Privacy Policy

Last updated: September 24, 2026

Leapfrog is a business software platform operated by Zira Group Inc. This Privacy Policy explains how Zira Group Inc. and its affiliates, including Lightapp Technologies Ltd. (together, "Zira," "we," "us," or "our"), handle personal information in connection with Leapfrog, leapfrogerp.com, and the related applications, portals, APIs, integrations, support, and communications (the "Services").

"Personal information" means information relating to an identified or identifiable person, including information called personal data under applicable law. This Policy covers website visitors, account holders, business contacts, and individuals whose information is processed through the Services. A separate notice may apply to job applicants or employees of Zira.

1. Our role and your organization

We determine how personal information is used to operate our website and business, manage customer relationships, administer billing, and protect the Services. For these activities, we generally act as a controller or business.

When a customer uses Leapfrog to manage its business, that customer generally decides why and how its business information is processed. We process that information on its behalf as a processor, service provider, or contractor, subject to our agreement and any applicable data processing addendum.

"Customer Data" means information that a customer or its authorized users submit, connect, or generate through their use of Leapfrog, including personal information in business records, communications, files, prompts, and outputs. If your information is in an employer's or another organization's workspace, direct requests about those records to that organization. We assist customers with their obligations as required by law and our agreements.

2. Information we collect for our business

Depending on your interactions with us, we may collect:

• Contact and professional information, including your name, work email, phone number, mailing address, employer, job title, and business interests.
• Account information, including user identifiers, sign-in information, authentication events, account settings, and subscription administration details.
• Commercial information, including inquiries, purchases, subscriptions, invoices, billing contacts, payment status, and relationship history. Payment providers generally process full payment card details.
• Device and usage information, including IP address, browser, operating system, approximate location, pages visited, referral sources, timestamps, cookie identifiers, diagnostic information, and security logs.
• Communications, including messages to our team, support tickets, feedback, survey responses, and meeting notes. Calls or meetings may be recorded or transcribed when the required notice or consent has been provided.
• Business inferences, such as likely product interests and engagement with our communications, derived from the information above.

We receive this information from you, your organization, your devices, service providers, referral and implementation partners, and lawful public or professional sources. We do not treat every record imported into a customer's workspace as a contact for our own marketing.

3. Customer Data processed through Leapfrog

The information processed depends on the modules, integrations, and workflows the customer enables. It may include:

• CRM records, including companies, people, deals or opportunities, relationship history, activities, tasks, notes, and attachments.
• ERP records, including customers, suppliers, products, inventory, orders, quotations, purchasing, production, shipping, invoices, and other operational or financial records.
• Workspace information, including members, roles, permissions, organization settings, and records of actions taken in the workspace.
• Connected communications, including email addresses, participants, message content, attachments, contact records, and calendar event details made available through authorized integrations.
• Calls and meetings, including recordings, transcripts, summaries, and participant information, when a supported feature is enabled and the customer has provided required notices and obtained required permissions.
• AI interactions, including prompts, business instructions, relevant records or documents supplied as context, generated text, proposed configurations, summaries, classifications, and workflow results.
• Integration and technical information, including authorization tokens, selected resources, synchronization records, API requests, execution logs, and error reports.

Business records may contain sensitive information, such as financial details or employee information. Only submit information that is necessary for your authorized use and supported by the applicable service agreement. Account credentials are used for authentication and security. We do not use sensitive personal information in our controller role to infer personal characteristics.

4. How we use information

We use information for our business to provide accounts and subscriptions, process payments, respond to inquiries, support customers, maintain security, investigate misuse, understand product performance, develop features, and comply with legal obligations. We may also use business contact information for relevant sales communications and events, subject to your choices and applicable law.

We process Customer Data to deliver the features selected by the customer. This may include organizing records, searching and retrieving information, synchronizing integrations, generating summaries and reports, suggesting configurations or next steps, running authorized workflows, diagnosing problems, and providing support. Access and processing remain subject to the customer agreement and the customer's documented instructions.

Where a legal basis is required for our controller activities, we rely on contract performance where a contract with the individual applies, our legitimate interests in operating and protecting the business, compliance with legal obligations, or consent. For business representatives who are not personally parties to our contract, legitimate interests may support account administration and communications. You may withdraw consent for future processing by contacting us or using the relevant controls.

5. AI features and customer information

Leapfrog uses AI to assist with business software configuration, CRM and ERP activities, and customer-selected workflows. When you use an AI feature, the information needed for the request may be processed by Zira and by contracted AI service providers. Depending on the request, this can include prompts, selected documents, relevant business records, communications, and generated results.

AI processing to answer a request is different from training a general-purpose model. We do not use or authorize providers to use Customer Data to train unrelated third-party or general-purpose AI models without the customer's express authorization and any additional permissions required by law or the source provider's rules. This authorization cannot override restrictions applicable to connected Google data described below.

We may use aggregated or deidentified information to evaluate and improve the Services when permitted by our agreements and applicable law. We maintain that information in a form that cannot reasonably identify an individual or customer and do not attempt to reidentify it, except to test safeguards where lawful. Restrictions imposed by a connected data provider also apply to derived information where required.

AI results can be inaccurate or incomplete. Customers remain responsible for deciding how to use them and for applying appropriate human review. The standard Services are not intended to make solely automated decisions about individuals that produce legal or similarly significant effects. Any such use requires a separate written agreement with us and all legally required safeguards.

6. Connected accounts and Google data

When you or your organization authorize an integration, we access the information and perform the actions covered by the permissions granted and the features enabled. Connecting an account can make relevant information available within your organization's workspace under its access settings. Review those settings and the integration disclosure before connecting a personal or business account.

You can revoke access using the connected provider's controls or the integration controls available in Leapfrog. Revocation stops future access through that authorization, although information already imported may remain subject to the customer's retention settings, agreement, and applicable law. Contact your workspace administrator or us to request deletion of imported information.

For Google integrations, our handling of information received through Google APIs follows the Google API Services User Data Policy and applicable Google Workspace user data policies, including their Limited Use restrictions. We use connected Google information only for permitted, user-facing features and permitted supporting purposes. We do not use it for advertising, data brokerage, creditworthiness decisions, or training or improving generalized AI models. Access by personnel and onward transfers are limited to the exceptions those policies permit. Where required, transfers in a corporate transaction require the user's prior express consent. These restrictions take priority over broader descriptions elsewhere in this Policy.

7. Who receives information

We may disclose information to affiliates and contracted providers supporting hosting, identity, security, payments, communications, analytics, AI processing, support, and other service functions. Providers processing Customer Data for us are subject to contractual protections appropriate to their role.

Our current infrastructure providers are Google Cloud (application hosting and connected Google accounts), Supabase (database hosting and sign-in, where the Google account used to sign in is recorded), and Anthropic (AI processing). Each acts as a processor under our instructions, and we will update this list when a provider changes.

Information in a workspace may be accessible to its administrators and authorized users according to the customer's settings. We may also disclose information to implementation partners or integrations the customer selects, recipients of customer-directed messages or shared records, and other parties at the customer's direction.

Other disclosures may include professional advisers subject to confidentiality duties, authorities where legally required, parties necessary to protect rights or investigate misuse, and participants in a financing or corporate transaction subject to appropriate safeguards. Connected-provider restrictions, including the Google restrictions above, continue to apply.

We do not sell Customer Data or use it to target advertising to individuals. We do not sell personal information for money. Certain disclosures of website identifiers or browsing activity through advertising technologies, if enabled, may be considered a sale or sharing under state privacy laws even without payment. The choices below apply to those activities. We do not knowingly sell or share personal information of children under 16.

8. Cookies and marketing choices

We may use cookies, local storage, pixels, and similar technologies for sign-in, security, preferences, measurement, and, where enabled, advertising. These technologies can collect device identifiers and information about website activity.

You can use browser settings and any cookie preference controls provided on the website to manage these technologies. We obtain consent for nonessential technologies where required and honor recognized opt-out signals, including Global Privacy Control, where applicable. Blocking necessary technologies may affect the Services.

To stop marketing emails, use the unsubscribe link or contact us. Account, billing, security, and other service communications may continue. Where the law provides a right to object to direct marketing, you may exercise it at any time.

9. Retention and deletion

We retain controller information for as long as reasonably necessary for the stated purpose, considering the relationship, the sensitivity of the information, security needs, disputes, and legal obligations. Account and transaction records may be retained after the relationship ends when needed for accounting or legal purposes. Marketing records are kept only while relevant, with limited suppression records retained to honor opt-outs.

Customer Data is retained according to the customer's settings, instructions, agreement, and applicable law. At the end of service, return or deletion is handled under the agreement and applicable backup cycles. Deletion may not immediately remove copies in backups; retained copies remain protected and are removed through the applicable retention process. Records may be preserved when legally required or necessary for a permitted security or dispute purpose. Connected-provider rules may impose additional retention or deletion limits.

10. Security and international processing

We maintain technical and organizational measures designed to protect personal information, including controls appropriate to access, authentication, transmission, storage, monitoring, and incident response. No service or security measure can eliminate every risk. Protect your credentials and notify us promptly if you suspect unauthorized access.

Zira operates in the United States and Israel and uses providers that may process information in other countries. Where required, international transfers are supported by an applicable adequacy decision, contractual safeguards such as the European Commission's Standard Contractual Clauses or the UK transfer addendum, or another valid mechanism. Contact us for information about the safeguards that apply to your information.

11. Your privacy rights

Depending on your location and our role, you may have rights to know about processing, obtain access and a portable copy, correct inaccuracies, request deletion, restrict or object to processing, withdraw consent, opt out of sale or sharing or targeted advertising, limit certain uses of sensitive information, and opt out of qualifying automated profiling. You may also have a right to appeal a denied request and complain to your privacy regulator.

These rights are subject to applicable requirements and exceptions. We do not discriminate against you for exercising them. For Customer Data, the customer generally handles the request and we provide the assistance required by our agreement and law.

For information we control, email privacy@zira.us with the subject "Leapfrog Privacy Request," call +1 650-701-7026, or write to the address below. Explain your relationship with us and your request. We may verify identity and, where an authorized agent acts for you, authority to make the request. If an appeal right applies, reply to our decision or contact us with the subject "Leapfrog Privacy Appeal." We respond within the periods required by applicable law.

California residents may exercise applicable rights to know, access, correct, delete, opt out of sale or sharing, and limit certain sensitive-information uses. For any portion of the preceding 12 months in which Leapfrog operated, the categories, sources, purposes, disclosures, and retention criteria are described above to the extent the relevant activities occurred. Information processed only for a customer remains subject to that customer relationship.

In the EEA, United Kingdom, and Switzerland, applicable rights may include an objection to processing based on legitimate interests and an objection to direct marketing. You may complain to the supervisory authority where you live or work or where an alleged violation occurred. Contact us for assistance identifying the appropriate authority or representative.

12. Children and other services

Leapfrog is intended for business use and is not directed to children under 16. Account holders must meet the age requirements in the Terms of Service. We do not knowingly collect information directly from children under 16 through account registration or the website. If you believe a child has provided information to us, contact us. Customers remain responsible for any information about minors that they submit.

Third-party websites and independently operated integrations have their own privacy notices. This Policy describes our practices, not those independent providers' practices.

13. Updates and contact details

We may revise this Policy as the Services, our practices, or legal requirements change. We update the date above and provide additional notice of material changes where required. Where new processing requires consent, we obtain it before that processing begins.

Zira Group Inc.

Attention: Privacy for Leapfrog

400 Concar Drive, San Mateo, California 94420, United States

Email: privacy@zira.us

Telephone: +1 650-701-7026

Website: https://leapfrogerp.com