Privacy Policy

Last Updated: August 19, 2026

Coleman Contingency, LLC ("we," "us," or "our") offers security consulting services, embedded personnel, and the M²ORE Vector™ platform. This Privacy Policy describes how we collect, use, protect, and handle personal data and organizational data in connection with our services. By accessing our services, you acknowledge and agree to this Privacy Policy.

Information We Collect

Account and Identity Data

When establishing an account, we collect your name, email address, job title, organization name, and role information. This data is managed through a third-party identity provider and is used for authentication, access control, and service communications.

Platform Usage Data

We collect data that you and your organization enter into the M²ORE Vector™ platform, including security assessment results, objectives and goal tracking data, operational risk records, risk factor and mitigation customizations, and AI-generated insights. This data is used solely to deliver platform services to your organization.

Consulting Engagement Data

In connection with consulting engagements, we may collect organizational information, security program documentation, personnel information relevant to the engagement scope, and other information you provide to facilitate service delivery. This data is used solely for the purpose of the engagement and is handled in accordance with applicable confidentiality agreements.

Integration Data

Where your organization activates integration connectors within the platform, data from connected external systems is ingested for AI querying through M²ORE Clarity. Integration data is subject to the same isolation and protection controls as all other platform data. Access to integration data is governed by permission groups configured by your organization's administrator.

Technical Data

We collect technical data including IP addresses, browser type, and session information for security monitoring, fraud prevention, and platform performance purposes. Session data is stored with automatic expiry.

Support Communications

We collect personal information you provide when contacting our support team at [email protected]. Support interactions may be recorded to improve our services and resolve your questions.

How We Use Information

We use the information we collect to:

  • Deliver platform services including security assessments, risk management, objectives and goal tracking, and AI-powered insights
  • Perform consulting, advisory, and professional services as engaged
  • Manage user authentication and role-based access control
  • Provide AI query capabilities through M²ORE Clarity using only your organization's data
  • Generate scheduled and on-demand AI Insights for your organization
  • Manage subscription lifecycle and license status
  • Maintain platform security, detect threats, and prevent unauthorized access
  • Respond to support requests and communications
  • Fulfill contractual obligations and comply with legal requirements

We do not use your data for advertising or marketing to third parties. We do not sell your personal data or organizational data.

AI Data Processing

The following commitments govern all AI data processing through the M²ORE Vector™ platform:

  • Your data is not used to train, fine-tune, or improve any AI model under any circumstances
  • Our AI service provider does not retain API inputs or outputs beyond the individual API call
  • M²ORE Clarity operates as a closed system and draws only from your organization's data with no access to the internet or other organizations' data
  • Integration data accessed through M²ORE Clarity is governed by permission groups, so users access only sources they are authorized for
  • Vector embeddings are isolated to your organization's dedicated namespace
  • AI response caching is scoped by organization and expires automatically

Data Sharing and Subprocessors

We do not sell personal data or organizational data. We do not share your data with third parties for marketing purposes. We engage subprocessors to deliver platform services, including cloud infrastructure, AI services, vector database, identity management, and location services. All subprocessors are bound by contractual data processing obligations no less protective than our commitments to you. A complete list of our subprocessors is available upon request.

We may disclose your information where required by law, court order, or governmental authority, or to protect the rights and property of Coleman Contingency or others.

Data Security

We implement technical and organizational security measures appropriate to the risk, including TLS encryption in transit, AES-256 encryption at rest, multi-factor authentication, role-based access control, web application firewall protection, and organization-level data isolation. Full details of our security controls are available in our Security and Compliance Whitepaper upon request.

Data Retention

We retain your platform data for the duration of your active subscription. Upon termination, all platform data is deleted within 30 days. Consulting engagement records are retained for seven years for legal and business purposes. Technical logs expire automatically within 90 days. A written deletion confirmation for platform data is provided upon request.

Your Rights and Choices

You have the right to access, correct, or request deletion of your personal information. To exercise these rights, contact us at [email protected]. We will respond within the timeframe required by applicable law.

For Users in the European Economic Area, United Kingdom, and Switzerland

If you are located in the EEA, UK, or Switzerland, you have additional rights under applicable data protection law including the right to data portability, the right to restrict processing, and the right to object to processing based on legitimate interests.

For California Residents

If you are a California resident, you have rights under the CCPA including the right to know what personal information we collect, the right to request deletion, and the right to opt out of the sale of your personal information. We do not sell personal information. To exercise your CCPA rights contact us at [email protected] with "CCPA Request" in the subject line.

International Data Transfers

Platform data is processed in the United States. If you are accessing the platform from outside the United States, your data will be transferred to and processed in the United States. By using the platform, you consent to this transfer.

Cookies and Tracking Technologies

The platform uses session cookies necessary for authentication and platform functionality. These cookies are required for the platform to operate and cannot be disabled while using the service. We do not use advertising cookies or third-party tracking technologies for marketing purposes.

Children

Our services are not directed to individuals under 18 years of age. We do not knowingly collect personal information from persons under 18.

Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting a notice on the platform or by email. Your continued use of our services after the effective date of any changes constitutes your acceptance of the updated policy.

Governing Law

This Privacy Policy is governed by the laws of the State of Texas. Any legal actions arising out of or related to this policy must be commenced in Harris County, Texas.

Contact

For privacy inquiries contact Coleman Contingency, LLC at [email protected]