Privacy, without the fog.

01 · Scope & Our Role

This policy covers information handled through the Site.

This Privacy Policy explains how 9th Story Foundry LLC (“9th Story Foundry,” “Foundry,” “we,” “us,” or “our”) collects, uses, discloses, retains, and protects personal information when you visit the Site, submit a form, create an account, place an order, access a download, request support, subscribe to a communication, or otherwise interact with us online.

For ordinary Site, account, order, and direct business interactions, 9th Story Foundry determines why and how the information is used and acts as the business or data controller.

Client engagements

A signed agreement may separately govern information handled during a consulting, advisory, assessment, implementation, vFSO, research, or other client engagement. When we process personal information inside a customer-controlled system or solely on a customer’s documented instructions, the customer may be the controller and we may act as its processor or service provider. The applicable agreement, security requirements, and customer privacy notice will control that processing to the extent they differ from this Site policy.

This policy does not apply to third-party sites or services that merely link to or from the Site.

02 · Information We Collect

We collect information you provide, transaction information, and ordinary technical data.

03 · Sensitive Information

Do not put protected material into an ordinary web form.

If an authorized engagement requires sensitive information, we will work with the customer to establish an appropriate system, access model, transfer method, retention rule, and contractual basis before collection. If you send sensitive material through an inappropriate channel, we may delete it, isolate it, or ask you to resubmit it securely.

04 · How We Use Information

We use personal information to operate, fulfill, communicate, improve, and protect.

Depending on the interaction, we use personal information to:

• operate, maintain, troubleshoot, secure, and improve the Site;
• respond to inquiries, schedule conversations, prepare scopes, and communicate about requested work;
• create and administer accounts, authenticate users, and maintain preferences;
• process orders, collect payment, calculate taxes, prevent fraud, deliver downloads, issue receipts, and administer refunds;
• provide customer support, product notices, corrections, and service communications;
• perform an accepted engagement and coordinate with authorized customer personnel and providers;
• understand aggregate Site use, diagnose performance, and improve products, content, and customer experience;
• protect rights, investigate misuse, enforce agreements, maintain records, and establish or defend legal claims;
• comply with tax, accounting, court, regulatory, law-enforcement, and other legal obligations; and
• send marketing or editorial communications when you request them or when applicable law otherwise permits, with an available unsubscribe method.

Legal bases for visitors in jurisdictions that require them

Where applicable, our legal bases may include performing or taking steps toward a contract; our legitimate interests in operating, securing, improving, and communicating about the business; compliance with legal obligations; protection of legal rights; and consent when consent is required. You may withdraw consent prospectively, but withdrawal does not make earlier lawful processing unlawful.

05 · Cookies & Site Technologies

Some cookies keep the store working. Optional tools should remain optional.

Cookies, local storage, session identifiers, pixels, scripts, and similar technologies can remember a cart, maintain a login, store a preference, prevent fraud, measure performance, or help a third-party service deliver requested content.

Externally hosted resources

At the effective date of this policy, portions of the Site may request the Archivo typeface from Google-hosted font services and certain front-end animation libraries from the jsDelivr content-delivery network. When a browser requests an external file, the provider receives ordinary technical request information such as IP address, browser or device details, requested URL, referring page, and timestamp. We may self-host or replace these resources later, in which case this description will be updated when the change is material.

Embedded and social content

Embedded video, social feeds, maps, scheduling widgets, or other third-party content may behave as though you visited the provider directly and may set cookies or collect interaction data under that provider’s policy. A simple outbound link ordinarily does not transmit the same level of interaction data until you follow it.

Your choices

You can use the Site’s cookie or privacy controls when available and can also block or delete cookies through your browser. Blocking essential cookies may prevent carts, checkout, accounts, downloads, forms, or other requested functions from working. Browser “Do Not Track” signals are not interpreted consistently across the industry. We will honor legally recognized opt-out mechanisms where they apply to our actual processing.

06 · How Information Is Shared

We share information to operate the business—not to create a data marketplace.

We may disclose personal information to the following categories of recipients, limited to what is reasonably necessary for the purpose:

• Infrastructure providers: website hosting, domain, content-delivery, backup, monitoring, security, and technical-support services;
• Commerce providers: WordPress/WooCommerce infrastructure, payment processors, tax tools, invoicing/accounting systems, fraud-prevention services, and download-delivery services;
• Communication providers: form, email, scheduling, customer-support, anti-spam, and newsletter services;
• Engagement providers: approved contractors, implementation partners, or specialists supporting an accepted engagement under appropriate duties;
• Professional advisers: attorneys, accountants, insurers, auditors, banks, and other advisers who need the information to provide services or protect rights;
• Authorities and affected parties: courts, regulators, law enforcement, government agencies, counterparties, or security responders when disclosure is required by law or reasonably necessary to protect rights, safety, systems, customers, or the public; and
• Business transactions: prospective or actual parties to a financing, reorganization, merger, acquisition, sale of assets, or similar transaction, subject to appropriate confidentiality and use restrictions.

Service providers may process information in the United States or other locations and are governed by their own legal obligations and our contracts with them where applicable. Payment providers independently determine some uses of transaction data, such as authorization, fraud prevention, compliance, and dispute handling.

07 · Retention

We keep information for a reason—not merely because storage is cheap.

Retention depends on the type of information, why it was collected, account and order status, customer instructions, security needs, applicable limitation periods, and tax, accounting, employment, contracting, certification, regulatory, or other legal requirements.

In general:

• account information is kept while the account is active and for a reasonable period afterward for support, fraud prevention, records, or legal obligations;
• order, payment, invoice, tax, download-authorization, and refund records are kept for the applicable business, accounting, contract, and legal recordkeeping period;
• inquiry and support correspondence is kept until the matter is resolved and for a limited follow-up or business-record period;
• security, authentication, server, error, and fraud logs are kept for shorter operational periods unless an incident, investigation, dispute, or legal duty requires longer retention;
• engagement records are kept according to the agreement, customer instruction, professional need, and applicable law; and
• marketing contact information is kept until you unsubscribe or we determine it is no longer useful, while a minimal suppression record may be retained to honor an opt-out.

We may retain information longer when required by law, legal hold, audit, insurance, dispute, investigation, or security need. We may retain aggregate or de-identified information that no longer reasonably identifies an individual. When retention is no longer justified, we delete, anonymize, or securely dispose of the information using methods appropriate to its sensitivity and the systems involved.

08 · Security

We use reasonable safeguards, but no connected system is risk-free.

We use administrative, technical, and organizational measures designed for the nature of the Site and information involved. Measures may include access restrictions, role-based administration, encryption in transit where supported, protected payment processing, account controls, patching, backups, logging, anti-spam and security services, vendor review, and procedures for responding to suspected incidents.

No website, email system, cloud platform, transfer method, or storage system can be guaranteed completely secure. You are responsible for using a strong unique password, protecting credentials and download links, maintaining secure copies of purchased files, limiting internal access, and notifying us promptly of suspected unauthorized access.

If a security incident involving personal information occurs, we will investigate and provide notices to affected individuals, customers, regulators, or others when required by applicable law or agreement.

09 · Your Rights & Choices

You may have rights to know, correct, delete, obtain, restrict, object, or opt out.

Depending on where you live and the law that applies, you may have the right to:

• confirm whether we process your personal information and access it;
• correct inaccurate personal information;
• request deletion, subject to legal and operational exceptions;
• obtain a portable copy of information you provided or that is otherwise covered by a portability right;
• object to or restrict certain processing;
• withdraw consent prospectively;
• opt out of sale, targeted advertising, or qualifying profiling;
• appeal a refusal where applicable law provides an appeal process; and
• receive equal service and pricing without unlawful discrimination for exercising a privacy right.

We do not currently sell personal information or use it for third-party targeted advertising or qualifying high-impact profiling. You may unsubscribe from marketing emails using the link in the message. Transactional, account, security, order, and service communications may continue when needed to provide a requested product or fulfill an obligation.

How to make a request

Email info@9thstory.io with the subject line Privacy Request and describe the request. We may need to verify identity, authority, account ownership, or residency before acting. An authorized agent may submit a request where law permits, but we may require proof of authority and direct verification with the individual.

Some information cannot be deleted or disclosed because of another person’s rights, privilege, security, fraud prevention, tax or accounting duties, transaction records, legal claims, customer instructions, or other lawful exceptions. We will explain a denial when required. Even when a particular privacy law does not formally apply to us or to the request, we will make reasonable efforts to honor legitimate access, correction, and deletion requests that do not conflict with legal, contractual, security, or operational obligations.

Automated decision-making

9th Story Foundry does not use Site personal information to make solely automated decisions that produce legal or similarly significant effects. Payment, fraud-prevention, security, and platform providers may use automated tools to evaluate transactions or misuse under their own terms and policies.

10 · International Use & Children

The Site is operated from the United States and built for adults.

International visitors

9th Story Foundry is based in Kentucky, United States. If you access the Site from another country, your information may be transferred to, stored in, or processed in the United States and other locations where our providers operate. Those locations may have different data-protection laws. Where required, we rely on contractual, consent, necessity, adequacy, or other lawful transfer mechanisms.

Children

The Site and its business products and services are not directed to anyone under 18. We do not knowingly collect personal information online from a child under 13. If you believe a child provided personal information without appropriate authorization, contact us so we can investigate and delete it when required.

11 · Third-Party Sites & Services

Other organizations govern their own systems.

The Site may link to or integrate with payment providers, scheduling tools, social networks, professional platforms, standards bodies, certification bodies, government sites, software vendors, video providers, maps, or other services. Their privacy notices and settings—not this policy—govern information they collect for their own purposes.

Review a third party’s terms and privacy practices before providing information or connecting an account. We are not responsible for a third party’s independent content, security, availability, or data practices merely because the Site links to or interoperates with it.