SYMPHONY SERVICES PRIVACY POLICY

Revision: 2026-07-01

This Privacy Policy (“Policy”) explains how your Personal Information is collected, stored, processed, transferred and disclosed by WaterFurnace International, Inc. (“WaterFurnace”), its affiliated companies and subsidiaries, and Trusted Third Parties (defined below) (also referred to as "we", "us", or "our") through the use of its Symphony System, including devices, web portal, and mobile application used to register and monitor our offerings (collectively, the “Symphony Services”).

Your Personal Information and the personally identifiable information created by your Symphony devices belong to you. You have the right to have a copy of your Personal Information at any time. For purposes of this Policy, "Personal Information" means information that identifies, relates to, describes, references, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular individual, and as otherwise defined in applicable laws.

This Policy applies to any Personal Information you provide to WaterFurnace through the Symphony Services, and any information we collect from other sources in the course of providing the Symphony Services. This Policy is a statement of our practices and of your rights regarding your information.

By accessing or using our Symphony Services, you acknowledge that you have read, understand, and explicitly agree to the practices as described in this Policy. If you do not agree to the privacy practices as described in this Policy, please do not use the Symphony Services.

Click on the links below to jump to each section:

When do we collect your information? 2

What information do we collect? 2

Information regarding the router's running status. 4

How do we use your Personal Information? 4

Use of de-identified information 5

Do we disclose any information to outside parties? 5

What choices do you have about your Personal Information? 8

Do we transfer your Personal Information across geographies? 9

How long do we retain your Personal Information? 9

Third party links 9

How do we protect your information? 9

Your California Privacy Rights 10

Your Nevada Privacy Rights 12

Do we collect information from children? 12

Contacting Us 12

Changes to our Policy 13

When do we collect your information?

WaterFurnace and its Service Providers, including installation contractors, and its associates, including utilities, energy efficiency consultants, lenders, and other energy industry partners as set forth in the categories of third parties below (“Trusted Third Parties”), collect, access and exchange, within the context of our services, information relating to you and your use of our Symphony Services in order to provide services and features that are easy to use and responsive to your needs. WaterFurnace and/or our Trusted Third Parties and Service Providers may collect Personal Information in the following ways. Please note that the specific pieces of information listed below are just examples — they are not a complete list of everything that may be collected from each source.

• From your computer or device when you connect to our Symphony Services.

Every computer connected to the Internet is provided with a domain name and an IP Address (e.g., 192.0.2.123). When you visit our Symphony Services and request a page from our website, our web servers automatically identify and log information such as the HTTP request and IP Address that is made to our web server.

• From you when you register an account and communicate with us.

We collect information from you when you register an account with us, request information by entering information in the Symphony Technical Support form, send us email, send us postal mail, or speak with us on the telephone.

• From the mobile application.

We may collect information from your mobile device when our mobile application is installed on your mobile device.

• From the Thermostat.

We collect information regarding temperature and thermostat settings.

• From the Aurora WebLink router.

We collect information when you and your devices interact with the Aurora WebLink router including Symphony Services usage analytics.

• From Third Party Sources.

We may collect information from contractors, distributors, or other resellers who help us to provide services, or from other Trusted Third Party suppliers or business partners.

What information do we collect?

When you provide Personal Information to us as described above, we use it for the purposes for which it was provided to us, as stated below, or as obvious from the context of collection. We may collect the following information:

• Name;
• Address;
• Email Address;
• Telephone;
• User Name;
• Password;
• Communication Preference;
• Device Type;
• Browser Type;
• Operating System or Platform;
• Name of Internet Service Provider;
• Referring Website;
• Exit Page;
• Pages visited on the website;
• Frequency, time, date, and duration of your visit on our website;
• Your Geolocation and physical location of where the Symphony Services are installed;
• Whether you access our website from multiple devices;
• Other interactions you may have on our website;
• Unique Device Identifier (e.g., Unique Device Identifier (UDID) or International Mobile Equipment Identity (IMEI));
• Mobile device MAC or IP address;
• Information about your mobile carrier;
• Home/Building size;
• Home/Building system configuration (including appliances monitored by the Symphony System, schedule, mode, automation and Thermostat settings);
• Thermostats in your home/building (including types, model numbers and software version numbers);
• Level of Service;
• Communications relating to customer support, and information drawn from such communications, for statistical and reference purposes;
• Data regarding actual indoor and outdoor temperature and humidity information;
• Thermostat usage data such as heating, ventilating, and air-conditioning ("HVAC") relay status, runtimes, settings;
• Time of events in home/building;
• HVAC diagnostic and usage logs from the HVAC system;
• Alerts from the HVAC system;
• Cookies and analytics;
• Information about your electrical usage relating to electrical loads monitored by the Symphony System;
• Overall household/building electrical usage;
• Wi-Fi service set identifier; and Information regarding the router's running status.

How do we use your Personal Information?

The following is a description of how we use the information about you that we collect from you and from other sources.

Performing services at your request

We process Personal Information in order to provide the services you request as well as to respond to communications from you. The precise purposes for which your Personal Information is processed will be determined by your request, and by applicable laws, regulatory guidance and professional standards.

Conducting data analytics and supporting our Symphony Services

We use information we collect from you and information that we collect automatically from the applications to manage and improve our Symphony Services and our business. We may, for example, use Personal Information in the following ways:

• To manage our business needs. This may include monitoring, analyzing, and developing and improving the Symphony Services, and improving the Symphony Services' performance and functionality. For example, we analyze Symphony Services user behavior and conduct research and analysis about the way you and other website(s) users use the Symphony Services.

• To manage risk and protect the Symphony Services. This includes using data to better protect our Symphony Services and you by helping to detect and prevent fraud and abuse of the Symphony Services.

Additional uses

• To provide you with location-specific services. When you share your location information with us, we may use that information to tailor options, functionality or offers related to your location. For certain Symphony Services, we may collect the precise, real-time location (i.e., geolocation) of your mobile device and your home/building-based platform devices. This information will be used for purposes of facilitating your use of the Symphony Services, and our ability to gain insights on the energy efficiency and benefits of the Symphony Services. For these purposes, the geolocation of your devices may be disclosed to our Service Providers who may process this information in connection with providing services on our behalf.

• To market our own products and services to you. Information we collect about you and how you use the Symphony Services and our services provides valuable information about how we can improve and offer additional products and services that we think might interest you.

• Conduct internal monitoring and training, develop new services, and conduct processing necessary to fulfill other contractual obligations for you.

• To comply with our legal and regulatory obligations. We may use your Personal Information as necessary to enforce the terms of our Symphony Services and to comply with all applicable laws and regulations. For information about the specific circumstances in which we may use or disclose your Personal Information for legal and regulatory purposes, please see “Legal Requirements and Business Transfers” below.

Use of de-identified information

We may also de-identify information—including geolocation information—by removing any identifier that can be associated with you. Once information has been de-identified, we no longer consider it to be Personal Information. De-identified information helps us develop reports and analyses about how our customers use our Symphony Services and for other research, such as research regarding behavioral inferences. We may share de-identified information and reports and analyses based on de-identified information publicly and with other companies. We also use de-identified information to troubleshoot technical issues with our Symphony Services and to compile statistics and reports of usage of the Symphony Services. To enable technical support, de-identified information may be identified by an anonymous random number, which is not connected to any of your Personal Information. To further protect your privacy, de-identified information does not include contact information or any other information that would identify any specific individual, household, or building.

Do we disclose any information to outside parties?

We do not sell or share your Personal Information (as defined by applicable law). We also do not trade, or otherwise transfer your Personal Information to non-partner third parties. The transfer of data restriction does not apply to the Trusted Third Parties or our Service Providers who assist us in operating our Symphony Services, conducting our business, or servicing you, who have agreed to keep this information confidential. We do not share your Personal Information with third parties except in the circumstances discussed in this Policy.

Within WaterFurnace

We may share your Personal Information with other WaterFurnace entities, brands, divisions, and subsidiaries to serve you, including for the activities listed above.

• Our Business Partners and Trusted Third Parties

In certain circumstances, we disclose Personal Information to Trusted Third Parties, consumer and market research companies and other organizations, or suppliers who help us provide services or to other third-party suppliers and companies who co-operate or collaborate with us on projects. These business partners may operate as separate controllers, and are responsible for their own compliance with data protection laws. If the Symphony Service is provided through your utility provider or third-party system provider, we may share your information with your utility provider or third-party system provider as directed by you and in accordance with your agreement with such utility provider or third-party service provider. Their obligations with respect to such Personal Information are governed by their agreement with you. Please review their privacy policy to understand their privacy practices.

• Our Service Providers

We may use independent contractors or external vendors ("Service Providers") to assist with our operations. Such Service Providers conduct services on our behalf in order to enable us to provide the Symphony System, support our operations, or conduct legitimate business activities in connection with the Symphony Services. Some of these Service Providers will have temporary access to our databases of Personal Information. However, their access to and use of such Personal Information is contractually limited such that they may only process your Personal Information on our behalf and in order to perform specific Symphony-related tasks.

• Legal Requirements and Business Transfers

We may use and disclose Personal Information (i) as required or permitted by applicable law, statute, rule, regulation, or professional standard, including in response to a subpoena, court order, search warrant, law enforcement request, or other valid legal process, or to regulatory or governmental authorities in connection with an inquiry, investigation, audit, or proceeding; (ii) as necessary to establish, exercise, or defend legal claims, or to protect the rights, property, or safety of WaterFurnace, our users, or others, including to prevent physical harm or financial loss; (iii) in connection with an investigation of a complaint, security threat, or suspected or actual illegal activity, including to detect, prevent, and respond to fraud, abuse, security risks, and technical issues that may harm you, us, or others; (iv) as necessary to enforce the terms and conditions governing your use of our Symphony Services, including investigating potential violations thereof; or (v) in the event that WaterFurnace is subject to mergers, acquisitions, joint ventures, sales of assets, reorganizations, divestitures, dissolutions, bankruptcies, liquidations, or other types of business transactions. In these types of transactions, Personal Information may be shared, sold, or transferred, and it may be used subsequently by a third party.

• Personal Information Disclosed to Third Parties

We may disclose the following categories of Personal Information to third parties for business purposes:

Categories of Third Parties	Categories of Personal Information shared with Third Parties	Business purpose for Disclosure
Affiliated companies and subsidiaries; Business partners, which may include, for example, lenders, utilities, our resellers, contractors, energy consultants, and integration partners; Service Providers who provide professional or technical support functions; Users you authorize or who have authorized you to use a connected device or product through our application; Marketing partners, which may include, for example, entities that assist us with market research or advertising; and Professional Service Providers, such as an external auditor or law firm; Trusted Third Parties/Third Party Owners.	Personal Identifiers (e.g., name, address, email address, telephone, or mobile number)	To provide the Symphony Services; to fulfill contractual obligations; to process and respond to inquiries; to conduct marketing and market research; to comply with legal and regulatory requirements; and to support business operations
Affiliated companies and subsidiaries; Business partners, which may include, for example, our lenders, resellers, contractors, and integration partners; Service Providers who provide professional or technical support functions; Users you authorize or who have authorized you to use a connected device or product through our mobile applications; Marketing partners, which may include, for example, entities that assist us with market research or online advertising; and Professional Service Providers, such as an external auditor or law firm.	Personal Records (e.g., signature, contact details, user ID, or other similar information)	To provide the Symphony Services; to verify identity and manage user accounts; to fulfill contractual obligations; to conduct marketing and market research; to comply with legal and regulatory requirements; and to support business operations
Affiliated companies and subsidiaries; Business partners, which may include, for example, lenders, our resellers, contractors, and installation partners; and Service Providers who provide professional or technical support functions.	Commercial Information (e.g., credit or debit card number or other financial information, information about products or equipment purchased, or charges you incur, and other information related to your transactions)	To provide the Symphony Services; to process transactions and payments; to fulfill contractual obligations; and to support business operations
Business partners, which may include, for example, energy consultants, utilities, our resellers, contractors, and integration partners; and Service Providers who provide professional or technical support functions.	Geolocation Information (e.g., computer, mobile device, or other electronic device used to access Symphony Services or mobile application)	To provide the Symphony Services; to facilitate location-specific functionality; to gain insights on energy efficiency and benefits of the Symphony Services; and to support business operations
Business partners, which may include, for example, our resellers, contractors, and installation partners; Service Providers who provide professional or technical support functions; and Marketing partners, which may include, for example, entities that assist us with market research or online advertising.	Computer, Mobile Device, Platform Device or Hardware, Internet Usage Information (e.g., browsing time, cookie information, Internet Protocol (“IP”) address, or website history, etc.)	To monitor, analyze, and improve the Symphony Services; to detect and prevent fraud and security incidents; to conduct marketing and market research; to determine the effectiveness of promotional campaigns; and to support business operations
Business partners, which may include, for example, our resellers, lenders, contractors, and installation partners; Service Providers who provide professional or technical support functions; and Users you authorize or who have authorized you to use a connected device or product through our mobile application.	User Account Information (e.g., WaterFurnace account number, information you provide to us about authorized users of an account who may have access to a connected device or mobile application)	To provide the Symphony Services; to manage user accounts and authorized access to connected devices; to fulfill contractual obligations; and to support business operations
Business partners, which may include, for example, our resellers, contractors, and installation partners; and Marketing partners, which may include, for example, entities that assist us with market research or online advertising.	Inferences Drawn from Personal Information (e.g., profile reflecting a household or personal preferences, characteristics, trends, predispositions, and behavior)	To improve the Symphony Services; to conduct marketing and market research; to identify usage trends; and to develop and offer relevant products and services

What choices do you have about your Personal Information?

We offer certain choices about how we communicate with you and what Personal Information we obtain about you and share with others. How can you update your information and communication preferences?

• Profile

If you have created a profile or account on our Symphony Services, you can update your contact information after you log into your account.

• Email

You may unsubscribe from emails from us by clicking the Unsubscribe at the bottom of any promotional email from us. You may also contact us by email or postal address as noted below. Please include your current contact information, the information you are interested in accessing, and your requested changes.

• Do Not Track

Because currently there is not an industry or legal standard for recognizing or honoring Do Not Track (“DNT”) signals, we do not respond to them at this time. However, please note that we strive to recognize opt out preference signals where legally required to do so.

Do we transfer your Personal Information across geographies?

If you are in another country, we may transfer Personal Information across geographical borders in accordance with applicable law. We, our affiliates, business partners, and other third parties may be based locally or in other countries outside of your own, some of which have not been determined by the European Commission to have an adequate level of data protection. WaterFurnace is based in the United States, which has not been determined by the European Commission to have an adequate level of data protection.

Data controller and processing

WaterFurnace is the data controller for the data collected in connection with the use of Symphony Services outside of the United States. Personal Information and device information is processed in the United States.

How long do we retain your Personal Information?

We will keep your Personal Information for the period necessary to fulfill the purposes described in this Policy unless a longer retention period is permitted or required by law.

In specific circumstances, we may store your Personal Information for longer periods of time so that we have an accurate record of your dealings with us in the event of any complaints or challenges, or if we reasonably believe there is a prospect of litigation relating to your Personal Information or dealings.

Third party links

Occasionally, at our discretion, we may include or offer third party products or services on our Symphony Services. These third-party sites have separate and independent privacy policies. We therefore have no responsibility or liability for the content and activities of these linked sites. We urge you to read the privacy policies of other Symphony Services before submitting any information to those Symphony Services.

How do we protect your information?

WaterFurnace has implemented reasonable physical, technical, and administrative security standards intended to protect Personal Information from loss, misuse, alteration, or destruction. We strive to protect your Personal Information against unauthorized access, use or disclosure, using security technologies and procedures, such as encryption and limited access.

However, please note that no method of transmitting or storing Personal Information over the internet is completely secure and we cannot guarantee the absolute safety of your Personal Information.

Your California Privacy Rights

Pursuant to applicable California law, including the California Consumer Privacy Act as amended by the California Privacy Rights Act (collectively, the "CCPA"), WaterFurnace makes the following disclosures regarding the Personal Information we collect:

Our Collection and Disclosure

We have collected the Personal Information set forth above from the identified sources in the past twelve (12) months and have disclosed such information as set forth in the table provided.

Our Selling and Sharing Practices

We have not sold or shared (as the terms are defined by the CCPA) consumers' Personal Information in the twelve (12) months preceding the effective date of this Policy.

However, please note that certain information we collect may constitute "sensitive Personal Information" under the CCPA, including precise geolocation data. We do not use such information for purposes other than those set forth in Cal. Code Regs. tit. 11 §7027(m).

Your Rights as a California Resident

If you are a California resident, you have the following rights under the CCPA:

• Right to Know - the right to request the:

  1. Categories of Personal Information we have collected about you;

  2. Categories of sources from which your Personal Information is collected;

  3. Business or commercial purpose of collecting, selling, or sharing your Personal Information;

  4. Categories of third parties with whom we share your Personal Information; and

  5. Specific pieces of Personal Information we have collected about you.

• Right to Delete - the right to request deletion of Personal Information we have collected from you, subject to certain exceptions described below.

• Right to Correct - the right to request that we correct inaccurate Personal Information we maintain about you, taking into account the nature of the Personal Information and the purposes of processing.

• Right to Opt Out of Sale or Sharing - the right to opt out of the sale of your Personal Information to third parties, and the right to opt out of the sharing of your Personal Information with third parties for purposes of cross-context behavioral advertising. However, as we do not sell or share your Personal Information, we do not provide a method through which to exercise this right.

• Right to Non-Discrimination - the right not to receive discriminatory treatment for exercising any of your privacy rights. We will not discriminate against you for exercising your rights under the CCPA.

Exercise Your Rights

To submit a request or to exercise your right to correct inaccurate Personal Information, please:

Email us at: symphony@waterfurnace.com

Call us at: 1-800-436-7283

Visit our webform at: https://symphony.mywaterfurnace.com/account/

To verify your identity when you submit a request, we will match the identifying information you provide to the Personal Information we have on file. If you have an account with us, we will also verify your identity through our existing authentication practices for your account. Requests will typically be honored within forty-five (45) days of receipt, but may take up to ninety (90) days based on the results of verification.

Authorized Agents

You may designate an authorized agent to make requests on your behalf. You must provide an authorized agent written permission to submit a request on your behalf, and we may require that you verify your identity directly with us. Alternatively, an authorized agent that has been provided power of attorney pursuant to applicable law may submit a request on your behalf.

Exceptions to the Right to Delete

We will not be required to comply with your request to delete your Personal Information if it is necessary for us to maintain your Personal Information in order to:

• Complete the transaction for which the Personal Information was collected, provide a good or service requested by you, or reasonably anticipated within the context of our ongoing business relationship with you, or otherwise perform a contract between you and us;

• Detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity; or prosecute those responsible for that activity;

• Debug to identify and repair errors that impair existing intended functionality;

• Exercise free speech, ensure the right of another consumer to exercise his or her right of free speech, or exercise another right provided for by law;

• Comply with the California Electronic Communications Privacy Act pursuant to Chapter 3.6 (commencing with Section 1546) of Title 12 of Part 2 of the Penal Code;

• Engage in public or peer-reviewed scientific, historical, or statistical research in the public interest that adheres to all other applicable ethics and privacy laws, when our deletion of the information is likely to render impossible or seriously impair the achievement of such research, if you have provided informed consent;

• Enable solely internal uses that are reasonably aligned with your expectations based on your relationship with us;

• Comply with a legal obligation; or

• Otherwise use your Personal Information, internally, in a lawful manner that is compatible with the context in which you provided the information.

Shine the Light

If you are a California resident, you have the right to request information regarding the disclosure of Personal Information to third parties for their direct marketing purposes during the immediately preceding calendar year. You may make one such request each year by emailing us at symphony@waterfurnace.com or writing to us at:

WaterFurnace International, Inc.

Attn: Legal Dept

9000 Conservation Way

Fort Wayne, IN 46809

Your Nevada Privacy Rights

We do not currently sell your covered information as those terms are defined under applicable Nevada law. However, you may still submit an opt-out request and we will honor that request as required by Nevada law if we were to ever engage in such a sale in the future. If you are a Nevada resident and would like to opt-out of future sales of your covered information, please submit your request to symphony@waterfurnace.com, contacting us via the contact information posted above, or by calling us at 1-800-436-7283. Your request must include your full name, street address, city, state, zip code, and an email address so that we can contact you if needed regarding this request. You may also be required to take reasonable steps as we determine from time to time in order to verify your identity and/or the authenticity of the request. We will respond to your request within sixty (60) days either confirming that your request has been processed or indicating that we need an additional thirty (30) days to complete the request.

Do we collect information from children?

Our Symphony Services are not directed to children under the age of 18 years and we do not knowingly collect Personal Information from children under the age of 18 years on our Symphony Services. Children under the age of 18 years are prohibited from using our Symphony Services. If we discover that we have inadvertently collected information of a child, we will take prompt steps to delete such information.

Contacting Us

If there are any questions regarding this Policy, you may contact us using the information below.

WaterFurnace International, Inc.

9000 Conservation Way

Fort Wayne, IN 46809

symphony@waterfurnace.com

Changes to our Policy

We may make changes to this Policy, and may apply any material changes to information previously collected, as permitted by law. When we make material changes to this Policy, we will notify you by posting the updated Policy on our Symphony Services, and we will update the effective date at the bottom of this Policy. By continuing to use our Symphony Services after being notified of material changes to this Policy, you agree that the terms of this Policy as of the effective date will apply to information previously collected or collected in the future.

This Policy was last modified on 2026-07-01.