Privacy Policy

Last Updated: February 21, 2026 This Privacy Policy ("Policy") is provided by Central Lense Inc., a Delaware corporation ("Central Lense," "we," "us," or "our"), and applies to personal information we collect through:

• Our website at centralense.com and all associated subdomains
• Our Microsoft 365 license marketplace powered by Shopify
• Contact forms, quote request forms, and other inquiry mechanisms on our website
• Communications you initiate with us, including email, phone, and online chat

This Policy applies to all visitors, prospective clients, marketplace customers, and other individuals who interact with our website and services ("you" or "your"). Geographic Scope: Central Lense Inc. is headquartered in the United States and primarily serves businesses within the United States. However, our website is accessible globally. If you access our website from the European Economic Area ("EEA"), the United Kingdom ("UK"), or other jurisdictions with data protection laws, we provide additional disclosures and rights in the applicable sections below, including provisions consistent with the General Data Protection Regulation ("GDPR"). This Policy does not apply to personal data we process on behalf of our managed IT services clients in our capacity as a service provider or data processor. That processing is governed by separate agreements, as described in the "Industry-Specific Data Handling" section.

We collect personal information in two ways: information you provide to us directly and information collected automatically when you use our website. (a) Information You Provide Directly When you submit forms or otherwise communicate with us, we may collect the following:

• Contact Form: Full name (required), email address (required), company name (optional), message content (required). We also automatically record the page from which the form was submitted (page source).
• Quote Request Form: Company name (required), full name (required), email address (required), phone number (optional), products of interest (required), quantity (optional), and message (optional).
• Support Text Messaging (SMS): If you consent to receive support texts, we collect your mobile telephone number, a record of your consent (date, method, and the related ticket or contact record), your opt-out history, and the content of text messages exchanged with our support engineers. See the "SMS Messaging Privacy" section below.
• Other Communications: Any personal information you voluntarily provide when you email us, call us, or otherwise correspond with us.

Form submissions are stored in our cloud database infrastructure (hosted by Supabase Inc.) in a secure "leads" table. (b) Information Collected Automatically When you visit our website, we and our third-party service providers automatically collect certain information, including:

• Google Analytics (GA4): IP address, browser type and version, operating system, referring URLs, pages viewed, user interactions and events, session duration, device type, and screen resolution.
• Google Fonts: When our website loads typefaces from Google's servers, your IP address and user-agent string are transmitted to Google LLC.
• Shopify Storefront (Marketplace): When you browse or interact with our Microsoft 365 license marketplace, a cart identifier is stored in your browser's local storage (under the key cl-cart-id). Product browsing data and cart contents are processed through the Shopify Storefront API.
• Supabase Authentication Cookies: For administrative users only, authentication session cookies with the prefix sb- are set to maintain secure access to our content management systems. These cookies are not set for general website visitors.
• Device and Network Information: Browser type, operating system, device identifiers, language preferences, time zone, and approximate geographic location derived from your IP address.

As required by the California Consumer Privacy Act, as amended by the California Privacy Rights Act (collectively, "CCPA"), the following table describes the categories of personal information we have collected in the preceding twelve months:

• Identifiers: Full name, email address, phone number, mobile telephone number, IP address, and Shopify cart identifiers. Sources: Contact forms, quote request forms, automatic collection, and support text messaging enrollment. Purpose: Responding to inquiries, processing marketplace orders, website analytics, and security.
• Internet or Other Electronic Network Activity Information: Browsing history on our website, page views, search queries, interaction data, referral URLs, browser type, and operating system. Sources: Google Analytics, server logs. Purpose: Website analytics, performance improvement, and security monitoring.
• Commercial Information: Products or services of interest, quote request details, quantity estimates, and marketplace browsing and cart data. Sources: Quote request forms, Shopify Storefront API. Purpose: Responding to service inquiries, order processing, and business development.
• Geolocation Data: Approximate geographic location derived from your IP address (city or region level only; we do not collect precise geolocation). Sources: Automatic collection via Google Analytics. Purpose: Analytics and understanding our audience demographics.
• Audio, Electronic, Visual, or Similar Information: The content of text messages exchanged between you and our support engineers, together with the associated consent and opt-out records. Sources: Our support text messaging program. Purpose: Communicating with you about your IT support requests and maintaining records of consent and opt-out choices. This information is never sold or shared, and is excluded from all other information sharing described in this Policy.

We do not collect sensitive personal information as defined under the CCPA, including Social Security numbers, financial account credentials, precise geolocation, racial or ethnic origin, religious beliefs, biometric data, or health information through our website.

We use the personal information we collect for the following business and commercial purposes:

• Responding to Inquiries: To respond to your contact form submissions and quote requests, typically within 24 business hours, and to follow up on your interest in our services.
• Service Delivery and Improvement: To deliver, maintain, and improve our website, marketplace, and related services, including diagnosing technical issues and optimizing user experience.
• Website Analytics: To analyze website traffic, usage patterns, and visitor demographics so we can understand how our website is used and make informed improvements.
• Communications About Services: To communicate with you about our managed IT services, cybersecurity solutions, and Microsoft licensing offerings that may be relevant to your expressed interests or inquiry.
• Marketplace Order Processing: To facilitate your browsing, cart management, and purchasing experience in our Microsoft 365 license marketplace.
• Security and Fraud Prevention: To protect our website, systems, and users from unauthorized access, abuse, fraud, and other security threats.
• Legal Compliance: To comply with applicable laws, regulations, legal processes, and enforceable governmental requests.
• Business Operations: To manage our business operations, including record-keeping, auditing, and internal reporting.

We do not use your personal information for automated decision-making or profiling that produces legal or similarly significant effects.

If you are located in the European Economic Area or the United Kingdom, we process your personal data only when we have a valid lawful basis under the GDPR or the UK GDPR. The lawful bases we rely on include:

• Consent (Article 6(1)(a)): We rely on your consent for placing and reading non-essential cookies, including analytics cookies (Google Analytics) and any future marketing cookies. You may withdraw your consent at any time through our cookie consent banner or by contacting us.
• Legitimate Interest (Article 6(1)(f)): We process personal data where necessary for our legitimate business interests, provided those interests are not overridden by your fundamental rights. Our legitimate interests include operating and improving our website, ensuring website security, understanding our audience through aggregated analytics, and pursuing business development from voluntarily submitted inquiries.
• Contract Performance (Article 6(1)(b)): We process personal data where necessary to take steps at your request prior to entering into a contract, such as responding to quote requests, processing marketplace orders, and fulfilling service inquiries.
• Legal Obligation (Article 6(1)(c)): We process personal data where necessary to comply with legal obligations to which we are subject, including tax reporting, responding to lawful government requests, and retaining records as required by law.

Our website uses cookies and similar tracking technologies to collect information about your browsing activity. These include:

• Essential Cookies: Required for basic website functionality, including session management and security. These cannot be disabled.
• Analytics Cookies: Used by Google Analytics (GA4) to collect information about how visitors use our website, including pages visited, session duration, and user interactions. These cookies are set only with your consent where required by law.
• Functional Storage: Our marketplace uses browser local storage (not cookies) to store your shopping cart identifier for session continuity.

We provide a cookie consent banner that allows you to manage your cookie preferences. You may accept or decline non-essential cookies at any time. For a detailed description of each cookie we use, its purpose, provider, and retention period, please review our Cookie Policy. You may also control cookies through your browser settings. Most browsers allow you to block or delete cookies. Please note that disabling certain cookies may affect website functionality.

We engage the following third-party service providers to operate our website and deliver our services. Each provider receives only the personal information necessary to perform its designated function and is contractually obligated to protect your data:

• Google LLC (Mountain View, CA), Google Analytics (GA4): Provides website usage analysis, including page views, session data, and user interaction metrics. Google Fonts: Delivers typefaces used on our website; your IP address and user-agent string are transmitted to Google servers when fonts are loaded. Google's privacy policy: policies.google.com/privacy
• Shopify Inc. (Ottawa, ON, Canada), Provides the e-commerce platform powering our Microsoft 365 license marketplace, including product catalog, cart management, and checkout processing via the Shopify Storefront API. Shopify's privacy policy: shopify.com/legal/privacy
• Supabase Inc. (San Francisco, CA), Provides cloud database infrastructure for storing form submissions and authentication services for our administrative users. Supabase's privacy policy: supabase.com/privacy
• Microsoft Corporation (Redmond, WA), Central Lense is an authorized Microsoft Cloud Solution Provider (CSP) partner. We sell Microsoft 365 licenses through our marketplace. Microsoft may receive information related to license provisioning and account setup. Microsoft's privacy statement: privacy.microsoft.com
• Microsoft Azure, Provides website hosting, content delivery, and server infrastructure. These providers may process IP addresses and request metadata in the course of delivering web content to your browser.

We do not authorize these service providers to use your personal information for their own marketing purposes. Each provider is subject to its own privacy policy, which we encourage you to review.

We may disclose your personal information in the following circumstances:

• Service Providers: We share personal information with the third-party service providers identified above, solely for the purposes described in this Policy and subject to contractual obligations of confidentiality and data protection.
• Legal Obligations: We may disclose personal information when required by law, regulation, legal process (such as a subpoena or court order), or enforceable governmental request.
• Protection of Rights and Safety: We may disclose personal information when we believe in good faith that disclosure is necessary to protect our rights, property, or safety, or the rights, property, or safety of our users or the public.
• Business Transfers: In the event of a merger, acquisition, reorganization, bankruptcy, asset sale, or similar business transaction involving Central Lense Inc., your personal information may be transferred as part of that transaction. We will notify you via email or a prominent notice on our website before your personal information is transferred and becomes subject to a different privacy policy.
• With Your Consent: We may disclose your personal information for any other purpose with your explicit consent.

We do not disclose your personal information to unaffiliated third parties for their own direct marketing purposes.

Central Lense Inc. does not sell personal information for monetary or other valuable consideration. However, under the California Privacy Rights Act ("CPRA"), certain uses of analytics cookies (such as Google Analytics) and similar tracking technologies may be considered "sharing" of personal information for cross-context behavioral advertising purposes. While we do not use your data for targeted advertising ourselves, the operation of third-party analytics tools may technically constitute "sharing" under the CPRA's broad definition. You have the right to opt out of this sharing. You may exercise this right by:

• Adjusting your preferences through our cookie consent banner when you visit our website
• Visiting our Do Not Sell or Share My Personal Information page
• Emailing us at privacy@centralense.com
• Enabling a Global Privacy Control ("GPC") signal in your browser, which we will honor as a valid opt-out request

We do not have actual knowledge that we sell or share the personal information of consumers under 16 years of age.

We retain personal information only for as long as reasonably necessary to fulfill the purposes for which it was collected, comply with our legal obligations, resolve disputes, and enforce our agreements. Specific retention periods are as follows:

• Contact Form and Quote Request Submissions: Retained for up to three (3) years from the date of submission, or until you request deletion, whichever occurs first. Submissions may be deleted earlier if no longer needed for business purposes.
• Google Analytics Data: Subject to Google's data retention settings, which we have configured to the default period of fourteen (14) months. After this period, user-level and event-level data is automatically deleted from Google's servers.
• Shopping Cart Data: Cart identifiers and associated data are stored in your browser's local storage and persist until you clear your browser storage or the data is no longer needed for order processing. This data is session-based and is not retained on our servers.
• SMS Consent and Opt-Out Records: Retained for as long as the mobile number remains enrolled in our support text messaging program and for three (3) years afterward, in order to evidence opt-in and opt-out history and to ensure an opted-out number is not re-enrolled in error.
• Text Message Content: Retained with the associated support ticket under the retention terms of the applicable client service agreement.
• Server Logs: Web server access logs containing IP addresses and request data are retained for up to ninety (90) days for security and diagnostic purposes.

We periodically review the personal information we hold and securely delete or anonymize data that is no longer necessary for the purposes outlined in this Policy. When we delete personal information, we use commercially reasonable methods to render it unrecoverable.

If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act (collectively, "CCPA"), provides you with the following rights regarding your personal information:

• Right to Know: You have the right to request that we disclose the categories and specific pieces of personal information we have collected about you, the categories of sources from which it was collected, the business or commercial purposes for collection, and the categories of third parties with whom we share it.
• Right to Delete: You have the right to request that we delete personal information we have collected from you, subject to certain exceptions permitted by law (such as completing a transaction, detecting security incidents, or complying with legal obligations).
• Right to Correct: You have the right to request that we correct inaccurate personal information that we maintain about you.
• Right to Opt-Out of Sale or Sharing: You have the right to opt out of the "sale" or "sharing" of your personal information for cross-context behavioral advertising. See the "Sale or Sharing of Personal Information" section above for details on how to exercise this right.
• Right to Limit Use of Sensitive Personal Information: We do not collect or process sensitive personal information as defined by the CCPA through our website. If this changes, we will provide a mechanism to limit its use and disclosure.
• Right to Non-Discrimination: We will not discriminate against you for exercising any of your CCPA rights. We will not deny you goods or services, charge you different prices or rates, provide a different level or quality of service, or suggest that you may receive a different price or level of service for exercising your rights.

How to Exercise Your Rights To submit a request to know, delete, or correct your personal information, please contact us by:

• Emailing privacy@centralense.com with the subject line "CCPA Request"
• Calling us at +1 (888) 245-7056

Verification Process: To protect your privacy and security, we will verify your identity before fulfilling your request. We will ask you to provide information that matches the personal information we have on file, such as your name and email address associated with your inquiry. If we cannot verify your identity, we may deny your request. Response Timeline: We will acknowledge your request within ten (10) business days and provide a substantive response within forty-five (45) calendar days. If we require additional time, we will inform you of the reason and extension period, which will not exceed an additional forty-five (45) days. Authorized Agents: You may designate an authorized agent to submit a request on your behalf. Authorized agents must provide written authorization signed by you and may be required to verify their own identity. You may also provide a power of attorney under California Probate Code sections 4121 to 4130.

Residents of certain other U.S. states have privacy rights under their respective state laws. This section applies if you reside in any of the following states with comprehensive consumer privacy legislation: Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Utah (UCPA), Texas (TDPSA), Oregon (OCPA), Montana (MCDPA), Iowa, Indiana, Tennessee, Delaware, New Hampshire, New Jersey, Maryland, Minnesota, Nebraska, Rhode Island, or Kentucky. Although the specific rights and procedures vary by state, these laws generally provide you with the following rights:

• Right to Access: You have the right to confirm whether we are processing your personal data and to access that data.
• Right to Delete: You have the right to request deletion of personal data you have provided to us or that we have obtained about you.
• Right to Correct: You have the right to request correction of inaccurate personal data.
• Right to Data Portability: Where technically feasible, you have the right to obtain a copy of your personal data in a portable, readily usable format.
• Right to Opt-Out of Targeted Advertising: You have the right to opt out of the processing of your personal data for the purposes of targeted advertising.
• Right to Opt-Out of Sale: Where applicable, you have the right to opt out of the sale of your personal data. As noted above, Central Lense does not sell personal information for monetary consideration.
• Right to Opt-Out of Profiling: You have the right to opt out of profiling in furtherance of decisions that produce legal or similarly significant effects concerning you. We do not engage in such profiling.

Right to Appeal: If we decline to take action on your request, you have the right to appeal that decision. To appeal, please email privacy@centralense.com with the subject line "Privacy Rights Appeal" and include a description of your original request and the reason for your appeal. We will respond to your appeal within the timeframe required by your state's law. If your appeal is denied, you may have the right to contact your state's attorney general to lodge a complaint. To exercise any of these rights, please contact us at privacy@centralense.com or call +1 (888) 245-7056. We will respond to your request within the timeframe required by the applicable state law, typically within forty-five (45) days.

If you are located in the European Economic Area ("EEA") or the United Kingdom ("UK"), the General Data Protection Regulation (EU GDPR) or the UK GDPR provides you with the following rights with respect to your personal data:

• Right of Access (Article 15): You have the right to obtain confirmation as to whether your personal data is being processed and, if so, to access that data along with information about the purposes, categories, and recipients of processing.
• Right to Rectification (Article 16): You have the right to request correction of inaccurate personal data and, taking into account the purposes of processing, to have incomplete personal data completed.
• Right to Erasure (Article 17): You have the right to request the deletion of your personal data when it is no longer necessary for the purposes for which it was collected, when you withdraw consent, when you object to processing and there are no overriding legitimate grounds, or when your data has been unlawfully processed.
• Right to Restriction of Processing (Article 18): You have the right to request restriction of processing when you contest the accuracy of the data, when processing is unlawful and you oppose erasure, when we no longer need the data but you need it for legal claims, or when you have objected to processing pending verification.
• Right to Data Portability (Article 20): You have the right to receive your personal data in a structured, commonly used, and machine-readable format and to transmit that data to another controller, where processing is based on consent or a contract and is carried out by automated means.
• Right to Object (Article 21): You have the right to object to processing based on legitimate interests or for direct marketing purposes. Where you object to processing for direct marketing, we will cease processing without exception.
• Right Regarding Automated Decision-Making (Article 22): You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you. We do not currently engage in such automated decision-making.
• Right to Withdraw Consent (Article 7(3)): Where processing is based on your consent, you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out prior to withdrawal.
• Right to Lodge a Complaint: You have the right to lodge a complaint with a supervisory authority in the EEA member state or UK country of your habitual residence, your place of work, or the place of the alleged infringement.

To exercise any of these rights, please contact us at privacy@centralense.com. We will respond to your request within one (1) month of receipt, which may be extended by an additional two (2) months for complex or numerous requests. We will inform you of any such extension within the initial one-month period.

Central Lense Inc. is headquartered in the United States, and your personal information is processed and stored on servers located in the United States. If you are visiting our website from outside the United States, please be aware that your personal information will be transferred to, stored in, and processed in the United States, where data protection laws may differ from those of your country of residence. For transfers of personal data from the EEA or UK to the United States, we rely on the following transfer mechanisms as applicable:

• EU-U.S. Data Privacy Framework: Where our third-party service providers are certified under the EU-U.S. Data Privacy Framework (and the UK Extension), transfers are made in reliance on those certifications.
• Standard Contractual Clauses (SCCs): Where the Data Privacy Framework does not apply, we rely on the European Commission's Standard Contractual Clauses (as adopted under Commission Implementing Decision (EU) 2021/914) to provide appropriate safeguards for the transfer of personal data. For UK transfers, we use the UK International Data Transfer Addendum to the SCCs.

Our third-party service providers, including Google, Shopify, Supabase, and Microsoft, maintain their own data transfer mechanisms and certifications. We encourage you to review their respective privacy policies for details on how they handle international data transfers. You may request a copy of the safeguards we have put in place by contacting us at privacy@centralense.com.

We take the security of your personal information seriously and implement reasonable administrative, technical, and physical safeguards designed to protect it from unauthorized access, use, alteration, and disclosure. Our security measures include:

• Encryption in Transit: All data transmitted between your browser and our website is encrypted using Transport Layer Security (TLS/HTTPS).
• Access Controls: Access to personal information is restricted to authorized personnel who need it to perform their job functions, subject to confidentiality obligations.
• Infrastructure Security: Our website is hosted on enterprise-grade cloud infrastructure with built-in security features, including firewalls, intrusion detection, and DDoS protection.
• Employee Security Training: Our team members receive training on data protection best practices and security awareness.
• Regular Security Assessments: We conduct periodic reviews of our security practices and systems to identify and address potential vulnerabilities.
• Vendor Due Diligence: We evaluate the security practices of our third-party service providers before engaging them and require contractual data protection commitments.

Despite these measures, no method of transmission over the Internet or method of electronic storage is completely secure. We cannot guarantee the absolute security of your personal information. In the event of a data breach that affects your personal information, we will notify you and the appropriate regulatory authorities as required by applicable law, including providing information about the nature of the breach, the data affected, and the steps we are taking in response.

Our website and services are designed for business professionals and are not directed to individuals under the age of sixteen (16). We do not knowingly collect, solicit, or maintain personal information from children under 16. We do not knowingly allow children under 16 to register for or use our services. If we learn that we have collected personal information from a child under 16, we will take steps to promptly delete that information from our records. If you are a parent or guardian and believe that your child has provided us with personal information, please contact us at privacy@centralense.com so we can take appropriate action.

Central Lense Inc. provides managed IT services and cybersecurity solutions to clients in regulated industries, including healthcare, financial services, legal, manufacturing, and government contracting. It is important to distinguish between the data collection practices described in this Privacy Policy and our data handling obligations as a service provider to those clients.

• Healthcare Clients (HIPAA): When we process protected health information (PHI) on behalf of healthcare clients, such processing is governed by a Business Associate Agreement (BAA) executed between Central Lense and the client, in compliance with the Health Insurance Portability and Accountability Act (HIPAA) and the HITECH Act. This Privacy Policy does not apply to PHI handled under those agreements.
• Financial Services Clients (GLBA/SOX): When we process nonpublic personal information on behalf of financial services clients, such processing is governed by separate Data Processing Addendums and service contracts that comply with the Gramm-Leach-Bliley Act (GLBA), the Sarbanes-Oxley Act (SOX), and other applicable financial regulations.
• Government and Defense Contractors (CMMC/DFARS): When we handle Controlled Unclassified Information (CUI) or Federal Contract Information (FCI) on behalf of government contractors, such processing complies with the Cybersecurity Maturity Model Certification (CMMC) framework and Defense Federal Acquisition Regulation Supplement (DFARS) clause 252.204-7012, as applicable.

The data processing we perform on behalf of clients in these regulated industries is subject to the specific terms and conditions set forth in the applicable client agreements, which take precedence over this Privacy Policy. If you are a client or prospective client with questions about how we handle data in these contexts, please contact us at legal@centralense.com.

This section applies to text messages sent and received by Central Lense Inc. through Microsoft Teams Phone as part of our support text messaging program. Our full SMS Terms and Conditions describe the program in detail. Information we collect: When you agree to receive support texts, we collect your mobile phone number, a record of your consent (the date it was given, the method by which it was given, and the related ticket or contact record), and the content of messages exchanged with our support engineers. How we use it: We use this information only to communicate with you about your IT support requests and to keep records of your consent and opt-out choices. We do not send marketing text messages. Consent to receive support texts is not a condition of purchase and is not required to receive support from Central Lense. Sharing: We do not sell, rent, or share your mobile number or SMS opt-in information with third parties or affiliates for marketing or promotional purposes. We share it only with the providers that deliver our text messages, such as Microsoft and its telecommunications carriers, and only as needed to provide the service. SMS opt-in data and consent are excluded from all other information sharing described in this Policy, including the analytics-related "sharing" described in the "Sale or Sharing of Personal Information" section above. Retention: We retain SMS consent and opt-out records for as long as the number remains enrolled and for a reasonable period afterward in order to document opt-in and opt-out history and to ensure an opted-out number is not re-enrolled in error. Message content is retained with the associated support ticket under the retention periods described above. Opting out: Reply STOP to any message to stop receiving texts, or reply HELP for help. You may also opt out by emailing privacy@centralense.com or calling +1 (888) 245-7056. Opting out does not affect your ability to receive support by phone, email, or your usual support channel. See our SMS Terms and Conditions for the full list of opt-out keywords. Contact: For questions about SMS privacy, email privacy@centralense.com or call +1 (888) 245-7056.

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or business operations. When we make changes, we will revise the "Last Updated" date at the top of this Policy. If we make material changes that significantly affect how we collect, use, or disclose your personal information, we will provide additional notice through one or more of the following methods:

• Posting a prominent notice on our website
• Sending a notification to the email address associated with your inquiry, where applicable
• Updating the "Last Updated" date prominently on this page

Your continued use of our website and services after the posting of changes constitutes your acknowledgment and acceptance of those changes. We encourage you to review this Privacy Policy periodically to stay informed about how we protect your information. Prior versions of this Privacy Policy are available upon request by contacting us at privacy@centralense.com.

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us using any of the following methods:

• Privacy Inquiries: privacy@centralense.com
• Legal Department: legal@centralense.com
• Phone: +1 (888) 245-7056
• Mailing Address:
  Central Lense Inc.
  300 Delaware Ave. Suite 210
  Wilmington, DE 19801
  United States

We will make every effort to respond to your inquiry within a reasonable timeframe and in accordance with the applicable legal requirements described in this Policy. If you are not satisfied with our response, you may have the right to lodge a complaint with your local data protection authority or state attorney general, as described in the rights sections above.