1. Information We Collect

1.1 Information You Provide Directly

We collect personal information you voluntarily provide, including:

• Contact details such as name, email address, phone number, and job title when you submit a contact form, request information, or communicate with us
• Professional information such as company name, role, and areas of research interest
• Communications you send us, including emails and inquiries

1.2 Information Collected Automatically

When you visit our Site, we and our third-party partners automatically collect:

• Device and browser information (browser type, operating system, device identifiers)
• Usage data (pages visited, time spent, links clicked, referring URLs)
• IP address and approximate geographic location
• Cookie identifiers and similar tracking technologies (see Section 3)

1.3 Information from Third Parties

We receive information about you from third-party services we use, including:

• ZoomInfo: identifies business visitors to our Site and enriches contact data for sales and marketing purposes
• Lucky Orange: provides session recording, heatmaps, and live chat functionality
• Microsoft Clarity: provides behavioral analytics and session recordings
• Google Analytics: provides website traffic and usage analytics

2. How We Use Your Information

We use your personal information for the following purposes:

• To respond to your inquiries and communicate with you about our services
• To operate, maintain, and improve our Site
• To understand how visitors use our Site and optimize user experience
• To identify potential business partners and customers through tools like ZoomInfo
• To send marketing and promotional communications (where you have consented or where permitted by law)
• To comply with legal obligations
• To protect the security and integrity of our Site and business

Where required by law (including under GDPR), we process personal information only where we have a lawful basis, such as: your consent, performance of a contract, compliance with a legal obligation, or our legitimate interests (e.g., improving our services and conducting B2B marketing).

3. Cookies and Tracking Technologies

We use cookies and similar tracking technologies on our Site. Cookies are small text files placed on your device. We use four categories of cookies:

Necessary: Essential for the Site to function. These cannot be disabled.

Preferences: Remember your settings and choices (e.g., language, chat preferences).

Statistics: Help us understand how visitors interact with the Site (e.g., Google Analytics, Microsoft Clarity).

Marketing: Used to identify visitors and deliver relevant content and targeted outreach (e.g., ZoomInfo).

You can manage your cookie preferences at any time by clicking the consent banner on our Site. You may also configure your browser to block cookies, though this may affect Site functionality.

4. How We Share Your Information

We may share your personal information with:

• Service providers who assist us in operating our Site and business (e.g., analytics providers, marketing platforms, IT vendors), who are bound by confidentiality obligations
• Business partners and prospective partners in the course of B2B outreach and collaboration
• Successors in the event of a merger, acquisition, or sale of all or part of our business
• Law enforcement or government authorities when required by applicable law, court order, or to protect our legal rights
• Any other party with your consent

We do not sell your personal information to third parties for monetary compensation. However, our use of certain marketing and analytics tools (such as ZoomInfo) may constitute “sharing” or “selling” under California law. See Section 7 for your California rights.

5. International Data Transfers

Alloy is based in the United States. If you are located outside the United States, please be aware that your personal information may be transferred to, stored, and processed in the United States or other countries where our service providers operate.

For transfers from the European Economic Area (EEA), United Kingdom, or Switzerland, we rely on appropriate safeguards such as Standard Contractual Clauses approved by the European Commission, or other lawful transfer mechanisms.

6. Data Retention

We retain personal information for as long as necessary to fulfill the purposes described in this policy, unless a longer retention period is required or permitted by law. In general:

• Contact and inquiry data: retained for up to 3 years from last contact
• Website analytics data: retained per the settings of each analytics platform (typically 14–26 months)
• Cookie consent records: retained for 12 months
• Legal and compliance records: retained for the period required by applicable law

7. Your Rights — California Residents (CCPA/CPRA)

If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):

• Right to Know: Request disclosure of the categories and specific pieces of personal information we have collected about you, and how we use and share it
• Right to Delete: Request deletion of your personal information, subject to certain exceptions
• Right to Correct: Request correction of inaccurate personal information
• Right to Opt-Out of Sale or Sharing: Opt out of the sale or sharing of your personal information for cross-context behavioral advertising. You may exercise this right by clicking “Do Not Sell or Share My Personal Information” in our website footer
• Right to Limit Use of Sensitive Personal Information: Limit our use of sensitive personal information to what is necessary to provide our services
• Right to Non-Discrimination: We will not discriminate against you for exercising your privacy rights

To submit a request, contact us at legal@alloytx.com. We will respond within 45 days.

8. Your Rights — EEA, UK, and Switzerland Residents (GDPR / UK GDPR / nFADP)

If you are located in the European Economic Area, United Kingdom, or Switzerland, you have the following rights:

• Right of access: Obtain a copy of your personal data
• Right to rectification: Correct inaccurate or incomplete personal data
• Right to erasure (“right to be forgotten”): Request deletion of your personal data
• Right to restriction of processing: Ask us to limit how we use your data
• Right to data portability: Receive your data in a structured, machine-readable format
• Right to object: Object to processing based on legitimate interests or for direct marketing
• Right to withdraw consent: Where processing is based on consent, withdraw it at any time without affecting prior processing
• Right to lodge a complaint: Lodge a complaint with your local supervisory authority (e.g., your national data protection authority)

To exercise these rights, contact us at legal@alloytx.com.

9. Your Rights — Japan Residents (APPI)

If you are located in Japan, you have rights under the Act on the Protection of Personal Information (APPI), including the right to request disclosure, correction, addition, deletion, suspension of use, and erasure of your personal information. To exercise these rights, please contact us at legal@alloytx.com.

10. Security

We implement reasonable technical, administrative, and physical safeguards to protect your personal information against unauthorized access, disclosure, alteration, or destruction. However, no method of transmission or storage is completely secure. If you become aware of a security issue, please contact legal@alloytx.com.

11. Third-Party Links

Our Site may contain links to third-party websites. We are not responsible for the privacy practices of those sites and encourage you to review their privacy policies.

12. Children’s Privacy

Our Site is not directed to individuals under the age of 16. We do not knowingly collect personal information from children. If you believe we have inadvertently collected such information, please contact us and we will promptly delete it.

13. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the “Last Updated” date at the top of this page. We encourage you to review this policy periodically.

14. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our privacy practices, please contact us at:

Alloy Therapeutics, Inc.

Email: legal@alloytx.com

Website: https://alloytx.com