ExitPulse Privacy Policy

1. Who We Are and What This Policy Covers

ExitPulse is operated by 9 Wait LLC, a Delaware limited liability company ("9 Wait," "we," "us," or "our"). Our privacy contact is exit9pulse@gmail.com, and a mailing address for legal correspondence is available on request.

This Privacy Policy describes how we collect, use, disclose, and protect personal information when you use the applications, websites, and services operated by 9 Wait LLC that link to this Policy, including the exitpulse.co website and the ExitPulse mobile applications for iOS and Android (together, the "Services"). It also explains the privacy rights available to you and how to exercise them. This Policy serves as our notice at collection for California residents.

The Services are intended for business owners, founders, and professionals who are 18 years of age or older. By using the Services you acknowledge that you have read this Policy. If you do not agree with it, please do not use the Services.

2. Information We Collect

2.1 Information you provide to us

• Account information. Email address, password (stored in hashed form only), and optional profile details you choose to add.
• Business and financial information. Information you enter to use ExitPulse features, such as your business name, industry, size, revenue, profit, expense add-backs, questionnaire responses, and other inputs used to produce valuation ranges, readiness and attractiveness scores, EBITDA normalization, and benchmarking.
• Content you create. Documents generated in the Services at your request, including Confidential Information Memorandum (CIM) sections, and any edits or notes you add to them.
• Communications. Messages you send us through the contact page, support requests, and account deletion requests, including the email address you submit with them.

2.2 Information collected automatically

• Device and app information. Device type, operating system and version, app version, language, and settings relevant to the Services.
• Usage and log data. Screens and pages viewed, features used, session information, crash reports, diagnostics, IP address, and approximate (city-level) location inferred from IP address. We do not collect precise GPS location.
• Identifiers. Account identifiers we assign, and, on the free tier only, device advertising identifiers (such as the Google Advertising ID or, where permitted, Apple IDFA) used to deliver in-app advertising as described in Section 6.

2.3 Information we receive from others

• App stores and billing. When you purchase a subscription or the Pre-Market package, Apple or Google processes your payment. We and our subscription manager (RevenueCat) receive transaction confirmations, subscription status, and entitlement information. We never receive or store your full payment card number.
• Service providers. Technical information from providers that help us run the Services, such as crash reporting and analytics.

We do not collect Social Security numbers, driver license numbers, precise geolocation, biometric information, or information about your race, religion, health, or sexual orientation, and we ask that you not enter such information into free-text fields.

3. California Categories of Personal Information

The table below summarizes, using the categories in California law, the personal information we collect, to whom we disclose it for a business purpose, and whether it is "sold" or "shared" as those terms are defined in the California Consumer Privacy Act as amended by the California Privacy Rights Act (the "CCPA"). We collect each category from you directly, from your devices, or from the sources described in Section 2, for the purposes described in Sections 4 through 6, and we retain it as described in Section 10.

We do not sell personal information for money, and we have not done so in the preceding 12 months. If personalized advertising is active on the free tier, the disclosure of identifiers, internet activity, and coarse location to advertising partners may constitute "sharing" for cross-context behavioral advertising under the CCPA; you can opt out as described in Sections 6 and 8. We use sensitive personal information (account credentials) only to authenticate you and maintain account security, purposes permitted under CCPA regulations, so we do not offer a separate "Limit the Use of My Sensitive Personal Information" right because none is required for these uses. We do not use or disclose sensitive personal information to infer characteristics about you.

4. How We Use Personal Information

We use personal information to:

• Provide the Services: create and secure your account, calculate valuation ranges, readiness and attractiveness scores, and EBITDA normalization, generate documents you request, and sync your data across your devices.
• Produce anonymized, aggregated peer benchmarks. Benchmarks are computed only from cohorts of at least five businesses and are designed so that no individual business can be identified.
• Process subscriptions and purchases and manage entitlements through Apple, Google, and RevenueCat.
• Provide customer support and respond to your requests, including deletion requests.
• Operate, maintain, analyze, and improve the Services, including debugging, crash analysis, and measuring feature performance.
• Display advertising on the free tier only, as described in Section 6. Paid tiers are ad-free.
• Communicate with you about your account, transactions, security, and material changes to the Services or this Policy.
• Send you news, tips, and offers about 9 Wait LLC products and services. You can opt out of marketing messages at any time using the unsubscribe link in the message or by contacting us; we will still send non-marketing service messages.
• Develop new products, services, and features, and improve our valuation, readiness, and benchmarking models and algorithms using aggregated or de-identified data.
• Carry out internal business operations such as accounting, auditing, and record keeping.
• Use information for other purposes with your consent or at your direction, or as otherwise disclosed to you at the time of collection.
• Protect the Services and our users: detect, investigate, and prevent fraud, abuse, security incidents, and violations of our Terms of Service.
• Comply with law, enforce our agreements, and establish, exercise, or defend legal claims.

For users in the European Economic Area, the United Kingdom, or Switzerland, our legal bases are: performance of a contract (providing the Services you sign up for), legitimate interests (securing and improving the Services, preventing fraud, and non-personalized advertising on the free tier), consent where required (for example, personalized advertising), and compliance with legal obligations.

5. AI Features

Some features, such as coaching tips and CIM drafting, are powered by third-party large language models, currently provided by Anthropic. AI requests are made from our servers, not directly from your device, and we send the provider only the information needed to deliver the feature you requested. Our agreements with AI providers restrict them from using your content to train their models. AI outputs are generated automatically, may contain errors, and are informational only; they are not financial, legal, or investment advice, and you should review them with qualified advisors before relying on them.

6. Advertising

The free tier of ExitPulse is supported by in-app advertising served through Google AdMob. Paid tiers (Pulse, Explorer, and Prep) do not display ads. Depending on your region, your device settings, and, where required, your consent, ads may be personalized (based on advertising identifiers and inferred interests) or non-personalized (based on context such as coarse location and the current session). We do not pass the business or financial information you enter into ExitPulse to advertisers, and we do not use it for ad targeting.

You can control advertising personalization at any time:

• On Android: Settings, then Google, then Ads, where you can delete or reset your advertising ID and opt out of ads personalization.
• On iOS: ads are personalized only if you allow tracking when prompted under App Tracking Transparency; you can change this in Settings, then Privacy & Security, then Tracking.
• Upgrade to any paid tier, which removes advertising entirely.
• California and certain other state residents can also opt out of "sharing" for cross-context behavioral advertising as described in Section 8, including through the Global Privacy Control.

7. How We Disclose Personal Information

We disclose personal information only as follows:

• Service providers. Companies that process personal information on our instructions to run the Services: cloud hosting and infrastructure (Amazon Web Services, hosted in the United States in the us-east-2 region), AI processing (Anthropic), subscription management (RevenueCat), app distribution and billing (Apple and Google), advertising on the free tier (Google AdMob), and analytics, crash reporting, and customer support tooling. Service providers are bound by contracts that restrict their use of your information to providing services to us.
• Advertising partners (free tier only). As described in Section 6. This is the only disclosure that may constitute "sharing" under the CCPA, and you can opt out.
• Aggregated and de-identified information. We may use and disclose aggregated and de-identified information, including benchmark statistics computed from cohorts of at least five businesses, for any lawful purpose. We maintain and use de-identified data without attempting to re-identify it, as California law requires.
• Legal and safety. If required by law, subpoena, or legal process, or where necessary to protect the rights, safety, or property of 9 Wait, our users, or the public.
• Business transfers. In connection with a merger, acquisition, financing, reorganization, or sale of assets, in which case this Policy will continue to apply to your information and we will notify you of any change in ownership.
• With your direction or consent. For example, if you export a CIM and send it to an advisor.

We do not sell personal information for money, and we do not disclose your business financial data to advertisers, data brokers, or other businesses for their own marketing.

8. Your Privacy Rights

8.1 Rights available to everyone

Regardless of where you live, you can access and update most account information in the app, and you can permanently delete your account and associated personal data at any time, either in the app (Profile, then Delete account) or at https://exitpulse.co/account-deletion. Web deletion requests enter a 7-day grace period so you can change your mind; deletion is then processed automatically and personal data is permanently removed from our systems no later than 90 days after your request, except where retention is required by law (see Section 10).

8.2 California residents

If you are a California resident, the CCPA gives you the right to: (a) know and access the personal information we collect, use, and disclose about you, including the categories of sources, purposes, and recipients; (b) delete personal information we collected from you, subject to legal exceptions; (c) correct inaccurate personal information; (d) opt out of the sale or sharing of personal information; (e) limit the use of sensitive personal information where a business uses it beyond permitted purposes (as explained in Section 3, we do not); (f) receive your information in a portable format; and (g) not receive discriminatory treatment for exercising your rights.

How to opt out of sharing: email exit9pulse@gmail.com with the subject "Do Not Sell or Share My Personal Information," use the ad-personalization controls in Section 6, or enable an opt-out preference signal. We honor the Global Privacy Control (GPC): when our website detects a GPC signal from your browser, we treat it as a valid request to opt out of sale and sharing for that browser. Because the ExitPulse app shows ads only on the free tier and personalization follows your device ad settings, turning off ads personalization on your device accomplishes the same result in the app.

We will verify requests to know, delete, or correct by matching the email address of your account and, where necessary, asking you to confirm control of that email. You may designate an authorized agent to submit requests on your behalf; we will require proof of the agent’s authorization and may still verify your identity directly. We respond to verifiable requests within 45 days and will notify you if we need a 45-day extension. California’s "Shine the Light" law (Civil Code Section 1798.83) permits you to request information about disclosures to third parties for their direct marketing; we make no such disclosures.

8.3 Other U.S. state residents

Residents of Colorado, Connecticut, Delaware, Iowa, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Texas, Utah, Virginia, and other states with comprehensive privacy laws have similar rights to access, correct, delete, and obtain a copy of personal data, and to opt out of targeted advertising, sales, and certain profiling. We do not sell personal data or engage in profiling that produces legal or similarly significant effects. You can opt out of targeted advertising using the methods in Sections 6 and 8.2. If we decline to act on your request, you may appeal by replying to our decision email with the word "Appeal"; we will respond to appeals within the period required by your state’s law, and if your appeal is denied, we will provide a way to contact your state attorney general.

8.4 European Economic Area, United Kingdom, and Switzerland

Where the GDPR or UK GDPR applies, you have the right to access, rectify, erase, restrict, and port your personal data, to object to processing based on legitimate interests, and to withdraw consent at any time without affecting prior processing. We process and store data in the United States; where we transfer personal data from the EEA, UK, or Switzerland, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses and equivalent UK and Swiss mechanisms. You may lodge a complaint with your local supervisory authority, though we would appreciate the chance to address your concern first.

8.5 Nevada residents

We do not sell covered information as defined by Nevada law. Nevada residents may nonetheless submit an opt-out request to exit9pulse@gmail.com, which we will honor if our practices change.

9. How to Exercise Your Rights

You can exercise any right described in this Policy by: (a) using the in-app controls (Profile, then Delete account); (b) submitting the form at https://exitpulse.co/account-deletion; or (c) emailing exit9pulse@gmail.com from the email address associated with your account, stating your request and your state or country of residence. We do not charge for rights requests, and we do not require you to create an account to submit one beyond the account whose data is at issue.

10. Data Retention

We retain personal information for as long as reasonably necessary for the purposes described in this Policy, considering the amount and sensitivity of the information, the purposes for which we process it, and applicable legal requirements. Indicative periods:

• Account, business, and financial data: retained while your account is active, and permanently deleted no later than 90 days after a verified deletion request or account deletion.
• Generated documents (including CIMs): retained while your account is active; deleted with your account.
• Server logs and diagnostics: retained for as long as reasonably necessary for security, debugging, and operations, typically no longer than 24 months, then deleted or de-identified.
• Benchmark aggregates: retained indefinitely in de-identified, aggregated form that is no longer linked to you.
• Transaction records: subscription and purchase records held by Apple, Google, and RevenueCat are retained under their policies and applicable tax and accounting law; we retain related entitlement records as required by law.
• Legal holds: we may retain specific information longer where reasonably necessary to comply with law, resolve disputes, or enforce agreements, and we will continue to protect it under this Policy.

11. Do Not Track and Opt-Out Preference Signals

Some browsers transmit "Do Not Track" signals; because no common industry standard for DNT exists, our website does not respond to DNT signals. We do honor the Global Privacy Control as a valid opt-out of sale and sharing for California and other states whose laws recognize opt-out preference signals, as described in Section 8.2.

12. Children

The Services are not directed to anyone under 18, and we do not knowingly collect personal information from anyone under 18. We do not sell or share the personal information of consumers we know to be under 16. If you believe a person under 18 has provided us personal information, contact exit9pulse@gmail.com and we will delete it.

13. Security

We use administrative, technical, and physical safeguards appropriate to the nature of the data, including encryption of data in transit, hashed credential storage, per-user data isolation so that no user can read another user’s data, server-side handling of AI requests so that API credentials never reside in the app, access controls with multi-factor authentication for our infrastructure, and cohort minimums for benchmarking. No method of transmission or storage is completely secure, and we cannot guarantee absolute security; if we learn of a breach affecting your personal information, we will notify you and regulators as applicable law requires.

14. International Data Transfers

We are based in the United States and process and store personal information on servers located in the United States (Amazon Web Services, us-east-2). If you use the Services from outside the United States, you understand that your information will be transferred to and processed in the United States, where privacy laws may differ from those of your jurisdiction, subject to the safeguards described in Section 8.4.

15. Third-Party Services

The Services link to or interoperate with third-party services, including the Apple App Store, Google Play, and pages you may visit from our website. Those services are governed by their own privacy policies, which we encourage you to read. This Policy applies only to the Services operated by 9 Wait LLC.

16. Changes to This Policy

We may update this Policy at any time in our sole discretion. The updated Policy will be posted at https://exitpulse.co/privacy with a new effective date and is effective upon posting unless stated otherwise. It is your responsibility to review this Policy periodically and each time you use the Services, and your continued use of the Services after an update constitutes acceptance of the updated Policy. For material changes we may also provide notice, such as an in-app notice or an email, but posting the updated Policy is sufficient notice. Where applicable law requires it, we will obtain your consent before applying materially different practices to previously collected personal information.

17. Contact Us

9 Wait LLC (ExitPulse)

United States

Email: exit9pulse@gmail.com

Account deletion: https://exitpulse.co/account-deletion

A mailing address for legal correspondence is available on request.

If you have a disability and need this Policy in an alternative format, contact us and we will provide it.