Legal
Privacy Policy
Effective date: June 20, 2026 · Last reviewed: June 20, 2026
This Privacy Policy explains how CodeCones, Inc. ("we", "us", "our"), doing business as ResolveCX, collects, uses, stores, and shares your personal information when you visit https://resolvecx.global (the "Site") or use our complaint management and resolution governance software (the "Service").
We are a U.S.-based company. This policy is governed by applicable U.S. federal and state privacy laws, including the Federal Trade Commission Act (FTC Act), the CAN-SPAM Act, the Children's Online Privacy Protection Act (COPPA), and, where applicable, the California Consumer Privacy Act / California Privacy Rights Act (CCPA/CPRA) and similar state privacy statutes.
Where personal information is collected from individuals located in the European Economic Area (EEA) or the United Kingdom (UK), we also comply with the EU General Data Protection Regulation (GDPR) and the UK GDPR (as retained in UK law by the Data Protection Act 2018), including the requirements for a lawful basis, data subject rights, and international transfer safeguards described in this policy.
1. Who We Are
Business: CodeCones, Inc., doing business as ResolveCX.
Contact: sales@resolvecx.global
For any questions about this policy or to exercise your privacy rights, please contact us at the email address above. We will respond within 45 days (or within any shorter period required by applicable law).
2. Personal Information We Collect
"Personal information" means information that identifies, relates to, or could reasonably be linked to you. We collect the following categories:
| Category | Examples | Source |
|---|---|---|
| Identifiers | First name, last name, email address, company name, job title, IP address | You provide it via the contact form or newsletter sign-up; some collected automatically |
| Commercial information | Interest in or inquiries about our products and services | You provide it through the contact form |
| Internet / network activity | Pages visited, time on page, browser type, referring URL, device type | Collected automatically when you visit the Site |
| Inference data | Inferences about your business role or interest in our Service based on browsing behavior | Derived from internet activity data |
| Cookie and tracking data | Session identifiers, preference settings, consent choices | Set automatically; see our Cookie Policy |
| Account / platform data (Service users) | Name, email, role, organization, activity logs within the platform | Provided on account creation or by your employer |
We do not collect sensitive personal information (such as Social Security numbers, financial account numbers, precise geolocation, biometric data, or health information) through the Site.
3. How We Use Your Personal Information
We use personal information for the following business purposes:
| Purpose | Business rationale |
|---|---|
| Responding to inquiries submitted via the contact form | Pre-sale and customer support communications |
| Sending newsletters and product updates (where you opted in) | Direct marketing; you may opt out at any time |
| Delivering and improving the Service | Core product operations and service quality |
| Security monitoring, fraud prevention, and abuse detection | Protecting our systems and users from harm |
| Complying with legal obligations | Responding to lawful requests and regulatory requirements |
| Analytics to understand how the Site is used | Improving content, navigation, and user experience |
4. Lawful Basis for Processing (GDPR / UK GDPR)
Where the GDPR or UK GDPR applies to your personal information, we rely on the following lawful bases under Article 6 to process it:
| Processing activity | Lawful basis (Art. 6) | Detail |
|---|---|---|
| Responding to contact form enquiries | Legitimate interests (Art. 6(1)(f)) | We have a legitimate interest in responding to potential customers and partners who have proactively contacted us. |
| Sending newsletters and marketing emails (opted-in) | Consent (Art. 6(1)(a)) | We only send marketing communications where you have given your express consent. You may withdraw consent at any time by unsubscribing. |
| Delivering and operating the Service (platform users) | Contract performance (Art. 6(1)(b)) | Processing is necessary to perform the service contract with your organization. |
| Security monitoring and fraud prevention | Legitimate interests (Art. 6(1)(f)) | We have a legitimate interest in protecting the Site and Service from abuse, fraud, and security threats. |
| Complying with legal obligations | Legal obligation (Art. 6(1)(c)) | Where we are required to retain or disclose information to comply with applicable law. |
| Analytics and Site improvement | Legitimate interests (Art. 6(1)(f)) | We have a legitimate interest in understanding how our Site is used in order to improve it. We use aggregated, anonymised data where possible. |
Where we rely on legitimate interests, we have assessed that our interests are not overridden by the rights and freedoms of affected individuals. You have the right to object to processing based on legitimate interests; see Section 8 (Your Privacy Rights) below.
5. Disclosure of Personal Information
We disclose personal information to the following categories of service providers and third parties only as necessary to operate the Site and Service:
| Third party | Purpose | Information shared |
|---|---|---|
| Resend (resend.com) | Transactional email delivery (contact form confirmations, newsletter) | Name, email address |
| Cloudflare (Turnstile) | Bot detection and spam prevention on contact and newsletter forms | IP address, browser fingerprint |
| Google Analytics (analytics.google.com) | Site usage analytics: pages visited, session duration, referring source. Only activated after you consent to Analytics cookies. IP anonymisation is enabled; data is aggregated. | Anonymised IP address, browser/device type, pages visited, session data (via _ga and _ga_* cookies) |
| YouTube / Google | Embedded video content on the Site | IP address, cookies set by YouTube, subject to Google's Privacy Policy |
| Netlify | Website hosting and serverless function execution | Web server logs including IP addresses |
| Your employer (Service context) | Where ResolveCX is deployed by your employer, your employer controls the workplace data processed within the platform | As configured by your employer |
We do not sell your personal information to third parties for monetary consideration, and we do not share your personal information with third parties for cross-context behavioral advertising (as those terms are defined under CCPA/CPRA), except as described in the Cookies section and our Cookie Policy.
We may disclose personal information if required to do so by law, in response to a valid legal process, or to protect the rights, property, or safety of ResolveCX, our users, or the public.
6. Data Storage and International Transfers
We are a U.S.-based business. Personal information collected through the Site is stored and processed on servers located in the United States. If you access the Site from outside the United States, your information will be transferred to, stored, and processed in the U.S.
For EEA and UK residents: Transfers of your personal data from the EEA or UK to the United States are subject to the international transfer requirements of the GDPR and UK GDPR respectively. We rely on the European Commission's Standard Contractual Clauses (SCCs) (Controller-to-Processor, Module 2) and, for UK transfers, the UK International Data Transfer Agreement (IDTA) or UK Addendum to SCCs as the transfer mechanism for transfers to our U.S.-based service providers. Copies of the applicable transfer mechanisms are available on request at sales@resolvecx.global.
Our primary third-party sub-processors (Resend for email, Cloudflare for security) are parties to or bound by appropriate transfer mechanisms. A current list of sub-processors is available on request.
7. Data Retention
| Data type | Retention period |
|---|---|
| Contact form submissions | Up to 24 months from submission, unless you request earlier deletion |
| Newsletter subscriptions | Until you unsubscribe or request deletion |
| Website server logs | Up to 90 days |
| Cookie preference records | Stored in your browser; expires after 12 months |
| Service / platform data | As specified in your organization's service agreement, typically for the duration of the contract plus 12 months |
8. Your Privacy Rights
Depending on where you live, you may have the following rights regarding your personal information. We honor these requests at no charge and will not discriminate against you for exercising them.
Rights under GDPR and UK GDPR (EEA and UK residents)
If you are located in the EEA or UK, you have the following rights under the GDPR / UK GDPR:
- Right of access (Art. 15): request a copy of the personal data we hold about you and information about how we process it.
- Right to rectification (Art. 16): request correction of inaccurate or incomplete personal data.
- Right to erasure / right to be forgotten (Art. 17): request deletion of your personal data where there is no compelling reason for its continued processing, subject to legal retention obligations.
- Right to restriction of processing (Art. 18): request that we restrict processing of your personal data in certain circumstances (e.g. while accuracy is contested or an objection is pending).
- Right to data portability (Art. 20): where processing is based on your consent or a contract and carried out by automated means, request a copy of your personal data in a structured, commonly used, machine-readable format, and to have it transmitted to another controller where technically feasible.
- Right to object (Art. 21): object to processing based on our legitimate interests, including for direct marketing. We will cease processing unless we can demonstrate compelling legitimate grounds that override your interests.
- Rights related to automated decision-making (Art. 22): we do not carry out solely automated decision-making that produces legal or similarly significant effects.
- Right to withdraw consent: where processing is based on your consent, you may withdraw it at any time without affecting the lawfulness of processing before withdrawal.
To exercise any of the above rights, contact us at sales@resolvecx.global. We will respond within 30 days (extendable by a further 2 months for complex or numerous requests, with notice). We may need to verify your identity before fulfilling the request. You also have the right to lodge a complaint with your local supervisory authority; see Section 14 for details.
Rights for California residents (CCPA/CPRA)
If you are a California resident, you have the following additional rights under the CCPA/CPRA:
- Right to know: request details about the categories and specific pieces of personal information we have collected about you.
- Right to delete: request deletion of personal information we have collected, subject to certain exceptions.
- Right to correct: request correction of inaccurate personal information we hold.
- Right to opt out of sale or sharing: we do not sell or share personal information for cross-context behavioral advertising. If this changes, we will update this policy and provide a "Do Not Sell or Share" opt-out before implementing any such activity.
- Right to non-discrimination: we will not deny goods or services or charge different prices because you exercised your privacy rights.
- Authorized agent requests: you may designate an authorized agent to make requests on your behalf.
Rights for residents of other U.S. states
Residents of Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Texas (TDPSA), and other states with consumer privacy laws may have similar rights. We will honor verifiable requests to the extent required by applicable law. Contact us at sales@resolvecx.global to submit a request. We will respond within 45 days (extendable by an additional 45 days with notice).
9. Do Not Sell or Share My Personal Information
We do not sell personal information, and we do not share personal information with third parties for cross-context behavioral advertising. No opt-out mechanism for sale or sharing is required at this time because we do not engage in those activities.
Third-party services embedded on the Site (such as YouTube) may set their own cookies that could be used for advertising purposes. You can manage these through our cookie consent banner or your browser settings. See our Cookie Policy for details.
10. Email Communications (CAN-SPAM)
If you subscribe to our newsletter or request information, we may send you commercial email communications. In compliance with the CAN-SPAM Act:
- We will clearly identify ourselves as the sender.
- Every marketing email will include a clear and conspicuous opt-out mechanism.
- We will honor opt-out requests within 10 business days.
- We will not use deceptive subject lines or sender addresses.
11. Cookies and Tracking Technologies
We use cookies and similar technologies to operate the Site and, with your permission, to analyze usage. For full details of the cookies we set, their purposes, and how to manage your preferences, please read our Cookie Policy.
12. Children's Privacy (COPPA)
The Site and Service are not directed at children under the age of 13. We do not knowingly collect personal information from children under 13. If we learn that we have inadvertently collected personal information from a child under 13, we will delete it promptly. If you believe a child under 13 has submitted personal information through the Site, please contact us immediately at sales@resolvecx.global.
13. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or other factors. When we do, we will revise the "Last reviewed" date at the top of this page. For material changes, we will provide notice via a prominent notice on the Site or by email where we hold your contact details. We encourage you to review this page periodically.
14. Contact Us and Supervisory Authorities
For any privacy-related questions, requests, or complaints, please contact:
CodeCones, Inc., doing business as ResolveCX
Email: sales@resolvecx.global
Country of establishment: United States
For U.S. residents
If you believe we have not adequately addressed your privacy concerns, you may also contact the Federal Trade Commission (FTC) at ftc.gov or your state's Attorney General office.
For EEA residents: right to lodge a complaint
If you are located in the EEA and believe we have processed your personal data in breach of the GDPR, you have the right to lodge a complaint with the supervisory authority in your EU member state of habitual residence, place of work, or the place of the alleged infringement. Contact details for all EEA supervisory authorities are available at edpb.europa.eu.
For UK residents: right to lodge a complaint
If you are located in the UK and believe we have processed your personal data in breach of the UK GDPR, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk/make-a-complaint.