Privacy Policy

1. Information We Collect

We do not intentionally collect sensitive personal data (health, biometrics, precise location). Any such data provided inadvertently is treated as confidential and erased when no longer required.

2. How We Use Information

• Service delivery, configure SaaS platforms, build automations, provide support
• Contract administration, create proposals, process invoices, collect payments
• Account security, protect your credentials and our infrastructure
• Legal & compliance, keep records, detect fraud, satisfy regulatory duties

We do not train AI models on client data, send cold‑marketing blasts, or engage in automated decision‑making that produces legal or similarly significant effects.

3. Legal Grounds

Because we operate only in the United States, we rely on:

• Contract necessity, we need the data to perform the Services you request
• Consent, where you explicitly authorise an action, such as storing an API key
• Legitimate interests, for security, quality assurance, and improving our offerings, balanced against your privacy rights

4. Sharing & Disclosure

We disclose personal information solely to:

1. Service providers, cloud hosting, email relay, secure secrets vault, payment processor
2. Professional advisers & security firms, under strict confidentiality
3. Legal authorities, when required by law or to protect rights, safety, or property

We do not "sell" or "share" personal information for cross‑context behavioural advertising as defined by the California Privacy Rights Act (CPRA).

No data leaves the United States. If future business needs require international transfer, we will update this policy and implement lawful transfer mechanisms.

5. Retention

We retain each data category while you remain an active client and for up to 12 months after the last paid invoice or last service access, unless a longer period is required by tax, accounting, or legal obligations. Encrypted backups roll off within 90 days of scheduled purge.

6. Your Privacy Rights

Under CPRA and other state laws, you may:

• Access and receive a copy of personal information we hold
• Correct inaccurate information
• Delete information (with limited exceptions)
• Receive a portable copy
• Limit use of sensitive personal information

Maryland residents will obtain identical rights under the Maryland Online Data Privacy Act (MODPA) effective October 1 2025. To exercise any right, email privacy@owntheclimb.com or call 443‑265‑2667. We will verify your identity (for example, using two‑factor authentication) and respond within 30 days.

7. Security

We protect data using industry‑standard encryption in transit and at rest, role‑based access controls, network firewalls, and continuous monitoring. Independent penetration testing is conducted annually. We maintain an incident‑response plan that enables notification within 72 hours where required.

8. Cookies & Tracking Technologies

Own The Climb currently does not deploy non‑essential cookies, ad pixels, or session‑recording scripts. Should we introduce them, we will provide a banner that supports granular consent and, for California residents, a "Do Not Sell/Share" link.

9. Children

Our Services are intended for adults aged 18 and older. We do not knowingly collect information from children. If we learn that we have collected personal data from a minor, we will delete it promptly.

10. Changes to This Policy

We may update this notice from time to time. Material changes will be posted here with a new "Effective" date and, where legally required, we will seek your consent.

11. Contact Us