Cookie and Tracking Policy

This Cookie and Tracking Policy (this "Policy") describes the cookies, tokens, local storage, device identifiers and similar technologies (collectively, "Tracking Technologies") that Zeus actually uses on and in the Services — including the Zeus mobile applications, the Zeus web portal, tokenized link pages, and any websites or web surfaces Zeus operates from time to time. This Policy is a transparency notice. It supplements, and should be read together with, the Zeus Privacy Policy at https://fieldzeus.com/legal; where this Policy and the Privacy Policy address the same subject, the Privacy Policy controls for personal-information handling and this Policy controls for the mechanics of Tracking Technologies. Capitalized terms not defined in this Policy have the meanings given in the Zeus Global Terms of Service and the Defined Terms used across the Zeus legal documents (including "Services", "Customer", "Authorized User", "Usage Data" and "Telemetry").

---

1. Scope; Consent by Use

Scope of this Policy. This Policy applies to every person who visits, accesses or uses any part of the Services, with or without an account, including Customers, Authorized Users and Link Recipients. It covers Tracking Technologies deployed by or for Zeus on Zeus-operated surfaces. It does not cover — and Zeus does not control — technologies deployed by third parties on their own properties, which are addressed in Section 4.

Consent by access or use — strictly necessary technologies. By visiting, accessing or using any part of the Services, you acknowledge and agree that you consent to Zeus's use of the strictly necessary Tracking Technologies described in Section 2.1, including successor technologies and similar technologies developed or adopted in the future, on and across every surface Zeus operates. Those technologies are required to deliver the Services and cannot be switched off. If you do not agree to them, your sole option is to stop accessing and using the Services.

Your choice for optional technologies. Zeus does not treat access or use as consent to the optional analytics Tracking Technologies described in Section 2.2. How these are controlled differs between the website and the mobile applications. On the Zeus website, analytics are not loaded and send nothing unless you affirmatively allow them when Zeus asks on your first visit; closing or dismissing that request without choosing is recorded as a decline, and you can change your choice at any time at https://fieldzeus.com/legal/privacy-choices. Where your browser sends the Global Privacy Control signal, Zeus treats optional analytics as declined and does not ask. In the Zeus mobile applications, product analytics are on by default, and you can turn them off at any time in Settings › Privacy › Share Usage Data; turning them off stops both collection and transmission from that device. Zeus applies the choice you make on each surface in every market it serves. The difference between the two surfaces is deliberate; neither is a statement about what any jurisdiction requires.

Illustrative, non-exhaustive, changing disclosure. The descriptions and any lists or tables in this Policy are illustrative only and are expressly non-exhaustive. The specific Tracking Technologies in use vary over time and may vary by surface, page, application version and feature, and may change without individual notice to you. You are responsible for reviewing this Policy periodically to stay informed; the version posted at https://fieldzeus.com/legal at the time of your use governs.

Canada: deemed-consent basis (CASL). For users in Canada, Zeus relies on the deemed-consent categories recognized by applicable Canadian law — including section 10(8) of Canada's Anti-Spam Legislation (CASL) for cookies, HTML and JavaScript and similar technologies — as the legal basis for the strictly necessary Tracking Technologies described in Section 2.1.

---

2. Tracking Technology Inventory (Tiered)

Tier 1: strictly necessary cookies, tokens and security technologies. Zeus uses cookies, tokens and equivalent storage that are strictly necessary to deliver the Services: authentication and session tokens, security and fraud-prevention mechanisms (including rate-limiting based on login IP, edge protection against denial-of-service traffic, and automated bot checks), load and routing mechanics, and preference storage. Because these technologies are essential to operate the Services, they cannot be disabled and there is no opt-out for them; if you remove, block or disable them, Zeus cannot guarantee that any part of the Services will function, and the Services will not work without them. Nothing in this Tier 1 is an analytics or advertising technology: none of it is used to measure your use of the Services, to build a profile of you, or to recognize you across other companies' websites, and none of it is governed by the optional-analytics choice described in Section 1 — those technologies are separate, and are described in Section 2.2.

The first-party cookies in this tier that Zeus sets today include: zeus_rt, which carries the sign-in refresh credential for a browser signed in to the Zeus web application, is restricted to the single sign-in refresh address and is not readable by page scripts; zeus_partner_session, which carries the signed-in session for a user of the Zeus partner portal and is likewise not readable by page scripts; and zeus_lang, which remembers the display language you picked from the Zeus website's language switcher and is written only when you pick one. The Zeus website sets no analytics cookie of its own; your analytics choice on the website is recorded in your browser's own local storage rather than in a cookie, which is one of the ways clearing site data can silently remove it (Section 3).

Zeus's web addresses — the Zeus website, the Zeus web application, the Zeus application programming interface and the tokenized link pages — are all served through Cloudflare, Inc. (United States), Zeus's content-delivery and edge-security provider, which acts on Zeus's instructions, is listed on Zeus's subprocessor page and is identified in the Zeus Privacy Policy. In that role Cloudflare terminates the encrypted connection, routes the request to Zeus's servers, and inspects request metadata — including the network (IP) address the request came from, the browser or client identification string it sent, and the technical characteristics of the connection — in order to absorb denial-of-service traffic and to block or challenge automated abuse. That inspection happens at the network layer and does not require a cookie; as of the Last updated date above, Cloudflare's edge sets no cookie on an ordinary visit to a Zeus address. Where a particular request is challenged rather than allowed or blocked outright, the challenge page is served by Cloudflare and, once it is solved, Cloudflare may set a short-lived clearance cookie or equivalent browser storage on the Zeus address so that the same visitor is not challenged again for a period. That clearance technology is a security mechanism within this Tier 1; it is not analytics, not advertising, and not subject to the optional-analytics choice, because a surface Zeus cannot protect is a surface Zeus cannot serve.

Zeus additionally uses Cloudflare Turnstile, a bot check operated by Cloudflare that distinguishes a person from an automated script before a request is accepted. Turnstile is applied to the public booking-request page a business publishes for its own customers, to account sign-up, sign-in and password-reset requests made from a browser, and to sign-in on the Zeus partner portal. It loads from challenges.cloudflare.com and runs inside a frame served from that address, and it may set storage in that context for the purposes of the check. Zeus receives from Turnstile only a pass-or-fail outcome for the individual request being checked, bound to the action it was issued for and usable once; Zeus does not use it to profile you, to measure your use of the Services or to recognize you across other companies' websites, and it is not an advertising technology. It cannot be switched off on the surfaces that carry it: a request Zeus cannot check is refused rather than accepted.

Tier 2: product analytics and device/session telemetry. Zeus collects product analytics and device/session Telemetry. This includes: server-side product events (such as feature usage and event names, associated with business and user identifiers, with coordinate data stripped before storage); device and session diagnostics from the mobile applications (install identifier, device model, operating system and version, locale, session heartbeats at approximately five-minute intervals while you are signed in, and error and crash reports including error stacks); and, on the Zeus website, page-view and page-exit events, a defined set of named interaction events (which calls to action or buttons were pressed, which pricing or comparison page was opened, which frequently-asked question was expanded, and which free calculator was used together with which of its fields was completed first, whether it produced a result, and whether figures were saved locally in the browser), and client-side diagnostics comprising uncaught error reports (error type, and a redacted message and stack trace) and Core Web Vitals page-performance measurements. Website interaction events do not carry any value typed into a field, and error reports are redacted in the browser before transmission to remove email addresses, telephone-shaped digit sequences, bearer tokens and URL query strings. No Telemetry session data is collected from the mobile applications while you are signed out.

Raw Telemetry records are retained for 30 days and aggregated rollups are retained for 365 days.

This data is collected into Zeus's own infrastructure and is also processed by PostHog Inc. (United States), Zeus's product-analytics processor for the mobile application, the Zeus website and Zeus's server-side product events. PostHog processes it on Zeus's instructions and for no purpose of its own, and is listed on Zeus's subprocessor page. On the Zeus website PostHog sets its own first-party cookies or equivalent local storage to recognize a returning browser across page views; those are analytics technologies, not advertising technologies. Zeus does not enable PostHog's session-replay or autocapture features.

On the Zeus website Zeus additionally deploys Google Analytics. Where Zeus has enabled it, Google LLC (United States) acts as a second website-analytics processor on Zeus's instructions, is listed on Zeus's subprocessor page, and sets its own first-party analytics cookies to recognize a returning browser across page views; those are analytics technologies, not advertising technologies. Zeus does not enable Google's advertising, audience-matching or signals features. Google Analytics is subject to the same consent gate as PostHog: it is not loaded and sends nothing until the visitor allows analytics, and it does not run where the browser signals Global Privacy Control.

The error and crash reports referred to above are additionally processed by Functional Software, Inc. (d/b/a Sentry) (United States), Zeus's crash-diagnostics processor for the mobile application and for Zeus's backend services, on Zeus's instructions and for no purpose of its own; it is listed on Zeus's subprocessor page. Zeus does not enable Sentry's session-replay or screenshot-attachment features. This processing is not carried out through advertising or audience-matching technology.

In the Zeus mobile application, product analytics are on by default, and you can turn them off at any time: open Settings › Privacy and switch off Share Usage Data, where the disclosure sits beside the switch. While it is off, the application neither initializes the analytics library nor sends events, and you can switch it back on in the same place. This control does not affect the strictly necessary technologies in Section 2.1, and it does not affect the crash and error diagnostics described immediately above, which Zeus processes as a service-integrity and security function of the application.

On the Zeus website the equivalent control is the first-visit choice described in Section 1, which you can change at any time at https://fieldzeus.com/legal/privacy-choices.

No advertising technologies; reservation. As of the Effective Date, Zeus does not deploy advertising SDKs, advertising cookies, audience-matching technology, or session-replay technology in the Services. The only third-party Tracking Technologies in the Services are the product analytics described in Section 2.2 and the strictly necessary edge-security and bot-check technologies described in Section 2.1. Zeus reserves the right to use the Tracking Technologies described in this Policy across the Services and, where permitted by applicable law, in communications Zeus sends; any materially new category of tracking — including any advertising technology — would take effect only as described in Section 7 and through an update to this Policy.

Effect of blocking or refusing Tracking Technologies. You may be able to block, restrict or delete cookies, tokens, local storage or device identifiers through your browser, device or operating-system settings. Although you are not required to accept non-essential Tracking Technologies, if you block, reject, disable or delete Tracking Technologies — including device identifiers on mobile devices — some or all features of the Services may be degraded, may not operate as intended, or may not work at all, and Zeus has no obligation to provide any feature that depends on a Tracking Technology you have refused.

Characterization of tracking data.

Zeus treats information collected by cookies and similar Tracking Technologies as non-personal information, except to the extent that applicable law requires particular identifiers (such as IP addresses) to be treated as personal information, in which case Zeus treats them as personal information under the Privacy Policy to that extent.

---

3. Do-Not-Track and Opt-Out Preference Signals

Do-Not-Track signals.

Because there is currently no consistent industry or legal standard for recognizing or honoring browser "Do Not Track" ("DNT") signals, Zeus does not respond to, or alter its practices in response to, DNT signals or similar mechanisms at this time.

Opt-out preference signals (e.g., Global Privacy Control).

Zeus honors the Global Privacy Control ("GPC") signal on the Zeus website for every visitor, whether or not applicable law requires it in that visitor's jurisdiction: where the browser sends GPC, Zeus treats optional analytics as declined and does not present the first-visit request. Where applicable law requires recognition of any other legally mandated opt-out preference signal, Zeus honors that signal as applicable law requires.

Recognition of any such signal occurs only with respect to the specific browser or device that communicates the signal, so you may need to set your preference on every browser and device you use.

Fragility of opt-out preferences; third-party tools disclaimed.

Any tracking preference or opt-out you set is stored per browser and per device; clearing cookies, resetting your device, updating or reinstalling software, or using a new browser or device may silently remove your preference, and you will need to set it again to maintain it.

Zeus is not responsible for the operation, effectiveness, availability or accuracy of any third-party opt-out tool, industry opt-out page or browser mechanism, for any choice you make through them, or for third parties' compliance with their own opt-out programs.

---

4. Third-Party Content, Links and Embeds

No control over, and no responsibility for, third-party technologies.

TO THE MAXIMUM EXTENT PERMITTED BY LAW, ZEUS DOES NOT CONTROL, AND ASSUMES NO RESPONSIBILITY OR LIABILITY FOR, COOKIES OR OTHER TRACKING TECHNOLOGIES SET BY ANY THIRD PARTY — INCLUDING THIRD-PARTY WEBSITES YOU REACH THROUGH LINKS IN THE SERVICES OR IN ZEUS COMMUNICATIONS, THIRD-PARTY CONTENT OR MEDIA EMBEDDED IN OR DISPLAYED THROUGH THE SERVICES (INCLUDING MAP TILES AND VIDEO EMBEDS), APP STORES, AND ANY THIRD-PARTY SERVICE YOU CHOOSE TO USE — OR FOR THE COLLECTION OR FURTHER USE OF DATA BY SUCH THIRD PARTIES.

Third parties may set such technologies unilaterally when a page or screen containing their embedded content loads, and their cookies may recognize your device across multiple websites.

Third-party policies govern; scope exclusion.

This Policy and the Zeus Privacy Policy do not cover any information that third parties collect from you through their own Tracking Technologies or that you choose to provide to them; any personal information collected by a third-party technology is governed exclusively by that third party's own privacy policy and terms, which you are responsible for reviewing.

---

5. Mobile Applications, Local Storage and On-Device Media Metadata

Mobile application storage and identifiers.

The Zeus mobile applications use only strictly necessary and functional local storage (including authentication tokens, the on-device working copy of your Workspace data, preferences and caches) plus the Telemetry described in Section 2.2, which you can switch off in Settings › Privacy › Share Usage Data; the applications contain no advertising SDKs and no advertising identifiers as of the Effective Date.

When you use the applications, Zeus may access, collect and store device identifiers (such as the app install identifier) as part of that Telemetry; restricting them may degrade the Services as described in Section 2.4.

On-device photo-library metadata scan ("Find Nearby Photos"). If you grant the Zeus mobile application access to your device photo library and use the "Find Nearby Photos" feature, the application reads the EXIF metadata of the images you have made accessible — specifically embedded GPS coordinates and capture dates — on your device, in order to match photos to your job sites. This scan is scoped to the photo-library access you grant, runs for that matching purpose, and its reading of photo location metadata is disclosed in the Zeus Privacy Policy.

When a photo is uploaded to Zeus, EXIF location metadata is stripped from the stored image file; any photo GPS coordinates retained as database metadata for job-matching are handled as described in the Privacy Policy.

No background or continuous location tracking.

The Tracking Technologies described in this Policy do not include background or continuous location tracking: any device location collection in the Services is snapshot-only at defined moments (as described in the Privacy Policy), the mobile applications request no background-location permission, and location data is never used to track you for advertising.

---

6. Changes to this Policy

Amendment by posting. Zeus may amend this Policy at any time, in its sole discretion, by posting the updated version with a new version date at https://fieldzeus.com/legal. Updates are effective upon posting. Zeus may, but is not obligated to, provide individual notice of changes, and Zeus assumes no obligation to notify you of any change. You bear the burden of monitoring this Policy for changes, and your continued access to or use of the Services after an updated version is posted constitutes your acceptance of the updated version; if you do not agree, you must stop using the Services. Changes required by applicable law, security, fraud prevention, or Zeus's infrastructure or service providers take effect immediately upon posting.

Application of updates.

Unless the updated version states otherwise, the then-current version of this Policy applies to all information collected through Tracking Technologies, including information collected before the update.

---

7. Conditional Addendum — Future Advertising, Audience Matching and Session Replay

If-and-when activation. Zeus's current third-party analytics processing is described in Section 2.2; this Section 7 covers everything beyond it. Zeus does not currently use any advertising or audience-matching technology or any session-replay technology. Zeus's third-party crash- and error-reporting processing is a current practice, is disclosed in Section 2.2, and is outside this Section 7. If and when Zeus enables any technology within this Section 7 — for example a server-side advertising conversion interface, hashed- identifier audience matching, or session-replay tooling — then before or upon that technology becoming active: (a) Zeus will update this Policy (and, where applicable, the Privacy Policy and the United States privacy supplement's sale/share and opt-out statements) to describe the technology, the data involved and the applicable choices; (b) any disclosure obligations, consent requirements or opt-out mechanisms that applicable law attaches to that technology (including Québec Law 25 s 8.1-consistent wording for non-essential technologies in Québec, and state-law opt-out mechanics in the United States) will be addressed in that update; and (c) the updated Policy will govern under Section 6. Until such an update is posted, no provision of this Section 7 describes a current Zeus practice.

Status of this Section. This Section 7 is a conditional framework only. It does not state, and must not be read as stating, that Zeus currently collects, processes, sells, shares or transfers any data through any advertising, audience-matching or session-replay technology. Zeus's third-party analytics processor and its third-party crash-diagnostics processor are disclosed in Section 2.2, not here.

---

8. Contact

Questions about this Policy or Zeus's Tracking Technologies: [email protected]. Legal notices: [email protected].