Privacy Policy

This Privacy Policy explains how Whitestance ("Whitestance," "we," "us," or "our") collects, uses, stores, and deletes information in connection with the Whitestance platform, a Cyber Risk & Insurance Posture Management (CRIPM) service (the "Service"). It is incorporated into our Terms of Service.

1. Information We Collect

• Account & organization data: Names, work email addresses, roles, and company profile information (legal name, website, industry).
• Assessment responses: Your answers about your security and AI-governance posture, including pointers to supporting data and any evidence you choose to upload.
• Billing data: Processed by Stripe. We receive subscription status and limited billing metadata (we do not receive or store full payment card numbers).
• Free-tool submissions: When you use one of our free tools (for example a free template, checklist, or scorecard), we collect the details you provide — such as your name, work email, company, role, and any posture context that tool asks for — so we can deliver your result and follow up with you directly. We do not add you to a marketing list or automated email sequence.
• Usage & technical data: Log data necessary to operate, secure, and improve the Service.

2. Sensitivity of Your Responses

Your assessment responses can reveal details about your organization's security posture, including potential weaknesses. We treat this information as highly sensitive. It is stored in an isolated database and is not included in application logs or exposed in URLs.

3. How We Use Your Information

We use your information to provide the Service, including calculating readiness scores, delivering guidance, enabling year-over-year tracking, processing billing, and sending service-related communications. We do not sell your personal or organizational data.

4. Aggregate & De-Identified Data

We may create aggregate or de-identified data (that cannot reasonably be used to identify you or your organization) for analytics, to improve the Service, and to enhance our content. We use identifiable Customer Data only to provide and support the Service for you.

5. How We Store and Protect Your Information

Customer Data is stored in an isolated database with strict access controls and encryption in transit and at rest. While we use reasonable industry-standard protections, no method of storage or transmission is completely secure. We cannot guarantee absolute security.

6. Data Retention & Deletion

While you maintain an active subscription, you have ongoing access to your data in the portal. Upon expiration, cancellation, or termination of your subscription (each, a "subscription end"):

• Grace period & export — For fifteen (15) days after subscription end, you retain full portal access to review and download (PDF) your data.
• Access lock (data retained) — After the grace period, your portal access is locked and your assessment data is no longer viewable in the portal. However, the data remains stored on your account (not deleted) so that renewing your subscription immediately restores full access and history. While locked, the portal will display the date on which your data will be permanently deleted if you do not renew.
• Permanent deletion — If you do not renew, your organization's data is permanently deleted from our active systems approximately six (6) months after subscription end. Renewing before that date restores everything.
• Deletion on request — You may request earlier permanent deletion of your data at any time by contacting us. We will process verified deletion requests promptly.

7. Sharing & Third-Party Processors

We share data only with trusted service providers who process it on our behalf to operate the Service, such as:

• Stripe (payments)
• Resend (email delivery)
• Cloud hosting providers
• AI providers (where used for generating explanations)

These providers are contractually required to use the data only for the services they provide to us. We may also disclose information if required by law, court order, or government request.

8. Your Rights & Choices

You can access, export, and manage much of your data directly in the portal, update your company profile, and request deletion. Depending on your location, you may have additional rights (for example, under GDPR, CCPA/CPRA, or other privacy laws) to access, correct, delete, or restrict processing of your personal data. To exercise these rights, contact us at the email below.

9. Security Disclaimer

We take reasonable measures to protect your information, but no security program is infallible. You are responsible for maintaining the security of your account credentials and for the accuracy of the information you submit.

10. Not Directed to Consumers or Children

The Service is intended for businesses and organizations and their authorized personnel. It is not directed to individual consumers or children under 18, and we do not knowingly collect data from children.

11. International Data Transfers

The Service is offered primarily to customers in the United States, and our core data processing and storage occurs within the United States. If you access the Service from outside the United States, you understand and consent to the transfer, storage, and processing of your information (including personal data) in the United States, where data protection standards may differ from those in your country.

We do not actively target or market the Service to individuals or organizations outside the United States. However, if you are located in the European Economic Area, United Kingdom, Canada, or another jurisdiction with specific data transfer requirements, additional safeguards or rights may apply. Please contact us if you have questions about international data transfers.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will provide reasonable notice of material changes. The "Last Updated" date below reflects the current version.

Last Updated: July 8, 2026

13. Contact

Whitestance — an Equity Solutions Network company
[email protected]