Privacy Policy.

Last updated: April 19, 2026

Wellspring, a business of Effective Direct Marketing, LLC ("Wellspring," "we," "us," or "our") operates a person-level behavioral intent data platform. This Privacy Policy explains how we collect, use, disclose, and protect personal information, and the rights available to consumers under applicable US state privacy laws.

This Policy applies to personal information processed by Wellspring in connection with its data services, its website at wellspring.stream, and related interactions. Wellspring operates in the United States only and is not directed to users outside the US.

1. Information we collect.

Wellspring collects personal information from several sources:

Information we collect directly from you

• Contact information you submit through our website (name, email address, company, phone number)
• Information you provide when requesting access to our services or corresponding with us
• Information you submit through the Your Privacy Choices page to exercise privacy rights

Information collected through our services

• Behavioral intent signals resolved to person-level profiles, including identifiers (name, email, postal address, phone number), behavioral inferences (topics and categories associated with online shopping activity), and commercial information (signal strength, timing, category)
• Professional and business information for individuals with an identifiable business context

Information from data partners

• Wellspring receives behavioral intent data and identity resolution data from third-party data partners. These partners contractually represent that the data was collected lawfully and that consumers were given notice and the opportunity to opt out where required

Information we do not collect

• We do not place cookies, pixels, or tracking scripts on our customers' websites
• We do not collect Social Security numbers, driver's license numbers, financial account numbers, or government ID numbers
• We do not knowingly collect information from individuals under 16 years of age

2. How we use information.

Wellspring uses personal information for the following business purposes:

• Providing our data services to business customers, including generating prospect lists and CRM enrichment signals
• Maintaining and improving the accuracy of the Wellspring directory
• Responding to inquiries, providing customer support, and managing customer relationships
• Processing privacy rights requests and maintaining suppression records
• Detecting and preventing fraud, security incidents, and illegal activity
• Complying with legal obligations, including data broker registration and consumer rights laws
• Managing and improving our website and services

3. How we disclose information.

Wellspring discloses personal information as follows:

To business customers

We disclose personal information to business customers who purchase our data services. Customers receive person-level records, including contact information and behavioral intent indicators, for the purpose of marketing and sales activities. Customers are contractually required to use the data in compliance with applicable laws, honor suppression updates, and not resell the data.

To service providers

We use service providers to operate our platform, including cloud infrastructure (AWS), integration and delivery infrastructure (MindCloud), and analytics, email, and security vendors. Service providers are contractually bound to use personal information only to perform services for Wellspring.

For legal reasons

We may disclose information to comply with legal obligations, respond to lawful requests from public authorities, enforce our terms, or protect our rights, property, or safety and that of our customers or others.

In business transfers

If Wellspring is involved in a merger, acquisition, or asset sale, personal information may be transferred as part of that transaction, subject to standard confidentiality protections.

4. Sale and sharing of personal information.

Under the California Consumer Privacy Act as amended by CPRA ("CCPA"), "sale" and "sharing" are defined broadly. Because Wellspring is a data services business that provides person-level information to customers for commercial purposes, our disclosures of personal information to customers qualify as "sale" or "sharing" under CCPA and several other state privacy laws.

California residents and residents of other states with equivalent rights can opt out of the sale or sharing of their personal information at any time through our Your Privacy Choices page.

Wellspring does not sell or share the personal information of consumers under 16 years of age.

5. Your privacy rights.

Residents of certain US states have the following rights with respect to their personal information. Availability of specific rights depends on state law.

• Right to know. Request confirmation of whether we process your personal information and request a copy of the categories and specific pieces of information we hold about you.
• Right to delete. Request deletion of personal information we hold about you, subject to legal exceptions.
• Right to correct. Request correction of inaccurate personal information.
• Right to opt out of sale or sharing. Opt out of the sale or sharing of your personal information.
• Right to limit use of sensitive personal information. Where applicable, request that we limit the use of sensitive personal information to what is necessary to provide services.
• Right to non-discrimination. We will not discriminate against you for exercising any of these rights.
• Right to appeal. Where required by state law, you have the right to appeal our response to a rights request.

How to exercise your rights

You can exercise any of these rights by submitting a request through our Your Privacy Choices page. We provide two methods for submitting requests: the online form, and email to privacy@wellspring.stream.

We verify requests by email confirmation. Once verified, we respond within 45 days (extendable to 90 days if complex, with notice). If you are an authorized agent submitting a request on behalf of a consumer, we will require written authorization signed by the consumer before processing.

6. Data security.

Wellspring is built on infrastructure from AWS and MindCloud, both of which maintain SOC 2 Type II and ISO 27001 attestations. We implement technical and organizational safeguards intended to protect personal information against unauthorized access, alteration, disclosure, or destruction. No method of transmission or storage is perfectly secure, and we cannot guarantee absolute security.

7. Data retention.

We retain personal information for as long as necessary to provide our services, comply with legal obligations, resolve disputes, and enforce our agreements. When personal information is no longer needed, it is deleted or de-identified. Suppression records associated with opt-out requests are retained indefinitely to ensure we continue to honor those requests.

8. Children's privacy.

Wellspring's services are not directed to individuals under 16, and we do not knowingly collect or process personal information from individuals under 16. If we learn we have collected information from a person under 16, we will delete it.

9. Changes to this policy.

We may update this Privacy Policy from time to time. The "Last updated" date at the top indicates when the policy was last revised. Material changes will be communicated through the website or, where required, by direct notice.

10. Contact us.

For privacy-related questions, to exercise your rights, or for any other inquiry regarding this Policy:

• Email: privacy@wellspring.stream
• Online: wellspring.stream/privacy-choices
• Mail: Wellspring, c/o Effective Direct Marketing, LLC, Clearwater, FL