Privacy Policy

1. Information We Collect

We collect information in the following categories, only as needed to provide and secure the Service:

Account & identity information

Name, email address, and role, provided when your account is created (either by you or by an Apheta administrator on your behalf via an invitation).

Files and content you upload or receive

Documents, images, PDFs, and other files that you or Apheta upload to your Vault, along with associated metadata (file name, size, upload date, folder location, expiration settings you configure).

Communications

Messages, form submissions, and support requests you send us through the Service, and — where applicable — email correspondence Apheta maintains related to your account.

Authentication & security data

Password (stored only as a one-way cryptographic hash, never in plain text), multi-factor authentication status, login timestamps, and IP address at the time of login, used to detect and prevent unauthorized access.

Usage & device information

Browser type, device information, and activity logs (such as file access, uploads, and downloads) needed to operate, audit, and secure the Service.

2. How We Use Information

We use the information described above to:

• Provide, maintain, and secure the Service, including authenticating your account and enforcing access permissions;
• Store, organize, and transmit the files and documents you or Apheta place in your Vault;
• Communicate with you about your account, security notices, and — where you've requested it — your inquiries;
• Detect, investigate, and prevent fraud, unauthorized access, malware, and other security incidents;
• Comply with legal, regulatory, and recordkeeping obligations applicable to Apheta as a financial and insurance consulting practice; and
• Improve the reliability and usability of the Service.

We do not use your information for behavioral advertising, and we do not build advertising profiles about you.

3. How We Share Information

We do not sell your personal information, and we do not share it with third parties for their own marketing purposes. We disclose information only in the limited circumstances below:

• Service providers acting on our behalf. A small number of vendors process limited data strictly to help us operate the Service — for example, our email delivery provider (to send account and notification emails) and error-monitoring tooling that we self-host on our own infrastructure. These providers are contractually limited to using data only to perform the service we've requested.
• Legal & safety reasons. We may disclose information if required by law, subpoena, or regulatory request, or where we believe in good faith that disclosure is necessary to protect the rights, property, or safety of Apheta, our clients, or others.
• With your direction. When you use a sharing or upload-request link we generate at your request, or otherwise instruct us to share specific content with a named recipient.
• Business transfers. If Apheta were ever involved in a merger, acquisition, or sale of assets, client information may be transferred as part of that transaction, subject to the protections of this Policy.

4. Financial Privacy Notice (Gramm-Leach-Bliley Act)

Apheta is an insurance consulting and estate planning practice, and certain information we collect about you may constitute "nonpublic personal information" under the Gramm-Leach-Bliley Act (GLBA). This section supplements the rest of this Policy for that information.

We disclose nonpublic personal information only as permitted by law and as described in Section 3 above — principally to service providers who help us deliver the Service, and to the professionals directly involved in servicing your account at your direction. We do not disclose your nonpublic personal information to nonaffiliated third parties for their own marketing purposes, so no opt-out is required for that type of sharing.

We maintain physical, electronic, and procedural safeguards, described in Section 5, that comply with the GLBA Safeguards Rule to protect your nonpublic personal information.

5. How We Protect Your Information

The Service is built and operated with the sensitivity of your information in mind:

• Your data stays on infrastructure we operate. Files and account data are stored on servers Apheta owns and manages directly — not on shared third-party cloud storage.
• Encryption in transit. All connections to the Service are encrypted (HTTPS/TLS).
• Malware scanning. Every file uploaded to the Service is automatically scanned for malware before it is stored.
• Multi-factor authentication. Accounts can be protected with a second authentication factor in addition to a password.
• Access controls. Access to client files is restricted by account permissions, and administrative access is limited to authorized Apheta personnel.
• Encrypted backups. Backups are encrypted and stored on infrastructure Apheta controls directly, rather than with an external backup vendor.
• Password protection. Passwords are never stored in plain text; they are stored using industry-standard one-way cryptographic hashing.

No system can be guaranteed 100% secure. If we become aware of a security incident affecting your personal information, we will notify affected clients and any applicable regulator as required by law.

6. Data Retention

We retain your account information and files for as long as your account remains active, or as needed to provide you the Service. We may retain certain information for longer where required to comply with our legal, tax, insurance-regulatory, or recordkeeping obligations, to resolve disputes, or to enforce our agreements. When information is no longer needed for these purposes, we take steps to delete or de-identify it.

If you'd like your account and associated files deleted sooner, contact us using the information in Section 11 and we will act on that request, subject to any retention we're legally required to maintain.

7. Your Privacy Rights

If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act (CCPA/CPRA), gives you the following rights over your personal information:

• Right to Know — request what personal information we've collected about you and how it's been used and disclosed.
• Right to Delete — request deletion of personal information we've collected from you, subject to certain legal exceptions.
• Right to Correct — request correction of inaccurate personal information we maintain about you.
• Right to Opt Out of Sale/Sharing — we do not sell personal information or share it for cross-context behavioral advertising, so there is nothing to opt out of, but you retain this right regardless.
• Right to Limit Use of Sensitive Personal Information — we only use sensitive personal information (such as financial or identifying details) to provide the Service, so no additional limitation request is needed to achieve this.
• Right to Non-Discrimination — we will not deny you services, charge you a different price, or provide a different level of service because you exercised a privacy right.

Residents of other states with comparable privacy laws (including Virginia, Colorado, Connecticut, Utah, and others as they take effect) have similar rights, which we honor on the same basis described above.

To exercise any of these rights, contact us using the information in Section 11. We may need to verify your identity before completing your request.

8. Cookies & Tracking Technologies

We do not use third-party advertising or analytics cookies, and we do not track you across other websites. The Service uses only what's strictly necessary to operate:

• A session cookie used solely for CSRF (cross-site request forgery) protection; and
• Browser local/session storage used to keep you signed in between visits.

None of these are used for advertising, profiling, or tracking your activity outside the Service.

9. Children's Privacy

The Service is intended for use by adults in connection with insurance, estate planning, and financial consulting services. It is not directed to children under 16, and we do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us and we will delete it.

10. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. When we make material changes, we will update the "Last updated" date above and, where appropriate, notify you directly. We encourage you to review this page periodically.

11. Contact Us

If you have questions about this Privacy Policy, or would like to exercise any of the rights described above, contact us at: