Privacy Policy

1. Who we are and what this covers

FFERM Technologies Inc. is a Delaware corporation in the United States. This draft describes how we handle personal information through the FFERM public website, its Resources pages, and the logged-in FFERM Risk Intelligence Platform. Separate agreements with an institution may impose additional or different obligations for its platform data.

Questions or privacy requests may be sent to privacy@ffermtech.com.

2. Information we collect

• Information you provide: name, email address, phone number, organization, role or title, messages, and other details submitted through contact, demo, support, or resource-access forms.
• Account and platform information: usernames, authentication records, role and organization details, risk assessments, controls, reports, uploaded files, and other content provided by an institution or its authorized users.
• Interactions: questions or content submitted to AI-assisted features or the Digital Mind, along with related outputs and feedback. Do not submit confidential customer or institution information to public-facing chat features.
• Technical and usage data: IP address, device and browser details, pages visited, referral and interaction events, diagnostic logs, and identifiers associated with cookies or similar technologies.
• Connected-service data: information supplied through integrations configured by an institution, such as its issue-tracking or governance systems.

3. How we use information

• Provide and secure the website, platform, accounts, simulations, and requested resources; verify email access and respond to inquiries.
• Process institution-provided data to support risk analysis, reporting, AI-assisted features, and authorized integrations.
• Measure usage, diagnose problems, improve functionality, and understand interest in our products and services.
• Communicate about requests, services, and relevant updates, subject to applicable choices and law.
• Protect against misuse, comply with legal obligations, and enforce applicable agreements.

4. Services and recipients

We use service providers for hosting, data storage, communications, analytics, and product features. Depending on the feature used and configuration, information may be processed by:

• Replit and database infrastructure, including PostgreSQL hosting providers such as Neon where configured, for application hosting and storage.
• Resend for delivery of resource links and other transactional email.
• HubSpot for website analytics and customer relationship management when enabled.
• Google Analytics and, where configured, Google Ads for usage measurement and advertising-related events.
• Delphi for Digital Mind conversations embedded on the public site.
• OpenAI services accessed through Replit's AI integration for AI-assisted platform features when those features are used.
• Institution-selected integrations, including services such as Jira or ServiceNow when connected, to exchange information needed for the configured workflow.

5. When information is shared

We may share information with the providers above to deliver requested functions, with an institution and its authorized users as needed to provide its service, when required by law or to protect rights and security, or in connection with a corporate transaction. Analytics or advertising integrations may involve sharing online identifiers; applicable privacy laws may give you additional choices about that activity.

A third-party service may apply its own privacy terms when you interact with it directly. Please review those terms before submitting sensitive information.

6. Cookies and similar technologies

Essential session technologies support login, security, and email-verified access to simulations. Analytics and marketing services such as Google and HubSpot may set or read cookies and similar identifiers when active. You can manage cookies in your browser and use the privacy controls offered by those providers. Disabling essential cookies may prevent account or simulation access.

We do not claim that a browser's Do Not Track signal is honored uniformly by every provider. Contact us about choices available under applicable law.

7. Retention and security

We keep information as needed for the purposes described here, contractual requirements, security, and applicable law; retention periods depend on the type of record and agreement. Emailed resource links expire after 30 days, but associated request records may be kept longer. You may ask about retention of a particular category at the address below.

We use administrative and technical safeguards appropriate to the information involved. No internet transmission or storage system can be guaranteed completely secure. Authorized institutions are also responsible for managing their users and the information they submit.

8. Your choices and rights

Depending on your location, you may have rights to request access, correction, deletion, or a copy of personal information, and to object to or limit certain processing. Email privacy@ffermtech.com with a request; we may verify your identity and may need to coordinate platform-data requests with the institution that controls that data. You can also manage marketing communications through the options provided in those messages.

9. Children and international processing

The services are intended for people age 13 or older. We do not knowingly collect personal information from children under 13; contact us if you believe that has occurred.

Information may be processed in the United States or other locations where our service providers operate. Different locations may have different privacy protections; we handle transfers in accordance with applicable requirements.

10. Changes and contact

We may update this policy as our services and practices change. We will post an updated version here and provide additional notice where required by law or agreement. For privacy questions or requests, email privacy@ffermtech.com.