Oathmark Privacy Policy

1. Scope and Important Context

Oathmark evaluates a client firm’s AI-tool use and related governance information and may provide an AI Governance Audit report, an insurance-ready exhibit, and starting-point governance policy templates. We process information to operate this paid engagement, communicate with Client, and provide the requested Deliverables.

The Service is not designed for consumers or children. It is not intended to be used as a general-purpose storage repository for highly sensitive personal data. Client should provide only information necessary for the engagement and should redact information it is not authorized to disclose. Client remains responsible for ensuring it has a lawful basis, notice, and any consent or authorization necessary to provide information about its personnel, clients, customers, or other third parties to Oathmark.

2. Information We Collect

We collect information from Client, from Client’s use of the Service, from payment transactions, and from ordinary technical operations. The categories may include the following.

2.1 Contact and identity information

We collect the name, work email address, work telephone number, job role or relationship to Client where provided, firm name, and other contact information supplied through checkout, intake, portal messages, or communications with us.

2.2 Firm and business information

We collect information about Client’s firm, such as firm type, size, AI tools in use, existing AI, privacy, security, or governance policies, relevant compliance frameworks or standards identified by Client, and other operational details Client provides in intake forms or uploaded materials.

2.3 Freeform intake and incident-narrative information

The intake process permits Client to provide free-text descriptions of AI-tool use, existing policies, insurance information, underwriting-readiness answers, and notes. Client may also choose to describe past AI-related security incidents, data breaches, confidentiality concerns, or similar events. These narratives can be sensitive and may incidentally reference personal information or confidential information about Client’s own personnel, customers, clients, or other third parties—for example, an incident might describe an employee entering an end-client’s personal information into a public AI tool. We do not request that Client include unnecessary personal information in these narratives, and Client should redact or minimize it where feasible.

2.4 Uploaded files and engagement materials

We collect documents, reports, policy materials, and other files that Client uploads or provides in connection with the engagement. Completed reports and related Deliverables may be stored for Client to download through private, time-limited signed URLs.

2.5 Payment and billing information

Payments are processed by Stripe Checkout. We may receive transaction-related information, such as the purchase, amount, payment status, billing contact details, Stripe checkout-session identifier, and limited payment-method metadata made available by Stripe. We do not receive or store raw payment-card numbers, CVV codes, or full card credentials.

2.6 Portal communications

We collect messages that Client sends through the engagement portal and related administrative correspondence, including message content, sender information, timestamps, and delivery or notification information. We may send email notifications about portal activity and engagement status.

2.7 Technical and log information

When you use the website or portal, our servers and service providers may automatically record standard technical information, such as IP address, browser type, device information, referring URL, pages or resources requested, date and time, error information, and security-related events. We use this information for service delivery, troubleshooting, abuse prevention, security, and operational administration.

2.8 Information from our service providers

We may receive information from our vendors in connection with a transaction or use of the Service, such as payment confirmation from Stripe, email delivery status from Resend, hosting or security logs from Vercel, and storage or database records from Supabase.

2.9 Google Account (Gmail) information — optional AI-tool scan

The Service includes an optional step within our free AI Governance Check quiz that lets a visitor connect their own Gmail account so we can check, on their behalf, whether their inbox shows signs of using common AI tools (for example, automated emails from ChatGPT, Claude, Microsoft Copilot, Grammarly, or similar providers). This step is entirely optional; the quiz can be completed without it.

If you choose to use this feature, you will be directed to Google's own sign-in and consent screen, where Google will ask you to authorize Oathmark to access your Gmail account under the read-only gmail.readonly scope. If you grant access:

• We use your temporary access token to run a small number of targeted searches against your inbox (for example, from:(openai.com OR chatgpt.com)), limited to a short list of known AI-tool sender domains.
• For a small number of matching messages, we request only the From, Subject, and Date headers using Gmail's metadata-only response format. We do not request, read, or store the body, attachments, or content of any email, even though the granted scope would technically permit fuller access.
• The header information retrieved from Gmail is used only to render your scan result in your own browser during that session and is not transmitted to or stored on our servers.
• If you choose to save your quiz result, only the names of the AI tools detected (for example, "ChatGPT" or "Grammarly") are saved to our database — not any email header, sender address, subject line, or message content.
• Your Google access token is held in a temporary, session-scoped browser cookie for the duration of the scan and is not retained as a long-lived or refresh token. You can end the connection at any time using the disconnect option in the quiz, or directly through your Google Account permissions page.

Google API Services User Data Policy. Oathmark's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Gmail data obtained through this feature for advertising, do not sell or transfer it to third parties, and do not use it to train generalized AI or machine-learning models. Humans do not read your Gmail data except where necessary for security, legal compliance, or with your consent.

2.10 Continuous Monitoring information — Governance Subscription only

Clients on the Governance Subscription package may enable Oathmark's optional Continuous Monitoring feature, which consists of a browser extension Client installs on personnel devices and a related AI-policy training tracker in the portal. If Client enables this feature, we collect the following, tied to Client's engagement rather than to any individual's account with us:

• Device information. A device label chosen by Client (for example, “Jane’s laptop”), the extension version installed, and timestamps for when the device was first and most recently seen.
• Detection events. When the extension detects that a monitored device has navigated to the web address of a known AI tool, it reports the tool name, the matched domain, the device label, and the date and time of that visit. The extension does not read page content, form data, keystrokes, or credentials, and does not report browsing activity outside a fixed list of known AI-tool web addresses.
• AI-policy training records. Client may separately enter, for its own personnel, an employee name, optional work email address, the name of the training or acknowledgment involved, and its completion status and date. This is personal information about Client's employees, provided and controlled by Client, not by Oathmark.

This information is stored under Client's engagement and is visible only to Client's authorized portal users and to Oathmark as Client's service provider for purposes of operating the feature. Oathmark provides Client a starting-point Employee AI-Monitoring Notice template describing this feature in plain terms; consistent with Section 12 below and Section 4.2 of our Terms of Use, Client — not Oathmark — is responsible for providing appropriate notice to, and obtaining any consent required from, the personnel whose devices or training records are involved, including under any applicable workplace-monitoring or employee-privacy law.

3. How We Use Information

We use the information described above to:

• process payments, confirm purchases, administer annual renewals, and maintain transaction records;
• create and administer Client’s engagement, including the private portal link associated with the relevant Stripe checkout session;
• request, receive, organize, review, and assess Client’s intake responses, uploads, and communications;
• prepare, deliver, and support the AI Governance Audit report, insurance-ready exhibit, and policy-template starting points;
• if Client enables Continuous Monitoring, operate the browser-extension detection feature and AI-policy training tracker described in Section 2.10, and provide the related Employee AI-Monitoring Notice template;
• if you opt into the Gmail scan feature, detect which AI tools you already use by searching a short list of known vendor sender domains and reading limited message headers, solely to generate your quiz result, as described in Section 2.9;
• communicate with Client about intake completion, engagement status, messages, reports, renewals, support, and changes to the Service or this Policy;
• protect the Service, investigate errors or suspected misuse, enforce our Terms of Use, and maintain system reliability and security;
• comply with applicable legal obligations, respond to lawful requests, establish or defend legal claims, and protect the rights, property, and safety of Oathmark, Client, and others; and
• improve the administration, reliability, and professional delivery of the Service, using de-identified or aggregated information where reasonably practicable.

Oathmark’s staff and tools may use third-party AI tools to assist in preparing audit work product. Client-submitted intake content is not used by Oathmark to train any AI model. We do not permit use of Client-submitted content for model training on our behalf. Client should nevertheless ensure that it does not submit information it is not authorized to disclose and should use reasonable data minimization as described in our Terms of Use.

4. Legal Bases for Processing

Where privacy law requires a legal basis for processing, we rely on one or more of the following, as applicable:

• Performance of a contract: to process purchases, administer the engagement, provide the portal and Deliverables, and communicate about the requested Service.
• Legitimate interests: to operate, secure, maintain, improve, and protect the Service; prevent fraud and misuse; respond to inquiries; preserve business records; and establish, exercise, or defend legal claims. We seek to balance these interests against individuals’ privacy interests and rights.
• Consent: where we request consent or where consent is otherwise the appropriate basis, such as for optional communications or a processing activity requiring consent under applicable law. Consent may be withdrawn prospectively, subject to legal and contractual limitations.
• Legal obligation and vital or public interests: where necessary to comply with law, lawful process, or a compelling safety-related need.

5. How We Disclose Information

We do not sell personal information. We disclose information only as described in this Policy, as directed or authorized by Client, or as otherwise permitted or required by law. We may disclose information:

• to Oathmark personnel, including authorized administrative personnel, who need access to manage engagements, review submitted materials, reply to messages, update engagement stage, and deliver reports;
• to the service providers listed in Section 6, solely to provide their services to us;
• to Client’s authorized representatives using the Engagement Link or other access method authorized by Client;
• to Client’s broker, carrier, insurer, or professional advisers only when Client directs us, provides the relevant Deliverable, or authorizes the disclosure;
• in connection with a merger, financing, reorganization, sale of assets, bankruptcy, or similar transaction, subject to appropriate confidentiality protections where practicable;
• to comply with law, regulation, subpoena, court order, or other lawful governmental request; and
• where reasonably necessary to protect the rights, property, safety, confidentiality, or security of Oathmark, Client, or others; to prevent fraud or abuse; or to enforce our agreements.

We may use and disclose aggregated or de-identified information that does not reasonably identify an individual, subject to applicable law.

6. Service Providers and Sub-processors

We use carefully selected vendors to operate the Service. These providers process information on our behalf or in connection with the functions described below:

Provider	Function
Stripe	Payment processing and Stripe Checkout; Stripe processes payment-card information and provides transaction and checkout information to us.
Supabase	Hosted Postgres database and private file storage for engagement records, uploads, and Deliverables.
Resend	Transactional email delivery, including engagement-status and portal-message notifications.
Vercel	Website hosting, serverless compute, DNS, content delivery, and related operational infrastructure.

These providers may process information in accordance with their own contractual commitments and privacy terms. We may add, replace, or remove vendors as our Service develops; if a material change affects this Policy, we will update it as described in Section 15. We do not authorize vendors to sell Client information or to use it for their own independent advertising purposes.

7. No Sale or Sharing for Cross-Context Behavioral Advertising

Oathmark does not sell personal information for money or other valuable consideration as those terms may be defined by applicable privacy law. We also do not share personal information for cross-context behavioral advertising, and we do not use third-party advertising trackers on the Service today. We have no actual knowledge of selling or sharing personal information of individuals under age sixteen.

8. Cookies, Browser Storage, and Tracking Technologies

Oathmark does not currently use third-party advertising or analytics trackers. The portal currently uses functional, browser-based session storage to support the portal user interface. Session storage is generally limited to the browser session and is not a persistent tracking cookie. If you opt into the Gmail scan feature described in Section 2.9, we also set a temporary, functional, httpOnly cookie to hold your Google access token for the duration of that scan; this cookie is not used for advertising or cross-site tracking. Standard server logs and the operational services described in this Policy may still record technical information as described in Section 2.7.

If we add analytics, advertising, or other material tracking technologies in the future, we will update this Policy and, where required, provide appropriate notice or choice mechanisms. Browser settings may allow you to manage certain browser storage or cookies, but disabling functional browser storage may affect portal operation.

9. Data Retention

We retain contact information, engagement records, intake responses, uploaded materials, portal messages, payment-related records, and Deliverables for the duration of the engagement and afterward for seven (7) years from the end of the engagement, unless a longer period is required or reasonably necessary for legal obligations, tax and accounting records, dispute resolution, enforcement of agreements, security, or legitimate business recordkeeping.

Completed reports and uploaded files are stored in private storage. Access for download is provided through time-limited signed URLs that generally expire after approximately seven (7) days; expiration of a signed URL does not itself delete the underlying file. Underlying files persist until deleted in accordance with the retention policy or applicable legal requirements.

At the end of the applicable retention period, we will delete, de-identify, or securely archive information, subject to technical feasibility, backups, legal holds, and legally required retention. Deletion from active systems may not be immediate, and residual copies may remain in backups for a limited period before being overwritten or deleted under routine backup practices.

10. Data Security

We use reasonable administrative, technical, and organizational measures designed to protect information against unauthorized access, loss, misuse, alteration, or disclosure. Our current practices include:

• encryption in transit through HTTPS;
• secrets and credentials managed through environment-variable-based controls rather than embedded in public client-side code;
• payment processing through Stripe so Oathmark does not handle raw payment-card numbers;
• private Supabase storage for uploaded files and Deliverables, with access through time-limited signed URLs rather than public file links; and
• internal administrative access to engagement data through an admin dashboard gated by a shared administrative secret.

These measures are intended to be proportionate to the nature of the Service, but no method of transmission, storage, or access control is completely secure. Client is responsible for protecting its Engagement Link, using secure devices and networks, and providing only information it is authorized to disclose. Oathmark does not represent that it holds SOC 2, ISO 27001, ISO 42001, or any other certification unless we expressly state so in a separate signed writing.

11. Privacy Rights and Choices

We extend the rights described in this Section as a matter of policy to eligible individuals, even where we have not independently determined that every threshold or condition of a particular privacy law applies to Oathmark or a specific request. These rights are subject to applicable law, verification, and lawful exceptions.

11.1 U.S. state privacy-style rights

Subject to applicable law, you may request:

• Access / right to know: confirmation of whether we process your personal information and access to, or a portable summary or copy of, the personal information we hold about you;
• Correction: correction of inaccurate personal information;
• Deletion: deletion of personal information, subject to exceptions for legal obligations, security, recordkeeping, transactions, legal claims, and other permitted purposes;
• Opt-out of sale or sharing: an opt-out of sale or sharing for cross-context behavioral advertising. Oathmark does not sell or share personal information in those ways, so no sale/share opt-out is currently necessary;
• Limitation of certain sensitive-information uses: a request to limit uses or disclosures of sensitive personal information where applicable. Oathmark uses information submitted for the engagement and does not use it for advertising; and
• Non-discrimination: freedom from unlawful discriminatory treatment for exercising privacy rights.

11.2 EU/EEA and UK-style rights

If you are in the European Economic Area, United Kingdom, or another jurisdiction providing similar rights, subject to applicable law you may request:

• access to your personal data;
• rectification of inaccurate or incomplete personal data;
• erasure of personal data;
• restriction of processing;
• portability of certain personal data;
• objection to processing based on legitimate interests, including objection to direct marketing where applicable; and
• withdrawal of consent, where processing is based on consent, without affecting the lawfulness of processing before withdrawal.

You may also have a right to lodge a complaint with the data-protection authority in your place of residence or work, or where an alleged infringement occurred. Before doing so, we encourage you to contact us so that we can try to resolve your concern.

11.3 How to exercise rights

To make a privacy request, contact us at privacy@oathmark.ai with the subject line “Privacy Request,” or write to us at the address in Section 17. Please identify the Client firm, describe the request, and provide information sufficient for us to verify your identity and authority. We may request additional information to verify a request, prevent fraud, protect others’ information, or confirm that an authorized agent is acting for you.

We will respond within the time required by applicable law. If we need more time, we will explain the reason and any extension available under applicable law. An authorized agent may submit a request where permitted, but we may require proof of authorization and direct verification of the relevant individual. We may deny or limit requests where an exception applies, including where fulfilling the request would disclose another person’s information, violate a legal duty, impair security, conflict with a legal hold, or prevent us from completing a transaction or providing the Service.

12. Roles for Client-Provided Information

As to contact, transaction, and administrative information we collect directly to operate the Service, Oathmark generally determines the purposes and means of processing described in this Policy. For personal information that Client includes in Client Materials about Client’s personnel, customers, clients, or other third parties, Client generally determines what to provide and why. The parties’ respective privacy roles may vary based on the facts, the applicable law, and any separate written data-processing agreement. Nothing in this Policy alters a separate written agreement concerning privacy or data processing.

13. International Data Transfers

Oathmark is based in the United States, and Service information is stored and processed using U.S.-based infrastructure and service providers. If you provide information from outside the United States, you understand that it may be transferred to, stored in, and processed in the United States and other locations where our service providers operate, which may have privacy laws different from those in your jurisdiction.

Where applicable law requires a transfer mechanism or additional safeguards for an international transfer, we will seek to use an appropriate mechanism or safeguard. If you need more information about relevant safeguards, contact us using the details in Section 17.

14. Children’s Privacy

The Service is for business representatives age eighteen (18) or older and is not directed to children. We do not knowingly collect personal information from children. If you believe a child has provided personal information to us, contact us at privacy@oathmark.ai and we will take appropriate steps to address the information.

15. Data Incidents

If we become aware of a security incident involving personal information in our possession or control, we will investigate and take reasonable steps to contain, assess, and remediate the incident. Where notification is required by applicable law or our contractual obligations, we will notify the affected Client or individual without undue delay and provide information reasonably available to us to support an appropriate response. Client remains responsible for notifications and obligations arising from Client’s own systems, personnel, customers, and data practices unless a separate written agreement states otherwise.

16. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, vendors, legal requirements, or the Service. We will post the updated Policy with a revised effective date. If a change is material, we will provide additional notice where required by applicable law. Your continued use of the Service after the updated effective date signifies acceptance to the extent permitted by law.

17. Contact Us

For privacy questions, requests, or concerns, contact:

Epic Sky, LLC, d/b/a Oathmark
Attn: Privacy / Oathmark
5550 Glades Road, Suite 610, Boca Raton, Florida 33431
Email: privacy@oathmark.ai