Privacy Policy

• Platform Operations: To operate, maintain, and improve the functionality, performance, and reliability of the Platform, including our compliance engines, calculators, and data visualization tools.
• Communication: To respond to inquiries submitted through our contact forms, provide requested information about our services, and send transactional communications related to your interactions with our Platform.
• Analytics and Research: To analyze aggregate usage patterns, understand how visitors interact with different sections of the Platform, and conduct internal research to improve our services. All analytics data is anonymized and aggregated.
• Security and Fraud Prevention: To detect, prevent, and respond to security incidents, unauthorized access attempts, and potentially fraudulent or malicious activity.
• Legal Compliance: To comply with applicable laws, regulations, legal processes, and enforceable governmental requests.
• Service Improvement: To identify technical issues, debug problems, and develop new features or improvements based on aggregate usage data.

• Consent: Where you have given clear, affirmative consent for us to process your personal data for specific purposes, such as when you accept cookies or submit a contact form. You may withdraw consent at any time.
• Legitimate Interests: Where processing is necessary for our legitimate interests (such as improving Platform functionality, ensuring security, and conducting analytics), provided those interests are not overridden by your data protection rights.
• Legal Obligation: Where processing is necessary to comply with a legal obligation to which we are subject.
• Contractual Necessity: Where processing is necessary for the performance of a contract with you or to take steps at your request before entering into a contract.

• Service Providers: We engage a limited number of trusted third-party service providers who perform services on our behalf, such as website hosting, email delivery, and analytics. These providers are contractually obligated to use your information only for the specific services they provide to us and are required to maintain the confidentiality and security of your data.
• Legal Requirements: We may disclose your information if required to do so by law, regulation, legal process, or enforceable governmental request, or if we believe in good faith that disclosure is necessary to protect our rights, your safety, or the safety of others, investigate fraud, or respond to a government request.
• Business Transfers: In the event of a merger, acquisition, reorganization, bankruptcy, or sale of all or a portion of our assets, your personal data may be transferred as part of that transaction. We will provide notice before your personal data is transferred and becomes subject to a different privacy policy.
• With Your Consent: We may share your information for other purposes with your explicit, informed consent.

• Encryption: All data transmitted between your browser and our servers is encrypted using TLS 1.2 or higher (HTTPS). Data at rest is encrypted using AES-256 encryption standards.
• Access Controls: Access to personal data is restricted to authorized personnel on a need-to-know basis, with multi-factor authentication and role-based access controls.
• Infrastructure Security: Our Platform is hosted on cloud infrastructure whose provider maintains SOC 2 Type II attestation, automated threat detection, and continuous security monitoring.
• Regular Assessments: We conduct regular security assessments, vulnerability scans, and code reviews to identify and address potential security risks.
• Incident Response: We maintain a documented incident response plan and will notify affected users and relevant authorities of any data breach in accordance with applicable law.

• Contact Form Submissions: Retained for up to 24 months from the date of submission, after which they are permanently deleted unless an ongoing business relationship exists.
• Analytics Data: Anonymized analytics data is retained for up to 26 months, consistent with standard analytics retention periods.
• Server Logs: Technical server logs are retained for up to 90 days for security and debugging purposes, then permanently deleted.
• Cookie Data: Cookie lifetimes vary by category. See Section 5 for details. You can clear cookies at any time through your browser settings.

• Right to Know: You have the right to request that we disclose the categories and specific pieces of personal information we have collected about you, the categories of sources from which the information was collected, the business or commercial purpose for collecting the information, and the categories of third parties with whom we share the information.
• Right to Delete: You have the right to request the deletion of your personal information that we have collected, subject to certain exceptions provided by law.
• Right to Correct: You have the right to request that we correct inaccurate personal information that we maintain about you.
• Right to Opt-Out of Sale or Sharing: We do not sell or share your personal information for cross-context behavioral advertising. As such, there is no need to opt out, but we respect this right fully.
• Right to Non-Discrimination: We will not discriminate against you for exercising any of your CCPA/CPRA rights. We will not deny you services, charge you different prices, or provide a different level of quality based on your exercise of privacy rights.

Categories of Personal Information Collected in the Past 12 Months: Identifiers (name, email address, IP address), Internet or other electronic network activity information (browsing history, interaction data), and professional or employment-related information (company name, industry, role). We have not sold any personal information in the past 12 months.

• Data Protection Officer: For GDPR-related inquiries, you may contact our designated privacy contact at privacy@centsless.org.
• Supervisory Authority: You have the right to lodge a complaint with your local data protection supervisory authority if you believe that our processing of your personal data violates applicable data protection law.
• Consent Withdrawal: Where we process your data based on consent, you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out prior to withdrawal.
• Automated Decision-Making: We do not engage in automated decision-making or profiling that produces legal effects or similarly significantly affects you.