputs the Service generates (such as the permitted LightBox PDF fields and low-resolution Hexagon thumbnails described in Section J), users may not download, export, copy, scrape, or redistribute any licensed imagery or parcel dataset.
• Any attempt to bypass access controls or extract underlying data is grounds for immediate termination.
• Licensed datasets are not retained except as needed to deliver the Service, including the temporary server-side and on-device caching described in Terms of Use Section L and the limited authorized static outputs (permitted LightBox PDF fields and low-resolution Hexagon thumbnails) generated by the Service.

L.2 Required Attributions

• Hexagon attribution as required under the Company's applicable Hexagon agreement and Hexagon's then-current published data-attribution guidelines (in-app when imagery displayed; in exports)
• "© LightBox" (in exports only; no in-app requirement)
• "© Mapbox © OpenStreetMap contributors"

This section discloses required attributions for licensed data. Attribution placement (in-app UI vs. exports) is governed by the Terms of Use and EULA. The Company complies with the security and virus-notification obligations in its agreement with Hexagon.

L.3 Retention and Purge Requirements

• The Company stores the licensed LightBox parcel dataset on its own backend, delivered in bulk under the Company’s enterprise license, and serves it to users on a view-only basis; users receive no right to download, extract, or retain it. Hexagon imagery is not stored in bulk by the Company; it may be requested directly from Hexagon or routed through a Company-controlled server-side proxy (where used, with a time-to-live of up to fourteen (14) days), and may also be cached temporarily on a user’s device for personal offline use through the Mapbox SDK.
• Upon termination of Company licensing, all licensed content will be purged as required by licensors.
• Aggregated or sufficiently generalized user-generated statistics may be retained where they cannot reasonably be linked to a user, account, household, parcel, project, or precise location.

L.4 No Implied Relationship

User access to Hexagon or LightBox Content does not create any contractual relationship between users and licensors.

L.5 Governing Law for Licensor Provisions

The Company’s agreements with its data providers are governed by their own controlling law, including Georgia law for Hexagon (Leica Geosystems) and Delaware law for LightBox; those agreements govern the relationship between the Company and each provider, and nothing in this Privacy Policy alters or overrides those requirements.

SECTION M — REQUIRED MAPPING AND DATA ATTRIBUTION

This section identifies the mandatory attribution requirements for third-party mapping and geospatial data providers whose content is displayed within the Service. Attribution requirements differ based on context: some sources require in-app UI attribution (map footer or attribution bar) when displayed, while others require attribution only in exported materials.

The Service uses multiple imagery and vector data providers across different zoom levels, including Mapbox, OpenStreetMap contributors, Hexagon, and LightBox. Required attribution is as follows:

• “© Mapbox” — Required for all Mapbox satellite, aerial, and tile-serving infrastructure used in the Service.
• "© OpenStreetMap contributors" — Required when using Mapbox Streets or any Mapbox vector layers that incorporate OpenStreetMap data.
• Hexagon attribution as required under the Company's applicable Hexagon agreement and Hexagon's then-current published data-attribution guidelines — Required in-app (map footer or attribution bar) when Hexagon aerial imagery is displayed. Also required in exported materials containing Hexagon imagery.
• "© LightBox" — Required in exported materials (PDFs, exports) containing LightBox parcel data. No persistent in-app attribution required.

In-App UI Attribution: Mapbox and OpenStreetMap contributors are always required when their basemap is displayed. Hexagon is required when aerial imagery is displayed. In-app attribution should appear in a map footer or attribution bar; no watermarking is required.

In-App Attribution Exclusions: USGS elevation data (public domain), FEMA flood hazard data (provided it is presented as informational and non-authoritative), and LightBox parcel data do not require persistent in-app attribution. These sources are acknowledged in documentation and exported materials.

Export Attribution: All applicable attributions must appear on the same page as the data in exported materials (PDFs, exports). Users may not remove, obscure, or alter any attribution associated with licensed or open-data sources.

SECTION N — CONTACT INFORMATION

If you have any questions, requests, or concerns regarding this Privacy Policy or our data practices, you may contact us using the information below:

Sitex LLC

PO Box 93

Otto, NC 28763

Email: privacy@sitexready.com

Phone: (864) 416-1195

We will make reasonable efforts to respond to inquiries and requests in a timely manner.

SECTION O — ACCESSIBILITY

This Privacy Policy is available in readable formats. If you require this Privacy Policy in an alternative format (such as large print, plain text, or audio), please contact us at privacy@sitexready.com and we will make reasonable efforts to accommodate your request.

SECTION P — SEVERABILITY

If any provision of this Privacy Policy is found to be unlawful, void, or unenforceable, that provision shall be modified to the minimum extent necessary to make it enforceable, or if modification is not possible, severed from this Privacy Policy. The remaining provisions shall remain in full force and effect.

SECTION Q — ASSIGNMENT

You may not assign or transfer your rights or obligations under this Privacy Policy without prior written consent of the Company. The Company may assign this Privacy Policy and any rights or obligations hereunder to any affiliate, successor, or acquiring entity without your consent, provided that the assignee agrees to be bound by the terms of this Privacy Policy with respect to the handling of personal information. Subject to the foregoing, this Privacy Policy shall bind and inure to the benefit of the parties and their respective successors and permitted assigns.

SECTION R — SURVIVAL

The following provisions shall survive termination or expiration of this Privacy Policy and any user account: Section D (How We Share Information, to the extent necessary to comply with legal obligations), Section E (Your Privacy Rights), Section F (Data Retention and Storage Practices), Section G (Data Security Practices), Section H (Age Restriction and Children’s Privacy), Section I (International Users and Data Transfers, to the extent necessary for ongoing data retention and processing), Section J (Third-Party Provider Licensing Disclaimers), Section L (Licensor Compliance Addendum), Section P (Severability), Section Q (Assignment), this Section R (Survival), and any other provisions that by their nature should survive. The survival provisions of this Privacy Policy and the Terms of Use are cumulative and each independently enforceable.

— END OF PRIVACY POLICY —

© 2026 Sitex LLC. All rights reserved. SiteX trademarks owned by Sitex LLC; SiteX patents owned by Sitex Technologies LLC and used under license. | v4.10