Port & Starboard LLC ("Company," "we," "us," or "our") operates WorkforceVault. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service. Please read this policy carefully.

1. Information We Collect

We collect information you provide directly to us, such as when you create an account, use our services, or contact us for support. This includes:

Account Information: Name, email address, phone number, company name, job title
Business Information: Company size, industry, location addresses for compliance purposes
Employee Data: Names and email addresses of employees for poster distribution and acknowledgment tracking
Payment Information: Billing address, payment card details (processed by our payment processor)
Usage Data: Log files, device information, IP addresses, browser type, pages visited

2. How We Use Your Information

We use the information we collect to:

Provide, maintain, and improve our services
Process transactions and send related information
Send compliance alerts and poster update notifications
Respond to your comments, questions, and support requests
Communicate about products, services, and events
Monitor and analyze trends, usage, and activities
Detect, investigate, and prevent security incidents
Comply with legal obligations

3. Information Sharing and Disclosure

We do not sell your personal information. We may share information in the following circumstances:

Service Providers: With vendors who assist in operating our platform (see Section 10)
Legal Requirements: When required by law, court order, or governmental request
Business Transfers: In connection with a merger, acquisition, or sale of assets
With Consent: When you direct us to share information with third parties
Aggregated Data: We may share anonymized, aggregated data that cannot identify you

4. Data Security

We implement industry-standard security measures to protect your personal information:

Encryption of data at rest and in transit (TLS 1.3)
Access controls and authentication requirements
Regular security assessments and penetration testing
Employee security training and background checks
Secure cloud infrastructure with leading providers

Security Commitment: Our infrastructure and processes are designed to meet SOC 2 Type II standards. We are actively pursuing formal SOC 2 Type II certification, with audit completion targeted for Q4 2026.

5. Data Retention

We retain your information for as long as your account is active or as needed to provide services. Specific retention periods:

Account Data: Duration of account plus 30 days after deletion request
Employee Acknowledgments: 7 years (to support compliance audits)
Transaction Records: 7 years (legal/tax requirements)
Usage Logs: 90 days
Support Communications: 3 years

We may retain certain information as required by law or for legitimate business purposes.

6. Your Privacy Rights

Depending on your location, you may have the following rights:

Access: Request a copy of your personal data
Correction: Request correction of inaccurate data
Deletion: Request deletion of your personal data
Portability: Receive your data in a portable format
Opt-Out: Opt out of marketing communications
Restriction: Request restriction of processing

To exercise these rights, contact us at privacy@workforcevault.com. We will respond within 45 days.

7. California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):

Right to Know: Request disclosure of the categories and specific pieces of personal information we have collected about you
Right to Delete: Request deletion of your personal information, subject to certain exceptions
Right to Correct: Request correction of inaccurate personal information
Right to Opt-Out of Sale/Sharing: We do not sell or share your personal information for cross-context behavioral advertising
Right to Limit Use of Sensitive Information: Limit how we use sensitive personal information
Right to Non-Discrimination: We will not discriminate against you for exercising your privacy rights

Categories of Information Collected: Identifiers, commercial information, internet activity, geolocation data, professional information.

To submit a request, email privacy@workforcevault.com with "California Privacy Request" in the subject line. You may designate an authorized agent to make a request on your behalf.

8. Virginia Privacy Rights (VCDPA)

If you are a Virginia resident, you have rights under the Virginia Consumer Data Protection Act (VCDPA):

Right to Access: Confirm whether we are processing your personal data and access such data
Right to Correct: Correct inaccuracies in your personal data
Right to Delete: Delete personal data you have provided or we have obtained
Right to Data Portability: Obtain a copy of your personal data in a portable format
Right to Opt-Out: Opt out of targeted advertising, sale of personal data, or profiling

Appeal Process: If we deny your request, you may appeal by emailing privacy@workforcevault.com with "VCDPA Appeal" in the subject line. We will respond within 60 days.

If your appeal is denied, you may contact the Virginia Attorney General at www.oag.state.va.us.

9. Cookies and Tracking Technologies

We use cookies and similar technologies to operate and improve our Service:

Essential Cookies: Required for basic site functionality, authentication, and security. Cannot be disabled.
Analytics Cookies: Help us understand how visitors use our site (e.g., pages visited, time on site). These are optional and only enabled after you opt in through our consent banner.
Preference Cookies: Remember your settings and preferences (e.g., dark mode, language).

We do not use: Third-party advertising cookies, cross-site tracking, or sell data to advertisers.

You can control cookies through our consent banner and your browser settings. Disabling essential cookies may affect site functionality.

10. Third-Party Service Providers

We use the following categories of service providers to operate our platform:

Cloud Infrastructure: Amazon Web Services (AWS) - data hosting and processing
Payment Processing: Stripe - payment transactions (we do not store full card numbers)
Email Services: Transactional email delivery for notifications and alerts
Analytics: Privacy-respecting analytics to understand site usage
Customer Support: Help desk software for support ticket management

All service providers are contractually bound to protect your data and use it only for the services they provide to us.

11. Data Breach Notification

In the event of a security incident involving your personal data:

Notification Timeline: We will notify affected users within 72 hours of discovering a breach that poses a risk to your rights
Notification Method: Via email to your registered account address and, where required, via prominent notice on our website
Content: Description of the incident, types of data affected, steps we are taking, and actions you can take to protect yourself
Regulatory Notification: We will notify relevant authorities as required by applicable law (including Virginia Attorney General for VCDPA breaches)

12. International Data Transfers

WorkforceVault is operated from the United States. If you access the Service from outside the United States, your information will be transferred to, stored, and processed in the United States. By using the Service, you consent to such transfer. We ensure appropriate safeguards are in place to protect your data in accordance with this Privacy Policy.

13. Children's Privacy

Our Service is not directed to individuals under 18. We do not knowingly collect personal information from children. If you believe we have collected information from a child, please contact us immediately at privacy@workforcevault.com.

14. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the new policy on this page and updating the "Last updated" date. For significant changes, we will provide additional notice via email. Your continued use of the Service after changes become effective constitutes acceptance of the revised policy.

15. Contact Us

For questions about this Privacy Policy or to exercise your privacy rights:

Port & Starboard LLC

Virginia Beach, Virginia

Email: privacy@workforcevault.com