Privacy Policy

1. About This Policy

Underline LLC (“Underline,” “we,” “us,” or “our”) is a Nebraska limited liability company located at 1703 N Park Ave, Grand Island, Nebraska 68803, United States.

This Privacy Policy describes how we collect, use, disclose, retain, and protect personal information in connection with our company websites, software, applications, platforms, hosting services, and related services that link to this Policy (collectively, the “Services”).

“Personal information” or “personal data” means information that identifies, relates to, or can reasonably be linked to an identifiable individual or household, as defined by applicable law.

This Policy explains our information practices. It does not waive your statutory rights, replace legally required consent, or authorize processing prohibited by law.

2. Services Covered

This Policy applies to Underline’s company websites and applicable products, including:

• StaffPortal
• Zentra
• WebKiln
• PitStop

It also applies to other Underline Services that expressly incorporate this Policy.

Additional notices may apply to particular products, features, or processing activities. When a supplemental notice specifically addresses an activity, that notice governs that activity to the extent it differs from this Policy.

Separate notices or agreements may govern employment, recruitment, or information processed exclusively on a customer organization’s behalf.

This Policy does not govern independent third parties’ information practices.

3. Underline’s Role

3.1 Information we control

Underline determines how personal information is processed for purposes such as operating our company websites, managing direct customer relationships, administering accounts, billing, providing support, analyzing service usage, and protecting the Services.

For these activities, we act as a controller or equivalent business entity under applicable privacy law.

3.2 Information controlled by customer organizations

An employer, business, venue, community, or other customer may use our Services to manage information about its employees, customers, members, or other individuals.

When we process information solely on that organization’s behalf, we act as its processor or service provider. The organization determines the purposes of processing, and our processing is governed by its instructions and applicable agreements, including any data processing agreement.

For requests concerning organization-controlled information, contact the organization directly. If you contact us, we will assist or refer the request as appropriate under our agreements and applicable law.

3.3 Organization administration

Authorized organization administrators may access and manage information associated with their organization, including user details, permissions, workspace content, and activity records, according to the features and permissions available to them.

Your organization’s policies and notices may explain additional access, retention, and monitoring practices.

4. Personal Information We Collect

The information collected depends on the Services and features used. Not every Service collects every category described below.

4.1 Account and contact information

We collect information provided when you register, accept an invitation, make an inquiry, or manage an account, which may include:

• Name, username, and display name.
• Email address, telephone number, and business contact details.
• Organization name, role, membership, and permissions.
• Account identifiers, authentication information, and security settings.
• Profile details and preferences.
• Records of consent, policy acknowledgments, and account changes.

4.2 Content you provide

We collect content you submit through supported features, including:

• Documents, files, forms, and other uploaded materials.
• Profiles, posts, comments, photographs, and other media.
• Messages and communications submitted through the Services.
• Feedback, support requests, reports, and moderation appeals.
• Information entered into customer workspaces.

Your submissions may contain personal information about you or other individuals. You must have appropriate authority or another lawful basis to provide information about other people.

4.3 Organization and operational information

Where supported by a product, an organization may provide business records such as staff details, roles, schedules, time records, time-off requests, operational records, and organization documents.

We process this information according to the relevant customer agreement and the organization’s instructions.

4.4 Transaction information

When you purchase Services, we process information associated with the transaction, such as billing contact details, billing address, subscription information, invoices, transaction identifiers, payment status, and limited payment-method information received from payment providers.

Payment providers process payment credentials and related information according to their own privacy notices and applicable contractual responsibilities.

Do not send complete payment-card numbers, account passwords, or authentication codes through ordinary email or support requests.

4.5 Technical, security, and diagnostic information

Our systems and providers collect information associated with accessing and operating the Services, which may include:

• IP address and approximate location inferred from it.
• Browser type, operating system, device characteristics, and language.
• Access times, referring pages, request details, and session identifiers.
• Sign-in events, administrative actions, and audit records.
• Errors, crash reports, performance measurements, and diagnostic context.
• Security events and information relevant to suspected misuse.

4.6 Usage analytics

We collect information about how the Services are used, such as pages visited, features accessed, interaction events, session activity, and performance.

We use this information to understand usage, identify problems, evaluate reliability, and improve the Services. Depending on the implementation, analytics records may be associated with a device, session, account, or organization.

We do not use advertising trackers or process personal information for targeted or cross-context behavioral advertising.

4.7 Information from other sources

We may receive information from:

• Organizations that invite you to or manage your account.
• Other users who interact with you or provide information about you.
• Authentication and integration providers you authorize.
• Payment providers reporting transaction activity.
• Providers assisting with security, fraud prevention, and service operation.

The information received through an integration depends on the permissions granted and the provider’s settings.

5. How We Use Personal Information

We use personal information as reasonably necessary to:

1. Provide, operate, maintain, and support the Services.
2. Create accounts, authenticate users, and administer access.
3. Store and deliver content and carry out authorized instructions.
4. Process transactions, administer subscriptions, and maintain financial records.
5. Respond to inquiries, support requests, reports, and complaints.
6. Send account, billing, security, legal, and service communications.
7. Detect, prevent, investigate, and address fraud, abuse, unauthorized access, and security incidents.
8. Enforce agreements, apply community rules, and review moderation reports.
9. Measure usage, diagnose errors, and improve reliability, accessibility, and functionality.
10. Send promotional communications where permitted by law and subject to your choices.
11. Meet legal obligations and establish, exercise, or defend legal claims.
12. Fulfill another purpose specifically disclosed when information is collected, with consent where required.

We do not use personal information or customer content to train artificial intelligence models.

We do not use organization-controlled information for unrelated purposes contrary to our agreements or applicable law.

6. Sensitive Personal Information

Certain content supplied by users or customer organizations may contain information classified as sensitive under applicable law.

Do not submit sensitive information unless the relevant Service supports it and you have an appropriate legal basis and authority to provide it.

Where applicable law requires consent for processing sensitive personal data, we obtain that consent or process the information under another legally permitted exception. When acting as a processor, we process sensitive information under the customer’s instructions and applicable agreement.

We do not sell sensitive personal data.

7. How We Disclose Personal Information

7.1 Providers supporting the Services

We disclose information to providers that help operate our business and Services, including providers of:

• Hosting, infrastructure, storage, and content delivery.
• Security, authentication, fraud prevention, and monitoring.
• Payment processing and billing.
• Email delivery and customer support.
• Usage analytics and diagnostics.
• Professional accounting, legal, and related services.

The information disclosed depends on the provider’s function. For example, infrastructure providers may process stored content and technical records; payment providers process transaction information; and analytics providers process usage and device information.

Where required, providers processing information on our behalf are subject to contractual confidentiality, security, and processing restrictions.

Some providers independently process certain information for their own legal, security, or payment-related responsibilities. Their notices govern those independent activities.

7.2 Customer organizations and authorized users

We disclose information to the organization managing the applicable workspace and to users authorized to access the relevant information or feature.

7.3 Public content and sharing

Information you intentionally publish publicly or make accessible through a public link may be viewed, copied, indexed, or redistributed by others.

Removing information from the Services may not remove copies independently retained by third parties.

7.4 Connected services

We disclose information to integrations or external services when you or an authorized organization administrator enables the connection or directs the disclosure.

7.5 Legal compliance and protection

We may disclose information when legally required or when reasonably necessary and permitted by law to:

• Respond to valid legal process.
• Comply with applicable legal obligations.
• Investigate fraud, security incidents, or unlawful activity.
• Protect the rights, property, or safety of Underline, users, or others.
• Establish, exercise, or defend legal claims.

7.6 Business transactions

Information may be disclosed in connection with a proposed or completed acquisition, merger, financing, reorganization, bankruptcy, or transfer of business assets, subject to applicable confidentiality and legal requirements.

7.7 Your instructions or consent

We disclose information when you direct us to do so or provide valid consent.

8. No Sale or Advertising Sharing

We do not sell personal information.

We do not share personal information for cross-context behavioral advertising or use personal information for targeted advertising.

Disclosures necessary to operate the Services, process payments, provide analytics, or fulfill authorized instructions are described in Section 7. We do not authorize providers processing information on our behalf to use that information for unrelated advertising purposes.

If our practices materially change, we will update this Policy and provide notices, choices, and consent mechanisms required by applicable law before implementing the affected processing.

9. Cookies and Similar Technologies

We use cookies, local storage, session identifiers, and similar technologies for authentication, security, preferences, service functionality, and usage analytics.

Essential technologies help provide requested features, including maintaining a signed-in session and protecting accounts.

Analytics technologies help us understand usage and improve performance. Where applicable law requires consent for optional storage or analytics technologies, we obtain consent before activating them.

You can manage cookies and site storage through your browser settings. Blocking or deleting essential technologies may affect sign-in or other functionality.

You may contact us to request information about analytics processing associated with your account or to exercise an applicable objection or opt-out right.

Because we do not sell personal information or process it for targeted or cross-context behavioral advertising, those activities do not require an advertising opt-out. We recognize legally required opt-out preference signals for any processing to which the applicable requirement extends.

A browser’s “Do Not Track” setting does not, by itself, disable necessary service functions or all analytics processing. It is distinct from legally recognized opt-out preference signals.

10. Retention

We retain personal information only for as long as reasonably necessary for the purposes described in this Policy, subject to legal obligations and applicable customer agreements.

We determine retention based on the category and purpose of the information:

• Account information: For the duration of the account relationship and afterward where necessary for closure, security, disputes, or legal compliance.
• Customer content: According to the applicable Service, customer instructions, and contractual deletion requirements.
• Billing and transaction records: For applicable accounting, tax, fraud-prevention, and legal recordkeeping needs.
• Support records: For resolving inquiries, maintaining relevant service history, and addressing related disputes.
• Security and audit records: For investigating incidents, protecting the Services, and meeting applicable obligations.
• Analytics information: For the period reasonably needed to evaluate usage and service performance, after which it is deleted or deidentified.
• Backups: Until overwritten or deleted through the applicable backup lifecycle, subject to required preservation.

We may retain information subject to a legal hold or another lawful preservation requirement. Retained information remains subject to appropriate restrictions.

Deleting an account does not automatically delete organization-controlled records, legally required records, or copies independently retained by other users.

11. Security

We maintain reasonable administrative, technical, and physical safeguards appropriate to the nature and volume of personal information and the risks associated with its processing.

No system or transmission method can guarantee absolute security.

You should protect your credentials, use available account-security features, and promptly report suspected unauthorized access.

If a security incident requires notification under Nebraska law or another applicable law, we provide required notifications to the appropriate individuals, customers, or authorities.

12. Age Requirements

The minimum ages for our products are:

| Product | Minimum age | |---|---| | StaffPortal | 18 | | Zentra | 18 | | WebKiln | 18 | | PitStop | 16 |

Where applicable law requires a higher age or additional authorization, those requirements also apply.

PitStop users who have not reached the age of legal adulthood in their jurisdiction must obtain any parental or guardian authorization required by law and applicable product terms.

Our Services are not directed to children under 13. We do not knowingly collect personal information from children under 13.

If we learn that information was collected contrary to applicable age restrictions, we take appropriate action, which may include restricting the account and deleting the information, subject to legal requirements.

Parents, guardians, and other individuals may report concerns to legal@underline.team.

These account eligibility requirements do not independently authorize a customer organization to submit children’s personal information. Such processing requires an appropriate supported use, lawful basis, and contractual arrangement.

13. Privacy Requests and Choices

Depending on applicable law, you may have rights to:

• Confirm whether your personal information is processed.
• Access your personal information.
• Correct inaccuracies.
• Request deletion.
• Obtain a portable copy of eligible information.
• Restrict or object to certain processing.
• Withdraw consent where processing relies on consent.
• Opt out of covered sales, targeted advertising, or profiling.
• Appeal a decision concerning a privacy request.
• Complain to an appropriate regulator.

Rights depend on the applicable law, our role, the information involved, and available exceptions.

Submitting a request

You may submit requests through either of these methods:

Email: legal@underline.team Mail: Underline LLC, Attention: Privacy Requests, 1703 N Park Ave, Grand Island, Nebraska 68803, United States.

Describe the request and identify the relevant account, Service, or organization. We do not require you to create an account solely to submit a privacy request.

Verification and representatives

We may request information reasonably necessary to authenticate a request or confirm authority to act for another person.

We use verification information for verification, security, and related legal compliance. We do not require unnecessary sensitive information.

An authorized agent, parent, or guardian may act where permitted by applicable law. We may request appropriate evidence of authority.

Marketing and consent

You may unsubscribe from promotional emails using the instructions provided in the message or by contacting us.

Necessary service, security, billing, and legal communications may continue.

Withdrawal of consent does not affect processing lawfully carried out before withdrawal.

14. Nebraska Consumer Rights and Procedures

The Nebraska Data Privacy Act, Neb. Rev. Stat. §§ 87-1101–87-1130, applies according to its statutory scope and exemptions, including its treatment of small businesses. This Policy does not represent that every provision applies to every Underline activity.

Where the Act applies, eligible Nebraska consumers may request:

1. Confirmation of processing and access to their personal data.
2. Correction of inaccurate personal data.
3. Deletion of personal data provided by or obtained about them.
4. A portable, readily usable copy of eligible personal data previously provided.
5. An opt-out of processing for targeted advertising, sale of personal data, or profiling in furtherance of decisions producing legal or similarly significant effects.

We do not sell personal data or conduct targeted advertising. We do not use personal data for profiling that produces legal or similarly significant effects concerning consumers.

Submit requests through the email or postal methods in Section 13.

Response period

For requests governed by the Nebraska Data Privacy Act, we respond without undue delay and within 45 days after receipt.

Where reasonably necessary and legally permitted, we may extend the response period once by an additional 45 days. We notify you within the initial period and explain the reason.

Responses are provided free of charge up to twice annually per consumer. For manifestly unfounded, excessive, or repetitive requests, we may charge a reasonable permitted fee or decline to act, as allowed by law.

If we cannot authenticate a request using commercially reasonable efforts, we may request additional information reasonably necessary to do so.

Appeals

If we decline a request, you may appeal by:

• Emailing legal@underline.team with the subject “Nebraska Privacy Appeal”; or
• Mailing an appeal to our address with “Nebraska Privacy Appeal” clearly indicated.

Include the original request, our response, and the reason you believe the decision should be reconsidered.

We provide a written appeal decision, including an explanation, within 60 days after receiving the appeal.

If we deny your appeal, you may submit a complaint to the Nebraska Attorney General through the official data privacy website:

https://protectthegoodlife.nebraska.gov/data-privacy-homepage

No unlawful discrimination

We do not unlawfully discriminate against you for exercising privacy rights. Exercising a right may affect a feature when the information is necessary to provide that feature, subject to applicable law.

15. Other Jurisdictions

Individuals outside Nebraska may have additional rights under applicable privacy laws. We honor those rights where the relevant law applies.

For individuals protected by applicable European, United Kingdom, or Swiss data protection law, relevant processing grounds may include contractual necessity, legal obligations, consent, and legitimate interests such as securing and operating the Services, subject to the required balancing of rights and interests.

Where applicable, you may object to processing based on legitimate interests, withdraw consent, request restriction, and complain to a competent supervisory authority.

Nebraska law does not displace mandatory privacy protections that apply to you under another jurisdiction’s law.

16. International Processing

Underline is based in the United States. Information may be processed in the United States and other locations where authorized providers operate.

Where applicable law restricts international transfers, we use the legally required transfer arrangements and supplementary safeguards appropriate to the transfer.

You may contact us for information about safeguards applicable to your information, subject to lawful confidentiality restrictions.

17. Third-Party Services

External websites, storefronts, payment services, and connected applications may collect and process information independently.

Review their privacy notices before using them or granting access.

This section does not reduce our responsibility for providers processing information on our behalf.

18. Changes to This Policy

We may update this Policy as our Services, practices, and legal obligations change.

We post the revised version and update the “Last Updated” date. We provide additional notice of material changes where required by law.

Where new processing requires consent or another legal prerequisite, we satisfy that requirement before implementing it. Publication of a revised Policy does not itself supply legally required consent.

19. Contact Information

For privacy questions, requests, appeals, or complaints:

Underline LLC Attention: Privacy Requests 1703 N Park Ave Grand Island, Nebraska 68803 United States

Email: legal@underline.team

Please identify the relevant Service and provide enough information for us to understand and respond to your request. Do not include passwords, complete payment-card numbers, or unnecessary sensitive information.

© 2026 Underline LLC. All rights reserved.