Expert Understudy Privacy Policy

Version 1.0, effective November 5, 2026. This policy applies to the Expert Understudy only: the free pilot (called the beta in our Terms of Service) at expert.wallaceunderstudy.io. The Wallace Understudy product for firms has its own privacy policy at wallaceunderstudy.io, and the Wallace investing platform has a separate privacy policy at wallacefinance.io.

The Short Version

The Expert Understudy is software for experts in any field. It interviews you, draws a map of what you know, and builds a playbook you and your team can ask, and, if you read your client files on the Client data tab, checks that playbook against summaries of them. This policy explains what we do with information about the people who use it.

The most important things to understand:

• What you type reaches us. Interview answers, questions in Ask, answers to checks, and documents you upload reach our servers and our AI provider. Keep details about your clients, patients, and customers out of them. If any get in, we take steps to remove them before storing: a document or question holding a Social Security number written with dashes, a valid payment card number, or a labeled account number is refused, as is a document whose title is only a client’s name, and an automated privacy step takes out client names, contact details, ID numbers, dates of birth, and exact amounts before the text is kept. That step is best effort, and it does not remove health information. Answers to checks are kept as you typed them.
• Meeting transcripts are scrubbed first. Names and identifiers are replaced on your own computer before anything leaves it; amounts and partial account numbers may remain. The transcript itself is never stored by us, though the statements drawn from it and the short quotes behind them are, whether or not you confirm them. Name detection is good, not perfect, so check the preview; meeting notes read in bulk from a connected folder are sent without one.
• Client files are read in your browser. On the Client data tab, a client file is read on your own computer. Its column names are sent to us first, before you review it, and when you read the file a summary follows: counts, dates by month or year, numbers in bands, the labels you release, and staff codes. The file, whole rows, and the values of private columns stay on your computer. Detection of identifying columns is best effort. Section 3 explains.
• We do not train AI on your content. Not your documents, not your playbook, not your questions, not the answers. Not to improve our product, not to benefit another customer, and not in any aggregated or de-identified form.
• We do not sell personal information, and nothing inside the Services is used for advertising. On our marketing website only, we use Google Analytics and the LinkedIn Insight Tag. You can opt out at any time; see Section 6.
• This is not a place for sensitive data. We do not ask for health information, information about children, government identifiers, or financial account numbers, and the Services are not built to hold them. Nothing in the Services detects or removes health information or information about minors, so keep it out, and on the Client data tab mark any column that holds it private. Section 2.1 explains.

What we do have is your account information, your interview answers and your map, the documents you choose to upload, the statements drawn from your meetings and the quotes behind them, what we learn from summaries of the client files you read on the Client data tab, your playbook, your recent chats, and operational data about how the software is running.

1. Who We Are and What This Covers

Wallace Finance Co., a Delaware corporation doing business as Wallace (“Wallace,” “we,” “us”), provides the Expert Understudy, a free beta software product that captures an expert’s knowledge as a map and a playbook used for training, continuity, and succession (the “Services”). We are based in Chicago, IL. Our mailing address for legal notices is our registered agent at 8 The Grn, Ste B, Dover, DE 19901. You can reach us at support@wallacefinance.io.

This policy covers personal information we handle in connection with the Services and our marketing website, including information about:

• Experts, meaning the people who open an account and whose knowledge is captured in a map and a playbook.
• Team Members, meaning the people an Expert invites to a seat.
• Prospective users and website visitors.

This policy does not cover your own clients, patients, or customers, except for the summaries of client files you read on the Client data tab, described in Section 3, which we hold for you. Otherwise the Services are not meant to receive information about them; if you enter it anyway, Section 3 says what happens to it. This policy also does not cover your own privacy practices; you are responsible for those.

Roles

Where a business opens the account, we act as a service provider and processor for that business with respect to its interview answers, documents, meeting statements, client file summaries and the facts learned from them, map, playbook, chats, and output, and we process that material only on its documented instructions and only to provide the Services. Where you open the account for yourself, you own that material, and we hold it to provide the Services to you and for no other purpose. In both cases we act as the business and controller for account registration data, support communications, marketing contacts, and service telemetry, for our own limited purposes.

2. What We Collect

Account and identity. Examples: Name, email, practice name, seat assignment, credentials and authentication data. Passwords are held only as salted hashes by our authentication provider.; Why and how long: To create and secure accounts, provide seats, and provide support. Retained until the account closes, plus the periods in Section 7.

Interview and map. Examples: What you type in the interview and the Interview screen, including your role, your background, and what the map is for; the areas and questions of your map; and your answers. Your answers reach our servers and our AI provider as you wrote them. An automated step takes client details out before an answer is kept.; Why and how long: To build your map and playbook. Retained until you erase your understudy content or the account closes.

Documents. Examples: The cleaned text of procedures, policy manuals, checklists, standards, and templates you upload (the original file is not kept); the items distilled from them; and the search index built from their passages, all stored with your account.; Why and how long: To build and maintain the playbook. Retained until you delete them, you erase your understudy content, or the account closes.

Meeting transcripts. Examples: Transcripts you supply from any notetaker. Names and identifiers are replaced on your own computer before anything is transmitted; amounts and partial account numbers may remain. Meeting notes read in bulk from a connected folder are sent without a preview.; Why and how long: To distill candidate statements for you to confirm or reject. The transcript itself is not stored. Statements waiting for your review, and the short quotes behind them, are kept until you confirm or reject them or erase your understudy content; a rejected statement is deleted. Confirmed statements and their quotes are kept until you erase your understudy content or the account closes.

Client files. Examples: If you use the Client data tab: each file’s column names, sent when the file is read and before the review card is shown, and, when you choose “Read this file,” a summary: for every column, its name, type, and how many cells are filled, empty, or distinct; for shared columns, dates as months or years, numbers as bands with a median band, the category labels you release, yes/no counts, and ID shapes; counts across pairs of shared columns, with any group of one or two rows withheld; staff codes in place of staff names; and the file’s row count, the months it covers, a fingerprint of the file, and your answers to the card’s questions. Never the file, whole rows, or the values of private columns. Section 3 explains.; Why and how long: To learn how you work and to run Validation. The summary itself is not kept. We keep the facts learned from it, the column names and what each means, which columns were private (names only), the released labels and staff codes, each file’s row count, months covered, and fingerprint, and your Validation history, until you erase your understudy content or the account closes. Deleting a client file takes its facts out of use, but they stay stored until you erase.

Playbook. Examples: The compiled claims, the quotes they rest on, sign-offs, rulings, conflicts, open questions, and version history.; Why and how long: To build and maintain the playbook and its provenance record. Retained until you erase your understudy content or the account closes.

Questions and output. Examples: Questions you and your Team Members ask, the answers returned with their citations, check answers and grades, and questions routed to you. A question refused for holding a Social Security number written with dashes, a valid payment card number, or a labeled account number is not stored; other client details are removed by the privacy step before a question is saved. Check answers are stored as typed, without the privacy step.; Why and how long: To operate Ask, Checks, and routing. Saved chats are retained for thirty (30) days. Routed questions, answers, and check records are retained until you erase your understudy content or the account closes.

File names. Examples: If you use Connect a folder, the folder and file paths in that folder, not only the file names, from a folder on your computer or, where offered, a Microsoft OneDrive or SharePoint folder.; Why and how long: To sort your documents and meeting notes. The names of files you add are kept with them, after the privacy step, until you delete the document, erase your understudy content, or the account closes; a document whose title is only a client’s name is refused.

Service telemetry. Examples: Which screens are opened and which actions are taken, by account identifier; error and exception reports; latency and performance data; device and browser type; IP address; approximate region derived from IP.; Why and how long: To operate, secure, debug, and improve the software. Not configured to capture the substance of your content. Product analytics are tied to your account and organization identifiers. Usage counts are kept about thirteen months; analytics events and error reports are kept by PostHog and Sentry under their own retention periods.

Security and audit logs. Examples: Sign-in events recorded by our authentication provider, and application and hosting logs, which record identifiers, codes, and counts, not content. We do not keep a separate record of administrative actions.; Why and how long: To detect and investigate unauthorized access. Kept for the periods our providers set; the backend’s logs currently have no expiry.

Bot check. Examples: When the check is on, signals from your browser and your IP address, processed by Cloudflare at sign-up.; Why and how long: To keep automated sign-ups out.

Communications. Examples: Emails, support tickets, and feedback about the beta.; Why and how long: To respond, support, and maintain a record of the relationship. Retained three years after last contact.

Website data. Examples: Pages viewed, referring source, device and browser information, approximate location derived from IP address, and identifiers set by strictly necessary cookies, Google Analytics, and the LinkedIn Insight Tag on our marketing site at wallaceunderstudy.io.; Why and how long: To operate and measure the website and to measure and target our own advertising on LinkedIn. See Section 6.

Business contact information. Examples: Name, business email, company, and job title of prospective customers and other business contacts, collected from sign-ups, correspondence, events, referrals, and publicly or commercially available professional sources.; Why and how long: To send marketing email and, unless you opt out, to show our ads to you on LinkedIn. Retained until you opt out or three years after last contact.

2.1 What We Do Not Ask For

We do not ask for, purchase, or set out to collect any of the following, and the Services are not designed to hold or produce them. Our Terms of Service bar you from entering them.

• Biometric identifiers or biometric information as defined in the Illinois Biometric Information Privacy Act, 740 ILCS 14/10, the Texas Capture or Use of Biometric Identifier Act, or Washington RCW 19.375. We do not process retina or iris scans, fingerprints, voiceprints, or scans of hand or face geometry.
• Consumer health data as defined in the Washington My Health My Data Act, RCW 19.373, or Nevada NRS 603A.400 et seq. We do not use geofencing around any health care facility.
• Genetic data, neural data, or neurotechnology data.
• Precise geolocation.
• Protected health information subject to HIPAA. We are not a covered entity or a business associate, and we will not enter a business associate agreement.
• Personal information of anyone under 18. The Services are for adults and are not directed to children.
• Social Security numbers, tax identification numbers, financial account numbers, or government identification numbers. Documents and questions holding a Social Security number written with dashes, a valid payment card number, or a labeled account number are refused automatically.

Because the Services accept what you type and upload, we cannot promise that none of this will ever reach us. If it does, it was supplied contrary to our Terms of Service. We handle it like the rest of your content, with the protections in this policy, and you can ask us to delete it at any time. Nothing in the Services detects or removes health information or information about minors: the privacy step does not remove it, and on the Client data tab a column you leave shared is summarized like any other, with its counts and, if you release them, its labels. Mark such columns private, and keep such details out of column names and everything else you type or upload. This applies to clinicians and to anyone who works with children.

We do not process sensitive personal information for the purpose of inferring characteristics about an individual.

3. What Reaches Us and What Does Not

Client files you read on the Client data tab are read in your own browser, and only their column names and the summary described below leave your device. Nothing here should be read as a promise that any other client information stays on your device. Here is what actually happens to what you put in.

Client files. On the Client data tab you can read your own client files, such as spreadsheets and exports from the tools you work in. A client file is opened and read in your browser. The file itself, whole rows, and the values of any column marked private never leave your computer. When a file is read, its column names are sent to us, where our AI provider suggests which columns identify clients and what each column holds. This happens before the review card is shown, so column names should not contain client details; if they do, those details reach us and our AI provider. The card then shows the column names, which columns are marked private, each column’s type, and the category labels and staff codes proposed for release. You can mark columns private or shared, choose which labels to release, and answer questions about columns. The card does not show the counts, bands, and months that will be sent.

What a client file sends. When you choose “Read this file,” your browser sends: for every column, its name, its type, and how many cells are filled, empty, or distinct, and for a private column only that; for shared columns, dates as months or years (never a day), amounts and other numbers as bands with a median band (never an exact amount), category columns as the labels you release (a label is proposed only if it has at most 40 characters and appears in at least 3 rows, and at most 25 are proposed per column), yes/no columns as counts and the spellings used, and ID columns as their shape and how many values repeat; counts across pairs of shared columns, with any group of one or two rows withheld; staff codes (Staff 1, Staff 2, and so on) in place of staff names, sent without a separate release step when a column is detected as naming staff; and the number of rows, the months the file covers, a fingerprint (a one-way hash) of the file, and your typed answers to the card’s questions. An answer holding a date, an amount, a known client name, or an account number is blocked in your browser. A later file with the same columns as one already read is summarized with your earlier choices and stored without showing the card again.

What we keep from client files. Our AI provider reads the summary and writes facts about how you work. We keep those facts; the column names and what each means; which columns were private (their names only); the released labels and staff codes; and, for each file, its row count, months covered, and fingerprint. The summary itself is not kept. Deleting a client file takes its facts out of use, but they stay in our database until you erase your understudy content (Section 7). Detection of identifying columns and values is best effort, and nothing detects health information or information about minors. You decide what you mark shared, and you are responsible for it.

Validation. Validation compares your playbook with the facts learned from your client files and shows where they agree and where they differ; the comparison is made by our AI provider. It shows this notice in every state: “Validation asks whether a captured rule is still right. It measures the playbook against activity, not a person against the playbook: nothing here is an employment, performance, or compliance metric, and Wallace is not a compliance, supervision, or surveillance system.” Every seat on your account can view Validation.

Meeting transcripts. When you supply a transcript, code running in your own browser replaces names and identifiers on your own computer; amounts, including round amounts and balances, and partial account numbers (for example “card ending 4417”) can remain. When you add a transcript on its own, you see the result, and only that version is transmitted; meeting notes read in bulk from a connected folder are scrubbed the same way and sent without a preview. It is used to distill candidate statements, each with a short quote from the transcript as its source, kept whether or not you confirm it. You confirm or reject each statement; statements you do not confirm never become part of the playbook, and rejecting a statement deletes it without a record, so the same transcript can suggest it again. The transcript is not retained in any form.

Interview answers. What you type in the interview reaches our servers and our AI provider’s privacy step as you wrote it. That automated step takes client details out first; the interviewer reads the scrubbed version, and that is what we keep. An answer that is only about one client is refused.

Questions in Ask. A question reaches our servers as you wrote it. If it holds a Social Security number written with dashes, a valid payment card number, or a labeled account number, it is refused and is not stored. Otherwise our AI provider’s privacy step takes client details out before the model that answers reads it, and the scrubbed version is saved with the chat for thirty days. The step is best effort, so keep client details out.

Documents. Documents are different, and we say so plainly. When you upload a procedure or a policy manual, it is read and distilled by an AI provider into quotable items, each passage is indexed so a question can find it, and those items and the document’s cleaned text are stored with the account, because storing them is what makes the product work. The original file is not kept. A document is refused if it holds a Social Security number written with dashes, a valid payment card number, or a labeled account number, or if its title is only a client’s name. A scanned document’s pages are sent to our AI provider to be read before that check runs. Other text goes to our servers, where the privacy step takes out client names, contact details, ID numbers, dates of birth, and exact amounts before the text is stored; a document waiting in the queue holds its raw text until that step runs. The privacy step does not remove health conditions, and it can miss things. You can delete any stored document at any time.

Connect a folder. You can connect a folder on your computer or, where offered, a Microsoft OneDrive or SharePoint folder. The folder and file paths in it, not only the file names, are sent to an AI provider so the documents and meeting notes can be sorted, passing through the privacy step first. A file whose name holds client details is not sorted. Files that look like versions of one another are read in your browser to compare them, and none of that is kept on our servers; your browser keeps the folder’s file names, paths, and a fingerprint of each file (Section 6). Spreadsheets stay on your computer unless you open one on the Client data tab, which sends its column names and summary as described above.

An honest statement about scrubbing.

We say “scrubbed” rather than “anonymized” on purpose. Scrubbing is automated, and name detection and the privacy step are good, not perfect. Text that has been scrubbed may still say enough to identify someone to a person who knows the facts. A client file summary is built to leave identifying columns behind, but a released label or staff code could still identify someone to a person who knows the facts, and detection of identifying columns is best effort. The key to your staff codes and the list of client names your browser keeps stay on your computer and are never sent to us. We do not attempt to re-identify anyone, we contractually prohibit our subprocessors from attempting it, and we treat any information that could reasonably be linked back to an individual as personal information under this policy.

4. How We Use Information

We use personal information to:

• Provide, operate, maintain, and secure the Services, including conducting the interview, building and updating maps and playbooks, learning from client file summaries and running Validation, answering questions, grading checks, sorting connected folders, and routing questions to the Expert.
• Create and administer accounts, provide and revoke seats, and authenticate people.
• Provide support and respond to inquiries.
• Detect, investigate, prevent, and respond to security incidents, fraud, and abuse, and enforce our Terms of Service.
• Understand how the software performs and where it fails, using service telemetry, and fix and improve it.
• Send service and administrative messages, including security notices, notice of changes to the beta, and material changes to our terms.
• Ask for feedback about the beta, and send marketing communications to business contacts and advertise our own products to business professionals on LinkedIn, in each case subject to opt-out.
• Comply with law and legal process, and establish, exercise, or defend legal claims.

4.1 What We Will Not Do With It

These are commitments, not descriptions of current practice, and we will not change them for content you have already supplied.

(a) No AI training on content. We do not use interview answers, maps, documents, meeting-derived content, client file summaries, playbooks, questions, or output to train, fine-tune, evaluate, or improve any artificial intelligence or machine learning model, and we do not permit any subprocessor to do so. This applies to identified, de-identified, and aggregated forms alike.

(b) No cross-customer use. We do not use one customer’s information to provide, improve, or benchmark the Services for anyone else. We do not build cross-customer comparisons, industry benchmarks, or peer cohorts from customer content.

(c) No sale, and no advertising use of your content. We do not sell personal information, as that term is defined in California Civil Code section 1798.140(ad), and we have never done so. We do not use or disclose interview answers, maps, documents, meeting-derived content, client file summaries, playbooks, questions, or output for advertising of any kind, and we serve no advertising cookies or third-party ad pixels inside the Services. On our marketing website only, we use the LinkedIn Insight Tag, and we may share business contact information with LinkedIn to advertise our own products. Some state laws treat this as sharing for cross-context behavioral advertising or as targeted advertising. Section 6 explains how to opt out.

(d) No employment or eligibility use. We do not provide personal information or output to anyone for the purpose of evaluating an individual for employment, credit, insurance, housing, or any other purpose enumerated in 15 U.S.C. 1681b.

(e) Limited human access. Our people do not read your content, except where you ask us to for support, where we need to in order to investigate a security issue, abuse, or a breach of our terms, or where the law requires it. The application gives our staff no screen that shows your interview answers, map, playbook, chats, or documents; our administrator console shows account details, seat names, usage, counts of documents and playbook versions, and answers given to the onboarding profile. Personnel who administer the database can reach your content directly, and do so only for the purposes above.

4.2 Automated Processing

The Services use artificial intelligence to conduct the interview, write the map and the playbook, read summaries of your client files and compare what they show with the playbook in Validation, and answer questions. Claims in the playbook are drafted by AI from what you supply. You can sign or correct any claim, reject a statement drawn from a meeting, leave a document out, and settle conflicts. The Services do not make decisions about any individual, do not replace or substantially replace human decision-making, and are contractually prohibited from being used as a basis for employment, compensation, or eligibility decisions. Checks are a training aid, not an evaluation of a person, and Validation asks whether a captured rule is still right: it measures the playbook against activity, not a person against the playbook.

On reasonable request we provide documentation of the Services’ intended uses, known limitations, categories of data processed, and guidance on human review.

5. Who We Share Information With

We disclose personal information only to the following categories of recipients. Except for Google, Microsoft, and LinkedIn, each is under a written contract that limits use to providing services to us, prohibits sale and sharing, prohibits use for any other purpose, prohibits combining our data with data from other sources, and requires equivalent protections and flow-down to any subcontractor. Google and LinkedIn receive the marketing website information (and, for LinkedIn, the business contact information) described below, Google and Microsoft receive the sign-in and folder information described below, and each uses it under its own terms and privacy policy.

Anthropic PBC. Function: Artificial intelligence processing, nearly all of it; What it receives: Interview answers, questions, map edits, document titles, and document text as you wrote them, which its privacy step reads before cleaning them; page images of scanned documents; the column names and summaries of client files you read on the Client data tab, and the facts learned from them, for Validation; stored document text; scrubbed meeting content; playbook claims; check answers, for grading; and the folder and file paths of a connected folder, as described in Section 3, for the purpose of running the privacy step and the interview, reading documents and client files, building the playbook, running Validation, answering questions, grading checks, and sorting folders. Accessed under Anthropic’s commercial terms, which prohibit training on customer content.

OpenAI, L.L.C. Function: Search index; What it receives: Stored document text, playbook claims, confirmed statements, facts (including facts learned from client files), answers, and the text of questions, to produce the numerical embeddings that let a question find what answers it. Accessed under OpenAI’s API terms, under which data sent through the API is not used to train or improve OpenAI models; abuse-monitoring logs are retained for up to thirty (30) days, then deleted.

Amazon Web Services, Inc. Function: Backend hosting; What it receives: The backend service runs here: it runs the privacy step and the interview, reads documents and client file summaries, and answers questions, so the content it handles passes through it, in the United States. Its logs record identifiers, codes, and counts, not content, and currently have no expiry (see Section 2).

Supabase. Function: Database hosting and authentication; What it receives: Account data, interview answers, maps, the cleaned text of stored documents, playbooks, what we keep from client files, chats, settings, and sign-in logs, held in a database protected by row-level security scoping every record to a single account. Passwords are held only as salted hashes by this provider. Hosted in the United States (Amazon Web Services, Ohio) since the move described in Section 14, and in Canada (Amazon Web Services, Montreal) from September 2026 until then.

Vercel. Function: Application hosting and delivery; What it receives: Application traffic, request metadata, and telemetry. The web application running here also extracts meeting statements, grades checks, reads scanned pages, and sorts connected folders, calling Anthropic. Content transits but is not persisted by this provider.

Resend. Function: Transactional email; What it receives: Recipient email address and message content for sign-in links, password resets, invitations, routed-question notifications, and notices that you have been added to a team.

PostHog, Inc. Function: Product analytics; What it receives: Pageviews and the actions taken, tied to your account and organization identifiers. Events from your browser go through our own domain; events sent from our servers go directly to PostHog. Text capture and session recording are turned off. It never receives the content of your documents, playbook, or conversations.

Functional Software, Inc. (Sentry). Function: Error monitoring; What it receives: Error types and code locations, with identifiers and codes, from the application and the backend. Error messages and anything a person wrote are removed before sending.

Cloudflare, Inc. Function: Bot check; What it receives: When the check is on: signals the check gathers from your browser at sign-up, and the token it returns, which we send to Cloudflare with your IP address to verify it.

Microsoft Corporation. Function: Optional sign-in; OneDrive and SharePoint folders; What it receives: If Microsoft sign-in is offered and you use it, Microsoft confirms your identity to us when you sign in. If you connect a OneDrive or SharePoint folder, your browser lists and reads its files from your own Microsoft account through Microsoft Graph, under a sign-in held in your browser, so Microsoft sees the application’s access to that folder.

Google LLC. Function: Website analytics; optional sign-in; What it receives: On our marketing website only: pages viewed, referring source, approximate location derived from IP address, browser and device information, and cookie identifiers, through Google Analytics. Nothing from inside the Services is sent to Google. If Google sign-in is offered and you use it, Google confirms your identity to us when you sign in.

LinkedIn Corporation. Function: Advertising; What it receives: On our marketing website only: information collected by the LinkedIn Insight Tag (pages visited, referring page, IP address, browser and device information, and cookie identifiers) and, unless you opt out, hashed business email addresses and company names of business contacts that we upload so our ads can reach them on LinkedIn. Nothing from inside the Services is sent to LinkedIn.

We also disclose information:

• To professional advisors, such as our lawyers, accountants, auditors, and insurers, under duties of confidentiality.
• To a governmental or regulatory authority, court, or party to legal process, where legally required. If we receive legal process seeking your information, we will notify you before producing anything unless we are legally prohibited from doing so, and will give you a reasonable opportunity to object or seek protection.
• In connection with a merger, acquisition, financing, reorganization, or sale of assets, including a transfer of the Wallace Understudy business to a separate entity under common ownership. The recipient will remain bound by commitments no less protective than this policy, and we will give notice.
• Where you direct us to. Team Members you invite see your playbook and Validation, can open the Knowledge map, and can ask the playbook questions. You can show the Showcase, a page that presents your Knowledge map with what you choose left out, to someone yourself, such as a prospective client or a buyer; it is shown on your own screen, not shared by a link, and we send nothing from it to anyone.

We maintain a current list of subprocessors in Exhibit B of the Expert Understudy Data Protection and Security Addendum and will give at least thirty (30) days’ notice before adding a new one that handles your content.

5.1 Questions Routed to the Expert

A Team Member’s question that the playbook does not cover can be routed to the Expert. The Expert sees the question without the name of the person who asked it. The record of the question and its answer remains with the account, and the answer, once given, is added to the playbook.

6. Cookies and Tracking

Inside the Services we use cookies and local storage for authentication, session management, security, and your preferences, and one first-party analytics cookie, set by PostHog, to count which screens are opened and which actions are taken, tied to your account. If you use the Client data tab, your browser also keeps, on your computer, a list of up to 5,000 client names seen in your client files and the key to your staff codes, so it can take client names out of meeting notes; neither is sent to us. If you connect a folder, your browser keeps the folder’s file names and paths and a fingerprint of each file, so it can tell versions apart. Signing out and erasing your understudy content do not clear these records; clearing your browser’s data for this site does, which matters on a shared computer. We do not run advertising cookies, cross-site trackers, or session-replay tools that capture keystrokes or screen content inside the Services.

On our marketing website we use strictly necessary cookies, Google Analytics to measure traffic, and the LinkedIn Insight Tag to measure and target our own advertising on LinkedIn. These tools set cookies or similar identifiers in your browser. You can opt out of the LinkedIn Insight Tag, and of any upload of your contact details to LinkedIn, at any time: use the Your Privacy Choices control below, email support@wallacefinance.io with the subject line “Opt Out,” or turn on Global Privacy Control in your browser. We treat Global Privacy Control and other recognized opt-out preference signals as a valid opt-out, and when your browser sends one, the LinkedIn tag does not load. You can also block or delete cookies in your browser, adjust your ad settings on LinkedIn, or use Google’s Analytics opt-out browser add-on.

Your Privacy Choices. Select the Your Privacy Choices control on our marketing website to opt out of the LinkedIn Insight Tag on this browser. To stop any upload of your contact details to LinkedIn, also email support@wallacefinance.io with the subject line “Opt Out.”

7. Retention

We keep personal information only as long as needed for the purpose it was collected, and then delete or de-identify it. Specific periods appear in the table in Section 2. Beyond those:

• Your content, meaning interview answers, maps, documents, meeting statements, what we keep from client files, playbooks, and output, is retained until you delete or erase it or your account closes. Saved chats expire after thirty (30) days. We do not yet delete quiet accounts automatically.
• You can act before we do. You may delete any stored document at any time. Deleting a client file takes its facts out of use, but they stay stored until you erase. Erasing your understudy content in Settings deletes all of it: your playbook and its versions, documents and the folders they are filed in, what we keep from client files and your Validation history, meeting statements, your interview and map, every seat’s Ask conversations and saved chats, the questions Ask could not answer, checks, routed questions, and your Showcase choices, so you start again from the interview. It does not delete your account, its seats, your onboarding profile, or usage counts, and it does not clear what your browser keeps (Section 6).
• Closing your account. Email support@wallacefinance.io with the subject line “Close My Account” (Settings shows the address). We will delete your content and account records within thirty (30) days and confirm in writing on request. Error reports held by Sentry, product analytics held by PostHog, which are tied to your account, and email send logs held by Resend are not deleted with the account and expire under those providers’ own retention.
• If the beta ends. We will give notice as our Terms of Service describe, you may ask for a copy of your content for thirty (30) days after access ends, which we prepare by hand (your map and playbook in a common format and the stored text of your documents; original files are not kept), and we will then delete it.
• We retain records we are independently required to keep, including financial and tax records, for the applicable statutory period.
• Backups are kept by our database provider on a rolling cycle and then purged. Deleted content may persist in backups until that cycle completes and is not restored to active use.

8. Security

We maintain administrative, technical, and physical safeguards designed to protect personal information, described in detail in the Expert Understudy Data Protection and Security Addendum. They include encryption in transit and at rest, password or single-use-link sign-in (or, where offered, Google or Microsoft sign-in) with passwords held only as salted hashes by our authentication provider, multi-factor authentication on the provider dashboards we use to administer production (Supabase, Vercel, Amazon Web Services, and Stripe), row-level tenant isolation, least-privilege access control with periodic review, secure development practices, vendor due diligence, and a written incident response plan. Our application’s own administrator console is limited to an allowlist of named Wallace administrators and does not yet require multi-factor authentication. For account support, that console can, among other things, issue a single-use link that sets the password of an account.

If we confirm a security incident affecting your information, we will notify you without undue delay and in any event within seventy-two (72) hours of confirmation, provide the information you need to meet any notification obligations of your own, and reasonably cooperate in your response. We will not notify your clients or regulators on your behalf without your written consent unless we are independently required to.

No system is perfectly secure. We do not warrant that the Services will be immune from every threat, and our obligations are those stated in the Terms of Service and the Expert Understudy Data Protection and Security Addendum.

9. Your Privacy Rights

Depending on where you live and in what capacity you interact with us, you may have some or all of the rights below. We honor these rights for all U.S. residents regardless of state, rather than making you prove residency in a qualifying state.

Know and access. What it means: Ask what personal information we hold about you, the categories of sources, the purposes, the categories of recipients, and receive a copy in a portable format.

Correct. What it means: Ask us to correct inaccurate personal information.

Delete. What it means: Ask us to delete personal information about you, subject to exceptions where we must keep it to complete a transaction, provide a service you requested, detect security incidents, comply with law, or exercise or defend legal claims.

Portability. What it means: Receive personal information in a structured, commonly used, machine-readable format. There is no self-serve export; we prepare the copy by hand on request.

Opt out of sale, sharing, and targeted advertising. What it means: We do not sell personal information. You can opt out of our use of the LinkedIn Insight Tag and of any upload of your contact details to LinkedIn, which some laws treat as sharing or targeted advertising, using the methods in Section 6. We honor Global Privacy Control and other recognized opt-out preference signals.

Limit use of sensitive personal information. What it means: We do not use sensitive personal information to infer characteristics, so this right is not engaged. We will still honor a request.

Opt out of profiling. What it means: Ask not to be subject to profiling in furtherance of decisions producing legal or similarly significant effects. The Services are not designed to make such decisions.

Non-discrimination and non-retaliation. What it means: We will not deny service, charge a different price, provide a different quality of service, or retaliate against you for exercising a privacy right.

Appeal. What it means: If we deny a request, you may appeal by replying to our decision. We will respond within forty-five (45) days with our decision and reasoning, and will tell you how to contact your state attorney general if you disagree.

9.1 How to Exercise a Right

Email support@wallacefinance.io with the subject line “Privacy Request.” Tell us which right you are exercising and give us enough information to locate your records. We will verify your identity in a manner proportionate to the sensitivity of the request, generally by confirming control of the email address associated with your account. We will not ask for more information than we need, and we will not use information you give us for verification for any other purpose.

We respond within forty-five (45) days, and may extend once by another forty-five (45) days where reasonably necessary, with notice to you. There is no charge unless a request is manifestly unfounded or excessive, in which case we will tell you before proceeding.

An authorized agent may submit a request on your behalf with written permission signed by you, and we may ask you to verify the agent’s authority directly.

A note for Team Members.

The information in an account belongs to the Expert or the business that opened it, and much of it is held for them. The fastest route is to raise a request with them. If you contact us instead, we will help, and we will forward your request to them where it concerns records they control.

9.2 State-Specific Disclosures

As of the date of this policy, twenty states have comprehensive consumer privacy laws in effect: California, Virginia, Colorado, Connecticut, Utah, Florida, Oregon, Texas, Montana, Delaware, Iowa, Nebraska, New Hampshire, New Jersey, Tennessee, Minnesota, Maryland, Indiana, Kentucky, and Rhode Island. Oklahoma and Louisiana take effect January 1, 2027, Alabama on May 1, 2027, and Vermont on January 1, 2028. Most of these laws do not apply to individuals acting in a commercial or employment context, which is the capacity in which many people use the Services. An Expert who uses the Services for personal projects is not in that context, and these laws apply directly where their thresholds are met. We extend the rights in Section 9 to all U.S. residents regardless.

California

California is the one state whose law covers personal information about individuals acting in a business or employment capacity, so it applies to you in full.

• Categories of personal information collected in the preceding twelve months, using the statutory categories: identifiers; personal information under California Civil Code section 1798.80(e); commercial information; internet or other electronic network activity information; professional or employment-related information; and inferences drawn from the foregoing, limited to inferences about professional process rather than about personal characteristics. We collect no biometric information, no geolocation beyond approximate region derived from IP address, no sensory data, no education records, and no protected classification characteristics.
• Sources: directly from you, from the Expert or business that invited you, from your device and browser as you use the Services, and from our service providers.
• Business and commercial purposes: those listed in Section 4.
• Categories disclosed for a business purpose in the preceding twelve months: identifiers, professional or employment-related information, commercial information, and internet activity information, disclosed only to the service providers listed in Section 5, including Google as our website analytics provider.
• Sale and sharing: we have not sold personal information, in the preceding twelve months or at any time. Beginning September 28, 2026, we share identifiers (such as cookie identifiers and hashed business email addresses) and internet or other electronic network activity information from our marketing website with LinkedIn for cross-context behavioral advertising. We did not share personal information in the twelve months before that date. We do not knowingly sell or share the personal information of anyone under 16. You can opt out through the Your Privacy Choices control in Section 6, by email, or with Global Privacy Control.
• Sensitive personal information: we do not ask for it, and we do not use or disclose it for purposes that would require a limitation right. Our service providers hold account passwords as salted hashes.
• Data broker status: we are not a data broker as defined in California Civil Code section 1798.99.80. We do not sell personal information, and we collect personal information directly from individuals with whom we or our customers have a direct relationship.
• Service provider status: where a business opens the account, we are a service provider under California Civil Code section 1798.140(ag) with respect to its content. We do not retain, use, or disclose that content for any purpose other than the specific business purposes set out in our written agreement with the business, we do not combine it with information from other sources, and we do not use it outside the direct business relationship.
• Retention: we do not retain personal information longer than reasonably necessary for the purposes described. Specific periods are in Sections 2 and 7.

Colorado, Connecticut, Montana, Delaware, Minnesota, Maryland, New Jersey, Oregon, New Hampshire, and Rhode Island

Residents of these states have the rights in Section 9, including the right to appeal a denial. We do not ask for sensitive data as those laws define it, do not sell personal data, and do not engage in profiling in furtherance of decisions producing legal or similarly significant effects. We process personal data from our marketing website and our business contact list for targeted advertising on LinkedIn, and you may opt out of that processing as described in Section 6. Minnesota residents additionally have the right to obtain a list of the specific third parties to which we have disclosed personal data; that list is Section 5. Maryland residents should note that we do not sell sensitive data or the personal data of anyone under 18, and we do not use the personal data of anyone we know to be under 18 for targeted advertising.

Virginia, Utah, Iowa, Texas, Nebraska, Tennessee, Indiana, Kentucky, and Florida

Residents of these states have the rights in Section 9 to the extent their laws provide them. As noted, these laws generally exclude individuals acting in a commercial or employment context; we extend the rights anyway.

Nevada

Nevada residents may direct a covered operator not to make a future sale of covered information. We do not sell covered information and have no plans to. You may still submit a request to support@wallacefinance.io.

All states: breach notification

Where a security incident affects personal information and notification is required by the law of your state, we will notify the affected individuals or, where we hold the information on behalf of a business, notify that business so it can notify. We will do so within the shortest period any applicable state law requires.

10. Financial Privacy and Regulation S-P

Wallace Finance Co. is registered with the Securities and Exchange Commission as an investment adviser and is subject to Regulation S-P with respect to its own advisory clients. Those clients are covered by a separate privacy notice available at wallacefinance.io. People who use the Expert Understudy are not advisory clients of Wallace Finance Co. by virtue of using it, and using it creates no advisory or fiduciary relationship. Registration does not mean that the SEC or any other agency has approved, reviewed, or endorsed the Services.

The Services are not designed to hold customer information under Regulation S-P, the Gramm-Leach-Bliley Act, or the Federal Trade Commission Safeguards Rule, and you agree to keep it out, except that on the Client data tab your browser reads your client files and sends only the column names and summary described in Section 3. The facts we keep from those summaries are drawn from client records. If your own practice is subject to those rules, the Data Protection and Security Addendum has a rider for you.

11. Artificial Intelligence Disclosures

Ask, the interview, and the interview session on the Interview screen each show a line saying that you are dealing with artificial intelligence. Checks, the Interview screen’s question dialog, and the playbook page do not show that line, although checks are graded by AI and the playbook’s claims are drafted by AI. We will disclose on request whether any particular interaction involves a generative model. The model providers are Anthropic (nearly all processing) and OpenAI (the search index).

We are not a “covered provider” under the California AI Transparency Act, California Business and Professions Code section 22757 et seq., because the Services are not a publicly accessible generative AI system with more than one million monthly users. Our Terms of Service prohibit using output to make or materially influence a consequential decision about a person.

12. Marketing and Communications

We send marketing email only to business contacts and to people who have signed up, and only where permitted. Every marketing email contains a working unsubscribe link and our physical mailing address, and we honor unsubscribe requests within ten business days as required by the CAN-SPAM Act. We do not send marketing text messages without prior express written consent. Unsubscribing from marketing does not stop transactional and service messages, which are necessary to the Services.

13. Children

The Services are offered only to people who are at least 18 years old. They are not directed to children, and we do not knowingly collect personal information from anyone under 18. If you work with children, keep anything that identifies a child out of the Services. Nothing in the Services detects or removes information about minors, so on the Client data tab mark private any column that holds information about a child, and keep it out of column names. If we learn we have collected such information, we will delete it. If you believe a minor has provided information to us, contact support@wallacefinance.io.

14. Data Location

We store and process your account data and content in the United States: the database is hosted by Supabase on Amazon Web Services in Ohio (us-east-2), the application runs on Vercel and Amazon Web Services, and AI processing runs through Anthropic and OpenAI, all in the United States. From September 2026 until November 2026, the database was hosted by Supabase on Amazon Web Services in Montreal, Canada (ca-central-1), so account data and content stored before the move were held in Canada. Error reports from the web application go to Sentry’s United States region. A small number of named Wallace personnel, including engineering personnel located in India, may access your account data and content remotely to operate and support the Services, under written confidentiality obligations and with access limited to what their role requires.

15. Changes to This Policy

We may update this policy. If we make a material change, we will post the updated policy with a new effective date and notify account holders by email at least thirty (30) days in advance. We will not apply a materially less protective practice to information already collected without giving you notice and the chance to close your account first.

16. Contact

Privacy questions and requests, security matters, and legal notices: support@wallacefinance.io. By mail: Wallace Finance Co., Attn: Privacy, 8 The Grn, Ste B, Dover, DE 19901.

If you are not satisfied with our response, you may contact your state attorney general. California residents may also contact the California Privacy Protection Agency.

Wallace Finance Co. is an SEC-registered investment adviser. Registration does not imply a certain level of skill or training and does not mean any government agency has approved or endorsed the Services. The Expert Understudy is not a compliance, supervision, or surveillance system, and it does not guarantee any regulatory, training, productivity, growth, or client-retention result. Figures shown in the Services and in our materials are illustrative.