Privacy Policy

Sinquery LLC DBA VylintShield (“VylintShield,” “we,” “us,” or “our”) is committed to protecting your privacy. This Privacy Policy explains how we collect, use, share, and protect information when you use our compliance documentation and audit-readiness platform and related services (the “Service”).

This Policy is designed to comply with the EU General Data Protection Regulation (GDPR) and the California Consumer Privacy Act / California Privacy Rights Act (CCPA/CPRA), as applicable.

1.1 Account Information

When you register, we collect:

• Full name
• Business email address
• Company name and size
• Job title / role
• Password (stored in hashed form)
• Billing address and payment method details (processed by Stripe, our third-party payment processor; VylintShield does not store raw card numbers)

1.2 Compliance and Configuration Data

To provide the Service, we process data you upload or create, which may include:

• Policies, procedures, and internal documents you generate or upload
• Evidence artifacts (screenshots, files, documents) you attach
• Assessment responses and gap analysis inputs

This data is yours. We process it only to deliver the Service.

1.3 Usage and Telemetry Data

We automatically collect information about how you use the Service:

• Pages visited, features accessed, and time spent
• Browser type, operating system, and IP address
• Clickstream and interaction data (e.g., button clicks, navigation paths)
• Error logs and crash reports

This data helps us improve the Service and diagnose issues.

1.4 Communications

If you contact us for support or otherwise communicate with us, we retain those communications and any information you provide.

1.5 Cookies and Similar Technologies

We use cookies, web beacons, and similar tracking technologies for:

• Authentication and session management (strictly necessary)
• Analytics and usage measurement (functional/analytics)
• Marketing and advertising attribution (described below)

Marketing and advertising attribution. On your first visit we set a first-party cookie named vs_attr. It records the campaign parameters in the link you arrived on (utm_source, utm_medium, utm_campaign, utm_content, utm_term), the page you landed on, the referring site, and the time of that visit. The cookie is httpOnly — no script running in your browser, ours or anyone else’s, can read it — and its contents are not shared with any third party. It expires 90 days after your first visit and is not refreshed. If you create an account, that first-visit record is stored with your account so we can measure which marketing channels bring us customers. We do not set this cookie for visitors in the European Economic Area, the United Kingdom or Switzerland, or for anyone who has opted out of analytics.

You can control cookies, including this one, through your browser settings. To object to this processing or to ask us to erase the attribution data held on your account, contact privacy@vylintshield.com; see Section 6 for the rights available to you.

1.6 AI Assistant Conversations

The Service includes an AI compliance assistant in the customer portal. When you use it, we retain your messages and the assistant’s replies, and we send the following to the AI provider named in Section 3 so that a reply can be generated: your organization name, the frameworks you have active, a summary of your assessments (name, framework, and percentage complete), a list of your document titles with their framework and status, and the recent messages in that conversation. We do not send the contents of the documents or evidence files you upload — only their titles. If you ask the assistant to escalate to a person, your email address, your organization identifier and the text of your request are also sent to the notification provider named in Section 3. Please do not enter information in the assistant that you would not want processed by those providers.

We use collected information to:

We do not sell your personal data to third parties.

We share data with third-party service providers who assist in operating the Service. Each handles data only for the purpose described in the table below. Every provider listed except Telegram is engaged under a data processing agreement or the provider’s published data processing terms. Telegram is used only as a notification channel to our own staff and is not engaged under a data processing agreement with us, which is why what we send it is limited to the fields named in its row:

We may update this list as our service providers change. Significant changes will be reflected here within 30 days.

We retain personal data for as long as necessary to fulfill the purposes described in this Policy:

• Account data: Retained for the duration of your subscription plus 3 years, unless you request deletion sooner.
• Compliance and configuration data: Retained for the duration of your subscription. Upon termination, deleted within 30 days at your request.
• Usage/telemetry data: Retained in identifiable form for up to 24 months, then aggregated/anonymized.
• Billing records: Retained for 7 years to comply with financial recordkeeping requirements.
• Communications: Retained for up to 3 years from the last interaction.

After applicable retention periods, data is securely deleted or irreversibly anonymized.

Sinquery LLC DBA VylintShield is established in the United States, and all of our processing takes place in the United States. If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, your data may be transferred to and processed in the US.

For such transfers, we rely on:

• Standard Contractual Clauses (SCCs) as approved by the European Commission
• UK International Data Transfer Agreements (IDTAs) where applicable

We also maintain a Data Processing Addendum (DPA) available for enterprise customers upon request at privacy@vylintshield.com.

Depending on your location, you may have the following rights:

For All Users

• Access: Request a copy of personal data we hold about you.
• Correction: Request correction of inaccurate or incomplete data.
• Deletion: Request deletion of your personal data (“right to be forgotten”), subject to legal retention requirements.
• Portability: Receive your personal data in a structured, machine-readable format.
• Opt-out of marketing: Unsubscribe from marketing emails at any time via the unsubscribe link or by contacting us.

EU/UK Residents (GDPR/UK GDPR)

In addition to the above, you have the right to:

• Restrict processing: Ask us to limit how we use your data.
• Object to processing: Object to processing based on legitimate interest or for direct marketing.
• Withdraw consent: Where we rely on consent, withdraw it at any time (this does not affect prior processing).
• Lodge a complaint: With your local data protection authority (e.g., the ICO in the UK, or your EU supervisory authority).

California Residents (CCPA/CPRA)

You have the right to:

• Know what personal information we collect, use, disclose, or sell
• Delete personal information we hold about you (with exceptions)
• Correct inaccurate personal information
• Opt out of the “sale” or “sharing” of personal information (VylintShield does not sell personal information)
• Non-discrimination for exercising your privacy rights

To submit a privacy request, contact us at privacy@vylintshield.com with subject line “Privacy Request — [your name/company].” We will respond within 30 days (GDPR) or 45 days (CCPA/CPRA).

We may need to verify your identity before processing requests.

We implement industry-standard security measures to protect your data, including:

• Encryption of data in transit (TLS 1.2+) and at rest
• Role-based access controls and least-privilege principles
• Incident response procedures with breach notification within 72 hours as required by applicable law

No method of transmission over the internet is 100% secure. If you believe your account has been compromised, contact security@vylintshield.com immediately.

The Service is intended for business use only and is not directed at individuals under 18 years of age. We do not knowingly collect personal data from minors. If we become aware of such collection, we will delete the data promptly.

We may update this Privacy Policy from time to time. Material changes will be communicated by:

• Email notification to your registered address
• In-app notification at least 30 days before changes take effect

Continued use of the Service after the effective date constitutes acceptance of the updated Policy.

For privacy questions, requests, or concerns:

Privacy Officer
Sinquery LLC DBA VylintShield
1309 Coffeen Ave, Sheridan, WY 82801
Email: privacy@vylintshield.com
Subject line: “Privacy Request — [your name/company]”

If you are in the EU or the UK, send any request under Section 6 directly to the Privacy Officer above. You do not need to route it through anyone else.