Privacy Policy

This Privacy Policy explains how Equity Solutions Network ("ESN," "we," "us") collects, uses, stores, and deletes information in connection with Whitestance, a Cyber Risk & Insurance Posture Management (CRIPM) platform (the "Service"). It is incorporated into our Terms of Service.

1. Information we collect

• Account & organization data: names, work email addresses, roles, and company profile (legal name, website, industry).
• Assessment responses: your answers about your security and AI-governance posture, including where you indicate the location of supporting data ("pointers") and any evidence you choose to provide.
• Billing data: processed by Stripe; we receive subscription status and limited billing metadata, not full card numbers.
• Usage & technical data: log data needed to operate and secure the Service.

2. Sensitivity of your responses

Your assessment responses can describe your organization's security weaknesses. We treat this as highly sensitive information, store it in an isolated database, and do not include your answers or network-location pointers in application logs or in URLs.

3. How we use your information

We use your information to provide the Service — including computing your readiness scores, routing gaps to guidance and modules, enabling year-over-year persistence, and supporting billing and communications. We do not sell your data.

4. Aggregate & de-identified data

We may create aggregate or de-identified data (which cannot reasonably be used to identify you) to improve the Service and our content. We use identifiable Customer Data only to provide the Service to you. [Consent mechanics and any opt-out to be confirmed by counsel.]

5. How we store and protect your information

Customer Data is held in an isolated database with access controls and encryption in transit and at rest. No method of storage or transmission is completely secure, and we cannot guarantee absolute security.

6. Data retention & deletion

Your active subscription entitles you to ongoing access to your data in the portal. Upon the expiration, cancellation, or termination of your subscription (each, a "subscription end"):

• Grace period & export: for fifteen (15) days after your subscription end you keep full portal access to review and download (PDF) your data.
• Access lock (data retained): after the grace period your portal access is locked and your assessment data is no longer displayed in the portal, but it is retained on your account — not deleted — so that renewing your subscription restores your access and full history. While locked, the portal shows you the date on which your data will be permanently deleted if you do not renew.
• Permanent deletion (backstop): if you do not renew, your organization's data is permanently deleted from our active systems approximately six (6) months after your subscription end. Renewing before that date restores everything. [Counsel to confirm the retention window (default 6 months) and any data ESN is legally required to keep or delete sooner.]
• Deletion on request: you may also request earlier permanent deletion of your data at any time by contacting us, and we will remove it following a verified request.

[Counsel to confirm this grace → locked-but-retained → 6-month-backstop-deletion model against data-minimization expectations for sensitive security data, treatment of routine backups, and any statutory retention/deletion obligations.]

7. Sharing & third-party processors

We share data only with service providers who process it on our behalf to run the Service — for example Stripe (payments), Resend (email delivery), our cloud host, and, where applicable, an AI provider used to generate explanations. These providers are bound to use the data only to provide their services. We may disclose information if required by law.

8. Your rights & choices

You may access and export your data in the portal, update your company profile, and request deletion. Depending on your location, you may have additional rights (for example, under GDPR or CCPA/CPRA) to access, correct, delete, or restrict processing of your personal data. [Region-specific rights, verification, and response timelines to be finalized by counsel.]

9. Security disclaimer

While we take reasonable measures to protect your information, no security program is perfect. You are responsible for keeping your account access secure and for the accuracy of what you submit.

10. Not directed to consumers/children

The Service is intended for organizations and their authorized personnel, not for individual consumers or children, and we do not knowingly collect data from children.

11. International data transfers

[If data is processed outside the customer's country, transfer mechanisms to be addressed by counsel.]

12. Changes to this policy

We may update this Privacy Policy and will provide reasonable notice of material changes; the "last updated" note below reflects the current version.

13. Contact

Equity Solutions Network — [email protected]

Last updated: draft (not yet effective).