Privacy Policy

Critical enterprise distinction: MSA supremacy

Please Note: This Privacy Policy applies strictly to interactions with our public-facing marketing website, Agile Onboarding portals, and general public inquiries.

For Enterprise, Mid-Market, and Sovereign-tier clients utilizing the RTFCT compliance substrate, all payload evaluations, cryptographic logs, and telemetry processed through The Forge and secured within The VLT (Vault) are strictly governed by your Master Services Agreement (MSA) and Data Processing Addendum. Data secured within the RTFCT Substrate is Dual-Master encrypted, cryptographically sovereign, and is mathematically isolated from all marketing ecosystems and never utilized for AI model training, profiling, or internal orchestration.

Summary of key points

• What personal information do we process? We may process personal information depending on how you interact with us and the Services, the choices you make, and the products and features you use.
• Do we process any sensitive personal information? We may process sensitive personal information when necessary with your consent or as otherwise permitted by applicable law.
• Do we collect any information from third parties? We may collect limited data from public databases, marketing partners, and social media platforms.
• How do we process your information? We process your information to provide, improve, and administer our Services, communicate with you, for security and fraud prevention, and to comply with law.
• In what situations and with which types of parties do we share personal information? We may share information in specific situations and with specific categories of third parties (e.g., cloud hosting, analytics).
• What are your rights? Depending on your geographic location, you have certain rights regarding your personal information, including access, correction, and deletion.

1. What information do we collect?

2. How do we process your information?

In Short: We process your information to provide, improve, and administer our Services, communicate with you, for security and fraud prevention, and to comply with law.

We process your personal information for a variety of reasons, depending on how you interact with our Services, including:

• To facilitate account creation and authentication.
• To deliver and facilitate delivery of services to the user.
• To respond to user inquiries and offer high-level support.
• To send administrative information to you.
• To evaluate and improve our Services, products, marketing, and your experience.
• To comply with our legal obligations.
• AI TRAINING DATA (PUBLIC SERVICES ONLY): To optimize sovereign marketing models. Exceptions: Under no circumstances are RTFCT client evidentiary logs, Forge telemetry, or VLT data utilized for AI model training.

3. When and with whom do we share your personal information?

In Short: We may share information in specific situations and/or with specific categories of third parties.

Vendors, Consultants, and Other Third-Party Service Providers. We may share your data with third-party vendors who perform services for us (e.g., Cloud Computing Services, Data Storage Service Providers, Payment Processors, Analytics). They cannot do anything with your personal information unless we have instructed them to do it.

Business Transfers. We may share or transfer your information in connection with, or during negotiations of, any merger, sale of company assets, financing, or acquisition.

Affiliates. We may share your information with our affiliates (e.g., FYNYGRYF GROUP LLC, GRYFFON GROUP), in which case we will require those affiliates to honor this Privacy Notice.

4. Do we use cookies and other tracking technologies?

We may use cookies and similar tracking technologies (like web beacons and pixels) to gather information when you interact with our Services. Specific information about how we use such technologies and how you can refuse certain cookies is set out in our Cookie Notice. We may share your information with Google Analytics to track and analyze the public use of the Services.

5. Do we offer artificial intelligence-based products?

As part of the wider ecosystem, we offer products powered by AI.

Strict Carve-Out: RTFCT operates as a forensic compliance substrate. The cryptographic logs, evaluation matrices, and telemetry routed into The VLT are strictly protected by Dual-Master encryption and are excluded entirely from being ingested, analyzed, or utilized by any AI model for the purposes of training, optimization, or profiling.

6. How do we handle your social logins?

If you choose to register or log in to our public Services using a social media account, we receive certain profile information about you from your social media provider. We use this information only for the purposes described in this Privacy Notice.

7. How long do we keep your information?

We keep your public/marketing information for as long as it is necessary for the purposes set out in this Privacy Notice, unless a longer retention period is required by law.

Note: For Enterprise clients utilizing the RTFCT Substrate, evidentiary logs secured in The VLT are retained under strict, mathematically immutable 1,095-day schedules as dictated by the MSA and emerging statutory requirements (e.g., SB 24-205).

8. How do we keep your information safe?

We have implemented appropriate and reasonable technical and organizational security measures designed to protect the security of any personal information we process. While public website interactions carry inherent internet risks, telemetry routed through the RTFCT Forge utilizes rigorous out-of-band evaluation and AES-256-GCM Dual-Master Key Protocol encryption to secure data at rest in The VLT.

9. Do we collect information from minors?

We do not knowingly collect, solicit data from, or market to children under 18 years of age. If you become aware of any data we may have collected from children under age 18, please contact us at [email protected].

10. What are your privacy rights?

You have the right to withdraw your consent to processing at any time. You can unsubscribe from our marketing communications at any time by clicking the unsubscribe link in our emails or contacting us directly at [email protected]. Upon request to terminate your public account, we will deactivate or delete your account from our active databases.

11. Controls for do-not-track features

We do not currently respond to DNT browser signals because there is no uniform technology standard. However, Global Privacy Control (GPC): We recognize and honor Global Privacy Control (GPC) signals for our public sites, treating it as a valid request to opt out of the sale or sharing of your personal information for targeted advertising purposes under applicable state privacy laws.

12. Do United States residents have specific privacy rights?

In Short: If you are a resident of California, Colorado, Texas, Utah, Virginia, or other states with enacted privacy legislation, you have specific rights regarding your personal information.

Categories of Personal Information We Collect

We have collected the following categories of personal information in the past twelve (12) months:

You have the right to request access, correction, and deletion of your personal data. You have the right to opt out of the processing of your data for targeted advertising. To exercise these rights, email us at [email protected].

13. Do other regions have specific privacy rights?

Australia and New Zealand: We process your personal information under the obligations of Australia's Privacy Act 1988 and New Zealand's Privacy Act 2020. You have the right to request access to or correction of your personal information.

Republic of South Africa: You have the right to request access to or correction of your personal information in accordance with POPIA.

14. Ecosystem data processing and artificial intelligence sovereignty

FYNYGRYF GROUP LLC operates a sovereign digital ecosystem. Data collected from public, marketing, and general ecosystem interactions may be securely processed across our proprietary infrastructure to optimize the ecosystem's internal AI systems (e.g., Digivisors).

THE RTFCT ISOLATION PROTOCOL: By explicit architectural mandate, CIVITAS LLC isolates all RTFCT Enterprise and Community Substrate traffic from the wider ecosystem. Telemetry, parameters, API requests, and VLT storage logs generated by RTFCT clients are structurally partitioned. They are never ingested by Fynygryf Group ecosystem orchestrators and are mathematically shielded from internal AI training protocols.

15. Do we make updates to this notice?

We may update this Privacy Notice from time to time. The updated version will be indicated by an updated "Revised" date at the top of this document. We encourage you to review this Privacy Notice frequently.

16. How can you contact us about this notice?

If you have questions or comments about this notice, you may contact our Data Protection Officer (DPO) by email at [email protected], by phone at (720) 546-6367, or by post at:

17. How can you review, update, or delete the data we collect from you?

You have the right to request access to the personal information we collect from you, details about how we have processed it, correct inaccuracies, or delete your personal information. To request to review, update, or delete your personal information, please email [email protected].