Privacy Policy

Effective Date: March 11, 2026 — Last Updated: March 11, 2026

1. Information We Collect

1.1 Account Information

Name, email address, and (optionally) organization name and physical address when you subscribe or contact us. If you designate Heritage Asset successors or account beneficiaries, we collect their name and contact information as provided by you.

1.2 Payment Information

Payments are processed entirely by Stripe, Inc. We receive confirmation of payment, subscription status, and the last four digits of your payment method for display in your account dashboard. We never receive, store, or have access to your full credit card number, bank account number, or other payment instrument details.

1.3 Vault Content

Files, 3D scans, CAD models, Digital Twins, photographs, provenance metadata, telemetry data, toolpath files, and any other content you upload to RigidVault. This content is stored on sovereign hardware operated by Kavanagh Industries within the United States. We process this content only to provide the services you request. Bill I

1.4 Machine Telemetry

If you connect a machine to the RigidPulse ecosystem, we collect sensor data (vibration, temperature, current, power, audio, environmental, and vision telemetry) solely to provide real-time monitoring, AI advisory/active control, predictive maintenance, and historical analytics. This data belongs to you. Bill II

1.5 Usage Analytics

Basic, anonymized analytics about platform usage — page views, feature usage frequency, error rates — collected through standard web server logs. We do not use Google Analytics, Facebook Pixel, or any third-party cross-site tracking tool.

1.6 Chain of Custody Logs

For Heritage Assets, we maintain an immutable log of every access event — views, downloads, exports, shares, and modifications — including timestamp, user identity, and action type. This log is part of the Heritage Asset record and subject to the same permanence commitments. Bill VII

1.7 Communications

Emails, support requests, and correspondence you send to us.

2. What We Do NOT Collect

3. How We Use Your Information

• Service delivery — Storing Assets, running subscriptions, processing payments, providing telemetry and AI services
• Product improvement — Anonymized, aggregated analytics only. Individual data is never used without anonymization
• Communication — Account notifications, billing receipts, security alerts. No marketing emails unless you explicitly opt in
• Legal compliance — Responding to valid legal process as required by applicable law

4. AI Training and Data Use

5. How We Store Your Information

5.1 Infrastructure

• RAID-10 redundant storage on enterprise-grade NAS with ECC memory and battery-backed write cache
• Network segmentation via UniFi enterprise managed network with VLAN isolation
• Geo-fenced firewall rules restricting vault traffic to United States IP addresses
• Encryption at rest using AES-256 or equivalent
• Encrypted transit via TLS 1.3 for all data in motion
• Air-gapped backup on physically separate media stored on-premises

5.2 Backups

We maintain regular automated backups on redundant, encrypted storage separate from production data.

6. Data Retention

6.1 Active Accounts

Data is retained for the duration of your active subscription. You may delete individual Assets at any time. Deleted standard Assets are purged within 30 days.

6.2 Cancelled Accounts — Standard Assets

Data is retained in read-only mode for 30 days after the end of your billing period to allow export in open formats, then permanently deleted.

6.3 Cancelled Accounts — Heritage Assets

Heritage-flagged Assets are never automatically deleted upon subscription cancellation, account inactivity, or tier downgrade. If a Heritage Custodian’s subscription lapses, Heritage Assets are moved to cold storage at no charge and remain available for export indefinitely. Permanent deletion requires explicit written consent from the Custodian or verified successor. Bill VII

6.4 Chain of Custody Logs

Heritage chain of custody logs are retained permanently as part of the Heritage Asset record. They are never deleted, even if the Heritage Asset itself is deleted at the Custodian’s request. Bill VII

6.5 Payment Records

Transaction records retained for 7 years per IRS requirements.

6.6 Communications

Support correspondence retained for 2 years after account closure.

7. How We Share Your Information

We do not sell, rent, or trade your personal information. We share information only in these limited circumstances:

• Payment processing — Billing information shared with Stripe, Inc. See Stripe’s Privacy Policy
• Legal requirements — Disclosure if required by law, subpoena, court order, or government regulation
• Business transfer — In the event of a merger or acquisition, customer data transfers with the business. You would be notified in advance
• With your consent — For specific purposes you explicitly authorize

We do not share data with advertisers, data brokers, social media platforms, or any third party for marketing purposes.

8. Third-Party Services

We use a limited number of third-party services:

• Stripe, Inc. — Payment processing only
• Microsoft 365 — Business email (shaun@kavanaghind.com)
• Namecheap — Domain registration for kavanaghind.com

None of these services have access to your vault content, machine telemetry, or Digital Twin data.

9. Cookies

We use only essential cookies for account authentication and session management. No tracking cookies, advertising cookies, or social media cookies.

10. Your Rights

Regardless of where you live, you have these rights:

• Access — Request a copy of all personal data we hold about you
• Correction — Request correction of inaccurate personal data
• Deletion — Request deletion (subject to Heritage and legal retention requirements)
• Export — Export all data in open, standard formats at any time, at no charge Bill I
• Restrict processing — Request that we limit processing to storage only
• Object to AI training — You are opted out by default. Revoke any prior opt-in at any time Bill IX
• Data portability — Receive data in machine-readable, open formats for transfer Bill I Bill V

To exercise any right, contact shaun@kavanaghind.com. We will respond within 30 days.

11. State Privacy Law Compliance

11.1 California (CCPA/CPRA)

California residents: you have the right to know what personal information we collect, request its deletion, and opt out of the sale of personal information. We do not sell personal information. We do not share personal information for cross-context behavioral advertising.

11.2 Other States

Kavanagh Industries complies with applicable state privacy laws including Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), and subsequent state privacy legislation. The rights described in Section 10 meet or exceed all current U.S. state requirements.

12. Children’s Privacy

We do not knowingly collect personal information from children under 13. Users between 13 and 17 may create accounts with verifiable parental or legal guardian consent. If we become aware that we have collected information from a child under 13 without parental consent, we will delete it immediately. Contact shaun@kavanaghind.com if you believe a child under 13 has created an account.

13. Security

We protect your data with physical, technical, and administrative safeguards including enterprise-grade network segmentation, encrypted storage and transit, access controls with multi-factor authentication, RAID-10 redundancy, and regular security assessment. No system is perfectly secure, but we commit to treating your data with the same care we would treat our own irreplaceable assets.

14. Data Breach Notification

In the event of a data breach affecting your personal information or vault content, we will notify you by email within 72 hours of confirming the breach. The notification will include the nature of the breach, what data was affected, what steps we are taking, and what steps you should consider. We will notify applicable state regulators as required by law.

15. CMMC and Defense Compliance

For Industrial and Sovereign tier subscribers involved in defense manufacturing, our infrastructure is designed to meet CMMC 2.0 and NIST 800-171 requirements. Defense-related data is handled under additional safeguards including dedicated VLAN isolation, NIST 800-171 AU-compliant access logging, and geofenced US-only traffic routing. Specific defense compliance terms are addressed in the Industrial/Sovereign Service Agreement.

16. Third-Party Links

Our website may contain links to third-party websites. We are not responsible for the privacy practices of other sites.

17. Changes to This Policy

We may update this Privacy Policy with at least 30 days’ written notice to your registered email. Changes will never reduce your privacy protections below the standards established in the RigidTrust™ Nine Bills of Rights. If you disagree, you may cancel and export all data at no charge.

18. Contact

For privacy questions, data rights requests, or concerns:

Kavanagh Industries LLC
Michigan, USA
shaun@kavanaghind.com
USPTO Patent Pending #63/991,057