Privacy Statement – Residents of Applicable U.S. States

Effective August 10, 2026

This Privacy Statement supplements the Apollo Privacy Policy and explains how Apollo handles personal information under applicable U.S. state privacy laws. Apollo operates a business-to-business data platform and registered data broker service. Apollo’s database consists primarily of professional and business-contact information, such as names, job titles, employers, business email addresses, business phone numbers, employment history, and similar information relating to individuals in their professional capacity.

Many U.S. state consumer privacy laws focus on individuals acting in a personal or household capacity and exclude certain information processed in a commercial, employment, or business context. As a result, some rights and obligations under those laws may apply to Apollo’s professional contact data only in a limited way, or may not apply to certain data or processing activities. The California Consumer Privacy Act and certain state data broker laws may apply more broadly to Apollo’s collection, use, disclosure, sale, or sharing of professional contact information.

As of the effective date, this Privacy Statement addresses U.S. state consumer privacy laws that may apply to Apollo’s handling of personal information, including the California Consumer Privacy Act (CCPA), Colorado Privacy Act (CPA), Connecticut Data Privacy Act (CTDPA), Delaware Personal Data Privacy Act (DPDPA), Indiana Consumer Data Protection Act (INCDPA), Iowa Consumer Data Protection Act (ICDPA), Kentucky Consumer Data Protection Act (KCDPA), Maryland Online Data Privacy Act (MODPA), Minnesota Consumer Data Privacy Act (MCDPA), Montana Consumer Data Privacy Act (MTCDPA), Nebraska Data Privacy Act (NDPA), New Hampshire Privacy Act (NHPA), New Jersey Data Privacy Act (NJDPA), Oregon Consumer Privacy Act (OCPA), Rhode Island Data Transparency and Privacy Protection Act (RIDTPPA), Tennessee Information Protection Act (TIPA), Texas Data Privacy and Security Act (TDPSA), Utah Consumer Privacy Act (UCPA), and Virginia Consumer Data Protection Act (VCDPA). These laws vary in scope, and this Privacy Statement will be updated as additional state privacy laws become effective or applicable to Apollo’s processing activities.

In this Privacy Statement, "Services" includes the Platform and all related services as defined in the Terms of Service, as well as the Website, marketing activities, and other interactions described in this Statement. Other capitalized terms used but not defined in this Statement have the meanings given to them in the Terms of Service.

1. Information Apollo Collects

Categories of Personal Information Apollo Collects. In the last twelve (12) months, Apollo may have collected the following categories of personal information:

• Identifiers — such as: name, email address, including business and/or other email addresses (including Gmail, Yahoo, Hotmail, etc.), job title and department, phone numbers (general or direct business numbers, faxes, and/or mobile numbers), and social networking URLs.
• California Customer Records categories — name, phone numbers, education history, employment status, employment history, and payment information such as credit or debit card numbers.
• Professional or employment-related information — current or past job titles, employment history, and business contact details.
• Internet or network activity — IP address, online identifiers, and information about a consumer's interaction with Apollo's website, application, or advertisements.
• Geolocation data — approximate physical location inferred from IP address or device geolocation features.
• Commercial information — products or Services purchased from Apollo.
• Inferences — predictions about preferences, interests, or professional attributes drawn from the information above.
• Sensitive personal information — limited to account login credentials for individuals who register for an Apollo account. This information is used solely to secure and administer User accounts and is not included in Apollo's contributor database, sold, or shared.

Categories of Sources. Apollo collects personal information from the following categories of sources:

• publicly available websites and professional directories;
• direct research;
• contributions from Apollo's Customers and Authorized Users;
• third-party data vendors and contractual partners;
• direct and indirect interactions on Apollo's website;
• direct and indirect engagements with Customers or their agents; and
• communications with potential Customers and other business contacts.

Purposes for Collection. Apollo collects, discloses, shares, and sells personal information for the following business and commercial purposes:

• to fulfill requests from consumers or Customers;
• to provide information, products, or Services;
• to include in Apollo's database of business contacts for licensing to Customers for B2B sales, marketing, and recruiting;
• to send alerts, event registrations, or notices about Apollo products and Services;
• to carry out contractual obligations and enforce rights, including billing and collections;
• to improve Apollo's website and Services; for testing, research, analysis, and product development;
• to protect the rights, property, or safety of Apollo, its Customers, or others;
• to respond to law enforcement requests or comply with applicable law;
• and in connection with a merger, acquisition, or similar corporate transaction.

Categories of Third-Party Recipients. Apollo may disclose personal information to: Apollo affiliates; service providers; Apollo Authorized Users; and Apollo Customers.

2. How We Sell and Share Personal Information

In the preceding twelve (12) months, Apollo has sold or shared the following categories of personal information:

The personal information disclosed or sold by Apollo within the identified categories is limited to information related to a consumer's professional profile as an employee of their employer. Apollo does not collect, share, disclose, or sell sensitive personal information such as sexual orientation, race, ethnicity, religious affiliation, or health-related information for purposes of providing its Services.

Apollo does not sell or share the personal information of minors under 16 years of age. Note: Maryland law (MODPA) and Texas law (TDPSA) extend certain protections to minors under 18. Apollo does not sell or share the personal information of any individual Apollo knows to be a minor under 18 years of age.

3. When Apollo Acts as a Service Provider

Apollo often receives personal information from its Customers in order to provide Services to those Customers. This information may or may not overlap with information in Apollo's contributor database. Where Apollo processes data as a service provider on a Customer's behalf, the Customer — not Apollo — controls that processing. If you want to know what personal information a specific Customer holds about you, you should contact that Customer directly.

4. Data Broker Registration

Apollo is registered as a data broker in California and maintains registrations in all other states where such registration is required, including Texas, Oregon, and Vermont.

5. Consumer Rights Requests — Annual Metrics

The following metrics are provided in compliance with the CCPA and California Data Broker Law, and will be updated by July 1 of each year. During the previous calendar year, Apollo received the following number of requests from California residents:

Apollo handles deletion and opt-out requests in the same manner. Where an individual's data is not currently in Apollo's database, Apollo implements a suppression process to ensure that information is not inadvertently collected or stored in the future.

6. Your Choices

Depending on the state where you live, you may have some or all of the following rights with respect to personal information Apollo holds about you. Rights vary by state: where a particular right is not available under your state's law, or where an exemption applies to Apollo's processing, Apollo will tell you when you submit a request. The rights described in Section 5 of Apollo’s Privacy Policy, including the rights to know/access, delete, correct, port, opt out of sale and sharing, opt out of targeted advertising, and appeal a denial, apply to residents of every state whose law provides them and are not repeated here. This section describes only the additional rights that are specific to, or that vary meaningfully by, individual states.

Right to Limit Use of Sensitive Personal Information (California). Under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA), California residents have the right to direct Apollo to limit its use and disclosure of sensitive personal information to what is necessary to perform the Services or provide the goods reasonably expected by an average consumer. Apollo collects sensitive personal information only in the form of account log-in credentials for registered Authorized Users, and uses that information solely to secure and administer User accounts. Apollo does not sell, share, or use sensitive personal information for any other purpose. Because Apollo's use of sensitive personal information is already limited to this narrow purpose, no further action is required to exercise this right, but you may contact us at privacy@apollo.io if you have questions.

Right to Opt Out of Automated Decision-Making. Apollo does not use automated decision-making technology (ADMT), including profiling, to make decisions that produce legal or similarly significant effects concerning you — such as decisions about financial services, housing, insurance, employment, or health care. Apollo's use of inferences is limited to organizing, enriching, and improving its database of business contacts for B2B sales, marketing, and recruiting, and for advertising. Because Apollo does not use ADMT for significant decisions, the opt-out rights that certain state laws provide with respect to such ADMT do not currently apply to Apollo's processing.

Note: Utah (UCPA) and Iowa (ICDPA) do not provide a right to opt out of automated decision-making or profiling. If Apollo's use of automated decision-making changes in a way that triggers these rights, Apollo will update this Privacy Statement and provide consumers with the applicable opt-out mechanism before deploying the technology for such purposes.

Where Apollo deploys an AI system that interacts directly with a consumer, Apollo will disclose that the consumer is interacting with AI, except where it would be obvious to a reasonable person or where disclosure is not required by applicable law.

Right to a List of Specific Third-Party Recipients (Minnesota, Oregon and Connecticut). Under the Minnesota Consumer Data Privacy Act (MCDPA), the Oregon Consumer Privacy Act (OCPA), and the Connecticut Data Privacy Act, residents of those states have the right to request a list of the specific third parties — not just categories of third parties — to whom Apollo has disclosed or sold their personal information. To submit this request, email privacy@apollo.io or visit our Privacy Center. This right is specific to Minnesota, Oregon, and Connecticut residents and is not available under the other state laws covered by this Privacy Statement.

California Shine the Light. California Civil Code Section 1798.83 ("Shine the Light") permits California residents to request, once per year and free of charge, information about the categories of personal information (if any) we have disclosed to third parties for those parties' direct marketing purposes in the preceding calendar year, and the names and addresses of those third parties. If you are a California resident and would like to make such a request, email privacy@apollo.io with "Shine the Light Request" in the subject line.

Special Protections for Covered Persons. If you are a “covered person” under New Jersey’s Daniel’s Law (N.J. Stat. Ann. § 56:8-166.1 et seq.) or a similar law that protects judicial officers, law enforcement personnel, public officials, or other covered individuals, you may request that Apollo not disclose protected information about you by emailing privacyrequests@apollo.io. Requests submitted to this address are routed to Apollo’s privacy team for expedited processing. Please include enough information for Apollo to verify your identity, confirm your covered-person status, and locate the relevant record.

7. How to Exercise Your Rights

Submitting a Request. To exercise your rights, submit a verifiable consumer request by:

• Emailing privacy@apollo.io
• Visiting Apollo’s Privacy Center

Your request must provide sufficient information for Apollo to reasonably verify your identity and to understand and respond to your request. You do not need to create an Apollo account to submit a request. Apollo will only use personal information provided in a verifiable consumer request to verify your identity or authority.

Authorized Agents. You may designate an authorized agent to submit a request on your behalf. The agent must provide proof of your written authorization when making the request — for example, a signed letter or a power of attorney. Apollo may also ask you to verify your identity directly to confirm the authorization, except where the agent holds a valid power of attorney under California Probate Code sections 4121 to 4130. Authorized agents must provide sufficient information to identify both the agent and the individual they represent.

California DELETE Act (DROP Platform). As a registered data broker in California, Apollo participates in the California Privacy Protection Agency's Delete Request and Opt-Out Platform (DROP). California consumers may submit a single deletion request through DROP that Apollo will process along with all other registered data brokers, without needing to contact each broker separately. Apollo accesses DROP at least once every 45 days. Where a request matches our records, we will delete that information, direct our service providers and contractors to do the same, and report the outcome through the platform. Once a consumer has requested deletion through DROP, Apollo will not sell or share new personal information about that consumer unless the consumer later directs us to do so or an exception under applicable law applies. Where we cannot verify a deletion request, we will treat it as a request to opt out of sale and sharing.

Response Timing and Format. Apollo will respond to verifiable consumer requests within 45 days of receipt, or within the period required by applicable state law. Where additional time is needed, Apollo will notify you within the initial 45-day period and may extend the response period by up to an additional 45 days (or such other period as applicable law permits), stating the reason for the extension. We will deliver our response by mail or electronically. Disclosures for access requests will cover the 12-month period preceding the request. For data portability requests, we will provide your information in a format that is readily usable and transferable. Apollo does not charge a fee to process or respond to a request unless it is excessive, repetitive, or manifestly unfounded; if a fee is warranted, Apollo will notify you with a cost estimate before completing the request.

Appealing a Denied Request. If Apollo denies all or part of your privacy rights request, you have the right to appeal that decision in states whose laws require an appeal mechanism, including Colorado, Connecticut, Delaware, Indiana, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, and Virginia.

To appeal a denial, email privacy@apollo.io with "Privacy Rights Appeal" in the subject line and include a description of the request that was denied and the basis for your appeal. Apollo will respond to your appeal within 45 days of receipt (or within 60 days where permitted by applicable law), and will provide a written explanation of the reasons for its decision. If your appeal is denied, you may contact the attorney general of your state to submit a complaint. Links to each state attorney general's consumer complaint portal are available at www.naag.org/find-my-ag.

8. Security

Apollo maintains administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, use, disclosure, alteration, or destruction, taking into account the nature of the information and the risks involved. Apollo’s security program is designed to align with recognized industry practices and is supported by certifications and controls described in Apollo’s Privacy Policy and Trust Center. If Apollo identifies a security incident that triggers notification obligations under applicable state breach-notification, consumer privacy, or data-broker laws, Apollo will notify affected consumers and applicable regulators as required by those laws.

9. Changes to This Privacy Statement

Apollo reserves the right to amend this Privacy Statement at its discretion and at any time. When we make material changes, we will provide notification by email or through a notice on this page, and will update the effective date above.

10. Contact Us

For questions about this Privacy Statement, the Apollo Privacy Policy, how we collect and use personal information, how to request this Privacy Statement in an alternative format, or to exercise your rights under applicable state privacy law, contact us at:

Apollo (ZenLeads Inc.)
Attn: Legal Department — Privacy
440 N Barranca Ave #4750
Covina, CA 91723-1722
Email: privacy@apollo.io