Website Privacy Policy

1. Scope and Applicability

This Privacy Policy (the "Policy") describes how the Socrates Systems Inc. ("Socrates," "we," "us," or "our") collects, uses, discloses, and protects personal information when you visit or interact with socratesos.com (the "Website"). This Policy applies to Website visitors and users.

The Website is a public business-to-business ("B2B") and business-to-consumer ("B2C") marketing and waitlist site for people and teams that want the intelligence behind their products or operations to become an owned asset. The Website and private-beta offering are intended only for people located in the United States. The Website is not a product account, customer workspace, or interface for uploading data to train or operate a model.

Important: Do Not Submit Sensitive or Confidential Information

Do not submit passwords, credentials, government identifiers, payment information, regulated data, trade secrets, source code, proprietary model inputs or training data, or other sensitive or confidential information through the Website waitlist form or another Website communication channel. The Website form is for inquiries only. If you submit such information inadvertently, use the contact method that will be identified in Section 16 so that Socrates can review and, where appropriate, delete it.

1.1 What This Policy Does Not Cover

This Policy does not apply to:

• Third-party websites, platforms, or services linked from the Website;
• Software, models, applications, implementation, support, or other services offered by Socrates under separate agreements or privacy notices; or
• Information collected offline or through channels other than the Website, except where this Policy specifically states otherwise.

2. Categories and Sources of Personal Information Collected

2.1 Information You Provide Directly

When you submit the Website's waitlist form, you may provide your first name, last name, email address, and phone number, all of which are required. You may also provide a company name, job title, and a free-text message. Do not include sensitive or confidential information in the Message field.

When analytics is allowed, the form may also receive the campaign parameters utm_source, utm_medium, utm_campaign, utm_term, utm_id, and utm_content in matching hidden fields if those HubSpot contact fields.

Submitting the current waitlist form asks Socrates to respond to your inquiry; it does not by itself document consent to receive marketing email, calls, texts, or automated messages. If the form later offers separate marketing choices, Socrates will preserve the submission time and the consent disclosure presented with the applicable choice.

2.2 Information Collected Automatically

(a) Hosting and Request Data

Vercel processes an IP address and request information needed to deliver the Website, apply security protections, and determine a visitor's country for consent-region selection. Runtime and security records may include the request method and path, timestamp, status code, host, request ID, user agent, search parameters, region, firewall and cache status, middleware and function metadata, deployment information, outgoing requests, events, and application log messages.

(b) Analytics Data, When Permitted

When analytics is permitted under Section 5, HubSpot visitor tracking may collect pages viewed, page location and title, referrer, navigation path, browser and device information, language, approximate location derived from an IP address, session and engagement data, and interactions with the Website.

When analytics is permitted under Section 5, the Website uses Google Analytics 4 ("GA4") to measure page views, approximate scroll engagement, approved calls to action, and successful or failed waitlist submissions. GA4 may process browser and device information, approximate location derived from an IP address, page path and title, referrer, session and engagement data, and the allowlisted events described below.

The Website's approved analytics event contract is limited to scroll depth at 25%, 50%, or 75%; the Join the Waitlist calls to action in approved page locations; and a successful or failed submission event for the approved waitlist form. The contract does not accept form values, free text, contact identifiers, error details, destination URLs, account identifiers, or user IDs.

(c) Campaign Attribution

After analytics is allowed, the Website reads only the six UTM parameters listed in Section 2.1. Values are stripped of control characters, trimmed, and limited to 512 characters. The Website stores the allowlisted values and their capture time in a first-party local-storage record named socrates_utm_attribution for up to 90 days. It does not store a full URL, referrer, form value, email address, or unrelated query parameter in that record. A newer tagged visit replaces the prior campaign record.

(d) Consent Preference

The Website stores a first-party socrates_consent cookie containing your analytics choice, consent-policy version, selection timestamp, region classification, and whether Global Privacy Control was detected. It does not contain a visitor ID or IP address and expires after 180 days.

2.3 Information We Do Not Intentionally Collect

The Website is not designed to intentionally collect:

• Payment or financial-account information;
• Social Security numbers or government-issued identifiers;
• Passwords, authentication secrets, or biometric data;
• Precise geolocation;
• Health, genetic, or other regulated special-category data;
• Information through advertising pixels, retargeting tools, session-replay tools, or chat widgets; or
• Proprietary source code, model inputs, training data, or confidential business records.

3. Purposes of Collection and Processing

3.1 Responding to Inquiries and Waitlist Management

• Create or update a contact record in HubSpot;
• Record, route, and respond to a waitlist request;
• Notify appropriate Socrates team members; and
• Evaluate interest in and eligibility for private-beta access.

3.2 Website Analytics and Improvement

• Understand how visitors navigate and use the Website;
• Measure Website performance and identify technical issues;
• Evaluate campaign attribution; and
• Improve Website content, layout, and user experience.

3.3 Website Operations and Security

• Deliver Website content;
• Protect against malicious traffic, fraud, and abuse;
• Maintain operational and security records; and
• Determine a visitor's country for consent selection.

3.4 Communications

• Respond to waitlist submissions and other inquiries; and
• Where you have separately opted in and applicable law allows, send promotional or educational email, calls, text messages, or automated messages about Socrates.

3.5 Legal Compliance and Business Operations

• Comply with law and legal process;
• Establish, exercise, or defend legal claims; and
• Conduct a business transfer described in Section 7.

4. Legal Bases for Processing (EEA/UK)

Socrates offers the Website and private beta only in the United States and does not intentionally target people in the European Economic Area ("EEA") or United Kingdom ("UK"). If EEA or UK data-protection law nevertheless applies, the legal bases for the Website processing described in this Policy are listed below, subject to applicable law.

5. Cookies, Analytics, and Similar Technologies

The Website uses necessary technology and one optional category, analytics. It does not use advertising technology.

5.1 Regional Consent Behavior

5.2 Cookie and Similar-Technology Inventory

The consent and HubSpot analytics cookies are first-party on.socratesos.com. HubSpot's CDN security cookies are third-party cookies on the HubSpot domains that serve the requested resources. The local-storage entry is not a cookie.

5.3 Advertising Technologies

The Website code does not use advertising cookies, advertising pixels, retargeting, cross-context behavioral advertising, Google Signals, advertising personalization, Google Ads audiences, or HubSpot Ads integrations. Google advertising consent states remain denied. If this changes, Socrates will update this Policy before deployment and obtain any required consent.

5.4 Managing Your Preferences

You can review, change, or withdraw analytics permission at any time through the Privacy choices control in the footer. When you decline or withdraw, optional analytics scripts do not load, the Website removes the UTM record, clears related hidden form fields, and attempts to delete the known HubSpot and any configured GA4 analytics cookies. The HubSpot waitlist form remains available without visitor tracking. Withdrawing consent does not affect processing that occurred before withdrawal.

6. Disclosures and Recipients

The Website code does not implement the sale of personal information or sharing for cross-context behavioral advertising. For the business purposes described in this Policy, the Website uses the following active providers:

The current Website build does not load a Cloudflare R2 or Stream resource. GitHub supports source-code management and deployment workflow but does not receive visitor personal information in the ordinary course. Socrates will update this Policy before adding a provider that materially changes Website data collection or disclosure.

Socrates may also disclose personal information:

• To comply with law, legal process, or enforceable government requests;
• To enforce applicable agreements;
• To protect the rights, property, or safety of Socrates, visitors, or the public; or
• With your consent or at your direction.

7. Business and Legal Transfers

If Socrates is involved in a merger, acquisition, reorganization, asset sale, financing, or similar transaction, personal information may be disclosed or transferred as part of that transaction. Socrates will take reasonable steps to require the recipient to honor this Policy or provide notice and, where required, an opportunity to consent.

8. International Data Transfers

Although Socrates offers the Website and private beta only in the United States, its providers and their subprocessors may operate in the United States and other countries. Personal information may therefore be transferred to, stored in, or processed in a country whose data-protection laws differ from those where you live.

The HubSpot form uses HubSpot's na1 service region, but that setting does not guarantee that all HubSpot or subprocessor activity occurs only in North America. Socrates relies on its providers' standard contractual transfer mechanisms where applicable and does not claim an independent Data Privacy Framework certification.

9. Data Retention

Socrates retains personal information only as long as reasonably necessary for the purposes described in this Policy, subject to a longer period where required or permitted for legal obligations, legal holds, disputes, security, fraud prevention, or enforcement.

When information is no longer needed, Socrates will delete or de-identify it consistent with applicable law and its approved retention practices.

10. Security

Socrates maintains reasonable administrative, technical, and organizational measures designed to protect personal information. Website and operational controls include:

• TLS/HTTPS and HTTP Strict Transport Security configuration;
• A per-request script nonce and restrictive Content Security Policy;
• Controls that block framing and object embedding and upgrade insecure requests;
• Validated analytics identifiers and consent-gated analytics loading;
• A runtime-validated analytics-event contract and allowlisted, length-limited UTM parameters;
• Removal of removable analytics storage after withdrawal;
• Vercel DDoS and firewall protections;
• MFA or passkeys, least-privilege access, limited administrators, no shared logins, and SSO where available;
• Protected branches, code review, environment separation, automated checks, audit logging, and deployment rollback; and
• A security-contact endpoint and a CSP-report endpoint.

Socrates selected established providers and relies on their standard contracts, published security documentation, certifications, and compliance programs. Socrates has not performed customized vendor security questionnaires or vendor-specific contractual security reviews for the Website providers. No Internet transmission or electronic-storage method is completely secure, and Socrates cannot guarantee absolute security.

11. U.S. State Privacy Rights

Socrates's current assessment is that it does not meet the revenue or processing-volume thresholds of a comprehensive U.S. state consumer-privacy law. Socrates is an early-stage startup with no customers or live form submissions, does not sell personal information or share it for cross-context behavioral advertising, and does not derive revenue from such activity. Socrates will reassess this conclusion as Website traffic, customers, and business activities develop.

Even where not legally required, Socrates voluntarily offers the following rights to U.S. residents who submit a verifiable request, subject to reasonable exceptions:

• Access: Request the personal information Socrates maintains about you.
• Delete: Request deletion of personal information Socrates collected from you.
• Correct: Request correction of inaccurate personal information.
• Portability: Request a portable copy where technically feasible.
• Opt out: Socrates does not sell personal information, share it for cross-context behavioral advertising, use it for targeted advertising, or conduct profiling that produces legal or similarly significant effects.
• Non-discrimination: Socrates will not discriminate against you for making a request.

11.1 How to Submit a Request

Submit the Website form and write Privacy Request in the Message field. The form is Socrates's only public request channel at this time; Socrates does not publish a dedicated privacy email address or privacy phone number.

11.2 Verification and Authorized Agents

Socrates may verify a requester by confirming control of an email address or phone number already associated with a HubSpot record and will request only information reasonably necessary to authenticate the request. Socrates will not fulfill a request it cannot reasonably verify.

An authorized agent must identify the individual, describe the requested action, and provide signed permission or a valid power of attorney. Unless a valid power of attorney is provided, Socrates may contact the individual directly to verify identity and the agent's authority. Socrates will log the request and verification steps in HubSpot.

11.3 Appeals and Timing

Socrates generally will respond within 45 days, subject to an extension where permitted. If Socrates denies a request, it will explain the reason. You may ask Socrates to reconsider by submitting another Website form marked Privacy Rights Appeal. Company leadership or another person who did not make the original decision will review the appeal, and Socrates will provide a written response within 45 days. Where applicable law requires it, a denial will explain how to contact the appropriate state regulator.

11.4 California Notice

Socrates does not currently meet the CCPA/CPRA applicability thresholds and has not voluntarily certified that it is subject to the CCPA. For transparency, the categories collected or expected to be collected in the preceding 12 months are summarized below. Socrates has not sold personal information or shared it for cross-context behavioral advertising during that period.

Socrates retains these categories under Section 9. It does not intentionally collect sensitive personal information through the Website, offer financial incentives tied to personal information, or disclose personal information to third parties for their own direct marketing.

11.5 Texas, Colorado, Virginia, and Other States

As an early-stage small business with no customers or form submissions, Socrates does not currently meet the consumer-data thresholds used by Colorado, Virginia, or other comprehensive state privacy laws that apply such thresholds. Socrates's current assessment is that it qualifies for the Texas Data Privacy and Security Act's small-business exemption and does not sell sensitive personal data. If Socrates later becomes subject to an applicable state law, it will honor the rights, appeals, response periods, and universal opt-out requirements of that law. General breach-notification, information-security, consumer-protection, email-marketing, and telephone-marketing laws may apply independently.

12. Rights of EEA and UK Data Subjects

Subject to applicable conditions and exceptions, EEA and UK data subjects may have rights to access, rectify, erase, restrict, or object to processing; receive portable data; and withdraw consent without affecting processing before withdrawal.

Submit a request using Section 11.1. Where the GDPR or UK GDPR applies, Socrates will respond within one month, extendable by up to two additional months for complex requests with notice to you. Socrates Systems Inc. is the controller of personal information collected through the Website. Socrates has not appointed an EEA or UK representative or Data Protection Officer because its Website and offering are limited to the United States. You may have the right to complain to a supervisory authority in the country where you live or work or where an alleged infringement occurred.

13. Do Not Track and Global Privacy Control

13.1 Do Not Track

Because no industry standard governs browser "Do Not Track" signals, the Website does not alter its behavior in response to DNT.

13.2 Global Privacy Control

The Website recognizes GPC through the Sec-GPCrequest header and the browser's globalPrivacyControl value before analytics loads. For U.S. visitors with GPC, optional analytics remains off by default and no initial prompt appears. You may voluntarily allow restricted, non-advertising analytics through Privacy choices. Non-U.S. or unresolved-region visitors may still receive the ordinary analytics-consent prompt.

GPC keeps sale, sharing for cross-context behavioral advertising, targeted advertising, and advertising-related processing disabled in every case. Socrates will treat GPC as a universal opt-out signal where applicable law requires it.

14. Third-Party Links

The Website may link to third-party sites or services that Socrates does not control. This Policy does not govern those services. Review their privacy notices before providing information. Socrates is not responsible for third-party content, privacy practices, or security.

15. Children's Privacy

The Website is a general-audience service and is not directed to children under 13. Socrates does not knowingly collect personal information from children under 13 through the Website. No age gate or minor-screening mechanism is used, and visitors are not required to be at least 18 years old. If Socrates learns that it collected personal information from a child under 13 without appropriate parental consent, it will delete the information. A parent or guardian may use the contact method in Section 16 to report such a submission.

15A. Commercial Communications

15A.1 Email

Socrates may respond to a waitlist request as a transactional or relationship communication. The current form does not by itself enroll you in promotional email. If you separately opt in, promotional email will identify Socrates Systems Inc. as the sender, include a valid physical postal address, provide a clear unsubscribe method, and honor opt-out requests within 10 business days.

15A.2 Telephone, Text, and Automated Messaging

Socrates may call or text you about your inquiry and intends to use marketing calls, SMS, and automated messaging only where you have separately provided the consent required by applicable law. Consent to marketing texts or automated messages is not a condition of purchasing a product or receiving private-beta access. Message frequency may vary, and message and data rates may apply. You may revoke consent at any time through the method provided in the communication, by replying STOP to a text, or by submitting the Website form. Socrates will honor the revocation and stop the applicable communications.

Socrates does not sell or share mobile opt-in data, phone numbers, or consent records with third parties for their own marketing. It may disclose them to service providers only as needed to send messages on Socrates's behalf, maintain consent and opt-out records, or comply with law.

16. Contact Information

For questions, privacy requests, concerns, accessibility requests, or reports of inadvertently submitted sensitive information or personal information from a child under 13, submit the Website form and describe the request in the Message field. The form is Socrates's only public contact channel at this time; Socrates does not publish a privacy or support email address or phone number.

17. Policy Updates

Socrates may update this Policy to reflect changes in practices, technology, law, or other factors. Socrates will update the date above and post the revised Policy. If a material change affects consent previously given, Socrates will change the consent-policy version so that the Website requests a new choice. Changes take effect when posted unless applicable law requires additional notice or consent.

18. Accessibility

Socrates publishes this Policy as machine-readable HTML designed to target WCAG 2.1 Level AA and support screen readers. Automated accessibility scans cover the legal pages, but Socrates has not completed an independent or comprehensive manual conformance audit or documented manual testing with assistive technologies. Translations, PDF, large-print, and other reasonable alternative formats are available upon request through the Website form.

The HubSpot waitlist form remains available regardless of analytics choice or GPC. Form submission is separate from visitor analytics, and declining analytics does not restrict Website content or the form.