Privacy Policy

1. Introduction

AAWAT Inc. ("Company," "we," "us," or "our") operates WISP Creator (the "Service"), a web-based platform that helps tax professionals create Written Information Security Plans. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service.

By using WISP Creator, you agree to the collection and use of information in accordance with this policy. If you do not agree with this policy, please do not use our Service.

2. Information We Collect

2.1 Account Information

When you create an account, we collect:

• Email address
• Password (stored securely using industry-standard hashing)
• Firm name
• State of operation
• Firm size category

2.2 WISP Content

To generate your WISP, we collect information you provide about your firm's security practices, including:

• Security coordinator designation
• Password and authentication policies
• Data protection measures
• Physical security practices
• Vendor relationships
• Employee training procedures
• Data retention policies

2.3 Payment Information

Payment processing is handled by Stripe, Inc. We do not store your full credit card number, CVV, or other sensitive payment details on our servers. Stripe's privacy policy governs the collection and use of your payment information.

2.4 Automatically Collected Information

When you use our Service, we automatically collect:

• IP address
• Browser type and version
• Device information
• Usage data (pages visited, features used, timestamps)
• Cookies and similar tracking technologies

3. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve our Service
• Generate your customized WISP documents using AI technology
• Process your payments and manage your account
• Send transactional emails (account confirmation, password resets, purchase receipts)
• Respond to your inquiries and provide customer support
• Monitor and analyze usage patterns to improve user experience
• Detect, prevent, and address technical issues or fraudulent activity
• Comply with legal obligations

4. AI-Powered Document Generation

WISP Creator uses artificial intelligence (AI) technology provided by third-party services to generate policy content based on your inputs. When you use our AI generation features:

• Your firm information and questionnaire responses are sent to Anthropic to generate customized policy language
• We do not use your data to train AI models
• Generated content is stored in your account for your use
• Security-research questions you type are additionally sent to OpenAI, which converts them into a numeric representation used to search our reference library of IRS, FTC and NIST material
• Each provider is named in section 5.1 below, and processes data in accordance with their privacy policies and our data processing agreements

5. Information Sharing and Disclosure

We may share your information in the following circumstances:

5.1 Service Providers

We share information with third-party vendors who perform services on our behalf:

• Railway: Application hosting and database storage, in the United States
• Anthropic: WISP and policy generation, the compliance assistant, and support e-mail triage
• OpenAI: Security-research retrieval — your question is embedded to search our reference library
• Brevo: Transactional e-mail
• Zoho: Support mailbox hosting
• Stripe: Payment processing — card details go directly to Stripe and never reach our servers

5.2 Legal Requirements

We may disclose your information if required by law, court order, or government request, or if we believe disclosure is necessary to protect our rights, your safety, or the safety of others.

5.3 Business Transfers

If AAWAT Inc. is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction.

5.4 What We Do NOT Do

• We do not sell your personal information to third parties
• We do not share your WISP content with other users
• We do not use your data for targeted advertising

6. Data Security

We implement appropriate technical and organizational measures to protect your information, including:

• Encryption of data in transit (TLS/SSL)
• Encryption of sensitive data at rest
• Secure password hashing (bcrypt)
• Regular security assessments
• Access controls and authentication requirements
• Audit logging of system access

However, no method of transmission over the Internet or electronic storage is 100% secure. While we strive to protect your information, we cannot guarantee absolute security.

7. Data Retention

We retain your account information and WISP content for as long as your account is active or as needed to provide you with our Service. If you request account deletion, we will delete or anonymize your personal information within 30 days, unless we are required to retain it for legal or legitimate business purposes.

Audit logs and anonymized usage data may be retained for up to 3 years for security and analytical purposes.

8. Your Rights and Choices

Depending on your location, you may have the following rights:

• Access: Request a copy of the personal information we hold about you
• Correction: Request correction of inaccurate information
• Deletion: Request deletion of your account and associated data
• Export: Download your WISP documents at any time
• Opt-out: Unsubscribe from marketing communications (transactional emails cannot be opted out while you have an active account)

To exercise these rights, please contact us at support@wisp-creator.com.

9. Cookies and Tracking

We use cookies and similar technologies to maintain your session, remember your preferences, and analyze how our Service is used. You can control cookie settings through your browser, but disabling cookies may affect Service functionality.

Types of cookies we use:

• Essential Cookies: Required for Service functionality (authentication, security)
• Preference Cookies: Remember your settings and preferences
• Analytics Cookies: Help us understand how the Service is used

10. Children's Privacy

Our Service is not intended for individuals under the age of 18. We do not knowingly collect personal information from children. If you believe we have collected information from a child, please contact us immediately.

11. International Data Transfers

Your information may be transferred to and processed in countries other than your own. We ensure appropriate safeguards are in place for such transfers in compliance with applicable data protection laws.

12. California Privacy Rights

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA), including the right to know what personal information we collect, request deletion, and opt-out of the sale of personal information (note: we do not sell personal information).

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new policy on this page and updating the "Last Updated" date. Your continued use of the Service after changes constitutes acceptance of the updated policy.

14. Contact Us

If you have questions about this Privacy Policy or our data practices, please contact us: