Privacy Policy

Version 1.4, effective September 30, 2026. This policy applies to the Wallace Understudy service only (formerly marketed as Wallace Succession). The Wallace investing platform has a separate privacy policy at wallacefinance.io.

The Short Version

Wallace Understudy is business software sold to firms. This policy explains what we do with information about the people who use it: advisors, team members, successors, and administrators.

The most important thing to understand is what we do not have.

• We do not receive your clients' data. Client files are read and analyzed by code running in your own browser. The raw files are never sent to us; from them, only de-identified patterns leave your device: households and accounts become codes, dollar values become ranges, dates become months. The key that would link a code back to a real person is generated and kept only on your device and is technically inaccessible to us. Meeting transcripts are pseudonymized on your own computer before anything leaves it, and the transcript itself is never stored by us. That is a property of how the software is built, not a promise about how we behave. Firm documents you choose to upload, such as procedures and policy manuals, are different: they are stored with your account so answers can quote them word for word.
• We do not train AI on your content. Not your documents, not your playbook, not your questions, not the answers. Not to improve our product, not to benefit another customer, and not in any aggregated or de-identified form.
• We do not sell personal information, and nothing inside the Services is used for advertising. Not your content, not your playbook, not your activity in the product. On our marketing website only, we use Google Analytics and the LinkedIn Insight Tag, and we may share business contact details with LinkedIn to show our ads to professionals there. You can opt out at any time; see Section 6.
• We do not collect sensitive categories. No biometrics, no health data, no genetic or neural data, no precise geolocation.

What we do have is your account information, the firm documents you choose to upload, the de-identified patterns, the method statements your advisor confirms, your playbook, your recent chats, and operational data about how the software is running.

1. Who We Are and What This Covers

Wallace Finance Co., a Delaware corporation doing business as Wallace ("Wallace," "we," "us"), provides Wallace Understudy, a software product and digital twin of an advisory practice used for training, continuity, and succession (the "Services"). We are based in Chicago, IL. Our mailing address for legal notices is our registered agent at 8 The Grn, Ste B, Dover, DE 19901. You can reach us at support@wallacefinance.io.

This policy covers personal information we handle in connection with the Services and our marketing website, including information about:

• Users, meaning the individuals a subscribing firm authorizes to use the Services.
• Subjects, meaning the individuals whose professional methodology is captured in a playbook.
• Prospective customers and website visitors.

This policy does not cover the subscribing firm's own clients, because we do not receive information about them. It also does not cover a firm's own privacy practices; each firm is responsible for its own.

Roles

With respect to firm documents, de-identified patterns, confirmed method statements, playbooks, chats, and output, we act as a service provider and processor on behalf of the subscribing firm, which is the business and controller. We process that material only on the firm's documented instructions and only to provide the Services. With respect to account registration data, billing data, support communications, marketing contacts, and service telemetry, we act as the business and controller for our own limited purposes.

2. What We Collect

Account and identity. Name, business email, job title, firm name, role, seat assignment, credentials and authentication data. Why and how long: To create and secure accounts, provision seats, and provide support. Retained for the subscription term plus the periods in Section 7.

Billing. Billing contact, billing address, subscription plan, invoice and payment history. Card data is handled by our payment processor; we do not store full card numbers. Why and how long: To bill and collect, and to meet tax and accounting record requirements. Retained seven years.

Firm Documents. Standard operating procedures, policy manuals, checklists, service calendars, and process documentation that a firm uploads, the policy items distilled from them, and the search index built from their passages, all on our servers. Why and how long: To compile and maintain the playbook. Retained until the firm deletes them or the account closes.

Interview and playbook content. Answers a Subject gives during capture, candidate method statements distilled from meetings that the Subject confirms or rejects, the compiled rules, their sources, confidence levels, item-level sign-offs, rulings, exclusions, and version history. Why and how long: To build and maintain the playbook and its provenance record. Retained for the subscription term.

Meeting transcripts. Transcripts a Subject supplies from any notetaker. Names, account identifiers, and balances are replaced on the Subject's own computer before anything is transmitted. Why and how long: To distill candidate method statements for the Subject to confirm. The transcript itself is not stored, on any tier.

De-identified Patterns. Household and account codes, asset and transaction ranges, month-level dates, activity counts and sequences, produced in the browser from client data files. Column headings from an unrecognized file layout may be sent to suggest a mapping; cell contents are not. Why and how long: To support validation against the playbook. The re-identification key stays on the firm's device. Retained for the subscription term.

Queries and output. Questions Users ask the playbook or the firm's enabled sources, the answers returned with their citations, quiz answers and grades, and questions routed to the Subject. Why and how long: To operate Ask, checks, and routing. Saved chats are retained for thirty (30) days. Routed questions, answers, and quiz records are retained for the subscription term.

Source settings. Which entries in the sources catalog the firm has enabled, and who changed each setting and when. Why and how long: To answer from the sources the firm has enabled and to keep a governance record. Retained for the subscription term.

Service telemetry. Feature usage counts, page and session metrics, error and exception logs, latency and performance data, device and browser type, IP address, approximate region derived from IP. Why and how long: To operate, secure, debug, and improve the software. Not configured to capture the substance of your content. Retained up to twenty-four months.

Security and audit logs. Sign-in events, access and permission changes, administrative actions, export events. Why and how long: To detect and investigate unauthorized access and to support your own recordkeeping. Retained at least twelve months, longer where you or the law require it.

Communications. Emails, support tickets, and demo or sales correspondence. Why and how long: To respond, support, and maintain a record of the relationship. Retained three years after last contact.

Website data. Pages viewed, referring source, device and browser information, approximate location derived from IP address, and identifiers set by strictly necessary cookies, Google Analytics, and the LinkedIn Insight Tag on our marketing site at wallaceunderstudy.io. Why and how long: To operate and measure the website, and to measure and target our own advertising on LinkedIn. See Section 6.

Business contact information. Name, business email, company, and job title of prospective customers and other business contacts, collected from sign-ups, correspondence, events, referrals, and publicly or commercially available professional sources. Why and how long: To send marketing email and, unless you opt out, to show our ads to you on LinkedIn. Retained until you opt out or three years after last contact.

2.1 What We Do Not Collect

We do not collect, capture, purchase, receive through trade, or otherwise obtain any of the following, and the Services are not designed to produce them:

• Biometric identifiers or biometric information as defined in the Illinois Biometric Information Privacy Act, 740 ILCS 14/10, the Texas Capture or Use of Biometric Identifier Act, or Washington RCW 19.375. We do not process retina or iris scans, fingerprints, voiceprints, or scans of hand or face geometry.
• Consumer health data as defined in the Washington My Health My Data Act, RCW 19.373, or Nevada NRS 603A.400 et seq. We do not use geofencing around any health care facility.
• Genetic data, neural data, or neurotechnology data.
• Precise geolocation.
• Protected health information subject to HIPAA. We are not a covered entity or a business associate and we will not enter a business associate agreement.
• Personal information of anyone under 18. The Services are business software and are not directed to children.
• Social Security numbers, tax identification numbers, financial account numbers, or government identification numbers. If any such information appears in a document a firm uploads, it is uploaded contrary to our Terms of Service and can be deleted by the firm at any time.

We do not process sensitive personal information for the purpose of inferring characteristics about an individual.

3. The On-Device Boundary

When a firm supplies client files for capture, those files are read and analyzed by JavaScript running in the User's own browser, on the User's own device. The contents of those files are not transmitted to us, received by us, or stored on our infrastructure, with one narrow exception: if a file arrives in a layout the software does not recognize, its column headings alone, never the cell contents, may be sent to our AI provider to suggest how the columns map.

What leaves the device is a de-identified pattern. Direct identifiers are removed before transmission: households and accounts are replaced with codes that cannot be reversed without a key, monetary values are expressed as ranges rather than exact figures, and dates are reduced to the month. The re-identification key that would connect a code to a real person is generated and held on the User's device, is never transmitted to us, and is technically inaccessible to us. When a file arrives in a layout the software does not recognize, the column headings alone may be sent to suggest a mapping; the cell contents are not.

An honest statement about de-identification.

We say "de-identified" rather than "anonymized" on purpose. A re-identification key exists; it exists only on your device, and we cannot reach it. We design the de-identified pattern so that we cannot identify any individual from what we hold, and we assess that design periodically against the risk that someone holding other information could re-identify a record. No de-identification technique is mathematically perfect for every dataset. We do not attempt re-identification, we contractually prohibit our subprocessors from attempting it, and we treat any information that could reasonably be linked back to an individual as personal information under this policy.

Meeting and call transcripts follow the same principle. When a Subject supplies a transcript from a notetaker, names, account identifiers, and balances are replaced on the Subject's own computer before anything is transmitted. The pseudonymized text is used to distill candidate method statements, which the Subject confirms or rejects; unconfirmed candidates never become part of the playbook. The transcript is not retained in any form, on any tier.

Firm documents are different, and we say so plainly. When a firm uploads a standard operating procedure or a policy manual, the document is read and distilled by an AI provider into quotable policy items, each passage is indexed so a question can find it, and those items, the index, and the underlying document are stored with the account, because storing them is what makes the product work. A firm can see exactly what was extracted from each document, can exclude any item, and can delete any stored document at any time.

4. How We Use Information

We use personal information to:

• Provide, operate, maintain, and secure the Services, including compiling and updating playbooks, running validation, answering questions from the playbook and from the sources a firm has enabled, grading checks, generating onboarding tracks, operating the continuity console, and routing questions to the Subject.
• Create and administer accounts, provision and revoke seats, and authenticate Users.
• Bill, collect payment, and maintain financial records.
• Provide support and respond to inquiries.
• Detect, investigate, prevent, and respond to security incidents, fraud, and abuse, and to enforce our Terms of Service.
• Understand how the software performs and where it fails, using service telemetry, and to fix and improve it.
• Send service and administrative messages, including renewal reminders, security notices, and material changes to our terms.
• Send marketing communications to business contacts, and advertise our own products to business professionals on LinkedIn, in each case subject to opt-out.
• Comply with law and legal process, and to establish, exercise, or defend legal claims.

4.1 What We Will Not Do With It

These are commitments, not descriptions of current practice, and we will not change them without giving subscribing firms advance notice and the right to terminate.

(a) No AI training on content. We do not use firm documents, interview answers, meeting-derived content, de-identified patterns, playbooks, queries, or output to train, fine-tune, evaluate, or improve any artificial intelligence or machine learning model, and we do not permit any subprocessor to do so. This applies to identified, de-identified, and aggregated forms alike.

(b) No cross-customer use. We do not use one firm's information to provide, improve, or benchmark the Services for any other firm. We do not build cross-firm comparisons, industry benchmarks, or peer cohorts from customer content.

(c) No sale, and no advertising use of firm content. We do not sell personal information, as that term is defined in California Civil Code section 1798.140(ad), and we have never done so. We do not use or disclose firm documents, interview answers, meeting-derived content, de-identified patterns, playbooks, queries, or output for advertising of any kind, and we serve no advertising cookies or third-party ad pixels inside the Services. On our marketing website only, we use the LinkedIn Insight Tag, and we may share business contact information with LinkedIn to advertise our own products. Some state laws treat this as sharing for cross-context behavioral advertising or as targeted advertising. Section 6 explains how to opt out.

(d) No employment or eligibility use. We do not provide personal information or output to anyone for the purpose of evaluating an individual for employment, credit, insurance, housing, or any other purpose enumerated in 15 U.S.C. 1681b.

4.2 Automated Processing

The Services use artificial intelligence to compile a playbook, compare recent activity against it, and answer questions. Every rule in the playbook traces to material the firm supplied or an item the Subject confirmed; the Subject's item-level sign-offs, rulings, and interview answers are the record of authorship, and the Services do not generate rules on their own initiative. The Services do not make decisions about any individual, do not replace or substantially replace human decision-making, and are contractually prohibited from being used as a basis for employment, compensation, or eligibility decisions. Validation output asks whether a captured rule is still right; it is a quality check on the playbook, not an evaluation of a person.

On request we provide subscribing firms with documentation of the Services' intended uses, known limitations, categories of data processed, and guidance on human review, sufficient to support the firm's own notice and documentation obligations.

5. Who We Share Information With

We disclose personal information only to the following categories of recipients. Except for Google and LinkedIn, each is under a written contract that limits use to providing services to us, prohibits sale and sharing, prohibits use for any other purpose, prohibits combining our data with data from other sources, and requires equivalent protections and flow-down to any subcontractor. Google and LinkedIn receive only the marketing website information (and, for LinkedIn, the business contact information) described below, and use it under their own terms and privacy policies.

Anthropic PBC. Artificial intelligence processing What it receives: De-identified patterns, stored firm document text, interview answers, pseudonymized meeting content, queries, and column headings from unrecognized file layouts, for the purpose of compiling the playbook and answering questions. Anthropic's web search tool also runs the live searches of the sources a firm has enabled, restricted to our server-enforced allowlist. Accessed under Anthropic's commercial terms, which prohibit training on customer content. Standard API retention is short and for trust and safety screening only.

OpenAI, L.L.C. Artificial intelligence processing What it receives: Stored firm document text, for reading and distilling documents into quotable policy items and for producing the numerical embeddings that power document search, and the text of a question when the playbook's documents are searched. Accessed under OpenAI's API terms, under which data sent through the API is not used to train or improve OpenAI models; abuse-monitoring logs are retained for up to thirty (30) days, then deleted.

Amazon Web Services, Inc. Cloud infrastructure What it receives: Stored firm document text, processed by the service that reads and indexes the documents you choose to store so they can be distilled and searched. Hosted in the United States.

Supabase. Database hosting and authentication What it receives: Account data, stored firm documents, playbooks, de-identified patterns, chats, and logs, held in a database protected by row-level security scoping every record to a single firm. Sign-in is by password or by emailed single-use link; passwords are held only as salted hashes by this provider.

Vercel. Application hosting and delivery What it receives: Application traffic, request metadata, and telemetry. Firm content transits but is not persisted by this provider.

Amazon Web Services. Application hosting for document processing and search What it receives: Stored firm document text and the passage index built from it, for reading and distilling documents and for answering searches over them. Location: United States.

Resend. Transactional email What it receives: Recipient email address and message content for account, security, billing, and service notices, including invitation links, routed-question notifications, and the weekly digest where a User has opted in.

Stripe. Billing What it receives: Billing contact, subscription plan, and payment instrument data. We do not store full card numbers.

Google LLC. Website analytics What it receives: On our marketing website only, pages viewed, referring source, approximate location derived from IP address, browser and device information, and cookie identifiers, through Google Analytics. Google processes this information to provide analytics to us, and may also use it as described in Google's own terms and privacy policy. You can opt out with Google's Analytics opt-out browser add-on. Nothing from inside the Services is sent to Google.

LinkedIn Corporation. Advertising What it receives: On our marketing website only, information collected by the LinkedIn Insight Tag (pages visited, referring page, IP address, browser and device information, and cookie identifiers), and, unless you opt out, hashed business email addresses and company names of business contacts that we upload so our ads can reach them on LinkedIn. LinkedIn uses this information under its own privacy policy. Nothing from inside the Services is sent to LinkedIn.

We also disclose information:

• To professional advisors, such as our lawyers, accountants, auditors, and insurers, under duties of confidentiality.
• To a governmental or regulatory authority, court, or party to legal process, where legally required. If we receive legal process seeking a firm's information, we will notify that firm before producing anything unless we are legally prohibited from doing so, and will give the firm a reasonable opportunity to object or seek protection.
• In connection with a merger, acquisition, financing, reorganization, or sale of assets, including a transfer of the Wallace Understudy business to a separate entity under common ownership. The recipient will remain bound by commitments no less protective than this policy, and we will give notice.
• Where a firm's administrator directs us to, or where a User asks us to.

We maintain a current list of subprocessors in Exhibit B of the Data Protection and Security Addendum, published at wallaceunderstudy.io/legal/data-protection-addendum, and will give subscribing firms at least thirty (30) days' notice before adding a new one, with the right to object.

When a User asks a question, the Services search only the sources the firm has enabled, through a server-enforced allowlist, using our AI provider's web search, and cite each answer to a named source. We do not store the text of pages retrieved from those sources, other than verbatim excerpts of public government materials that we keep in the product. Citing a source is not an endorsement of it.

5.1 Questions Routed to the Subject

A team member can route a question the playbook does not cover to the Subject. The Subject sees the question without the name of the User who asked it. The record of the question and its answer remains associated with the firm's account, and the answer, once given, is added to the playbook and may be shown to the whole firm as recently taught material.

6. Cookies and Tracking

Inside the Services we use only strictly necessary cookies and local storage: authentication, session management, security, and user preferences. We do not run advertising cookies, cross-site trackers, or session-replay tools that capture keystrokes or screen content inside the Services.

On our marketing website we use strictly necessary cookies, Google Analytics to measure traffic, and the LinkedIn Insight Tag to measure and target our own advertising on LinkedIn. These tools set cookies or similar identifiers in your browser. You can opt out of the LinkedIn Insight Tag, and of any upload of your contact details to LinkedIn, at any time: use the Your Privacy Choices control below, email support@wallacefinance.io with the subject line "Opt Out," or turn on Global Privacy Control in your browser. We treat Global Privacy Control and other recognized opt-out preference signals as a valid opt-out, and when your browser sends one, the LinkedIn tag does not load. You can also block or delete cookies in your browser, adjust your ad settings on LinkedIn, or use Google's Analytics opt-out browser add-on.

7. Retention

We keep personal information only as long as needed for the purpose it was collected, and then delete or de-identify it. Specific periods appear in the table in Section 2. Beyond those:

• Firm content, meaning firm documents, de-identified patterns, confirmed method statements, playbooks, and output, is retained for the subscription term. Saved chats expire after thirty (30) days. After cancellation or termination your content stays readable for ninety (90) days, with an export available on written request, and is then deleted; we confirm deletion in writing on request.
• A firm can act before we do. At any time during the term a firm may delete any stored document, download its playbook as a PDF on the tiers that include it, request copies of its playbook and its uploaded documents, and erase all twin content.
• Where a subscribing firm is required by law or professional rule to retain records relating to the Services, we will support that retention on written instruction. This includes retaining inputs, outputs, and configuration records for four years where a firm is subject to California employment recordkeeping rules, three years where a firm is subject to Colorado automated decision-making recordkeeping, and five or seven years where a firm is subject to accounting workpaper retention requirements.
• We retain records we are independently required to keep, including financial and tax records, for the applicable statutory period.
• Backups are purged on a rolling cycle not exceeding thirty-five days. Deleted content may persist in backups until that cycle completes and is not restored to active use.

8. Security

We maintain administrative, technical, and physical safeguards designed to protect personal information, described in detail in the Data Protection and Security Addendum. They include encryption in transit and at rest, password or single-use-link sign-in with passwords held only as salted hashes by our authentication provider, multi-factor authentication for administrative access, row-level tenant isolation, least-privilege access control with periodic review, logging and monitoring, secure development practices, vendor due diligence, and a written incident response plan.

If we confirm a security incident affecting a firm's information, we will notify that firm without undue delay and in any event within seventy-two (72) hours of confirmation, provide the information the firm needs to meet its own notification obligations, and reasonably cooperate in its response. We will not notify a firm's clients or regulators on the firm's behalf without its written consent unless we are independently required to.

No system is perfectly secure. We do not warrant that the Services will be immune from every threat, and our obligations are those stated in the Terms of Service and the Data Protection and Security Addendum.

9. Your Privacy Rights

Depending on where you live and in what capacity you interact with us, you may have some or all of the rights below. We honor these rights for all U.S. residents regardless of state, rather than making you prove residency in a qualifying state.

Know and access. Ask what personal information we hold about you, the categories of sources, the purposes, the categories of recipients, and receive a copy in a portable format.

Correct. Ask us to correct inaccurate personal information.

Delete. Ask us to delete personal information about you, subject to exceptions where we must keep it to complete a transaction, provide a service you requested, detect security incidents, comply with law, or exercise or defend legal claims.

Portability. Receive personal information in a structured, commonly used, machine-readable format.

Opt out of sale, sharing, and targeted advertising. We do not sell personal information. You can opt out of our use of the LinkedIn Insight Tag and of any upload of your contact details to LinkedIn, which some laws treat as sharing or targeted advertising, using the methods in Section 6. We honor Global Privacy Control and other recognized opt-out preference signals.

Limit use of sensitive personal information. We do not use sensitive personal information to infer characteristics, so this right is not engaged. We will still honor a request.

Opt out of profiling. Ask not to be subject to profiling in furtherance of decisions producing legal or similarly significant effects. The Services are not designed to make such decisions.

Non-discrimination and non-retaliation. We will not deny service, charge a different price, provide a different quality of service, or retaliate against you for exercising a privacy right.

Appeal. If we deny a request, you may appeal by replying to our decision. We will respond within forty-five (45) days with our decision and reasoning, and will tell you how to contact your state attorney general if you disagree.

9.1 How to Exercise a Right

Email support@wallacefinance.io with the subject line "Privacy Request." Tell us which right you are exercising and give us enough information to locate your records. We will verify your identity in a manner proportionate to the sensitivity of the request, generally by confirming control of the email address associated with your account. We will not ask for more information than we need, and we will not use information you give us for verification for any other purpose.

We respond within forty-five (45) days, and may extend once by another forty-five (45) days where reasonably necessary, with notice to you. There is no charge unless a request is manifestly unfounded or excessive, in which case we will tell you before proceeding.

An authorized agent may submit a request on your behalf with written permission signed by you, and we may ask you to verify the agent's authority directly.

A note for Users at subscribing firms.

Much of the information in your account belongs to your firm and we hold it as a service provider. Where that is the case, the fastest route is to raise the request with your firm, which can act directly in the product. If you contact us instead, we will help, and where we are acting as a service provider we will forward your request to your firm and support its response rather than acting unilaterally on records it controls.

9.2 State-Specific Disclosures

As of the date of this policy, twenty states have comprehensive consumer privacy laws in effect: California, Virginia, Colorado, Connecticut, Utah, Florida, Oregon, Texas, Montana, Delaware, Iowa, Nebraska, New Hampshire, New Jersey, Tennessee, Minnesota, Maryland, Indiana, Kentucky, and Rhode Island. Oklahoma and Louisiana take effect January 1, 2027, Alabama on May 1, 2027, and Vermont on January 1, 2028. Most of these laws do not apply to individuals acting in a commercial or employment context, which is the capacity in which most Users interact with us. We extend the rights in Section 9 to all U.S. residents regardless.

California

California is the one state whose law covers personal information about individuals acting in a business or employment capacity, so it applies to Users in full.

• Categories of personal information collected in the preceding twelve months, using the statutory categories: identifiers; personal information under California Civil Code section 1798.80(e); commercial information; internet or other electronic network activity information; professional or employment-related information; and inferences drawn from the foregoing, limited to inferences about professional process rather than about personal characteristics. We collect no biometric information, no geolocation beyond approximate region derived from IP address, no sensory data, no education records, and no protected classification characteristics.
• Sources: directly from you, from the subscribing firm that authorized your account, from your device and browser as you use the Services, and from our service providers.
• Business and commercial purposes: those listed in Section 4.
• Categories disclosed for a business purpose in the preceding twelve months: identifiers, professional or employment-related information, commercial information, and internet activity information, disclosed only to the service providers listed in Section 5, including Google as our website analytics provider.
• Sale and sharing: we have not sold personal information, in the preceding twelve months or at any time. Beginning September 28, 2026, we share identifiers (such as cookie identifiers and hashed business email addresses) and internet or other electronic network activity information from our marketing website with LinkedIn for cross-context behavioral advertising. We did not share personal information in the twelve months before that date. We do not knowingly sell or share the personal information of anyone under 16. You can opt out through the Your Privacy Choices control in Section 6, by email, or with Global Privacy Control.
• Sensitive personal information: we do not collect it and we do not use or disclose it for purposes that would require a limitation right.
• Data broker status: we are not a data broker as defined in California Civil Code section 1798.99.80. We do not sell personal information, and we collect personal information directly from individuals with whom we or our customers have a direct relationship.
• Service provider status: with respect to firm content we are a service provider under California Civil Code section 1798.140(ag). We do not retain, use, or disclose firm content for any purpose other than the specific business purposes set out in our written agreement with the firm, we do not combine it with information from other sources, and we do not use it outside the direct business relationship.
• Retention: we do not retain personal information longer than reasonably necessary for the purposes described. Specific periods are in Sections 2 and 7.

Colorado, Connecticut, Montana, Delaware, Minnesota, Maryland, New Jersey, Oregon, New Hampshire, and Rhode Island

Residents of these states have the rights in Section 9, including the right to appeal a denial. We do not process sensitive data as those laws define it, do not sell personal data, and do not engage in profiling in furtherance of decisions producing legal or similarly significant effects. We process personal data from our marketing website and our business contact list for targeted advertising on LinkedIn, and you may opt out of that processing as described in Section 6. Minnesota residents additionally have the right to obtain a list of the specific third parties to which we have disclosed personal data; that list is Section 5. Maryland residents should note that we do not sell sensitive data or the personal data of anyone under 18, and we do not use the personal data of anyone we know to be under 18 for targeted advertising.

Virginia, Utah, Iowa, Texas, Nebraska, Tennessee, Indiana, Kentucky, and Florida

Residents of these states have the rights in Section 9 to the extent their laws provide them. As noted, these laws generally exclude individuals acting in a commercial or employment context; we extend the rights anyway.

Nevada

Nevada residents may direct a covered operator not to make a future sale of covered information. We do not sell covered information and have no plans to. You may still submit a request to support@wallacefinance.io.

All states: breach notification

Where a security incident affects personal information and notification is required by the law of your state, we will notify the affected individuals or, where we hold the information on behalf of a subscribing firm, notify that firm so it can notify. We will do so within the shortest period any applicable state law requires.

10. Financial Privacy and Regulation S-P

Wallace Finance Co. is registered with the Securities and Exchange Commission as an investment adviser and is subject to Regulation S-P with respect to its own advisory clients. Those clients are covered by a separate privacy notice available at wallacefinance.io. Wallace Understudy subscribers are not advisory clients of Wallace Finance Co. by virtue of subscribing, and subscribing creates no advisory or fiduciary relationship. Registration does not mean that the SEC or any other agency has approved, reviewed, or endorsed the Services.

Where a subscribing firm is itself subject to Regulation S-P, the Gramm-Leach-Bliley Act, or the Federal Trade Commission Safeguards Rule, we act as its service provider. We maintain the safeguards described in the Data Protection and Security Addendum, we notify the firm of a confirmed security incident within seventy-two hours, and we support the firm's own incident response and notification obligations. Because we do not receive the firm's client data, the volume of nonpublic personal information in our possession is designed to be zero. Firm documents containing Social Security, card, or account numbers are refused at upload. If other client information, such as a name, is included in a firm document despite our guidance, it is stored like any firm document, and the firm can delete it at any time.

11. Artificial Intelligence Disclosures

We identify the Services as artificial intelligence at the point of interaction, and we will disclose on request whether any particular interaction involves a generative model.

We are not a "covered provider" under the California AI Transparency Act, California Business and Professions Code section 22757 et seq., because the Services are not a publicly accessible generative AI system with more than one million monthly users. We are not a "developer" subject to obligations under Colorado's automated decision-making technology law unless a subscribing firm uses output to materially influence a consequential decision, which our Terms of Service prohibit. We nonetheless maintain and will supply the developer-style documentation described in Section 4.2 so that any firm subject to that law, to Illinois's artificial intelligence employment notice requirements, or to California's automated decision-making technology regulations can meet its own obligations.

12. Marketing and Communications

We send marketing email only to business contacts and only where permitted. Every marketing email contains a working unsubscribe link and our physical mailing address, and we honor unsubscribe requests within ten business days as required by the CAN-SPAM Act. We do not send marketing text messages without prior express written consent. Unsubscribing from marketing does not stop transactional and service messages, which are necessary to the subscription.

13. Children

The Services are business software offered only to firms and their authorized personnel. They are not directed to children, and we do not knowingly collect personal information from anyone under 18. If we learn we have collected such information, we will delete it. If you believe a minor has provided information to us, contact support@wallacefinance.io.

14. Data Location

We process and store personal information in the United States. We do not offer or permit offshore access to customer environments, and support is provided from the United States.

15. Changes to This Policy

We may update this policy. If we make a material change, we will post the updated policy with a new effective date and notify subscribing firm administrators by email at least thirty (30) days in advance. We will not apply a materially less protective practice to information already collected without giving the affected firm notice and the right to terminate without penalty.

16. Contact

Privacy questions and requests, security matters, and legal notices: support@wallacefinance.io. By mail: Wallace Finance Co., Attn: Privacy, 8 The Grn, Ste B, Dover, DE 19901.

If you are not satisfied with our response, you may contact your state attorney general. California residents may also contact the California Privacy Protection Agency.

Wallace Finance Co. is an SEC-registered investment adviser. Registration does not imply a certain level of skill or training and does not mean any government agency has approved or endorsed the Services. Wallace Understudy documents and validates how closely a practice follows its own stated process; it is not a compliance, supervision, or surveillance system, and it does not guarantee any regulatory, training, productivity, growth, or client-retention result. Figures shown in the Services and in our materials are illustrative.