Privacy Policy

1. Information we collect

• Account information: name, email address, job title, and password credentials.
• Company information: company name, industry, size, and compliance frameworks relevant to your account.
• Usage data: pages visited, features used, session duration, IP address, browser type, device identifiers, and similar telemetry.
• Assessment results: vendor risk assessments, generated risk registers, incident response plans, policy libraries, security quiz results, intel briefings, and any content you input into the Scarlet Intelligence platform.
• Payment information: billing details processed through our payment processor, Stripe. Scarlet Risk does not store full payment card numbers.

2. How we use your information

• To deliver and maintain Scarlet Intelligence platform services.
• To generate AI-powered risk assessments, policy drafts, compliance gap analyses, and intel briefings.
• To process payments and manage subscriptions.
• To communicate with you about your account, security alerts, product updates, and customer support requests.
• To monitor, secure, debug, and improve the Services.
• To comply with legal obligations.

3. Data storage

Customer data is hosted in our managed backend (Supabase) on United States–based infrastructure. We use industry-standard encryption in transit (TLS) and at rest. Access to production data is limited to the founder and to service providers that operate the platform on our behalf.

4. Third-party service providers

We share limited information with sub-processors that help us operate the Services. Each is bound by contractual confidentiality and data protection obligations:

• Anthropic (Claude API): AI model inference for the website chat assistant.
• Lovable: hosting, application backend, and our AI gateway, which routes some AI requests to Google Gemini models.
• Stripe: payment processing and subscription billing.
• Resend: transactional email delivery.
• Supabase: managed database, authentication, and file storage.
• Make: routing of sales and sign-up leads.
• Have I Been Pwned: breach checks for the domains and emails you ask us to check.

We do not sell your personal information to third parties.

Aggregate vendor risk signal

When you assess a third-party vendor in Scarlet Risk, we contribute de-identified risk signal about that vendor — risk category ratings, whether public breach or incident history was noted, the general sensitivity of data involved, and generic data-category labels — to a shared, platform-wide vendor registry. This signal is stored without your name, company, account identifier, or any other information that identifies you, and it is aggregated across all contributing accounts. Other customers assessing the same vendor may see the aggregate risk score, aggregate data categories, and known flags. No customer can see which other customers use or assess a given vendor, and no account-identifying data is ever shared between accounts. Your own assessments, notes, and evidence remain private to your account.

This practice is also described in our Data Processing Agreement.

Text messaging opt-in data

We will not share your opt-in to an SMS campaign with any third party for purposes unrelated to providing you with the services of that campaign. All categories of information described in this policy exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties. We will not share your mobile information with third parties or affiliates for marketing or promotional purposes.

We may share your Personal Data, including your SMS opt-in or consent status, with third parties that help us provide our messaging services, including but not limited to platform providers, phone companies, and other vendors who assist us in the delivery of text messages.

5. Your rights

You have the right to access, correct, export, or delete the personal information we hold about you. To exercise any of these rights, contact privacy@scarletrisk.com. We will respond within the timeframes required by applicable law. We respond to verified requests within 30 days.

6. Cookies

Scarlet Risk uses essential cookies and similar storage to keep you signed in, maintain your session and remember your cookie choice. These are always on and do not require consent.

We also use optional analytics and marketing tools to understand how our website is used and to follow up on inquiries: Google Analytics, Mixpanel, PostHog, HubSpot and Apollo. How they start depends on where you are:

• European Economic Area, United Kingdom and Switzerland: these tools do not load until you choose "Accept analytics" in our cookie banner. If you choose "Essential only," or make no choice, they stay off. If we cannot tell where you are, we apply this stricter rule.
• Everywhere else, including the United States: these tools are on by default, and a notice tells you so. You can turn them off at any time with "Cookie Settings" or "Do Not Sell or Share My Info."

We honor the Global Privacy Control (GPC) signal: if your browser sends it, we treat it as an opt-out and these tools stay off unless you choose "Accept analytics" yourself.

You can change your choice at any time with the "Cookie Settings" or "Do Not Sell or Share My Info" links in the footer of every page. When you opt out, by choosing "Essential only" or "Do Not Sell or Share My Info," the optional tools stop, their stored identifiers are cleared, and the page reloads so none of them keep running. Activity from before you accept is never sent later. Signing in, your account and all essential site functions remain available whichever option you choose.

We do not sell personal information and we do not use your assessment content for advertising. You can also block or delete cookies in your browser, but sign-in and other core features will not work without essential cookies. To ask about analytics data, contact privacy@scarletrisk.com.

7. GDPR and CCPA compliance

If you are located in the European Economic Area, the United Kingdom, or Switzerland, you have rights under the General Data Protection Regulation (GDPR), including the right to access, rectification, erasure, restriction, portability, and objection. Our lawful bases for processing include contract performance, legitimate interests, and consent where required.

If you are a California resident, the California Consumer Privacy Act (CCPA) and CPRA give you the right to know what personal information we collect, request deletion, opt out of any sale or sharing of personal information (we do not sell), and not be discriminated against for exercising your rights.

8. Data retention

We retain customer data while your account is active. If you cancel, you can ask us to delete your account data by emailing privacy@scarletrisk.com. We complete verified deletion requests within 30 days, and data in backups is removed in the normal backup rotation. We may retain limited records where the law requires it, such as billing records. Aggregated or de-identified data, including the aggregate vendor risk signal described above, may be retained longer for analytics and product improvement.

9. Children's privacy

The Services are intended for business use and are not directed to children under 16. We do not knowingly collect personal information from children.

10. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email or through an in-product notice at least 30 days before they take effect.

11. Contact

For privacy questions or requests, contact us at privacy@scarletrisk.com.