Reef Capital Partners LLC Privacy Policy

Last Updated: September 17, 2026

This Privacy Policy (“Privacy Policy”) governs reefcp.com and other websites owned or operated by Reef Capital Partners LLC (including any successors and assigns), a Delaware limited liability company (collectively, “we,” “our,” or “us”). For purposes of this Privacy Policy, Reef Capital Partners LLC is the owner, operator, and applicable controller or business for the Sites. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit any of the websites we own or operate (collectively, the “Sites”). Certain Sites may be managed on our behalf by third-party service providers acting as website or media managers or data processors under written agreements that require such third parties to comply with this Privacy Policy and applicable data protection laws and to process personal information only in accordance with our documented instructions. This Privacy Policy covers personal information we collect through the Sites and related online services only; it does not apply to information collected offline, through other channels not expressly covered herein, or in the context of our workforce (applicants, employees, or independent contractors) or other business relationships, which are governed by separate notices where applicable. This Privacy Policy also does not apply to information collected in connection with investment activities, investor relations, or due diligence processes, which are governed by separate agreements and notices.

Site-specific disclosures (including links to our contact details (2600 N Ashton Blvd, Ste 200B, Lehi, Utah 84043; [email protected]; (801) 216-8850) and any cookie preference center (where available on applicable Sites)) may apply. On applicable Sites, a “Your Privacy Choices”/“Do Not Sell or Share My Personal Information” link or icon appears in the footer and provides access to opt-out choices and, where enabled, the cookie preference center. Additional or supplemental disclosures may apply for residents of certain jurisdictions, including California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon, the European Economic Area and the United Kingdom, and Canada (including Quebec), as described in Section 5 below. For California residents, this Privacy Policy also serves as our notice at collection and describes the categories of personal information we collect, the purposes for which we use it, the categories of recipients, and our retention practices (see Sections 1, 2, 3, and 6). Where required by applicable law, we provide a consent and cookie management experience on applicable Sites (where enabled). See Sections 1(c) for details about cookie choices, browser-based opt-out signals, and automated tools. Please read this Privacy Policy carefully. By accessing or using our Sites, you acknowledge that you have read and understood this Privacy Policy. To the extent permitted by applicable law, your continued use of the Sites following posting of any updates and, where required by law, after the effective date of such updates, constitutes acceptance of the updated Privacy Policy. Governing law for any disputes related to this Privacy Policy, as well as jurisdiction and venue for such disputes, are as set out in the General Terms & Conditions. IF YOU DO NOT AGREE TO THIS PRIVACY POLICY, DO NOT CONTINUE TO ACCESS OR USE THE SITES.

1. Information We Collect

We collect personal information and other data from you through direct submission, automated means, and third-party sources where we have a lawful basis for doing so under applicable privacy laws (e.g., the CCPA/CPRA and other U.S. state laws, the EU/UK GDPR, and Canada’s PIPEDA and Quebec Law 25), including the following categories of personal information from or about you: identifiers (e.g., name, email, phone, IP address, device identifiers); commercial information (e.g., records of inquiries, purchases, or transactions with us); internet or other electronic network activity (e.g., browsing/use data, interactions with our emails); approximate geolocation (derived from IP address); audio, electronic, or visual information (e.g., call recordings where disclosed, website security logs); professional or employment information; inferences drawn from the foregoing; and, where you choose to provide it or where necessary for a permitted purpose, limited sensitive personal information as described below. We collect this information directly from you, automatically from your device, and from service providers and partners. We use it for the purposes described in Section 2 and disclose it as described in Section 3. We retain personal information for as long as reasonably necessary to achieve the purposes described (taking into account legal, tax, accounting, and security requirements) and then delete, de-identify, or aggregate it as required by law.

a. Information You Provide to Us

Contact information such as name, email address, phone number, and mailing address.
Business information such as job title, company name, or property or service interests.
Communication content including messages sent through contact forms or via email.
Other data you voluntarily provide to us. We ask that you do not submit sensitive personal information (as defined by applicable law, including Social Security numbers, driver’s license numbers, passport numbers, or other government identifiers; precise geolocation; financial account numbers with access credentials; racial or ethnic origin; religious or philosophical beliefs; union membership; genetic or biometric data processed for identification purposes; health information; or information concerning sex life or sexual orientation) unless we specifically request it or it is necessary for the relevant purpose. If we collect sensitive personal information, we use and disclose it only for purposes permitted by applicable law, including to: (i) provide requested services; (ii) maintain security and integrity; (iii) prevent, detect, and investigate fraud and other illegal activity; (iv) verify or maintain the quality of our services; (v) perform services on behalf of the business; and (vi) comply with legal obligations. We will not use or disclose sensitive personal information for purposes of inferring characteristics about you or, where applicable, beyond permitted purposes under the CPRA and its implementing regulations or other applicable law, except where we have offered required choices and obtained any necessary consent as required by applicable law, or where such use is otherwise permitted by law.

b. Information Collected Automatically

When you visit our Sites, we may automatically collect:

IP address and device identifiers.
Browser type and version.
Pages visited, referring website, and interactions with our emails (such as opens and link clicks).
Time and date of visit.
Approximate location data (derived from IP address); we do not collect precise geolocation (within a radius of 1,750 feet or less) unless you affirmatively enable location services through your device or browser settings and provide consent where required by applicable law.

c. Cookies and Tracking Technologies

We use cookies and similar tracking technologies (e.g., web beacons, pixels, local storage) to enhance your experience, analyze usage, and personalize content. You can manage your cookie preferences through your browser settings or our cookie preference center (on applicable Sites, where enabled). You can also exercise opt-out rights related to cross-context behavioral advertising/targeted advertising via the “Your Privacy Choices”/“Do Not Sell or Share My Personal Information” link or icon in the Sites’ footer (on applicable Sites) or through our cookie preference center (where enabled on applicable Sites). For more information about our use of these technologies, please refer to our Cookie Policy available on the Sites and the choices described therein, or, if a standalone Cookie Policy is not available, see the cookie disclosures within the preference center. Where required by law, we will obtain your consent for non-essential cookies, and we honor applicable browser-based opt-out signals (such as Global Privacy Control) to the extent required by law. While no uniform standard for recognizing “Do Not Track” (DNT) signals has been finalized, we currently do not respond to DNT signals except as required by applicable law. However, we honor Global Privacy Control (GPC) and other legally recognized opt-out signals as required by applicable law, and will update this Privacy Policy if additional industry standards are adopted or if legal requirements change. We may work with analytics and advertising partners that set their own cookies or similar technologies on our Sites to help us measure traffic and performance and to serve or measure personalized ads; you may control or opt out of these uses as described above. Some of these partners act as our service providers/processors under our instructions, while others act as independent controllers or third parties. The choices and controls available to you may vary by Site and by partner. If a cookie preference center is unavailable on a Site, you can manage cookies via your browser or device settings and, where applicable, use platform- or industry-level opt-outs; you may also contact us using the details in this Privacy Policy for assistance with your choices, and we will respond within a reasonable timeframe as required by applicable law.

2. How We Use Your Information

We collect, use, and retain personal information only as reasonably necessary and proportionate to achieve the purposes described below (or other disclosed, compatible purposes, or as otherwise permitted or required by applicable law). We use your information to:

Respond to inquiries and provide customer support.
Send administrative communications.
Personalize and improve user experience, including to provide, measure, and optimize marketing and advertising, subject to your opt-out rights and applicable consent requirements under law.
Conduct research and analytics.
Comply with legal obligations and enforce our terms; maintain the security and integrity of the Sites, including fraud prevention, detection, and debugging.
Evaluate and manage potential property opportunities, business relationships, and related business purposes.
Provide information about our properties, services, and company updates.

De-identified and aggregate data. We may create and use de-identified or aggregate information. Where we maintain de-identified data, we will: (i) take reasonable measures to ensure the information cannot be associated with or reasonably linked to a particular individual or household; (ii) publicly commit not to attempt to re-identify it (except to test our de-identification processes); and (iii) contractually require any recipients to comply with these obligations. We will not attempt to re-identify de-identified data except as permitted by applicable law, including for the purpose of testing the effectiveness of our de-identification processes.

Marketing Communications. We may send you marketing emails or similar communications about our properties, services, or events consistent with applicable law; you can opt out at any time by using the “unsubscribe” link in those messages. Please note that you may still receive transactional or service communications (e.g., responses to inquiries, account or security notices) even if you opt out of marketing.

3. How We Share Your Information

We may share your information with:

Affiliated companies within our corporate family.
Service providers and contractors who assist with business operations (e.g., IT, analytics, marketing, customer support, payment processing, legal and professional services, and other business services) under written agreements or terms of service that include appropriate contractual safeguards, data processing terms, and confidentiality obligations requiring them to process personal information only according to our instructions and applicable law. Some partners act as our service providers/processors under these terms, while others operate as independent controllers or third parties; choices available to you may vary by Site and by partner.
Managers or administrators of our companies, properties, or Sites.
Legal authorities, when required to comply with applicable law or legal process.
Prospective investors, partners, or buyers, and their advisors, in connection with or during negotiation of a business transaction (e.g., merger, acquisition, sale, financing, bankruptcy, reorganization, or asset transfer), subject to appropriate confidentiality obligations and only to the extent reasonably necessary for the transaction, and to successors or assigns in the event such transaction is completed.
Other parties with your consent.

We do not “sell” personal information for monetary or other valuable consideration as that term is defined under applicable U.S. state privacy laws, including the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA). We may “share” personal information for cross-context behavioral advertising as that term is defined under California law and may process personal information for targeted advertising as defined under other U.S. state laws, subject to your right to opt out via the “Your Privacy Choices”/“Do Not Sell or Share My Personal Information” link or icon in the Sites’ footer (on applicable Sites), through our cookie preference center (where enabled on applicable Sites), or by using a recognized browser-based opt-out signal such as Global Privacy Control (GPC) (to the extent required by law). If a cookie preference center is not available on a given Site or is temporarily unavailable, you may manage cookies via your browser settings and/or submit an opt-out request using the “Your Privacy Choices”/“Do Not Sell or Share My Personal Information” link or icon (where enabled). We may allow analytics and advertising partners to collect information on our Sites via cookies and similar technologies for audience measurement, personalization, and advertising; where required, we obtain consent and/or provide the ability to opt out. We may also process de-identified information and will maintain such information in de-identified form and not attempt to re-identify it except as permitted by law. We do not knowingly sell or share the personal information of consumers under 16 years of age, and we do not have actual knowledge that we sell or share such information. Nevada residents: we do not sell “covered information” as defined under NRS 603A; nevertheless, you may submit a verified request to opt out of any future sale by emailing [email protected] with “Nevada Opt-Out Request” in the subject line.

4. Third-Party Links

Our Sites may contain links to third-party websites and services that we do not control. This Privacy Policy does not apply to those third-party websites. We encourage you to review their privacy policies.

5. Your Privacy Rights

Depending on your location, you may have certain rights, including:

a. California Residents (CCPA/CPRA)

You may have the right to:

Request access to and portability of the personal information we have collected about you.
Request deletion of your personal information.
Request correction of inaccurate personal information.
Opt out of the sale or sharing of personal information (including for cross-context behavioral advertising).
Request that we limit the use and disclosure of your sensitive personal information to permitted purposes under applicable law. We use and disclose sensitive personal information only for such permitted purposes (e.g., to provide requested services, ensure security and integrity, prevent fraud, and comply with law), and we do not use sensitive personal information to infer characteristics about you.
Not be discriminated against for exercising privacy rights.

To make a request, contact us at [email protected], by phone at (801) 216-8850, or by mail at 2600 N Ashton Blvd, Ste 200B, Lehi, Utah 84043, or through any designated request portal we may provide. The preferred method for submitting requests is via email at [email protected]; phone and mail are available alternatives. You may designate an authorized agent to submit requests on your behalf; we will require verification of both your identity and the agent’s authority to act on your behalf, and will require the agent to provide a signed permission or power of attorney, except where the agent is registered with the California Secretary of State to conduct business in California on your behalf. We will verify your identity before processing any requests and may ask for additional information to do so, which may include information matching at least two or three data points we maintain about you, depending on the sensitivity of the request and as permitted by applicable law. We may decline requests that are manifestly unfounded, excessive, or repetitive under applicable law, or where we cannot verify your identity after reasonable efforts. We will provide an explanation if we decline a request and, where applicable, inform you of your right to appeal, and will handle any appeal within applicable legal timelines, which may be extended where permitted by law. We will respond to verified requests within 45 days under the CCPA/CPRA (or such other time period as required by applicable law), unless an extension is required under applicable law, in which case we will notify you of the extension and the reason for it. Under the CCPA/CPRA, we may extend our response time by an additional 45 days when reasonably necessary, provided we notify you of the extension within the initial 45-day period. To the extent required by law, you may also exercise opt-out rights regarding the sale/sharing of personal information or targeted advertising by using the “Your Privacy Choices”/“Do Not Sell or Share My Personal Information” link or icon in the Sites’ footer on applicable Sites (where enabled) or through our cookie preference center (where enabled on applicable Sites). Please note that some of our partners act as service providers/processors under our instructions, while others act as independent third parties/controllers; available choices and the effect of opt-outs may vary by Site and by partner. If a separate Cookie Policy is not available on an applicable Site, cookie disclosures are provided within the preference center. California residents may also, to the extent applicable, request information about our disclosures of personal information to third parties for their direct marketing purposes under California Civil Code § 1798.83 (the “Shine the Light” law) by contacting us as described in the “Contact Us” section.

b. Other U.S. States

You may have similar rights under other U.S. state privacy laws, including (as applicable) in Colorado, Connecticut, Utah, Texas, Oregon, Virginia, and other states. These can include the right to access, correct, delete, obtain a portable copy of your personal data, and to opt out of targeted advertising, the sale of personal data, and profiling in furtherance of decisions that produce legal or similarly significant effects. You can exercise these rights using the methods described in the “Contact Us” section ([email protected]; (801) 216-8850; 2600 N Ashton Blvd, Ste 200B, Lehi, Utah 84043) or any self-service tools we provide (e.g., our cookie preference center and the “Your Privacy Choices”/“Do Not Sell or Share My Personal Information” link or icon in the Sites’ footer, where enabled on applicable Sites). We will verify requests as required by law and may request additional information to complete verification. You may designate an authorized agent where permitted by law; we may require proof of authorization and identity verification. We will respond within required timelines and may extend those timelines where permitted by law, notifying you of any extension and the reason for it. If we decline to act on your request, you may appeal our decision within the time required by law (e.g., within 30–60 days, as applicable), and we will process appeals within applicable legal timelines, which may be extended where permitted. If your appeal is denied, where applicable under your state’s law, you may have the right to contact your state’s Attorney General or other regulator to submit a complaint, and we will provide information about how to do so. Nevada residents may submit a verified request to opt out of the sale of personal information under NRS 603A by contacting us at [email protected] with “Nevada Do Not Sell Request” in the subject line or by using the other contact methods listed above; however, we do not currently sell personal information as defined by NRS 603A.

We may send you marketing or promotional communications as permitted by law. You may unsubscribe from marketing at any time by following the instructions in those communications (e.g., the unsubscribe link in emails) or by contacting us as described in the “Contact Us” section. If you opt out of marketing, we may still send you non-promotional, transactional, or service-related messages (such as responses to inquiries or updates about requested services).

c. European Economic Area and United Kingdom (GDPR)

If you are located in the EEA or UK, the controller is Reef Capital Partners LLC. Reef Capital Partners LLC owns and operates the Sites and acts as the applicable controller or business for the Sites.

Subject to conditions and exceptions under applicable law, you have rights to request access, rectification, erasure, restriction, portability, and to object to processing, including profiling, particularly where we rely on legitimate interests. You also have an absolute right to object at any time to our processing of your personal data for direct marketing (including profiling related to such marketing). Our legal bases for processing include consent, performance of a contract or steps taken at your request prior to entering into a contract, compliance with legal obligations, our legitimate interests (balanced against your interests and rights), protection of vital interests, and, where applicable, performance of a task carried out in the public interest.

Where we transfer your personal data outside the EEA/UK to countries not subject to an adequacy decision, we do so in compliance with applicable law, including by relying on the European Commission’s Standard Contractual Clauses (2021 version) and/or the UK International Data Transfer Addendum (as applicable), and by implementing additional technical, organizational, and contractual safeguards and transfer risk assessments as required by GDPR Article 46 and the Schrems II decision. Copies or a description of the relevant transfer safeguards may be provided upon request, subject to appropriate redactions to protect confidential, security, and commercially sensitive information.

You may contact us at [email protected], by phone at (801) 216-8850, or by mail at 2600 N Ashton Blvd, Ste 200B, Lehi, Utah 84043 to exercise your rights or raise questions. Where required, we will designate an EU and/or UK representative and will publish the representative contact details on the relevant Site or provide them upon request. You also have the right to lodge a complaint with your local data protection authority.

We retain personal data for as long as necessary for the purposes described in this Privacy Policy, including to satisfy legal, accounting, or reporting requirements, and as further described in Section 6 (Data Security and Retention).

d. Canada (PIPEDA and Quebec Law 25)

If you are in Canada, you may request access to and correction of your personal information and withdraw consent to processing where we rely on consent. Depending on your province, you may have additional rights. You may contact the Office of the Privacy Commissioner of Canada or, in Quebec, the Commission d’accès à l’information, regarding a concern. Where we transfer personal information outside Canada (including Quebec), we use contractual and other safeguards appropriate to the sensitivity of the information and, where required, conduct assessments of the transfer.

We obtain consent as required by law, including express consent for certain sensitive information, and provide information about our practices in clear and simple language.

6. Data Security and Retention

We collect and process only the personal information that is reasonably necessary and proportionate to achieve the purposes described in this Privacy Policy or as otherwise disclosed to you. We implement administrative, technical, and physical safeguards designed to protect personal information from unauthorized access, use, disclosure, alteration, and destruction. However, no security measures are perfect, and we cannot guarantee absolute security. In the event of a security incident affecting personal information, we will provide notices to affected individuals and/or regulators as required by applicable law. We do not use or disclose sensitive personal information for purposes other than those permitted by applicable law, including to perform services you request, ensure security and integrity, maintain and improve our systems, for short-term transient use, debugging, and to verify or maintain the quality or safety of our services, and we do not use sensitive personal information to infer characteristics about you.

We retain personal information only for as long as reasonably necessary to fulfill the purposes for which it was collected, to comply with our legal obligations, to resolve disputes, to enforce our agreements, and as otherwise permitted or required by law (such as tax, accounting, and compliance purposes). Upon expiration of the applicable retention period, we will securely delete or anonymize personal information in accordance with applicable law. We consider the nature and sensitivity of the information, the potential risk of harm from unauthorized use or disclosure, the purposes of processing and whether those purposes can be achieved by other means, and applicable legal requirements. Where we maintain de-identified information, we commit to maintain and use it in de-identified form and not to re-identify it (except to test and demonstrate the effectiveness of our de-identification), and we will require any recipients to do the same.

7. Children’s Privacy

Our Sites are not directed to children under 13, and we do not knowingly collect personal information from children under 13. We also do not knowingly sell or share personal information of consumers under 16 years of age. If we learn that we have collected personal information from a child under 13 contrary to applicable law, we will promptly take appropriate steps to delete such information within a reasonable timeframe, typically within 30 days of discovery. If you believe a child has provided us with personal information, please contact us at [email protected], by phone at (801) 216-8850, or by mail at 2600 N Ashton Blvd, Ste 200B, Lehi, Utah 84043.

8. Automated Decision-Making and AI

We may use automated tools and artificial intelligence to support our operations (e.g., to help detect fraud, measure engagement, or analyze data patterns), but we do not make decisions based solely on automated processing, including profiling, that produce legal or similarly significant effects about you without human involvement. Any material decisions involve human review. Where required by law, we will describe such processing and provide mechanisms to exercise related rights (e.g., to obtain human review, express your point of view, and contest a decision).

9. International Data Transfers

If you access the Sites from outside the United States, your information may be transferred to, stored, and processed in the United States and other countries where our service providers operate, which may have different data protection laws than your country of residence. We implement appropriate safeguards for such transfers as required by law, including the EEA/UK safeguards described in Section 5(c) where applicable. Copies or a description of relevant transfer safeguards may be provided upon request, subject to appropriate redactions to protect confidential, security, and commercially sensitive information.

10. Accessibility

If you need this Privacy Policy in an alternative format due to a disability, please contact us at [email protected] (preferred), by phone at (801) 216-8850, or by mail at 2600 N Ashton Blvd, Ste 200B, Lehi, Utah 84043, and we will use reasonable efforts to make it available in an alternative format upon request.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we do, we will revise the “Last Updated” date at the top and, for material changes, we will provide appropriate notice to you (e.g., via email or prominent notice on our Sites) before the changes become effective, where required by law. We will not make material changes that retroactively reduce your rights or expand our use of previously collected personal information without obtaining your consent where required by applicable law. Where changes materially affect processing that relies on your consent, we will seek fresh consent as required. We will maintain prior versions of this Privacy Policy and make them available upon request, or by posting a version history where required by law. Your continued use of the Sites after the effective date of any update (following any required notice period) constitutes your acceptance of the updated policy to the extent permitted by applicable law. Where applicable law requires affirmative consent for material changes (such as changes to the purposes of processing based on consent or new types of sensitive data processing), we will obtain such consent before applying the changes to your personal information.

12. Inquiries

If you have questions about this Privacy Policy or wish to exercise privacy rights available under applicable law, please contact us at the information below. We do not discriminate against consumers for exercising privacy rights, including by denying goods or services, charging different prices or rates, providing a different level or quality of goods or services, or suggesting that you will receive a different price, rate, level, or quality of goods or services. Depending on your jurisdiction, privacy rights may include the right to access, correct, delete, obtain a portable copy of personal data, and opt out of targeted advertising, the sale of personal data, or profiling in furtherance of decisions that produce legal or similarly significant effects.

Email ([email protected]) is our primary intake channel for privacy requests; you may also contact us by phone or mail. Unless a different controller is identified on a specific Site or in a notice at collection, Reef Capital Partners LLC is the controller for the Sites described in this Privacy Policy. We will verify your identity (and, where applicable, the authority of an authorized agent or representative) before acting on a request using reasonable methods appropriate to the sensitivity of the personal data and the risk of harm from unauthorized access or deletion. We may request additional information reasonably necessary to complete verification, such as matching data points you provide with information we maintain, but we will not require you to create an account with us to submit or fulfill a request. For authorized agent requests, we may require written authorization signed by the consumer or proof of power of attorney. We will respond within timelines required by applicable law and may extend those timelines where permitted by law, notifying you of any extension. You may also submit requests via any “Your Privacy Choices” or “Do Not Sell or Share My Personal Information” links/icons that may appear in the footer on applicable Sites (where enabled), and via our cookie preference center accessible from the footer on applicable Sites (where enabled).

13. Contact Us

Reef Capital Partners LLC

Attn: Privacy Team
2600 N Ashton Blvd, Ste 200B

Lehi, Utah 84043

Email: [email protected] (please include “Privacy Request” in the subject line and do not include sensitive personal information in your email)

Phone: (801) 216-8850