Scrub Privacy Addendum

Effective date: September 28, 2026

This addendum adds to the theFurnace.ai Privacy Policy at join.thefurnace.ai/privacy for the DNC + Litigator Scrub at dnc.thefurnace.ai (the "Scrub Service"). It is provided by Capital Commission Management, LLC d/b/a theFurnace.ai ("we," "us"). Where this addendum and the Privacy Policy differ, this addendum controls for the Scrub Service.

1. Two kinds of data

• Your account data. Information about you as our customer. We decide how it is used.
• Your file data. The lead files you upload and the results we make from them. We process it on your behalf, as your service provider, under the Scrub Service Terms. You decide why it is collected and used.

2. What we collect

• Account: your email address; your password, stored only as a scrambled hash; and, if you sign in with Google, your name, email, and Google account ID. We ask Google only for your basic profile and email.
• Purchases: what you bought, when, and your credit balance and history. Payments are processed by Stripe; we do not see or store full card numbers.
• Files: the files you upload, the columns we detect (phone, name, state), the cleaned file, the removed-rows file, and the report for each scrub, plus each scrub's file name, date, number count, and credits used.
• Security and technical data: your IP address and sign-in attempts (used to limit abuse), a cookie that keeps you signed in, and standard server logs.
• Messages: emails and other messages you send us.

3. How we use it

To run your scrubs and deliver results; to create and secure your account; to process payments and apply credits; to send you service emails (account confirmation and password reset links, results, credit notices); to support you; to prevent fraud and abuse; to keep business records; and to meet legal obligations. We may use counts that do not identify you or any person (for example, total numbers flagged across all scrubs) to describe and improve the Scrub Service.

We do not sell your account data or your file data. We do not use your file data to market to the people in your files, and we do not share it with other customers.

4. Who we share it with

Only the service providers we need to run the Scrub Service:

• Third-party data providers. To run a scrub, we send the phone numbers in your file, and the names where your file has them, to our do-not-call, litigator, and phone-number data providers. They handle that data under their own terms and policies. We do not control, and make no promise about, how they store, use, or delete it.
• Stripe (payments).
• Google (only if you choose Google sign-in).
• Hosting and database providers (where the site runs and your account and files are stored).
• Email delivery provider (to send you service emails).
• Internal team messaging tools (our team gets notices about purchases and scrubs, which may include your email, file name, and counts).

We may also share information with our professional advisers, with a buyer or successor if our business is sold or reorganized, or when the law requires it or it is needed to protect our rights. Data is stored and processed in the United States.

5. How long we keep it

• Files and results: our practice is to keep them in your account with no set expiration while your account is open, so you can download past scrubs.
• Deletion on request: email scrub@thefurnace.ai from your account email to delete any file, all of your scrub data, or your account. After we confirm the request came from you, we delete the requested data from our active systems within 30 days. Copies may remain in backups until they are overwritten in the normal course.
• What we keep after deletion: records of payments, credit transactions, and the fact that a scrub ran (date, number count, credits used), plus anything the law requires or that we need for a dispute.
• Data sent to our data providers is not covered by our deletion, because we do not control it (Section 4).
• Closed or terminated accounts: we may delete the account's files and results at any time after closure, and we will do so within 30 days if you asked us to close the account.

6. Security

Your files are kept in private storage that is not publicly reachable. Downloads require you to be signed in to the account that owns the file, and each download uses a link that expires after a few minutes. Data moves over encrypted (HTTPS) connections. Access is limited to the people and systems that need it to run the Scrub Service. No system is perfectly secure. If a breach affects your data, we will notify you as the law requires.

7. If your number is in a file a customer scrubbed

Businesses use the Scrub Service to check their own lead lists against do-not-call registries and similar lists before they make contact. If your phone number or name was in one of those files, we processed it for that business, as its service provider, only to run the checks and return results to that business. We did not contact you and will not use your information to market to you. To ask about your data, contact the business that holds the list. You can also email scrub@thefurnace.ai and we will point your request to that business. If you want off do-not-call lists or want a business to stop calling, tell that business directly and add your number at donotcall.gov.

8. Your rights

Section 6 of the Privacy Policy applies. For file data, we act as the uploading business's service provider and will route requests to it.

9. Children

The Scrub Service is for business use by adults. Customers may not upload information about children.

10. Changes and contact

We will post updates here with a new effective date and notify customers of material changes by email. Contact: Capital Commission Management, LLC d/b/a theFurnace.ai, 1600 E 8th Ave, STE A200, Tampa, FL 33605, scrub@thefurnace.ai, 813-358-8389.