Overview
Sinquery LLC DBA VylintShield (“VylintShield,” “we,” “us,” or “our”) is committed to protecting your privacy. This Privacy Policy explains how we collect, use, share, and protect information when you use our compliance documentation and audit-readiness platform and related services (the “Service”).
This Policy is designed to comply with the EU General Data Protection Regulation (GDPR) and the California Consumer Privacy Act / California Privacy Rights Act (CCPA/CPRA), as applicable.
1. Information We Collect
1.1 Account Information
When you register, we collect:
- Full name
- Business email address
- Company name and size
- Job title / role
- Password (stored in hashed form)
- Billing address and payment method details (processed by Stripe, our third-party payment processor; VylintShield does not store raw card numbers)
1.2 Compliance and Configuration Data
To provide the Service, we process data you upload or create, which may include:
- Policies, procedures, and internal documents you generate or upload
- Evidence artifacts (screenshots, files, documents) you attach
- Assessment responses and gap analysis inputs
This data is yours. We process it only to deliver the Service.
1.3 Usage and Telemetry Data
We automatically collect information about how you use the Service:
- Pages visited, features accessed, and time spent
- Browser type, operating system, and IP address
- Clickstream and interaction data (e.g., button clicks, navigation paths)
- Error logs and crash reports
This data helps us improve the Service and diagnose issues.
1.4 Communications
If you contact us for support or otherwise communicate with us, we retain those communications and any information you provide.
1.5 Cookies and Similar Technologies
We use cookies, web beacons, and similar tracking technologies for:
- Authentication and session management (strictly necessary)
- Analytics and usage measurement (functional/analytics)
- Marketing and advertising attribution (described below)
Marketing and advertising attribution. On your first visit we set a first-party cookie named vs_attr. It records the campaign parameters in the link you arrived on (utm_source, utm_medium, utm_campaign, utm_content, utm_term), the page you landed on, the referring site, and the time of that visit. The cookie is httpOnly — no script running in your browser, ours or anyone else's, can read it — and its contents are not shared with any third party. It expires 90 days after your first visit and is not refreshed. If you create an account, that first-visit record is stored with your account so we can measure which marketing channels bring us customers. We do not set this cookie for visitors in the European Economic Area, the United Kingdom or Switzerland, or for anyone who has opted out of analytics.
You can control cookies, including this one, through your browser settings. To object to this processing or to ask us to erase the attribution data held on your account, contact privacy@vylintshield.com; see Section 6 for the rights available to you.
1.6 AI Assistant Conversations
The Service includes an AI compliance assistant in the customer portal. When you use it, we retain your messages and the assistant’s replies, and we send the following to the AI provider named in Section 3 so that a reply can be generated: your organization name, the frameworks you have active, a summary of your assessments (name, framework, and percentage complete), a list of your document titles with their framework and status, and the recent messages in that conversation. We do not send the contents of the documents or evidence files you upload — only their titles. If you ask the assistant to escalate to a person, your email address, your organization identifier and the text of your request are also sent to the notification provider named in Section 3. Please do not enter information in the assistant that you would not want processed by those providers.
2. How We Use Your Information
We use collected information to:
| Purpose | Legal Basis (GDPR) |
|---|---|
| Provide and operate the Service | Contract performance |
| Operate the AI compliance assistant in the portal | Contract performance |
| Process payments via Stripe and manage subscriptions | Contract performance |
| Send transactional emails (receipts, alerts, security notices) | Contract performance / Legitimate interest |
| Provide customer support | Contract performance / Legitimate interest |
| Improve and develop the Service (using anonymized/aggregated data) | Legitimate interest |
| Send product updates and marketing communications | Consent (where required) / Legitimate interest |
| Comply with legal obligations | Legal obligation |
| Detect, prevent, and investigate fraud or security incidents | Legitimate interest |
We do not sell your personal data to third parties.
3. Third-Party Service Providers
We share data with third-party service providers who assist in operating the Service. Each handles data only for the purpose described in the table below. Every provider listed except Telegram is engaged under a data processing agreement or the provider’s published data processing terms. Telegram is used only as a notification channel to our own staff and is not engaged under a data processing agreement with us, which is why what we send it is limited to the fields named in its row:
| Provider | Purpose | Data Shared |
|---|---|---|
| Vercel | Hosting, CDN, and analytics | Usage logs, IP addresses, telemetry |
| Stripe | Payment processing | Billing info, transaction data |
| Neon | Managed PostgreSQL database hosting (United States) | Account data, compliance assessment data, generated documents, evidence records and uploaded evidence files |
| Anthropic | AI compliance assistant — generates the assistant’s replies. Used for no other purpose. | Organization name, active frameworks, assessment and document-title summaries, and the messages you send the assistant |
| Resend | Transactional email delivery | Email address, notification content |
| Telegram | Delivers operational alerts to our staff when you ask the assistant to escalate to a person | Your email address, your organization identifier, and the escalation text you submit |
| Google Analytics | Site analytics. Not loaded for EU/EEA/UK/Swiss visitors, and suppressed for any visitor who opts out. | Usage/telemetry data (pseudonymized) |
We may update this list as our service providers change. Significant changes will be reflected here within 30 days.
4. Data Retention
We retain personal data for as long as necessary to fulfill the purposes described in this Policy:
- Account data: Retained for the duration of your subscription plus 3 years, unless you request deletion sooner.
- Compliance and configuration data: Retained for the duration of your subscription. Upon termination, deleted within 30 days at your request.
- Usage/telemetry data: Retained in identifiable form for up to 24 months, then aggregated/anonymized.
- Billing records: Retained for 7 years to comply with financial recordkeeping requirements.
- Communications: Retained for up to 3 years from the last interaction.
After applicable retention periods, data is securely deleted or irreversibly anonymized.
5. Data Transfers
Sinquery LLC DBA VylintShield is established in the United States, and all of our processing takes place in the United States. If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, your data may be transferred to and processed in the US.
For such transfers, we rely on:
- Standard Contractual Clauses (SCCs) as approved by the European Commission
- UK International Data Transfer Agreements (IDTAs) where applicable
We also maintain a Data Processing Addendum (DPA) available for enterprise customers upon request at privacy@vylintshield.com.
6. Your Rights
Depending on your location, you may have the following rights:
For All Users
- Access: Request a copy of personal data we hold about you.
- Correction: Request correction of inaccurate or incomplete data.
- Deletion: Request deletion of your personal data (“right to be forgotten”), subject to legal retention requirements.
- Portability: Receive your personal data in a structured, machine-readable format.
- Opt-out of marketing: Unsubscribe from marketing emails at any time via the unsubscribe link or by contacting us.
EU/UK Residents (GDPR/UK GDPR)
In addition to the above, you have the right to:
- Restrict processing: Ask us to limit how we use your data.
- Object to processing: Object to processing based on legitimate interest or for direct marketing.
- Withdraw consent: Where we rely on consent, withdraw it at any time (this does not affect prior processing).
- Lodge a complaint: With your local data protection authority (e.g., the ICO in the UK, or your EU supervisory authority).
California Residents (CCPA/CPRA)
You have the right to:
- Know what personal information we collect, use, disclose, or sell
- Delete personal information we hold about you (with exceptions)
- Correct inaccurate personal information
- Opt out of the “sale” or “sharing” of personal information (VylintShield does not sell personal information)
- Non-discrimination for exercising your privacy rights
To submit a privacy request, contact us at privacy@vylintshield.com with subject line “Privacy Request — [your name/company].” We will respond within 30 days (GDPR) or 45 days (CCPA/CPRA).
We may need to verify your identity before processing requests.
7. Security
We implement industry-standard security measures to protect your data, including:
- Encryption of data in transit (TLS 1.2+) and at rest
- Role-based access controls and least-privilege principles
- Incident response procedures with breach notification within 72 hours as required by applicable law
No method of transmission over the internet is 100% secure. If you believe your account has been compromised, contact security@vylintshield.com immediately.
8. Children’s Privacy
The Service is intended for business use only and is not directed at individuals under 18 years of age. We do not knowingly collect personal data from minors. If we become aware of such collection, we will delete the data promptly.
9. Changes to This Policy
We may update this Privacy Policy from time to time. Material changes will be communicated by:
- Email notification to your registered address
- In-app notification at least 30 days before changes take effect
Continued use of the Service after the effective date constitutes acceptance of the updated Policy.
10. Contact Us
For privacy questions, requests, or concerns:
Privacy Officer
Sinquery LLC DBA VylintShield
1309 Coffeen Ave, Sheridan, WY 82801
Email: privacy@vylintshield.com
Subject line: “Privacy Request — [your name/company]”
If you are in the EU or the UK, send any request under Section 6 directly to the Privacy Officer above. You do not need to route it through anyone else.
Sinquery LLC DBA VylintShield — We take your compliance data as seriously as you do.