Consents & Privacy.

TECH collects specific, unbundled consents — each one with its own purpose, its own document version, and its own immutable audit record. You can view, export, or revoke any consent from Settings at any time. This approach reflects GDPR Article 7 (specific consent per purpose), CCPA/CPRA §999.306 (unbundled disclosure), and FINRA's recordkeeping expectations.

The six consents

What we record on each consent

Every consent grant, update, and revocation writes an immutable audit record. The schema:

• Consent name — one of the six categories above.
• Version — the document version in force at the moment the consent was granted. Versions are never rewritten retroactively; if a policy changes, a new version number is issued and users are re-prompted.
• State — granted or revoked.
• Timestamp — UTC, to the second.
• IP address — source IP of the request.
• User-agent — browser/device string.
• Source — which surface produced the event: registration_form, onboarding_step_N, settings_update, reconsent_after_policy_change, api_endpoint.

Records are retained for at least seven years past revocation or account deletion — the retention floor for CCPA disputes and GDPR regulatory inquiries.

How versioning works

When we update a policy (Terms, Privacy, AI, FINRA), we bump the document version in CURRENT_VERSIONS. On your next login after a version change, you'll see a re-consent banner showing:

• Which policy changed.
• A link to the previous version and the current version.
• A short summary of material changes (redlined diff available on request).
• A clear accept or reject path.

If you reject a mandatory version update, your account is placed in consent-lapsed state — you retain access to your data and the export/deletion endpoints, but new matches, messages, and Intelligence runs are paused until you either accept the new version or complete account deletion.

Revocation

Optional consents (Communications) can be revoked any time without platform impact. Mandatory consents cannot be revoked while your account is active — revoking a mandatory consent is equivalent to closing your account, and the UI treats it that way by taking you to the account-deletion confirmation flow.

This is deliberate: a platform that works only when users consent to AI matching cannot coherently offer "revoke AI matching but keep using the platform" — that would be a fiction. What you can do is leave the platform at any time, in which case we process your deletion with appropriate retention overrides for the FINRA-mandated messaging archive.

Data export (right to know)

CCPA §1798.110 and GDPR Article 15 both entitle you to a copy of the personal data a platform holds about you. The export endpoint produces a zip containing:

• Your user profile (name, email, title, phone, bio, avatar URL, LinkedIn).
• Your organization profile as you control it (sector, stage, description, objectives, criteria).
• All messages you have sent on the platform (content, timestamps, recipients).
• All matches you have seen (PRISM output, your responses).
• All Intelligence reports you have generated (Fit, ROI, Playbook, FinTech Analyzer).
• All consents you have granted or revoked, with full version history.
• Your engagement log (login events, sessions, actions).
• Your notification preferences and history.

Delivery is by signed URL within 30 days; for orgs on the free tier the typical delivery is same-day. The URL expires 72 hours after generation.

Account deletion (right to delete)

CCPA §1798.105 and GDPR Article 17 both entitle you to request deletion of your personal data, subject to regulatory exceptions. The deletion flow:

1. Click "Delete my account" in Settings → Privacy.
2. Read the confirmation screen listing what will be deleted and what will be retained (with the specific regulatory basis for retention).
3. Confirm via emailed token (anti-CSRF).
4. TECH scrubs your personal data within 7 days. Retention-overriden fields are tombstoned but not deleted.

What gets retained: FINRA Rule 4511 messaging archive (minimum six years from send; message bodies remain searchable by regulator but your user identity is tombstoned), KYB records (seven years post-verification under BSA), compliance logs containing your actions (seven years post-action). Everything else — profile, preferences, non-message content you authored — is fully deleted.

Data correction (right to correct)

CCPA §1798.106 and GDPR Article 16 entitle you to correct inaccurate data. Most profile fields are self-serve editable immediately in Settings. Fields you cannot edit directly (KYB-verified fields like legal entity name) can be corrected by re-running KYB with the updated source documents.

Do Not Sell / Do Not Share

TECH does not sell personal information and does not engage in the CCPA-defined "cross-context behavioural advertising" that the 2024 CPRA amendments target. There is no opt-out to process because there is no sale or sharing to opt out of. The Do Not Sell link on our privacy policy is a legal formality; clicking it is a no-op from your perspective beyond recording the preference.

API surface