PRIVACY POLICY

Summary of Key Points

1. What Information Do We Collect?

We collect personal information that you voluntarily provide to us when expressing an interest in obtaining information about us or our products and services, when participating in diligence, or when contacting us directly.

Personal Information Provided by You

• Contact Data: Name, professional email address, phone number, company name, title, and communication preferences.
• Inquiry & Diligence Data: Content of messages, diligence queries, documentation requests, and engagement scope submitted via our contact register or email.

Information Automatically Collected

When you visit our site, our hosting infrastructure automatically logs standard technical metadata, including IP addresses, browser user agent, device platform, operating system, referring URLs, and access timestamps. This telemetry is used strictly for reliability, DDoS defense, and infrastructure security.

2. How Do We Process Your Information?

We process your personal information for purpose-bound, lawful objectives, including:

• Responding to business inquiries, formal diligence requests, and partnership proposals.
• Fulfilling corporate formalities, executing NDAs, and onboarding verified counterparties to appropriate series accounts.
• Maintaining the security, resilience, and operational integrity of our web infrastructure and defense layers.
• Complying with applicable legal, statutory, and regulatory obligations under Texas and United States law.

3. What Legal Bases Do We Rely On?

We only process your personal information when we have a valid legal reason to do so under applicable law, including:

• Consent: Where you have granted explicit consent for a specific purpose (e.g., submitting an inquiry form).
• Contractual Necessity: Where processing is necessary to execute or negotiate agreements with your organization.
• Legitimate Interests: Where processing supports our legitimate business interests in operating secure services, preventing fraud, and managing customer communications, provided such interests do not override your fundamental rights.
• Legal Obligations: Where disclosure or retention is required by subpoena, statute, or regulatory audit.

4. When and With Whom Do We Share Your Personal Information?

We do not sell, rent, or trade personal information to data brokers, advertisers, or third-party marketing networks. We share information solely with trusted service providers necessary for infrastructure operation:

• Cloud Infrastructure: Amazon Web Services (S3, CloudFront) for static asset distribution and edge termination.
• Network & DNS: Cloudflare for authoritative nameservers, edge caching, and DDoS mitigation.
• Email & Productivity: Google Workspace for corporate email exchange and administrative routing.
• Workflow Automation: Sovereign on-premises automation engines (n8n on protected host tiers) for processing corporate intake records.

All service providers operate under written confidentiality agreements and are prohibited from retaining or using your data for any unauthorized purpose.

5. Do We Use Cookies and Other Tracking Technologies?

Ravenhelm.co does not deploy third-party advertising tracking cookies, cross-site trackers, or behavioral surveillance pixels. Any cookies or local storage utilized are strictly necessary for core site performance, security headers, and edge delivery.

6. Do We Offer AI-Based Products and Agent Systems?

Ravenhelm develops auditable AI governance, agentic systems, and runtime constraint platforms. In connection with these systems:

• Training Isolation: Proprietary counterparty diligence materials, inquiry data, and non-public technical specifications are never used to train public foundation models.
• Attribution & Provenance: Where agentic workflows interact with counterparty systems, actions are logged with immutable cryptographic trails to preserve accountability and provenance.
• Deterministic Guardrails: Our architectures enforce strict execution boundaries, ensuring autonomous tools operate only within authorized, pre-negotiated scopes.

7. How Long Do We Keep Your Information?

We retain personal information only for as long as necessary to fulfill the purposes outlined in this notice, satisfy contractual record-keeping obligations, or comply with statutory retention rules. Diligence inquiries that do not proceed to an executed agreement are purged or archived according to our corporate data governance schedule.

8. How Do We Keep Your Information Safe?

We implement defense-in-depth organizational and technical controls designed to protect personal data against unauthorized access, destruction, loss, or disclosure:

• Enforced TLS 1.3 encryption across all public endpoints and transit pathways.
• Strict role-based access control (RBAC), multi-factor hardware authentication, and credential isolation via passwordless vaults.
• Sovereign repository hosting, isolated runner execution, and automated vulnerability scanning.

While no electronic transmission over the internet can be guaranteed 100% immune from attack, we maintain active monitoring and emergency incident procedures to remediate anomalies immediately.

9. Do We Collect Information from Minors?

Our website, enterprise products, and governance systems are directed exclusively to business professionals, developers, and institutions. We do not knowingly solicit or collect personal information from individuals under eighteen (18) years of age.

10. What Are Your Privacy Rights?

Depending on your jurisdiction, you may have rights under applicable data protection laws (including the GDPR, UK GDPR, and Canadian PIPEDA), such as:

• The right to request access to and obtain a copy of your personal data.
• The right to request rectification of inaccurate or incomplete records.
• The right to request erasure (“the right to be forgotten”) under qualified statutory conditions.
• The right to restrict or object to certain processing activities.
• The right to data portability.

To exercise any of these rights, contact us at privacy@ravenhelm.co or nate@ravenhelm.co.

11. Controls for Do-Not-Track Features

Most modern web browsers incorporate Do-Not-Track (“DNT”) or Global Privacy Control (“GPC”) signals. Because ravenhelm.co does not track visitors across third-party websites or engage in behavioral profiling, our default posture natively honors the intent of DNT and GPC signals.

12. Do United States Residents Have Specific Privacy Rights?

Residents of California, Texas, Virginia, Colorado, Connecticut, Utah, and other US states with comprehensive privacy legislation enjoy specific rights regarding their personal data, including the right to know, correct, delete, and opt out of the sale or sharing of personal information.

Ravenhelm does not sell personal information or share personal information for cross-context behavioral advertising. We do not process sensitive personal information for the purpose of inferring characteristics about consumers.

13. Do We Make Updates to This Notice?

We may update this privacy notice periodically to reflect operational, legal, or regulatory adjustments. When changes occur, we will update the “Last Updated” date at the top of this document. Material updates affecting counterparty obligations will be accompanied by prominent public notice or direct communication.

14. How Can You Contact Us About This Notice?

If you have questions, comments, or data rights requests concerning this policy, please reach out to our designated compliance contact:

15. How Can You Review, Update, or Delete Your Data?

To review, update, or permanently delete personal data held by Ravenhelm, LLC, submit a verified request to privacy@ravenhelm.co. We verify and respond to consumer requests within thirty (30) days in compliance with applicable law.