Privacy Policy

Information We Collect

Information You Provide Directly

• Waitlist registration: first name, last name, email address, company name
• Account creation: username, password (hashed), billing information
• Communications: messages, support requests, survey responses
• SMS/text opt-in: mobile phone number when you consent to receive text messages

Information Collected Automatically

• Usage data: pages visited, features used, session duration, click patterns
• Device data: browser type, operating system, IP address, device identifiers
• Log data: server logs, error reports, timestamps
• Cookie data: see Section 6 for full details

Information From Third Parties

• Analytics providers (aggregated behavioral data)
• Integration partners when you connect third-party services

How We Use Your Information

We use your personal information to:

• Manage your waitlist position and send waitlist status updates
• Provision, operate, and improve the C-Suite Platform
• Authenticate your identity and maintain account security
• Send transactional communications (account notices, billing receipts)
• Send marketing communications where you have consented
• Send SMS/text messages where you have explicitly opted in (see Section 3)
• Analyze usage patterns to improve platform features
• Comply with legal obligations
• Prevent fraud, abuse, and security incidents

Legal Bases for Processing (GDPR)

• Contract performance: to provide services you have requested
• Legitimate interests: platform security, fraud prevention, service improvement
• Consent: marketing emails, SMS communications, optional analytics
• Legal obligation: tax records, regulatory compliance

SMS & Electronic Communications

SMS Opt-In

By providing your mobile phone number and checking the SMS consent box on our waitlist or signup form, you expressly consent to receive text messages from Clean Core, LLC / C-Suite at the number provided. These messages may include:

• Waitlist status and access notifications
• Platform updates and feature announcements
• Account alerts and security notifications
• Promotional messages (where separately consented)

Message Frequency

Message frequency varies based on your activity and preferences. We may send up to 10 messages per month.

Message & Data Rates

Standard message and data rates from your carrier may apply. C-Suite does not charge for SMS messages, but your carrier's standard rates apply.

Opt-Out Instructions

You may opt out of SMS communications at any time by replying STOP to any message. After opting out, you will receive one final confirmation message. To opt back in, text START to the same number. You may also opt out by contacting us at privacy@core-industries.com.

Help

Text HELP to any SMS message to receive support information, or email us at privacy@core-industries.com.

No Sharing of SMS Opt-In Data

Your SMS opt-in consent and mobile phone number will not be shared with, sold to, or used by any third party for their own marketing purposes. Phone numbers collected for SMS are used solely to send you messages from C-Suite.

Email Communications

You may unsubscribe from marketing emails at any time by clicking the "Unsubscribe" link in any email or by contacting us. Transactional emails (receipts, security alerts) cannot be opted out of while your account is active.

AI Processing

C-Suite is an AI-powered platform. When you use the Platform:

• Your inputs, queries, and interactions are processed by AI models to generate executive advice and responses
• Conversation context may be retained to provide coherent, contextually relevant AI responses
• We may use de-identified, aggregated interaction data to improve AI model performance
• We do not use your personal data to train foundational AI models without your explicit consent

AI Decisions

AI-generated advice and recommendations on the Platform are informational only and do not constitute professional legal, financial, medical, or other regulated advice. We do not make automated decisions with legal or similarly significant effects without human review.

Third-Party Integrations

HubSpot

We use HubSpot CRM to manage waitlist registrations and communications. When you submit our waitlist form, your name, email address, and company name are transmitted to and stored in HubSpot. HubSpot may use cookies to identify returning visitors. HubSpot's privacy policy is available at legal.hubspot.com/privacy-policy.

We use HubSpot as a data processor on our behalf, under a data processing agreement that requires HubSpot to handle your data securely and in accordance with applicable law.

Google Analytics 4 (GA4)

We use Google Analytics 4, provided by Google LLC, to understand how visitors interact with our website. GA4 collects data such as pages visited, session duration, approximate geographic location (city/country level derived from IP address), device type, browser, and referral source. GA4 uses first-party cookies (_ga, _ga_*) to distinguish unique users. Google may process this data on servers in the United States. We have enabled IP anonymization. Google's privacy policy is available at policies.google.com/privacy. You may opt out via the Google Analytics Opt-out Browser Add-on.

Google Tag Manager (GTM)

We use Google Tag Manager to manage tracking scripts and marketing tags on our website. GTM itself does not collect personal data or set cookies — it is a tag management system that deploys other tools (such as Google Analytics and HubSpot tracking). Tags managed through GTM are governed by their respective privacy policies as described in this section. Google's privacy policy applies to the GTM service at policies.google.com/privacy.

Other Third-Party Services

We may use additional service providers for:

• Payment processing (Stripe) — we do not store full payment card numbers
• Infrastructure hosting (cloud providers)
• SMS delivery (A2P-registered messaging providers)

These providers are contractually bound to use your data only to provide services to us.

Cookies & Tracking Technologies

We use cookies and similar technologies to operate the Platform. Here is what we use:

• hubspotutk — HubSpot unique visitor token. Tracks returning visitors for form pre-fill and analytics. Duration: 13 months. Category: functional/analytics.
• __hssrc — HubSpot session cookie. Determines if a user has started a new session. Session duration. Category: functional.
• __hssc — HubSpot session tracker. Tracks sessions for analytics. 30 minutes. Category: analytics.
• _ga — Google Analytics 4. Distinguishes unique users. Duration: 2 years. Category: analytics.
• _ga_<container-id> — Google Analytics 4. Persists session state. Duration: 2 years. Category: analytics.
• _gid — Google Analytics. Distinguishes users within a 24-hour window. Duration: 24 hours. Category: analytics.
• _gat — Google Analytics. Throttles request rate. Duration: 1 minute. Category: performance.
• Session cookies — Essential for authenticated sessions. Session duration. Category: strictly necessary.

Managing Cookies

You can control cookies through your browser settings. Disabling strictly necessary cookies may impair Platform functionality. For analytics cookies, you may also opt out via Google Analytics Opt-out.

We do not currently respond to Do Not Track (DNT) signals, but we honor Global Privacy Control (GPC) signals for California residents.

Data Sharing & Sale

We may share your information in the following limited circumstances:

• Service providers: vendors who help us operate the Platform (see Section 5), bound by data processing agreements
• Legal compliance: when required by law, subpoena, or valid government request
• Safety: to protect the rights, property, or safety of our users or the public
• Business transfer: in connection with a merger, acquisition, or sale of assets, with notice to you
• With your consent: any other sharing requires your explicit permission

Data Retention

We retain your personal information for as long as needed to provide the Platform and fulfill the purposes in this Policy:

• Waitlist data: until you request deletion or 2 years after your waitlist signup, whichever comes first
• Account data: for the life of your account plus 3 years after closure
• Transaction records: 7 years (tax and accounting requirements)
• Conversation/AI interaction logs: 90 days, then de-identified or deleted
• Marketing consent records: retained for 5 years as evidence of consent (TCPA requirement)

Your Rights & Choices

All Users

• Opt out of marketing emails (unsubscribe link or email request)
• Opt out of SMS by texting STOP
• Request deletion of your waitlist/account data
• Request correction of inaccurate information

California Residents (CCPA/CPRA)

You have the right to:

• Know what personal information we collect, use, share, or sell
• Delete your personal information (subject to exceptions)
• Correct inaccurate personal information
• Opt-out of sale or sharing (we do not sell or share for cross-context advertising)
• Limit use of sensitive personal information
• Non-discrimination for exercising your rights

To exercise these rights, email privacy@core-industries.com with "California Privacy Request" in the subject line. We will respond within 45 days.

EEA/UK Residents (GDPR/UK GDPR)

You have the right to access, rectification, erasure, restriction, portability, and to object to processing. You may also lodge a complaint with your local supervisory authority. Contact us at privacy@core-industries.com.

Colorado Residents (CPA)

Colorado residents have the right to opt out of targeted advertising, right to access, correction, deletion, and portability. Contact privacy@core-industries.com.

Children's Privacy

The Platform is intended for users 18 years of age and older. We do not knowingly collect personal information from children under 13. If we learn we have collected information from a child under 13, we will promptly delete it. If you believe a child has provided us their information, please contact privacy@core-industries.com.

Security

We implement industry-standard technical and organizational measures to protect your personal information, including:

• Encryption in transit (TLS 1.2+) and at rest
• Access controls and authentication requirements
• Regular security assessments
• Vendor security review processes

No method of transmission over the internet is 100% secure. We will notify you of any breach affecting your personal data as required by applicable law.

International Data Transfers

C-Suite is operated from the United States. If you access the Platform from outside the US, your data will be transferred to and processed in the United States. For EEA/UK users, such transfers occur pursuant to Standard Contractual Clauses or other approved transfer mechanisms. By using the Platform, you acknowledge this transfer.

Changes to This Policy

We may update this Privacy Policy periodically. When we make material changes, we will:

• Update the "Effective Date" at the top of this page
• Send an email notification to registered users
• Display a notice on the Platform

Continued use of the Platform after changes take effect constitutes acceptance of the updated Policy.