Privacy Policy

Version 4 · Last updated: April 27, 2026

This Privacy Policy ("Privacy Notice" or "Policy") describes how and why How Much Holdings Pty Limited (ACN 687 662 871) and the other members of the How Much Group (as defined below) (collectively, "How Much Holdings," the "How Much Group," "we," "us," or "our") may access, collect, store, use, disclose, sell, share, and/or transfer (collectively, "process") your personal information when you use our services ("Services"), including when you:

• Visit any of the Websites listed below, or any other website, mobile application, sub-domain, or online service of ours that links to or references this Privacy Notice;
• Submit a Service Request, register for an account, or otherwise interact with the Services; or
• Engage with us in any other related way, including sales, marketing, advertising, surveys, or events.

Definitions

"How Much Group" means How Much Holdings Pty Limited (ACN 687 662 871, Australia), How Much Holdings Limited (United Kingdom), and each of their respective parents, subsidiaries, affiliates, successors, and assigns.

"Websites" means each and any of the following websites and online services operated by a member of the How Much Group, together with all sub-domains, mobile applications, and other online services that link to or reference these Terms or this Privacy Notice:

• solarreviews.com
• fixr.com
• howmuch.net
• uk.howmuch.net
• solar-estimate.org
• mysolar.com
• bathroom-estimate.org
• windows-estimate.org
• siding-estimate.org
• roofingcalculator.com

Use of any of the Websites is governed by our Terms of Service and this Privacy Policy as they apply in your region of residence. References in this Privacy Notice to "the Services" include each of the Websites unless the context requires otherwise.

Please read this Privacy Notice carefully. By using the Services, you acknowledge that you have read, understood, and agreed to the practices described in this Privacy Notice and our Terms of Service. If you do not agree, you must not use the Services.

CROSS-REFERENCE TO TERMS OF SERVICE: Disputes relating to this Privacy Notice are governed by the Terms of Service, including the mandatory binding arbitration provision, class action and collective action waiver, jury trial waiver, exclusive forum selection clause (South Australia, Australia, with a step-down to the state and federal courts of New Castle County, Delaware as the sole U.S. forum for any jurisdictional challenge or U.S. action), governing law (South Australia), shortened limitations period, and attorneys' fees provisions set out therein.

Questions or concerns? If you have any questions or concerns, contact us at privacy@hmg.ai.

Summary of Key Points

This summary provides key points from our Privacy Notice. You can find more detail under each heading below.

What personal information do we process?

When you visit, use, or navigate the Services, we may process personal information depending on how you interact with us, the choices you make, and the products and features you use.

Do we process any sensitive personal information?

We do not knowingly process information considered "sensitive" or "special category" under applicable laws (such as racial or ethnic origin, sexual orientation, religious beliefs, health, biometric data, or precise geolocation), except where you voluntarily provide it or where required to deliver the Services.

Do we collect any information from third parties?

Yes. We may collect information from public databases, marketing partners, social media platforms, advertising networks, data providers, Service Professionals, and other outside sources.

How do we process your information?

We process your information to provide, improve, market, and administer our Services; to match you with Service Professionals; to communicate with you (including by call, SMS, and email); for security and fraud prevention; for our legitimate business interests; and to comply with law.

Do we sell or share your personal information?

YES. We sell and/or share your personal information for monetary or other valuable consideration to and with Service Professionals, marketing partners, advertising networks, data providers, and our affiliates, including for purposes of targeted advertising and lead generation. By submitting a Service Request, you consent to such sale and/or sharing. You may have the right to opt out of certain sales and/or sharing as described under "YOUR PRIVACY RIGHTS" below.

Will my information be transferred outside my country?

Yes. Your information will be transferred to, processed in, and stored in Australia, the United States, the United Kingdom, Canada, and other jurisdictions where we, our affiliates, our service providers, our Service Professionals, or our marketing partners maintain operations.

How do we keep your information safe?

We have organisational and technical processes and procedures in place to protect your personal information. However, no electronic transmission or information storage technology can be guaranteed to be 100% secure. We do not warrant or guarantee that hackers, cybercriminals, or other unauthorised third parties will not be able to defeat our security and improperly collect, access, steal, or modify your information.

What are your rights?

Depending on where you are located, applicable privacy law may give you certain rights regarding your personal information. See "YOUR PRIVACY RIGHTS" below.

How do you exercise your rights?

Email privacy@hmg.ai. We will consider and act on any request in accordance with applicable data protection laws.

Table of Contents

1. WHAT INFORMATION DO WE COLLECT?
2. HOW DO WE PROCESS YOUR INFORMATION?
3. WHEN AND WITH WHOM DO WE SHARE, SELL, OR TRANSFER YOUR PERSONAL INFORMATION?
4. CONSENT TO BE CONTACTED (TCPA / CASL / PECR / SPAM ACT / TELEMARKETING)
5. DO WE USE COOKIES AND OTHER TRACKING TECHNOLOGIES?
6. HOW LONG DO WE KEEP YOUR INFORMATION?
7. HOW DO WE KEEP YOUR INFORMATION SAFE?
8. DO WE COLLECT INFORMATION FROM CHILDREN AND MINORS?
9. INTERNATIONAL DATA TRANSFERS
10. YOUR PRIVACY RIGHTS
11. CONTROLS FOR DO-NOT-TRACK FEATURES AND OPT-OUT PREFERENCE SIGNALS
12. UNITED STATES STATE PRIVACY RIGHTS
13. AUSTRALIAN PRIVACY ACT NOTICE
14. CANADIAN PRIVACY NOTICE (PIPEDA, QUEBEC LAW 25, ALBERTA PIPA, BC PIPA, CASL)
15. UNITED KINGDOM PRIVACY NOTICE (UK GDPR / DPA 2018)
16. DISCLAIMERS, LIMITATIONS OF LIABILITY, AND DISPUTE RESOLUTION
17. UPDATES TO THIS NOTICE
18. HOW CAN YOU CONTACT US ABOUT THIS NOTICE?
19. HOW CAN YOU REVIEW, UPDATE, OR DELETE THE DATA WE COLLECT FROM YOU?

1. What Information Do We Collect?

Personal information you disclose to us

In short: We collect personal information that you provide to us.

We collect personal information that you voluntarily provide to us when you register on the Services, submit a Service Request, express an interest in obtaining information about us or our Service Professionals, when you participate in activities on the Services, or otherwise when you contact us. The personal information we collect may include:

• Names
• Phone numbers (mobile and landline)
• Email addresses
• Mailing and physical addresses, including the address of any property relevant to a Service Request
• Property information (e.g., type, size, ownership status, utility provider, electricity usage)
• Project information (e.g., budget, timing, financing preferences)
• Contact preferences and consents
• Authentication data (usernames, passwords, login credentials)
• Billing information, including debit/credit card numbers and billing addresses
• Job titles or business contact details
• Any other information you choose to provide in surveys, reviews, photographs, communications, or otherwise

Sensitive information

We do not knowingly request or process information considered "sensitive" under applicable law, except as needed to provide the Services or with your express consent.

All personal information that you provide to us must be true, complete, and accurate, and you must notify us of any changes.

Information automatically collected

In short: Some information — such as your IP address and browser/device characteristics — is collected automatically.

We automatically collect certain information when you visit, use, or navigate the Services. This information may include device and usage information, such as your IP address, browser and device characteristics, operating system, language preferences, referring URLs, device name, country, location, information about how and when you use our Services, and other technical information. This information is primarily needed to maintain the security and operation of our Services, for our internal analytics and reporting, for fraud detection, and for advertising and marketing.

Like many businesses, we also collect information through cookies, pixels, web beacons, SDKs, and similar technologies. The information we collect includes:

• Log and Usage Data — service-related, diagnostic, usage, and performance information our servers automatically collect, including IP address, device information, browser type and settings, dates/times of usage, pages and files viewed, searches and other actions, error reports, and hardware settings.
• Device Data — information about your computer, phone, tablet, or other device you use, including IP address (or proxy server), device and application identification numbers, location, browser type, hardware model, internet service provider and/or mobile carrier, operating system, and system configuration information.
• Location Data — information about your device's location, which can be either precise or imprecise. We may use GPS, Wi-Fi, IP address, and other technologies to estimate your location. You may opt out of allowing us to collect this information either by refusing access or disabling your Location setting on your device, but if you do, you may not be able to use certain aspects of the Services.
• Inferences and profiling data — derived from any of the above, including likelihood of conversion, project intent scores, and similar.

Information collected from other sources

In short: We collect data from public databases, marketing partners, lead aggregators, and other outside sources.

To enhance our ability to provide relevant marketing, offers, and services, and to update our records, we obtain information about you from other sources, such as public databases, joint marketing partners, affiliate programs, lead aggregators, data providers, social media platforms, advertising networks, Service Professionals, and other third parties. This information may include mailing addresses, job titles, email addresses, phone numbers, intent or behavioural data, IP addresses, social media profiles and URLs, demographic information, and custom profiles, for purposes of targeted advertising, lead generation, and event promotion.

2. How Do We Process Your Information?

In short: We process your information to provide, improve, and administer our Services; to match you with Service Professionals; to communicate with you; to market to you; for security and fraud prevention; and to comply with law.

We process your personal information for a variety of reasons, including:

• To facilitate account creation and authentication and otherwise manage user accounts.
• To deliver and facilitate delivery of the Services to you, including to match you with Service Professionals and to allow Service Professionals to contact you about your Service Request.
• To respond to your inquiries and provide customer support.
• To send you administrative information, including changes to our terms or policies.
• To request feedback and to contact you about your use of the Services.
• To send you marketing and promotional communications by email, SMS/MMS, telephone (including pre-recorded and auto-dialed calls), direct mail, push notification, or any other reasonable means, in accordance with your preferences and applicable law.
• To deliver targeted advertising and to measure the effectiveness of our and our partners' marketing campaigns.
• To sell, share, license, or otherwise transfer your personal information to Service Professionals, marketing partners, lead buyers, advertising networks, and our affiliates for the purposes set out in this Privacy Notice.
• To prevent and detect fraud, abuse, security incidents, and unlawful activity, and to protect the rights, property, and safety of How Much Holdings, our users, our Service Professionals, and others.
• To evaluate, develop, and improve our Services, products, marketing, and your experience, including by testing, analytics, machine learning, and research.
• To establish, exercise, or defend legal claims, including in connection with any actual or threatened complaint, investigation, audit, regulatory inquiry, arbitration, or litigation.
• To comply with our legal, regulatory, accounting, tax, audit, and reporting obligations.
• For any other purpose with your consent or as permitted by law.

3. When and With Whom Do We Share, Sell, or Transfer Your Personal Information?

In short: We share, sell, and transfer information in the situations described below and with the following categories of third parties.

3.1 Service Professionals (Lead Recipients)

When you submit a Service Request, we may sell, share, license, or otherwise transfer your personal information — including your name, address, phone numbers, email address, project information, and Service Request details — to one or more Service Professionals (such as solar installers, contractors, remodelers, lenders, and similar) so that they may contact you and/or provide a quote. We may receive monetary or other valuable consideration in connection with these transfers, which constitutes a "sale" or "sharing" of personal information under certain U.S. state laws. By submitting a Service Request you consent to this sale and/or sharing.

3.2 Vendors, Consultants, and Other Third-Party Service Providers

We share your data with third-party vendors, service providers, contractors, processors, or agents ("third parties") who perform services for us or on our behalf and require access to such information. We have contracts in place with our third parties to safeguard your personal information.

The categories of third parties we may share personal information with include:

• User account registration and authentication services
• Advertising networks and ad-tech providers
• Cloud computing, hosting, and infrastructure providers
• Data analytics and attribution providers
• Communications and messaging providers (including SMS aggregators, email service providers, and call centers)
• Payment processors
• Customer relationship management (CRM) and marketing automation platforms
• Lead aggregators and marketing partners
• Identity verification, fraud prevention, and anti-spam vendors
• Professional advisors (lawyers, accountants, auditors, and insurers)

3.3 Other Sharing Situations

We may also share your personal information in the following situations:

• Business Transfers — in connection with, or during negotiations of, any merger, sale of company assets, financing, reorganisation, insolvency, or acquisition of all or a portion of our business to or by another company.
• Affiliates — with our parent, subsidiaries, joint venture partners, or other companies under common control with us, who will be required to honour this Privacy Notice.
• Legal and Safety — to comply with applicable law, court orders, subpoenas, lawful requests by public authorities, regulatory inquiries, or to enforce our Terms of Service or other agreements; to investigate fraud or other unlawful activity; to protect the rights, property, or safety of How Much Holdings, our users, our Service Professionals, or others; or to defend ourselves in any legal proceeding.
• With your consent — for any other purpose disclosed by us when you provide the information or with your consent.

3.4 Google Maps Platform APIs

We may share your information with certain Google Maps Platform APIs (e.g., Google Maps API, Places API) to retrieve information when you make location-specific requests. We obtain and store on your device ("cache") your location. You may revoke your consent at any time by contacting us. The Google Maps Platform APIs we use may store and access cookies and other information on your devices.

4. Consent to Be Contacted (TCPA / CASL / PECR / Spam Act / Telemarketing)

4.1 Prior Express Written Consent

By submitting a Service Request, registering for an account, or otherwise providing your telephone number(s), email address, or other contact information through the Services, you provide your prior express written consent (within the meaning of the Telephone Consumer Protection Act, 47 U.S.C. § 227 and its implementing regulations (the "TCPA")) for How Much Holdings, our affiliates, our marketing partners, and one or more Service Professionals to contact you at the telephone number(s) and email address(es) you have provided, including by:

• Live telephone calls;
• Pre-recorded or artificial voice messages;
• Text messages (SMS/MMS), including by automatic telephone dialing systems and any automated technology;
• Email messages, including with promotional or marketing content;
• Direct mail; and
• Any other reasonable means of communication.

This consent applies even if your number(s) appear on any federal, state, internal, corporate, or other Do Not Call list. Consent is not a condition of any purchase. Message and data rates may apply. Message frequency may vary.

4.2 Australian Spam Act / Do Not Call Register

Where applicable to you, by providing your consent above, you also consent for purposes of the Spam Act 2003 (Cth) and the Do Not Call Register Act 2006 (Cth) (and equivalents) to receive commercial electronic messages and telemarketing calls from How Much Holdings, our affiliates, our marketing partners, and Service Professionals.

4.3 Canada — CASL Express Consent

If you are located in Canada, by submitting a Service Request or otherwise providing your contact details, you provide your express consent for purposes of Canada's Anti-Spam Legislation, S.C. 2010, c. 23 ("CASL") and the Telecommunications Act (and the Unsolicited Telecommunications Rules of the Canadian Radio-television and Telecommunications Commission (CRTC)) to receive commercial electronic messages (including emails and SMS/MMS) and telemarketing calls (including by automatic dialing-announcing devices) from How Much Holdings, our affiliates, our marketing partners, and Service Professionals at the contact details you provide. Each commercial electronic message we send will identify the sender and contain a working unsubscribe mechanism. You may withdraw your consent at any time as described below.

4.4 United Kingdom — PECR Consent

If you are located in the United Kingdom, by submitting a Service Request or otherwise providing your contact details, you provide your consent for purposes of the Privacy and Electronic Communications (EC Directive) Regulations 2003 ("PECR") to receive direct marketing communications by electronic means (including email, SMS/MMS, and live or automated telephone calls) from How Much Holdings, our affiliates, our marketing partners, and Service Professionals at the contact details you provide. You may withdraw your consent at any time and you have the right to object to direct marketing at any time, free of charge, as described below.

4.5 Revocation of Consent

You may revoke this consent at any time by following the unsubscribe instructions in any communication, by replying "STOP" to any text message, or by emailing privacy@hmg.ai. Revocation will apply to communications initiated by us after we have a reasonable time to process your request and will not apply to transactional or service-related communications, or to communications you separately authorise with any Service Professional or third party.

4.6 Recording of Calls

You consent to the recording, monitoring, and retention of any telephone or electronic communications between you and us (and you should assume that Service Professionals may also record their communications with you, as permitted by law).

4.7 Cross-Reference to Terms of Service

All disputes regarding the consents in this Section 4 (including TCPA, CASL, PECR, and Spam Act claims) are subject to the dispute resolution provisions in our Terms of Service, which include mandatory binding arbitration, a class action and collective action waiver, a jury trial waiver, exclusive forum selection in South Australia (with Delaware as the sole U.S. fallback forum), governing law of South Australia, a one-year limitations period, and reasonable legal fees recovery for the prevailing party.

5. Do We Use Cookies and Other Tracking Technologies?

In short: We use cookies and other tracking technologies to collect and store your information.

We may use cookies and similar tracking technologies (like web beacons, pixels, SDKs, tags, and local storage) to gather information when you interact with our Services. Some online tracking technologies help us maintain the security of our Services, prevent crashes, fix bugs, save your preferences, and assist with basic site functions.

We also permit third parties and service providers to use online tracking technologies on our Services for analytics and advertising purposes, including to help manage and display advertisements, to tailor advertisements to your interests, or to send abandoned shopping cart reminders.

To the extent these online tracking technologies are deemed to be a "sale" or "sharing" of personal information (which includes targeted advertising, as defined under applicable laws) under U.S. state laws, you can opt out as described below in section 12 (UNITED STATES STATE PRIVACY RIGHTS).

Cookie Consent in the United Kingdom

If you are located in the United Kingdom or another jurisdiction whose laws require opt-in consent for the use of non-essential cookies and similar technologies (including the UK GDPR, the Data Protection Act 2018, and the Privacy and Electronic Communications (EC Directive) Regulations 2003 ("PECR")), we will obtain your prior, informed, freely given, specific, and unambiguous consent through a cookie banner or other consent mechanism before placing any non-essential cookies or similar technologies on your device. You may withdraw your consent at any time, free of charge, through our Cookie Preference Settings.

Cookie Consent in Quebec, Canada

If you are located in Quebec, we will, where required by Law 25 (Act respecting the protection of personal information in the private sector), notify you of the use of any technology that collects personal information and offer you the means to deactivate non-essential identification, location, or profiling functions.

Google Analytics

We may share your information with Google Analytics. The Google Analytics Advertising Features that we may use include Google Display Network Impressions Reporting. To opt out of being tracked by Google Analytics across the Services, visit https://tools.google.com/dlpage/gaoptout. You can opt out of Google Analytics Advertising Features through Google Ads Settings. For more information on the privacy practices of Google, please visit Google's Privacy & Terms page.

6. How Long Do We Keep Your Information?

In short: We keep your information for as long as necessary to fulfil the purposes outlined in this Privacy Notice or as required or permitted by law.

We will only keep your personal information for as long as it is necessary for the purposes set out in this Privacy Notice, unless a longer retention period is required or permitted by law (such as tax, accounting, audit, fraud prevention, dispute defense, or other legal requirements). In particular, we may retain personal information for the duration of the applicable statute or period of limitations (or longer if required) to enable us to defend against any actual, potential, or threatened claims, investigations, or litigation. When we have no ongoing legitimate business need to process your personal information, we will either delete or anonymise it, or, if this is not possible, we will securely store it and isolate it from any further processing until deletion is possible.

7. How Do We Keep Your Information Safe?

In short: We aim to protect your personal information through a system of organisational and technical security measures.

We have implemented appropriate and reasonable technical and organisational security measures designed to protect the security of any personal information we process. However, despite our safeguards and efforts to secure your information, no electronic transmission over the Internet or information storage technology can be guaranteed to be 100% secure, and we do not warrant or guarantee that hackers, cybercriminals, or other unauthorised third parties will not be able to defeat our security and improperly collect, access, steal, or modify your information. Although we will do our best to protect your personal information, transmission of personal information to and from our Services is at your own risk. You should only access the Services within a secure environment.

8. Do We Collect Information From Children and Minors?

In short: The Services are not directed to children, and we do not knowingly collect data from minors below the applicable age of digital consent in their jurisdiction.

We do not knowingly collect, solicit data from, or market to children under 18 years of age, nor do we knowingly sell or share such personal information. By using the Services, you represent that you are at least 18 years old (or, if applicable law sets a lower age of contractual or digital consent in your jurisdiction, that you have reached that age), or that you are the parent or guardian of such a minor and consent to such minor dependent's use of the Services.

Specifically:

• United States: Under the Children's Online Privacy Protection Act, 15 U.S.C. § 6501 et seq. ("COPPA"), we do not knowingly collect personal information from children under 13. The Services are not directed to children under 18.
• United Kingdom: We do not knowingly process personal data of children under 13 without verified parental consent (the digital age of consent under the UK GDPR / DPA 2018).
• Canada: We do not knowingly collect personal information from children below the age of consent applicable under the relevant provincial law (which may range from 13 to 14 depending on the province; in Quebec, parental consent is required for minors under 14 under Law 25).
• Australia: We do not knowingly collect personal information from children under 18 in a manner inconsistent with the Australian Privacy Principles.

If we learn that personal information from a child below the applicable age of consent has been collected without the necessary parental authorisation, we will deactivate the account and take reasonable measures to promptly delete such data from our records. If you become aware of any such data, please contact us at privacy@hmg.ai.

9. International Data Transfers

How Much Holdings Pty Limited is incorporated and operates from Australia. Our Services are also operated and supported from the United States, the United Kingdom, Canada, and other jurisdictions. By using the Services or providing us with personal information, you acknowledge and agree that your information may be transferred to, processed in, and stored in Australia, the United States, the United Kingdom, Canada, and any other country where we, our affiliates, our service providers, our Service Professionals, or our marketing partners maintain operations, and that such jurisdictions may have data protection and privacy laws different from (and potentially less protective than) those in your country of residence. You consent to such transfer, processing, and storage.

Transfer Mechanisms

Where required by applicable law, we put in place appropriate safeguards for cross-border transfers, including:

• For transfers from the United Kingdom to a country not the subject of UK adequacy regulations: the UK International Data Transfer Agreement (IDTA) or the UK International Data Transfer Addendum to the EU Standard Contractual Clauses.
• For transfers from Canada (including Quebec): contractual safeguards comparable to those required under PIPEDA, Quebec Law 25, Alberta PIPA, and BC PIPA, including a privacy impact assessment for transfers from Quebec where required.
• For transfers from Australia: reasonable steps under Australian Privacy Principle 8 to ensure overseas recipients comply with the APPs in relation to your personal information.

You may obtain a copy of the relevant safeguards (with commercial information redacted) by contacting privacy@hmg.ai.

10. Your Privacy Rights

In short: You may review, change, or terminate your account at any time, and you may have certain rights under applicable law.

Withdrawing your consent

If we are relying on your consent to process your personal information, you have the right to withdraw your consent at any time by contacting us using the contact details provided below. Withdrawal of consent will not affect the lawfulness of processing before its withdrawal nor, where applicable law allows, will it affect processing of your personal information conducted in reliance on lawful processing grounds other than consent.

Opting out of marketing and promotional communications

You can unsubscribe from our marketing and promotional communications at any time by clicking the unsubscribe link in our emails, replying "STOP" or "UNSUBSCRIBE" to SMS messages, or by contacting us. You will then be removed from the relevant marketing lists. We may still communicate with you for service-related, transactional, or other non-marketing purposes.

Account information

If you would like to review, change, or terminate your account, you may contact us using the contact information below or log in to your account settings. Upon your request to terminate your account, we will deactivate or delete your account and information from our active databases. However, we may retain certain information in our files to prevent fraud, troubleshoot problems, assist with any investigations, defend against actual or potential claims, enforce our legal terms, and/or comply with applicable legal requirements.

Cookies and similar technologies

Most web browsers are set to accept cookies by default. You can usually choose to set your browser to remove cookies and to reject cookies. If you choose to remove or reject cookies, this could affect certain features or services of our Services.

11. Controls for Do-Not-Track Features

Most web browsers and some mobile operating systems and applications include a Do-Not-Track ("DNT") feature. At this stage, no uniform technology standard for recognising and implementing DNT signals has been finalised. We do not currently respond to DNT browser signals or any other mechanism that automatically communicates your choice not to be tracked online, except where required by law (for example, recognised opt-out preference signals such as the Global Privacy Control where applicable to U.S. state law residents). California law requires us to let you know how we respond to web browser DNT signals.

12. United States State Privacy Rights

In short: If you are a resident of California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, or Virginia, you may have the rights described below.

Subject to applicable U.S. state law, you may have the right to request access to, receive details about, correct, port, or delete the personal information we maintain about you, and to opt out of certain processing. These rights may be limited in some circumstances by applicable law. We may decline a request as permitted by law, including if we are unable to verify your identity.

Categories of Personal Information We Collect

We have collected the following categories of personal information in the past twelve (12) months:

Category	Examples	Collected
A. Identifiers	Real name, alias, postal address, telephone or mobile contact number, unique personal identifier, online identifier, IP address, email address, account name	YES
B. Customer Records (Cal. Civ. Code §1798.80)	Name, contact information, financial information	YES
C. Protected classification characteristics	Gender, age, date of birth, marital status, demographic data	NO
D. Commercial information	Transaction information, purchase history, financial details, payment information	YES
E. Biometric information	Fingerprints, voiceprints	NO
F. Internet or other similar network activity	Browsing history, search history, online behaviour, interest data, interactions with our and other websites, applications, systems, and ads	YES
G. Geolocation data	Device and approximate location (IP-based, postcode/zip)	YES
H. Audio, electronic, sensory, or similar information	Call recordings created in connection with our business activities	YES
I. Professional or employment-related information	Job title, work history (where you provide it)	NO
J. Education information	Student records and directory information	NO
K. Inferences	Inferences drawn from any of the above to create a profile or summary about an individual's preferences, characteristics, or likely purchase intent	YES
L. Sensitive personal information	(see definition under applicable law)	NO

Sources of Personal Information

Information you provide; information automatically collected; information from public databases, marketing partners, lead aggregators, advertising networks, social media platforms, data providers, Service Professionals, and other third parties.

How We Use and Share Personal Information

As described in sections 2 and 3 above.

Sales and Sharing of Personal Information

WE SELL AND/OR SHARE THE FOLLOWING CATEGORIES OF PERSONAL INFORMATION:

• Category A — Identifiers
• Category B — Personal information as defined in the California Customer Records statute
• Category D — Commercial information
• Category F — Internet or other similar network activity (for targeted advertising)
• Category G — Geolocation data (approximate)
• Category K — Inferences

These categories are sold and/or shared with: Service Professionals (installers, contractors, remodelers, lenders) who you opt-in to receive a quote from; lead aggregators and marketing partners; advertising networks; data providers; affiliates; and analytics providers.

Your Rights

• Right to know whether we are processing your personal data and to access it
• Right to correct inaccuracies in your personal data
• Right to request deletion of your personal data
• Right to obtain a copy of the personal data you previously shared with us (data portability)
• Right to opt out of the sale or sharing of your personal data
• Right to opt out of targeted advertising
• Right to opt out of profiling in furtherance of decisions that produce legal or similarly significant effects
• Right to limit use and disclosure of sensitive personal information (where applicable)
• Right to non-discrimination for exercising your rights
• Right to appeal a denial of your request

How to Exercise Your Rights

Email privacy@hmg.ai or contact us using the details at the end of this notice. To opt out of the selling/sharing of personal information for targeted advertising, you may also disable cookies in your Cookie Preference Settings (where available) or transmit a recognised opt-out preference signal (such as the Global Privacy Control).

Under certain U.S. state data protection laws, you can designate an authorised agent to make a request on your behalf. We may deny a request from an authorised agent that does not submit proof of authority. Upon receiving a request, we may need to verify your identity before responding.

Appeals

If we decline to take action regarding your request, you may appeal our decision by emailing privacy@hmg.ai. We will inform you in writing of any action taken or not taken in response to the appeal, including a written explanation of the reasons for the decision. If your appeal is denied, you may submit a complaint to your state attorney general.

California "Shine The Light" Law

California Civil Code Section 1798.83 permits California residents to request and obtain from us, once a year and free of charge, information about categories of personal information (if any) we disclosed to third parties for direct marketing purposes and the names and addresses of all third parties with which we shared personal information in the immediately preceding calendar year. Submit your request in writing using the contact details below.

13. Australian Privacy Act Notice

This section applies to individuals in Australia. It supplements (and where applicable modifies) the rest of this Privacy Notice.

How Much Holdings Pty Limited handles personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles ("APPs").

Collection

We collect personal information for the purposes described in section 2. If we cannot collect the personal information we need, we may not be able to provide the Services.

Disclosure overseas

Your personal information is likely to be disclosed to overseas recipients in the United States and other jurisdictions where our affiliates, service providers, Service Professionals, and marketing partners are located.

Access and correction

You may request access to, or correction of, the personal information we hold about you by contacting privacy@hmg.ai.

Complaints

If you believe we have breached the APPs, please contact privacy@hmg.ai so we can investigate. If you are not satisfied with our response, you may complain to the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au.

Cross-Reference to Terms of Service

Disputes are subject to the dispute resolution provisions in our Terms of Service, including mandatory binding arbitration, class action and collective action waivers, jury trial waiver, exclusive forum selection in South Australia, governing law of South Australia, the one-year limitations period, and the legal fees recovery provision. Calls between you and us may be recorded and monitored as set out in Section 4.6.

14. Canadian Privacy Notice (PIPEDA, Quebec Law 25, Alberta PIPA, BC PIPA, CASL)

This section applies to individuals in Canada. It supplements and, where applicable, modifies the rest of this Privacy Notice.

14.1 Applicable Laws

How Much Holdings handles personal information of Canadian residents in accordance with the Personal Information Protection and Electronic Documents Act, S.C. 2000, c. 5 ("PIPEDA"); the Act respecting the protection of personal information in the private sector, R.S.Q., c. P-39.1 (Quebec) (as amended by Law 25); the Personal Information Protection Act (Alberta) ("Alberta PIPA"); the Personal Information Protection Act (British Columbia) ("BC PIPA"); and Canada's Anti-Spam Legislation, S.C. 2010, c. 23 ("CASL").

14.2 Person Responsible for the Protection of Personal Information

The person responsible for the protection of personal information (the "Privacy Officer," and for purposes of Quebec Law 25, the "Person in Charge of the Protection of Personal Information") is contactable at:

Privacy Officer, How Much Holdings Pty Limited
Email: privacy@hmg.ai
Postal: Level 19, 83 Pirie Street, Adelaide, South Australia 5000

14.3 Purposes of Collection, Use, and Disclosure

We collect, use, and disclose personal information for the purposes set out in Section 2 (How Do We Process Your Information?) and Section 3 (When and With Whom Do We Share, Sell, or Transfer Your Personal Information?). Where required by applicable Canadian law, we obtain your consent (express or implied, as appropriate) at or before the time of collection.

14.4 Cross-Border Transfers and Storage

Your personal information will be transferred to, processed, and stored outside of Canada, including in Australia, the United States, the United Kingdom, and other jurisdictions. While outside Canada, your information may be subject to access by foreign courts, law enforcement agencies, and national security authorities under the laws of the recipient jurisdiction. We implement contractual and organisational safeguards comparable to those required under PIPEDA and applicable provincial law.

14.5 Quebec — Specific Disclosures (Law 25)

If you are a resident of Quebec:

• We may use your personal information to render decisions based exclusively on automated processing (such as lead scoring, fraud screening, and matching with Service Professionals). You may request information on the personal information used, the reasons and principal factors and parameters that led to the decision, and the right to have the decision reviewed by a person if you so request.
• Some of our identification, location, or profiling functions are activated by default; where required by Law 25, we will offer you a means to deactivate them.
• Where required, we conduct privacy impact assessments before transferring your personal information outside Quebec.
• You may contact our Privacy Officer (identified in Section 14.2) regarding any rights or complaints under Law 25.

14.6 Your Rights

Subject to applicable Canadian and provincial law, you have the right to:

• Access the personal information we hold about you and request a copy of it;
• Request correction or rectification of inaccurate or incomplete personal information;
• Withdraw your consent to our collection, use, or disclosure of your personal information (subject to legal or contractual restrictions and reasonable notice);
• Request the cessation of dissemination, the de-indexation, or the re-indexation of personal information about you (Quebec);
• Receive your personal information in a structured, commonly used technological format and request its transfer to another person or body (Quebec data portability);
• Be informed of an automated decision made exclusively on the basis of automated processing of your personal information and to have it reviewed by a natural person (Quebec);
• Lodge a complaint with our Privacy Officer or with the appropriate regulator (see Section 14.8 below).

14.7 CASL Express Consent and Withdrawal

By submitting a Service Request or otherwise providing your contact details, you provide your express consent under CASL to receive commercial electronic messages and telemarketing calls from How Much Holdings, our affiliates, our marketing partners, and Service Professionals. Each commercial electronic message we send will identify the sender and contain a working unsubscribe mechanism. You may withdraw your consent at any time by following the unsubscribe instructions in any message, by replying "STOP" to any text message, or by emailing privacy@hmg.ai.

14.8 Complaints

If you have a privacy complaint, please first contact our Privacy Officer using the contact details in Section 14.2. If you are not satisfied with our response, you may lodge a complaint with the Office of the Privacy Commissioner of Canada (www.priv.gc.ca), or, where applicable, with the Commission d'accès à l'information du Québec (www.cai.gouv.qc.ca), the Office of the Information and Privacy Commissioner of Alberta (www.oipc.ab.ca), or the Office of the Information and Privacy Commissioner for British Columbia (www.oipc.bc.ca).

14.9 Cross-Reference to Terms of Service

Disputes relating to this Privacy Notice and your personal information are subject to the dispute resolution provisions in our Terms of Service, including mandatory binding arbitration, class action and collective action waivers, jury trial waiver, exclusive forum selection in South Australia, governing law of South Australia, the one-year limitations period, and the legal fees recovery provision. You consent to the recording and monitoring of telephone and electronic communications between you and us as set out in Section 4.6.

15. United Kingdom Privacy Notice (UK GDPR / DPA 2018)

This section applies to individuals in the United Kingdom. It supplements and, where applicable, modifies the rest of this Privacy Notice. References to "UK GDPR" mean the United Kingdom General Data Protection Regulation as it forms part of UK law by virtue of section 3 of the European Union (Withdrawal) Act 2018, together with the Data Protection Act 2018 ("DPA 2018").

15.1 Controller

How Much Holdings Pty Limited (ACN 687 662 871), of Level 19, 83 Pirie Street, Adelaide, South Australia 5000, is the controller of your personal data.

15.2 UK Representative

Pursuant to Article 27 UK GDPR, our UK representative is:

How Much Holdings Limited
3rd Floor, 207 Regent Street
London W1B 3HH
United Kingdom
Email: privacy@uk.howmuch.net

You may contact our UK representative on any issue related to the processing of your personal data.

15.3 Categories of Personal Data; Sources

As described in Section 1 (What Information Do We Collect?). We may collect special category data only with your explicit consent or where another lawful basis under Article 9 UK GDPR applies.

15.4 Purposes and Lawful Bases

We process your personal data for the purposes set out in Section 2 on the following lawful bases:

• Performance of a contract (Article 6(1)(b)): to register and operate your account, to deliver Service Requests, and to facilitate communications with Service Professionals.
• Consent (Article 6(1)(a) and Article 9(2)(a) where applicable): to send you direct marketing communications by email, SMS, and telephone; to set non-essential cookies and similar technologies; to disclose your information to Service Professionals where consent is required; and to process any special category data.
• Legitimate interests (Article 6(1)(f)): to operate, secure, and improve the Services; to prevent and detect fraud and abuse; to undertake research and analytics; to enforce our Terms of Service; and to establish, exercise, or defend legal claims, including against actual, threatened, or anticipated litigation. Our legitimate interests are balanced against your rights and freedoms; you may object to processing on this basis (see Section 15.6).
• Legal obligation (Article 6(1)(c)): to comply with our legal, regulatory, accounting, tax, audit, and reporting obligations, and to respond to lawful requests from public authorities.
• Vital interests (Article 6(1)(d)): in rare cases, to protect a person's life or physical integrity.

15.5 Sale, Sharing, and Recipients

We share your personal data with the categories of recipients listed in Section 3, including Service Professionals, lead aggregators, marketing partners, advertising networks, our affiliates, and our service providers. Where required, such sharing is based on your consent.

15.6 Your Rights

Subject to the UK GDPR and DPA 2018, you have the following rights:

• Right of access (Article 15): to be informed and to receive a copy of your personal data.
• Right to rectification (Article 16): to correct inaccurate or incomplete data.
• Right to erasure (Article 17): to have your personal data deleted in certain circumstances (e.g., where it is no longer necessary, or you withdraw consent and there is no other lawful basis).
• Right to restriction of processing (Article 18).
• Right to data portability (Article 20): to receive your personal data in a structured, commonly used, machine-readable format and to transmit it to another controller, where processing is based on consent or contract.
• Right to object (Article 21): to object to processing based on legitimate interests, including profiling, and an absolute right to object to direct marketing at any time.
• Rights related to automated decision-making and profiling (Article 22): not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects, except where permitted by law.
• Right to withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.
• Right to lodge a complaint with the Information Commissioner's Office ("ICO"), the UK supervisory authority, at www.ico.org.uk, although we encourage you to contact us first.

15.7 How to Exercise Your Rights

Email privacy@hmg.ai or contact our UK Representative at the address in Section 15.2. We will respond within one (1) month of receipt, extendable by up to two (2) further months where necessary. We may need to verify your identity before responding.

15.8 Retention

We retain personal data for the periods described in Section 6 and, in any event, for the duration of any applicable limitations period to enable us to defend any claim. Specific retention periods are available on request.

15.9 International Transfers

We transfer your personal data outside the United Kingdom in accordance with Section 9 (International Data Transfers), including where appropriate the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, supplemented where necessary by additional technical and organisational measures.

15.10 Cross-Reference to Terms of Service

Disputes relating to this Privacy Notice and your personal data are subject to the dispute resolution provisions in our Terms of Service, including mandatory binding arbitration, class action and collective action waivers, jury trial waiver, exclusive forum selection in South Australia (with Delaware as the sole U.S. fallback), governing law of South Australia, the one-year limitations period, and the legal fees recovery provision. Nothing in this Section limits any non-waivable rights you have under the UK GDPR or DPA 2018, including your right to lodge a complaint with the ICO. You consent to the recording and monitoring of telephone and electronic communications between you and us as set out in Section 4.6.

16. Disclaimers, Limitations of Liability, and Dispute Resolution

16.1 No guarantee of security

We use reasonable measures to protect personal information but cannot and do not warrant or guarantee the security of any information you transmit to us or that we hold. To the maximum extent permitted by law, we disclaim all warranties relating to security, accuracy, completeness, or fitness for a particular purpose of any data we process.

16.2 Limitation of liability

To the maximum extent permitted by applicable law, our liability arising out of or in connection with this Privacy Notice, our processing of your personal information, or any actual or alleged data breach, is subject to the limitations of liability set out in our Terms of Service, which are incorporated by reference.

16.3 Dispute resolution; mandatory arbitration; class action waiver; jury trial waiver; exclusive forum; legal fees recovery

Any dispute, claim, or controversy arising out of or relating to this Privacy Notice — including its formation, interpretation, breach, or termination, and including any claim relating to the consents in Section 4 (TCPA, CASL, PECR, Spam Act), the recording of calls under Section 4.6, or any claim under any U.S. state privacy law, the Australian Privacy Act, PIPEDA, Quebec Law 25, Alberta PIPA, BC PIPA, the UK GDPR, or the DPA 2018 — will be resolved in accordance with the dispute resolution provisions of our Terms of Service, which include:

• a mandatory binding arbitration agreement;
• a class action and collective action waiver;
• a jury trial waiver;
• an exclusive forum selection clause for the courts of the State of South Australia, Australia, with a step-down to the state and federal courts of New Castle County, Delaware as the sole U.S. forum for any jurisdictional challenge or U.S. action;
• governing law of South Australia (with the FAA governing the arbitration agreement);
• a one-year shortened limitations period; and
• a reasonable legal fees and cost recovery provision in favour of the prevailing party.

By using the Services, you agree to those provisions. Nothing in this Section limits any non-waivable rights you have under your local data protection law, including the right to lodge a complaint with the relevant supervisory authority.

16.4 Consent to recording of calls

You consent to the recording, monitoring, and retention of any telephone or electronic communications between you and us, including for quality assurance, training, compliance, and dispute resolution purposes, as set out in Section 4.6.

16.5 Indemnification

You agree to indemnify and hold us harmless to the extent set out in our Terms of Service, including in connection with any inaccurate, fraudulent, or unauthorised information you submit through the Services.

17. Updates to This Notice

In short: Yes, we will update this notice as necessary to stay compliant with relevant laws.

We may update this Privacy Notice from time to time. The updated version will be indicated by an updated "Last updated" date at the top of this Privacy Notice. If we make material changes, we may notify you by prominently posting a notice on the Services or by directly sending you a notification. We encourage you to review this Privacy Notice frequently to be informed of how we are protecting your information. Your continued use of the Services after any update constitutes your acceptance of the updated Privacy Notice.

18. How Can You Contact Us About This Notice?

If you have questions or comments about this Privacy Notice, you may contact us at any of the addresses below:

Controller / Registered office (Australia):

How Much Holdings Pty Limited (ACN 687 662 871)
Attention: Privacy Officer
Level 19, 83 Pirie Street
Adelaide, South Australia 5000
Email: privacy@hmg.ai

U.S. notice address:

How Much Marketing LLC
Suite 1200, 17th Street
Denver, CO 80202
United States of America
Email: privacy@howmuch.net

U.K. representative (Article 27 UK GDPR):

How Much Holdings Limited
3rd Floor, 207 Regent Street
London W1B 3HH
United Kingdom
Email: privacy@uk.howmuch.net

19. How Can You Review, Update, or Delete the Data We Collect From You?

Based on the applicable laws of your country, province, or state of residence, you may have the right to request access to, correction of, or deletion of the personal information we collect from you, and to obtain details about how we have processed it. You may also have the right to withdraw your consent to our processing of your personal information. These rights may be limited in some circumstances by applicable law. To make a request, please email privacy@hmg.ai.

BY USING THE SERVICES, YOU ACKNOWLEDGE THAT YOU HAVE READ AND UNDERSTAND THIS PRIVACY NOTICE AND AGREE TO ITS TERMS, INCLUDING THE TRANSFER OF YOUR PERSONAL INFORMATION ACROSS BORDERS (INCLUDING TO AND FROM AUSTRALIA, THE UNITED STATES, CANADA, AND THE UNITED KINGDOM), THE SALE AND/OR SHARING OF YOUR PERSONAL INFORMATION FOR LEAD GENERATION AND TARGETED ADVERTISING, THE RECORDING OF CALLS, AND THE DISPUTE RESOLUTION PROVISIONS (INCLUDING MANDATORY ARBITRATION, CLASS ACTION AND COLLECTIVE ACTION WAIVERS, JURY TRIAL WAIVER, EXCLUSIVE FORUM IN SOUTH AUSTRALIA WITH A DELAWARE FALLBACK, AND LEGAL FEES RECOVERY) INCORPORATED FROM OUR TERMS OF SERVICE.