Privacy Policy

1. Scope and roles

This Policy covers information processed when you visit our marketing site, create or use a Platform account, communicate with us, or receive transactional email (including password resets and invites). The Platform is designed for business customers. When we process Customer Data on behalf of your organization inside the workspace, we act as a service provider / processor to that organization; the organization is responsible for its own privacy notices to end users and counterparties.

This Policy is not a consumer credit report disclosure. S3 is not a consumer reporting agency under the FCRA and does not offer consumer credit repair.

2. Categories of information we process

• Identifiers and contact data: name, work email, phone, organization name, role, and similar account fields.
• Authentication and security data: password hashes, session tokens (stored as HMAC digests), CSRF tokens, password-reset token digests, IP addresses associated with auth events, and approximate device/browser metadata.
• Commercial and billing data: plan selection, subscription status, invoice metadata, payment status, Net terms, facility limits, Stripe customer/subscription identifiers, and Payment Performance Data on platform invoices.
• Workspace content: firmographic lookup inputs/results (when a provider is connected), document metadata and files you upload to the vault, webhook endpoints and delivery logs, contract templates you create, team invites, API key metadata, syndication snapshots, and account-manager notes.
• Usage and diagnostics: API and page request patterns subject to rate limiting, error logs, and operational metrics needed to run a secure service.
• Communications: messages you send to support, legal, or sales addresses, and email delivery events from our provider (for example sent/bounced).

3. Sources of information

• Directly from you or your organization’s admins (registration, profile, uploads, forms).
• Automatically from your use of the site and Platform (cookies/session storage as described below, logs).
• From service providers acting on our instructions (payment, email, hosting).
• From optional enrichment or repository partners you enable or instruct us to use.
• From publicly available or licensed business data sources when a firmographic provider is configured.

4. How we use information

We use information to:

• Provide, operate, secure, and improve the Platform and Trade Credit Facility invoicing.
• Authenticate users, reset passwords, manage sessions, and enforce entitlements by plan.
• Process payments, send invoices, pursue collection of amounts owed, and maintain accounting records.
• Send transactional messages (security, invites, billing, product notices). Marketing email, if any, will include unsubscribe where required.
• Generate trade-reporting exports you initiate and, where authorized, support commercial furnishing of Payment Performance Data.
• Detect abuse, debug incidents, comply with law, and enforce our Terms.
• Respond to privacy, legal, and support requests.

5. How we share information

We do not sell personal information for money in the conventional sense. We may share information as follows:

• Service providers / processors: hosting, databases, email delivery (for example Resend), payment processing (for example Stripe), security and monitoring vendors—bound to use data only for services to us.
• Optional enrichment or storage partners you configure (firmographics HTTP/Middesk-style providers; S3-compatible object storage).
• Commercial repositories, syndicates, or consortiums when Payment Performance Data or trade files are furnished under standard commercial data-furnisher practices or when you export/transmit data.
• Corporate transactions: merger, acquisition, financing, or sale of assets, subject to continued confidentiality protections.
• Legal and safety: to comply with law, lawful process, or to protect rights, safety, and integrity of users and the Services.
• With your direction: when your admins invite teammates or connect outbound webhooks to URLs you control.

S3 Business Intelligence is a commercial software and data platform. Net 30/60/90 terms are a Trade Credit Facility for Platform Services & Data Invoicing. Payment performance on those invoices may be furnished to commercial credit repositories under standard data-furnisher practices. S3 is not a consumer reporting agency, credit repair organization, lender, or bank. Outcomes at any repository are not guaranteed.

6. Cookies, sessions, and similar technologies

We use essential cookies and similar storage for authentication and CSRF protection (including host-only secure session cookies in production). These are required for the Platform to function. We do not currently use third-party advertising cookies on the core application. If we add analytics that are not strictly necessary, we will update this Policy and provide choices where required.

7. Retention

We retain account, billing, and Payment Performance Data for as long as your organization has an account and for a commercially reasonable period afterward to meet legal, tax, accounting, dispute, and security requirements. Password-reset tokens are short-lived (approximately one hour) and invalidated after use. Session lifetimes follow idle and absolute timeouts described in product security documentation. Workspace content is retained until you delete it or your account is closed and purge schedules run, unless a longer hold is required by law or an active dispute.

8. Security

We implement administrative, technical, and organizational measures appropriate to the nature of the Services, including encrypted transport (HTTPS), hashed passwords, HMAC-bound session tokens, CSRF protections, role-based access inside organizations, and server-side entitlement checks. No method of transmission or storage is perfectly secure; you are responsible for safeguarding credentials and for classifying the sensitivity of data you upload.

9. Children

The Services are not directed to individuals under 18, and we do not knowingly collect personal information from children. If you believe a child has provided information, contact contact@s3-bi.tech and we will take appropriate steps to delete it.

10. Your choices and privacy rights

Depending on your location (including if California’s CCPA/CPRA or similar U.S. state laws apply to you as a consumer in a covered context), you may have rights to request access, correction, deletion, or an opt-out of certain sharing that qualifies as “sale” or “sharing” under those laws. Because we primarily serve businesses and process workspace data as a service provider to your organization, many requests related to Customer Data should be directed to your organization’s admin first.

• Account self-service: update profile fields and manage team access where your role permits.
• Marketing opt-out: use unsubscribe links or email contact@s3-bi.tech.
• Privacy requests: email contact@s3-bi.tech with your name, work email, organization, and the nature of the request. We will verify and respond within the time required by applicable law.
• Authorized agents: we may require proof of authorization and identity verification.

We will not discriminate against you for exercising privacy rights under applicable law.

11. U.S. focus and international access

S3 is based in the State of Tennessee, United States. The Platform is operated for U.S. commercial customers; information may be processed and stored in the United States. If you access the Services from another country, you understand that U.S. law may differ from the laws of your residence.

12. Changes to this Policy

We may update this Policy to reflect operational, legal, or product changes. We will revise the “Last updated” date and, for material changes, provide additional notice (for example via email or an in-product notice) when required. Continued use after the effective date of changes constitutes acceptance of the updated Policy, except where applicable law requires another process.

13. Contact

Serenity Software Solutions, doing business as S3 Business Intelligence · the State of Tennessee, United States. Contact: contact@s3-bi.tech. Phone: (662) 912-6830.