PLY FINANCIAL, INC — SERVICEM8 ADD-ON PRIVACY POLICY

1. INTRODUCTION AND SCOPE

This Privacy Policy applies specifically to the Ply add-on for ServiceM8 (the "Add-on") and describes how Ply Financial, Inc ("Ply," "we," "us," or "our") collects, uses, stores, discloses, and retains data when you connect your ServiceM8 account to Ply.

This policy supplements Ply's general privacy policy (available at getply.com/privacy-policy). Where this policy addresses a topic specific to the ServiceM8 integration, this policy controls. For all other data practices, the general privacy policy applies.

In this policy, "you" and "your" refer to the ServiceM8 account holder (typically a trade or field-service business) who installs and connects the Add-on. "End customers" and "staff" refer to individuals whose personal data may be present in your ServiceM8 account and processed by Ply on your behalf.

Controller and Processor Roles. When Ply processes data that originates from your ServiceM8 account — including end-customer details and staff information — you are the data controller and Ply acts as a data processor on your behalf. Ply processes this data solely in accordance with your instructions (as expressed through the Add-on's configuration settings) and for the purposes described in this policy. For data that Ply collects independently (such as your Ply account registration information and billing details), Ply is the data controller.

2. WHAT THE ADD-ON DOES

Ply is an inventory, purchasing, and job-costing system for trade and field-service businesses. The ServiceM8 Add-on keeps a contractor's jobs, staff, pricebook, and job materials in sync between ServiceM8 and Ply. We process ServiceM8 data solely to provide the Add-on’s functionality and the Ply features described in Section 6 to the account holder who installed the Add-on. We do not sell ServiceM8 data and do not use it for advertising or cross-customer profiling. Connection is explicit and user-initiated via OAuth 2.0; no data is read from your ServiceM8 account before you grant approval.

3. DATA WE READ FROM YOUR SERVICEM8 ACCOUNT

When you connect the Add-on, Ply accesses the following data from your ServiceM8 account via the ServiceM8 API (api.servicem8.com) using your OAuth token:

Webhooks. Ply currently subscribes to job.created and job.updated webhooks (idempotent processing; duplicates are discarded). Additional event types are modeled but not subscribed today.

OAuth Scopes vs. Actual Data Use. ServiceM8 requires OAuth scopes to be declared up front, and the scope list may be broader than the data Ply actually reads. Ply requests a fixed set of scopes, which the account holder approves when connecting. The list set out in this Section 3 is the complete list of data Ply reads and stores today. A granted scope does not mean the data is accessed.

Data We Do Not Read. The Add-on does not access: company (customer) records; job photos, videos, or attachments; invoices, quotes, or payment documents; inbox, SMS, or email message bodies; staff GPS location data (Ply does not request this scope); forms, checklists, badges, proposals; or any ServiceM8 credentials or passwords.

4. DATA WE WRITE BACK TO SERVICEM8

All write-back features are off by default. The account holder must affirmatively enable each one. When enabled, Ply may write the following data back to your ServiceM8 account:

• Push job materials (name, description, quantity, cost, price, tax rate)
• Push pricebook items (name, description, item number, cost, price)
• Push pricebook deletions
• Push stock levels
• Attach purchase-order links to jobs (adds a job note linking to the Ply purchase order)
• Webhook subscription management

We do not send SMS or email to your clients or staff via ServiceM8, do not create or modify ServiceM8 customer records, and do not create ServiceM8 jobs.

5. OTHER DATA COLLECTED IN CONNECTION WITH THE ADD-ON

In addition to data read from ServiceM8, the Add-on collects and stores:

6. HOW WE USE THE DATA

6.1 Data Usage

We use data obtained through the Add-on solely for the following purposes:

• Providing, operating, and maintaining the synchronization between ServiceM8 and Ply
• Reconciling inventory, job costing, and purchasing within Ply
• Troubleshooting and resolving technical issues
• Maintaining the security and integrity of the Add-on
• Internal analytics and performance monitoring of the Add-on (using only aggregated or de-identified data for cross-customer analysis)
• Responding to your support requests
• Complying with applicable law and protecting our legal rights
• Providing AI-assisted features within Ply, as described under “AI Features” below

We do not use ServiceM8 data for advertising, marketing, cross-customer profiling, or any purpose unrelated to the Add-on's functionality.

6.2 AI Features

Some Ply features use AI models provided by the sub-processors listed in Section 8(b). When a user of your account uses an AI-assisted feature, data Ply already holds, which may include ServiceM8-derived data such as pricebook items, supplier contact details, and team member names and email addresses, is sent to the relevant AI provider solely to perform that feature's function (for example, generating a response or extracting and matching document data). Ply does not use ServiceM8 data to train AI models.

7. STORAGE AND SECURITY

7.1 Infrastructure

All data is stored in Ply's primary PostgreSQL database (Amazon Aurora, managed) hosted on Amazon Web Services (AWS) in the US East (Ohio) region. The database is tenant-isolated — all queries are scoped by business — and is not publicly accessible. Deletion protection is enabled. File storage uses encrypted Amazon S3 buckets with public access blocked. Cold-storage archives are moved to Amazon S3 Glacier Instant Retrieval with the same encryption and access controls.

International Transfer Notice. If you are located in Australia, New Zealand, the United Kingdom, or any jurisdiction outside the United States, your ServiceM8 data will be transferred to and processed in the United States. By connecting the Add-on, you acknowledge this transfer.

United Kingdom. Where required, we rely on appropriate contractual safeguards for transfers, including the International Data Transfer Agreement or standard contractual clauses approved by the UK Information Commissioner's Office (“ICO”).

Australia. Under Australian Privacy Principle (APP) 8, Ply takes reasonable steps to ensure that any overseas recipient handles your personal information in accordance with the APPs. Ply is contractually bound to handle all data received via the Add-on consistently with the APPs, and Ply accepts accountability for any failure by its sub-processors to do so.

New Zealand. Under Information Privacy Principle (IPP) 12 of the Privacy Act 2020, Ply will not transfer personal information outside New Zealand unless it believes on reasonable grounds that the recipient is subject to comparable privacy protections, or the individual authorizes the transfer. Ply’s contractual and security commitments described in this policy are intended to provide those comparable protections.

7.2 Encryption

In Transit. All data in transit is protected by TLS 1.2 or higher (TLS 1.3 supported) using a FIPS-compliant cipher policy. TLS 1.0 and 1.1 are not supported.

At Rest. OAuth tokens are AES-encrypted at the application level. The database, backups, and snapshots are encrypted with AWS Key Management Service (KMS) using a customer-managed key with annual rotation. S3 buckets are encrypted using AWS KMS.

7.3 Access Controls

User authentication uses JSON Web Tokens (JWT). Access is role-based (Super Admin, Owner, Admin, Manager, Technician). Connecting and disconnecting the ServiceM8 integration is restricted to Owner, Admin, and Manager users. Internal Ply staff access is governed by least-privilege principles.

7.4 SOC 2 Program

Ply maintains a SOC 2 security program covering encryption, access control, tenant isolation, logging and monitoring, backup and recovery, change management, and vendor management. A SOC 2 Type II audit has been completed (audit window: June–August 2026) and the report is pending issuance. Once available, the report will be provided to customers and partners under NDA upon request.

7.5 Data Breach Notification

If Ply becomes aware of a security incident that results in the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to personal data processed through the Add-on (a “Data Breach”), Ply will:

• Notify the affected account holder without undue delay, and in any event within 72 hours of becoming aware of the Data Breach, providing sufficient detail for the account holder to assess the breach and meet its own regulatory notification obligations
• Cooperate with the account holder in investigating and remediating the Data Breach
• Maintain records of all Data Breaches, including the facts, effects, and remedial actions taken

This notification enables you, as the data controller, to comply with your own obligations under applicable law, including the UK GDPR (Article 33, 72-hour supervisory authority notification), the Australian Notifiable Data Breaches scheme (Part IIIC of the Privacy Act 1988, requiring assessment and notification within 30 days of becoming aware of a breach likely to result in serious harm), and the New Zealand Privacy Act 2020 (mandatory notification to the Privacy Commissioner and affected individuals for serious privacy breaches).

7.6 Data Processing Agreement

Where applicable law requires a binding data processing agreement between the controller and processor (including under UK GDPR Article 28), Ply offers a standalone Data Processing Agreement (DPA) that supplements this policy. The DPA sets out the subject matter and duration of processing, the nature and purpose of processing, the types of personal data processed, the categories of data subjects, and the obligations and rights of the controller. To request a copy, contact us at privacy@getply.com.

8. DISCLOSURE — WHO ELSE SEES THE DATA

We do not sell ServiceM8 data or share it with third parties for their own independent purposes. Data obtained through the Add-on is disclosed only in the following circumstances:

(a) Back to ServiceM8. When you enable write-back features, data is written back to your ServiceM8 account as described in Section 4.

(b) Sub-processors. We use the following infrastructure and tooling sub-processors under contract, each of which processes data solely on our instructions. We will update the list below when we engage a new sub-processor and will provide account holders with at least 30 days’ prior notice before the new sub-processor begins processing data, giving you the opportunity to object. A current list of sub-processors is maintained at this policy’s URL.

(c) Your Other Connected Systems. If you have connected other third-party systems to your Ply account, data may flow to those systems in accordance with the integrations you have enabled.

(d) Ply Support Personnel. Our support team may access your data at your request or as necessary to investigate and resolve a technical fault.

(e) Legal Requirements. We may disclose data where required by law, regulation, legal process, or enforceable governmental request, or where necessary to protect the rights, safety, or property of Ply, our users, or the public.

(f) Corporate Transactions. In the event of a merger, acquisition, reorganization, or sale of assets, your data may be transferred to a successor entity, which will be bound by the same commitments set out in this policy.

9. RETENTION AND DELETION

10. YOUR RIGHTS AND RESPONSIBILITIES

10.1 Account Holder Responsibilities

As the data controller for end-customer and staff data processed through the Add-on, you are responsible for:

• Ensuring you have a lawful basis (such as consent or legitimate interest) to share end-customer and staff data with Ply through the ServiceM8 integration
• Providing appropriate privacy notices to your end customers and staff
• Responding to data subject access, correction, export, and erasure requests from your end customers and staff (Ply will assist you in fulfilling such requests)
• Configuring the Add-on's sync and write-back settings in accordance with your own privacy obligations

10.2 Your Rights

Depending on your location, you and the individuals whose data is processed through the Add-on may have rights under applicable privacy law. The following is a summary of rights under the laws most relevant to our ServiceM8 user base:

Australia (Privacy Act 1988). Australian Privacy Principle (APP) 12 provides a right to access personal information held about you. APP 13 provides a right to request correction of inaccurate information. You may also complain to the Office of the Australian Information Commissioner (OAIC) if you believe we have breached the Australian Privacy Principles (APPs).

New Zealand (Privacy Act 2020). You have the right to access your personal information (Information Privacy Principle 6) and to request correction (Information Privacy Principle 7). You may complain to the Office of the Privacy Commissioner if you believe your privacy has been interfered with.

United Kingdom (UK GDPR and Data Protection Act 2018). You have the right to access, rectify, erase, restrict processing of, and port your personal data, and to object to processing. Where processing is based on consent, you may withdraw consent at any time without affecting the lawfulness of prior processing.

United States. Depending on your state of residence, you may have additional rights under state privacy laws (including the California Consumer Privacy Act (CCPA), Colorado Privacy Act (CPA), Connecticut Data Privacy Act (CTDPA), Utah Consumer Privacy Act (UCPA), and Virginia Consumer Data Protection Act (VCDPA)). Please refer to Ply's general privacy policy for state-specific details, or contact us at the address below.

For end-customer or staff data subject requests: because Ply acts as a processor for this data, access, correction, export, and erasure requests should be directed to the ServiceM8 account holder (i.e., the contractor who installed the Add-on). Ply will assist the account holder in fulfilling such requests.

To exercise your rights, or for any privacy-related inquiry, contact us at: privacy@getply.com.

11. LEGAL BASES FOR PROCESSING

Where applicable law requires a legal basis for processing (including under the UK GDPR), we rely on the following:

Performance of a contract. Processing your ServiceM8 data is necessary to provide the Add-on functionality you requested when you connected the integration.

Legitimate interests. We have a legitimate interest in maintaining the security, stability, and performance of the Add-on, and in troubleshooting technical issues. These interests are balanced against, and do not override, your fundamental rights and freedoms.

Legal obligation. We may process data to comply with applicable legal requirements.

Consent. Where required by applicable law and not covered by another basis, we will obtain your consent before processing. You may withdraw consent at any time by contacting us at privacy@getply.com.

12. CHILDREN'S DATA

The Add-on is designed for use by trade and field-service businesses and is not directed at individuals under 18 years of age. We do not knowingly collect personal data from children. If you believe that data relating to a child has been processed through the Add-on, please contact us at privacy@getply.com and we will take steps to delete it.

13. CHANGES TO THIS POLICY

We may update this policy from time to time to reflect changes in our data practices, legal requirements, or Add-on functionality. When we do, we will update the "Last Updated" date at the top of this page. If we make material changes, we will notify you via the email address associated with your Ply account or through a notice in the Add-on. Changes to our sub-processor list are notified separately under Section 8(b). We encourage you to review this policy periodically.

As the Add-on evolves, Ply may expand the categories of ServiceM8 data it accesses or the purposes for which that data is processed — for example, by supporting additional ServiceM8 endpoints (such as quotes, invoices, scheduling, or job content), enabling customer or contact synchronization, or introducing analytics or reporting features that rely on aggregated or de-identified data. Any such expansion will be reflected in an updated version of this policy, published before the new processing begins, and notified to account holders in accordance with the procedures described above. New data-access features that materially increase the personal data processed through the Add-on will be off by default and will require the account holder’s affirmative opt-in before activation. Current AI features are described in Section 6. If Ply introduces new AI features that process ServiceM8 data, or changes its AI providers, we will update Sections 6 and 8(b) before that processing begins, describing the data used and the provider, and confirming that ServiceM8 data will not be used to train third-party models without the account holder’s explicit consent.

14. CONTACT US

If you have questions, concerns, or complaints about this policy or our data practices in connection with the ServiceM8 Add-on, please contact us:

Phone: (571) 601-3548

If you are located in the United Kingdom and are not satisfied with our response, you may lodge a complaint with the ICO at ico.org.uk. If you are located in Australia, you may complain to the OAIC at oaic.gov.au. If you are located in New Zealand, you may complain to the Office of the Privacy Commissioner at privacy.org.nz.