Legal

Privacy Policy

Effective date: May 18, 2026 · Antifragile GRC LLC, a Texas limited liability company

Plain English summary: We collect only what we need to provide the service. We don't sell your data. We don't share it with advertisers. Your compliance data belongs to you and you can export or delete it at any time.

1. Who we are

Antifragile GRC LLC ("Antifragile GRC", "we", "us", or "our") provides a compliance management platform for community banks and financial institutions, accessible at app.antifragilegrc.com. Our principal place of business is in Texas, United States.

Questions about this policy: support@antifragilegrc.com

2. Information we collect

Information you provide to us:

Account information: Name, email address, job title, and organization name when you register or are added as a user
Organization information: Bank name, address, regulator, and asset size provided during onboarding
Compliance data: All content you enter into the platform — obligations, risks, controls, policies, complaints, findings, and related records. This is your data; we process it only to provide the service
Inquiry information: Name, email, phone, and organization details submitted through our website contact form
Payment information: Billing contact details. Payment card or bank account details are handled directly by our payment processor and are not stored by us

Information collected automatically:

Login timestamps and IP addresses (for security and audit purposes)
Actions taken within the platform (for audit log functionality)
Browser type and operating system (for troubleshooting)

We do not use third-party analytics, advertising trackers, or cookies beyond what is required to operate the platform session.

3. How we use your information

To provide, maintain, and improve the compliance platform
To set up and manage your account
To send service communications — account setup, password resets, product updates
To respond to support requests
To process payments and manage billing
To maintain security and prevent fraud
To comply with legal obligations

We do not use your compliance data to train machine learning models, benchmark against other clients, or for any purpose other than providing the service to you.

4. How we share your information

We do not sell your personal information. We do not share it with advertisers or data brokers. We share information only in these limited circumstances:

Service providers: Infrastructure providers (Railway for hosting, Google Workspace for email) who process data on our behalf under confidentiality obligations
Payment processing: Payment processors who handle billing transactions
Legal requirements: When required by law, regulation, or valid legal process
Business transfers: In the event of a merger or acquisition, with notice to you

5. Data retention

We retain your account and compliance data for the duration of your subscription and for 90 days after termination, during which you may export your data. After 90 days, data is permanently deleted unless we are required by law to retain it longer.

Inquiry data submitted through the website form is retained for 12 months.

6. Your rights

You have the right to:

Access: Request a copy of the personal information we hold about you
Correction: Update or correct inaccurate personal information
Deletion: Request deletion of your personal information (subject to legal retention requirements)
Export: Download all your compliance data as an Excel file at any time from within the platform
Portability: Receive your data in a machine-readable format

To exercise these rights, contact support@antifragilegrc.com. We will respond within 30 days.

7. Security

We use industry-standard security measures including encrypted connections (TLS), hashed passwords, and access controls. We limit access to personal data to personnel who need it to provide the service.

No system is perfectly secure. If we become aware of a security breach affecting your data, we will notify you promptly in accordance with applicable law.

8. Data location

Your data is stored on servers located in the United States. If you are accessing the platform from outside the United States, your data will be transferred to and processed in the United States.

9. Children's privacy

Our platform is designed for use by financial institutions and their employees. We do not knowingly collect information from anyone under 18 years of age.

10. Changes to this policy

We may update this policy from time to time. We will notify you of material changes by email or by a notice within the platform at least 30 days before the change takes effect. Continued use of the platform after that date constitutes acceptance of the updated policy.

11. Contact

Antifragile GRC LLC
Texas, United States
support@antifragilegrc.com