Privacy Notice

How 4Camp collects, uses, discloses, and protects personal information

Version 1.2 | Effective date: October 12, 2026 | Last updated: October 12, 2026

1. About This Notice

4Camp, Inc. ("4Camp," "we," or "us") provides the CAMP platform. This notice explains the personal information we handle when you visit our website, use CAMP directly or through an organization, place an order, or contact us. It also explains how CAMP handles information that you or your organization upload or connect.

The customer responsible for a CAMP account decides what information to place in it, which services to connect, and who may use it. We handle that information to provide and secure CAMP under the applicable customer agreement. When we process personal information on a customer’s behalf through CAMP, the Data Processing Addendum (“DPA”) governs that processing. If you use an organization-managed account, contact that organization about access to or deletion of information in the account; if you are the customer for the account, contact 4Camp.

The Master License and Services Agreement (the “Agreement”) and DPA provide additional terms for CAMP and customer information. The current DPA is available at 4camp.ai/legal/dpa.

2. Information We Handle

• Contact and account information. Names, email addresses, telephone numbers, organization and role, account identifiers, administrators, permissions, plan information, preferences, and acceptance records.
• Orders and payments. Billing contacts, invoices, subscription and transaction records, payment status, tax information, and limited payment details. A payment processor or seller generally collects complete card or bank credentials directly.
• Communications. Information you provide in sales inquiries, support requests, feedback, and requests for Professional Services.
• Technical and usage information. IP address, browser and device information, authentication events, account and feature interactions, configuration and performance telemetry, error records, and security logs. We do not keep a private-search history or use private search terms or results for product analytics, advertising, profiling, or model training.
• Customer Data and credentials. Data, content, files, prompts, configurations, and other information submitted or provided by or for a customer for processing by CAMP ("Customer Data"). A customer may also provide API keys, tokens, certificates, or other credentials needed for an authorized connection ("Customer Credentials").

We may receive account details from an organization that manages your access, and order or payment status from an authorized reseller, payment processor, or merchant of record. Customers choose what information to place in CAMP, including whether a connected source or workflow contains sensitive information.

3. Why We Use Information

• Provide CAMP. Create and administer accounts, authenticate users, perform customer-configured searches and workflows, maintain connected services, provide support, and deliver requested Professional Services.
• Run our business. Process orders and renewals, issue invoices and service notices, answer inquiries, and maintain necessary records.
• Protect the service. Detect fraud, abuse, unauthorized access, and security problems; troubleshoot errors; and enforce applicable terms.
• Improve operations. Use limited account, feature, and performance information to understand service health and improve CAMP. We do not use private search terms or results for this purpose.
• Communicate and comply. Send service and security messages, send marketing where permitted, comply with law, and protect legal rights.

For data we control, we rely where required on: contract for services you personally buy from 4Camp; legitimate interests in serving organizational users, inquiries, improvement, security, fraud prevention, and enforcement; legal obligations for tax, records, and lawful requests; and consent for nonessential cookies and marketing when required, otherwise legitimate interests for lawful business communications.

Except where Customer authorizes it in writing and source-provider rules allow, 4Camp does not use Customer Data, prompts, outputs, connected-source content, embeddings, or Deidentified Data to train or fine-tune AI models or permit a provider to do so. The DPA governs providers acting on our behalf.

4. Customer Data and Connected Services

CAMP Files

CAMP Files holds files a customer uploads or writes through a workflow, including local files the customer chooses to keep. CAMP may create account-private metadata, source references, short summaries, and search indexes so authorized users and workflows can find and use that information. The customer agreement, Service Plan, Order Form, and DPA govern retention, export, and deletion.

External connections

A customer can connect file repositories, databases, customer relationship systems, Model Context Protocol services, and other sources. CAMP uses the permissions granted by the connecting user, the source provider, and the customer. It reads selected content to provide authorized search, discovery, indexing, and workflow functions. Write actions require separate permission and a customer-authorized action.

CAMP does not save complete files from a connected source as retained copies in CAMP Files or another CAMP repository unless the customer expressly directs that action. To make retrieval faster, CAMP may hold source content briefly in an encrypted cache. It retains source metadata, references, short summaries, embeddings, and pointers to relevant passages to support customer-authorized discovery. For a connected database, CAMP may retain configured queries and metadata; row-level embeddings are created only if the customer selects that option. Complete database rows are not stored in the vector index by default.

CAMP applies layered role-based access checks when users, agents, and workflows retrieve or act on connected content, according to the customer’s configuration and the source’s permissions. CAMP can present approved content from multiple connected sources in a governed virtual directory, subject to those access checks and any configured PII masking. A customer-controlled workflow may send authorized source content, prompts, or context to an integration or selected AI model. Where available and configured, PII masking can reduce personal information shown in selected views or supplied to workflows, tools, and AI models. It may miss personal or sensitive details and does not make the content anonymous. We do not use connected-source information for advertising, sell it to data brokers, or provide it to model providers for 4Camp-directed training. CAMP does not maintain a private-search history. Technical request information may still appear in security or operational logs.

Disconnecting a source stops new access through that connection. Temporarily cached content expires through the cache process. References, summaries, indexes, saved outputs, and copies deliberately placed in CAMP Files may remain until deleted under the customer agreement, Service Plan, DPA, applicable source-provider requirements, or law. The customer responsible for the account can manage connected permissions and retained content through available controls or contact us for a request covered by the agreement.

5. AI Models and Other Integrations

CAMP does not operate its own foundation model. Models made available through 4Camp are optional; a customer may operate CAMP without enabling one. Each customer decides in its sole discretion which models and integrations to use, whether they are made available through 4Camp or obtained under the customer’s own provider account. The customer controls the workflows and permissions that determine what authorized data is transmitted.

Third-party model providers have their own policies and contractual commitments. Information 4Camp presents about a provider’s stated retention, collection, training, or other practices is informational. We do not audit model vendors or independently verify or warrant those statements, their intended or actual practices, or the effectiveness of a stated protection. Optional models made available through 4Camp are provided as-is. Model availability, performance, outputs, warranties, and remedies are governed by the Agreement. These statements do not limit 4Camp’s obligations under the DPA for a provider acting as its Subprocessor.

When a customer connects a provider under its own account and direct agreement, that provider’s terms govern the provider’s handling of information under that relationship. When 4Camp engages a provider to process Customer Personal Data on its behalf, the DPA and the Subprocessor List govern 4Camp’s responsibilities. Customer Credentials are used for customer-authorized connections and can be revoked at the source or through available CAMP controls.

6. Payments and Information Sharing

Payments

An order may be sold directly by 4Camp, processed by a designated payment provider, or sold by an authorized reseller or merchant of record. We use contact, order, billing, and payment-status information to provide access, administer subscriptions, support transactions, and meet accounting and legal duties. The seller or payment provider may collect billing address, card or bank details, tax information, and fraud-prevention information under its own privacy notice. We receive the information needed to fulfill and support the CAMP order. We market to merchant-of-record buyers only with recorded consent required by the seller’s data-sharing terms and applicable law.

Other disclosures

• Account administrators. The organization managing an account can control user access and see information within its permissions.
• Customer-chosen services. CAMP sends information to a connected service or selected model when a customer configures and uses a feature or workflow that calls it.
• Service providers. Hosting, security, support, communications, and other providers handle information needed to operate CAMP or our business. The DPA governs providers acting as 4Camp Subprocessors for Customer Personal Data.
• Legal and corporate purposes. We may disclose information when required by law, to protect rights or security, or in a corporate transaction subject to applicable safeguards and source-provider restrictions.

The current list of providers that may process Customer Personal Data on 4Camp’s behalf is available at 4camp.ai/legal/subprocessors. We do not sell personal information or share it for cross-context behavioral advertising as those terms are used in California law.

7. Website Cookies and Communications

CAMP uses cookies or similar storage for sign-in and session security. Our public website and third-party tools may use them for chat, traffic measurement, site features, and embedded media. Those providers’ privacy notices may also apply. Browser settings and any preference control we provide can manage nonessential cookies; blocking some cookies may limit functions. We request consent where law requires it.

We send messages needed for accounts, billing, support, legal notices, and security. We may send product information where permitted. You can stop marketing email with its unsubscribe link or by contacting us; service and security messages may continue. Our websites do not currently respond to Do Not Track signals. We honor legally required opt-out preference signals, including Global Privacy Control, where applicable.

8. Retention and Security

We keep website, contact, account, billing, and support information for as long as reasonably needed for the purposes in this notice, taking account of the relationship, legal duties, security, disputes, and recordkeeping needs. Customer Data and related records are retained, returned, exported, or deleted under the applicable customer agreement, Service Plan, Order Form, and DPA. Backups may remain protected until their ordinary deletion cycle or as required by law.

We use administrative, technical, and organizational safeguards to protect information. Customer Data is protected in transit and at the storage layer as stated in our contractual security terms. In the hosted service, files and sensitive metadata held in CAMP Files, and temporarily cached content retrieved from external file repositories, also receive application-level encryption using keys assigned to the customer’s account. These particular key protections do not apply in the same way to every technical log, derived index, or business record. Authorized processing may require decryption. Where enabled, controlled browser and application sessions run in isolated, time-limited containers with temporary working storage; those execution environments are removed when their sessions end or expire. Customer-saved outputs and operational records follow the retention terms above. No method of storage or transmission is completely secure.

Access to Customer Data by 4Camp personnel is limited to what is needed to provide or support the requested service, investigate security or abuse, comply with law, or carry out an authorized customer instruction. The DPA and applicable source-provider restrictions may impose additional limits.

9. International Processing

4Camp and providers may process information in the United States and elsewhere. The DPA covers Customer Personal Data transfers. For website, account, and order data we control, restricted transfers will use an adequacy decision, EU Standard Contractual Clauses (with the UK Addendum where applicable), a UK IDTA, or another valid safeguard. Request copies at legal@4camp.ai. Any customer-specific data-residency commitment must be stated in the applicable agreement, Service Plan, or Order Form.

10. Your Choices and Privacy Rights

Depending on the law that applies, you may be able to access, correct, delete, restrict, or obtain a copy of personal information; object to processing; withdraw consent; opt out of certain sales, sharing, targeted advertising, or marketing; and appeal a denied request. Exceptions may apply. To exercise a right concerning information in an organization-managed CAMP account, contact that organization first. We assist it as required by the DPA and law. If you are the customer for the account, or if your request concerns a website visit, order, or direct contact with 4Camp, write to legal@4camp.ai.

We may verify your identity or authority before acting on a request. You can also complain to a privacy authority where the law gives you that right. You may object at any time to our direct marketing by using the unsubscribe link or writing to legal@4camp.ai.

11. California and Other US State Information

This section applies where a US state privacy law gives additional rights. In the preceding 12 months, depending on your interaction with us, we collected and disclosed the following categories for the purposes described above:

• Identifiers and professional details. Contact and organization details, user and account identifiers, and roles. Sources include you, your organization, and authorized referral or channel partners. Recipients may include your organization and providers for communications, support, and account administration.
• Commercial information. Plans, subscriptions, orders, payment status, invoices, and limited billing details. Sources include you, your organization, sellers, and payment providers. Recipients may include sellers, processors, banks, and tax, accounting, or legal providers.
• Online activity and technical information. Device and browser information, IP addresses, cookies, authentication and security records, and feature-use telemetry. Sources include websites, CAMP, and supporting systems. Recipients may include hosting, security, website, and support providers and authorized account administrators.
• Communications and customer-provided information. Inquiries, support records, and information submitted to CAMP. Sources include you and your organization. Recipients depend on the customer-configured services and the disclosures described in Sections 4 through 6.

We do not sell or share personal information for cross-context behavioral advertising and do not have actual knowledge that we sell or share information about anyone under 16. Login credentials or security data that a state law treats as sensitive are used for access, security, fraud prevention, and requested services. We do not use sensitive information for a purpose that triggers a California right to limit. The retention criteria in Section 8 apply to these categories.

Where available, state rights may include knowing, accessing, correcting, or deleting information; obtaining a copy; opting out of sale, sharing, or certain profiling; appealing a refusal; and equal treatment when exercising a right. California requests may be sent to legal@4camp.ai, made by calling +1 800 925 8950, or mailed to the address below. We process recognized opt-out preference signals as required by law.

12. Children and Automated Decisions

CAMP and our websites are intended for business and professional use and are not directed to children under 13. We do not knowingly collect personal information directly from children under 13. If you believe a child supplied information to us, contact legal@4camp.ai. Customers are responsible for determining whether their use of CAMP involves minors and for obtaining required permission.

We may use automated checks for bots, fraud, abuse, and security threats. We do not use website, account, or billing information to make decisions based solely on automated processing that have legal or similarly significant effects on an individual unless we provide the notices, safeguards, and choices required by law. Customers control their own CAMP workflows and decisions made using them.

13. Changes and Contact

We may update this notice as our practices or legal obligations change. We will post the revised notice with a new date and give any additional notice required by law. This notice does not amend an executed customer agreement or DPA. Prior versions may be requested from us.

4Camp, Inc.
5200 NW 33rd Ave, Suite 200-AM260
Fort Lauderdale, Florida 33309, USA
Privacy inquiries, requests, and appeals: legal@4camp.ai

Please do not send passwords, payment-card information, medical records, government identification numbers, or other sensitive information by ordinary email.

Appendix A. Connection-Specific Notices

This appendix applies only when a customer connects the service identified below. The notice supplements the general treatment of connected services in Section 4.

Google Workspace

4Camp’s use and transfer of information received from Google Workspace APIs, including derived data, adheres to the Google API Services User Data Policy and the Google Workspace API User Data and Developer Policy, including the Limited Use requirements. CAMP accesses and uses this information to provide the customer-authorized features described in Section 4. Personnel review of specific Google Workspace API files for support occurs only with the user’s documented express consent or as Google’s policy otherwise permits.