ETHIX Privacy Policy

When you create an Account, we collect your name, email address, firm name, professional license or credential information (where applicable), and payment information (processed by our payment processor — see Section 6).

As described in our Terms of Service, Customer Data — the referral records, client identifiers, notes, documents, and other content you and your firm submit to the Services — belongs to you, not to us. We process it only as necessary to provide, secure, support, and improve the Services. Customer Data may include client initials or identifiers, practice area, fee arrangement details, and other information you choose to enter about a referral.

When a subscriber sends a referral certificate, requests a status update, or shares a Referral Card, we collect limited information about the recipient — typically a name and email address — solely to deliver that specific communication or enable that specific interaction. Guest-tier individuals do not have an Account and are not required to provide any information beyond what's needed for the specific feature they're using (e.g., submitting a public referral, requesting to join a firm's network).

Like most web services, we automatically collect certain technical information when you use the Services — IP address, browser type, device information, and usage data (such as which pages or features are accessed and when). This is used for security, troubleshooting, and improving the Services, not for advertising.

If you connect a third-party integration (e.g., a practice management system), we may receive information from that service as necessary to provide the connected functionality, subject to that third party's own terms and privacy practices.

We use cookies and similar technologies (such as local storage) for purposes that fall into three categories:

• Strictly necessary — cookies required for the Services to function, such as keeping you logged in and remembering your session. These cannot be disabled without breaking core functionality.
• Functional — cookies that remember your preferences (such as light/dark mode) to improve your experience.
• Analytics — cookies that help us understand how the Services are used in aggregate, so we can identify and fix problems and improve features over time.

We do not use third-party advertising cookies, and we do not use cookies to track you across other websites. Most browsers let you control or delete cookies through their settings; doing so may affect the functionality of the Services.

As described in our Terms of Service, a referral record may be visible to more than one party — the sending professional, the receiving professional, their respective firms, and any guest participant granted access to that specific record. Information you place into a shared record becomes visible to those parties.

If your Account is provisioned under a firm subscription, your firm's Admin(s) can access, manage, and export data associated with that Account, consistent with the role-based permissions described in the Services.

We share information with third-party vendors who help us operate the Services, including:

• Stripe — for payment processing. Stripe receives payment information directly; we do not store full payment card numbers ourselves.
• SendGrid — for delivering transactional emails, including referral certificates, status update requests, and account notifications.
• Our hosting/infrastructure provider — for storing and running the Services.

Each of these vendors is contractually limited to using information only as necessary to provide their service to us, and is prohibited from using it for their own independent purposes.

We may disclose information if required by law, subpoena, or other legal process, or if we believe in good faith that disclosure is necessary to protect our rights, your safety, or the safety of others.

If ETHIX is involved in a merger, acquisition, or sale of assets, information may be transferred as part of that transaction, subject to the same protections described in this Policy (or a materially similar policy).

We retain Customer Data for as long as your Account remains active, so the Services can function as intended.

Following expiration or termination of your Subscription, Customer Data remains available for export for thirty (30) days, after which we may delete it in the ordinary course, subject to any legal retention obligation and our backup cycles (below).

In addition to standard infrastructure backups used to protect against system failure, we maintain a single, periodically refreshed backup copy of each active subscriber's referral data, held separately from the live system for disaster-recovery purposes. This backup is refreshed approximately once a month; when a new backup is created, the prior backup is deleted, so only the most recent backup is retained at any given time. Backup copies are subject to the same security protections described in Section 8 of this Policy. Following cancellation of a Subscription, we will delete the associated backup copy consistent with the thirty (30) day retention period described in Section 7(b) above.

You can export your Customer Data at any time through the Services' built-in export functionality.

You may opt out of non-essential communications (such as the automated monthly backup email) through your Account settings. We may still send essential communications related to your Account, billing, or security. Ethix currently sends communications by email only — we do not send marketing text messages or place marketing phone calls.

Depending on where you live, applicable state privacy laws may give you the right to:

• Know and access the categories and specific pieces of personal information we have collected about you.
• Correct inaccurate personal information we maintain about you.
• Delete personal information we have collected from you, subject to certain exceptions (such as information we're required to retain by law).
• Opt out of the sale or sharing of your personal information. ETHIX does not sell personal information, and this right is not applicable to our current practices.
• Non-discrimination — we will not deny you the Services, charge different prices, or provide a different level of service because you exercised any of these rights.

To exercise any of these rights, contact us at contact@ethixlaw.com. We may need to verify your identity before completing certain requests. You may also designate an authorized agent to make a request on your behalf, subject to our ability to verify that authorization. We will respond to verified requests within the timeframe required by applicable law.

If you're a guest-tier individual who received a certificate, a status update request, or a Referral Card link and would like your information removed from our systems, you may contact us at contact@ethixlaw.com using the process described above.