DRAFT, not legal advice, for attorney review before use with real users. Version: 2026-11-draft-1 · Effective date: [EFFECTIVE DATE]

Sales Monarch Privacy Policy

This Privacy Policy explains how personal information is collected, used and shared in Sales Monarch (the "Service"), operated by [IOTA LEGAL ENTITY NAME] ("IOTA", "we", "us"), [IOTA ADDRESS].

1. Who is responsible for your data

1.1. Each sales company that uses Sales Monarch (a "Client Team") owns and controls the data of its reps and team members.

1.2. IOTA processes that data on the Client Team's behalf, under a Data Processing Addendum with the Client Team. That means we use it to run the Service for the team, not for our own separate purposes.

1.3. If you have a question about how your team uses your data, you can contact your Team Admin or us. We will pass requests to your Client Team where needed.

2. Age

The Service is for people 18 and older only. We do not knowingly collect data from anyone under 18. If we learn we have, we will delete it.

3. What we collect

3.1. Account details: name, email address, password (stored in hashed form) if you choose one, your team and role.

3.2. Profile details: photo/avatar, phone number, school, and the goals you enter (such as your 5-year goal, next-summer goal and "my why").

3.3. Training activity: checklist progress, stage, percent complete, module and video progress (including how much of each video you watched), pass-off results and notes, training sessions attended, cohort, and points.

3.4. Proof Uploads: documents, images, recorded pitch videos and text answers you submit, plus review status and feedback from your Team Leader. Earlier versions of a submission are kept.

3.5. Information others enter about you: your Team Leader or Team Admin may add notes, review feedback, training logs and evaluations. If you bring a friend to an event, a Team Leader may record that friend's name.

3.6. Consent records: which version of the Terms and this Policy you accepted, your media-consent choices, the time, and your IP address.

3.7. Technical data: session cookies, IP address, device and browser type, and error reports when something breaks.

3.8. What we do not collect: we do not store Social Security numbers, tax forms or government ID documents. Hiring paperwork stays in your Client Team's own systems.

4. How we use it

4.1. To run the Service: sign you in, show your checklist and modules, track progress, route Proof Uploads to reviewers, calculate points and leaderboards, and send service emails (for example, sign-in links, review results and reminders).

4.2. To let your Client Team manage training: progress views, stall alerts, and Team Leader evaluations.

4.3. To keep the Service secure and working: preventing misuse, keeping an audit log of privileged actions, and fixing errors.

4.4. To provide support. IOTA Platform Admins may view an account as that user to fix a problem; this is logged.

4.5. Training reuse only with opt-in. Your pitch videos are used in training material for others only if you separately opt in. See the Media Consent.

4.6. We do not sell your personal information, and we do not use it for advertising.

5. Who can see your data

5.1. Your Proof Uploads (documents, images, pitch videos, text answers): only your Team Leader, your team's Team Admins, and IOTA Platform Admins. Other reps never see them.

5.2. Your cohort (reps on your team who started the same month): your name, avatar, stage, percent complete and points.

5.3. Leaderboards: show your points to others on your team. Teams never see each other's data.

5.4. Your Team Leader and Team Admins: your progress, profile, training activity and Proof Uploads.

5.5. Service providers (subprocessors) that help us run the Service:

5.6. Legal reasons: we may disclose information if required by law, or to protect the rights, safety or property of users, Client Teams, IOTA or others.

5.7. Business transfers: if IOTA is involved in a merger, acquisition or sale of assets, data may be transferred subject to this Policy and our agreements with Client Teams.

6. Cookies

6.1. We use strictly necessary session cookies to keep you signed in and secure.

6.2. We do not use advertising or cross-site tracking cookies.

7. Security

7.1. Data is encrypted in transit and at rest.

7.2. Proof Uploads and training videos are private and served through links that expire.

7.3. Access is limited by team and role, and privileged actions are logged.

7.4. No system is perfectly secure. If a breach affects your data, we will notify your Client Team and, where the law requires, you.

8. How long we keep data

8.1. Active accounts: while you are on the team.

8.2. If you leave your team: your account becomes read-only for 90 days, then is archived.

8.3. Proof Uploads: deleted 12 months after upload, unless your Client Team chooses to keep them longer.

8.4. [ATTORNEY/IOTA: confirm how long archived accounts, consent records, audit logs and backups are kept.]

9. Your rights

9.1. You can ask for:

• a copy (export) of your data;
• deletion of your data;
• correction of inaccurate data;
• withdrawal of your optional training-reuse opt-in, at any time.

9.2. Deletion and points. When your data is deleted, your entries in the points ledger are anonymized rather than removed, so team totals stay accurate without identifying you.

9.3. How to ask: email [privacy@salesmonarch.org?] or contact your Team Admin. Because your Client Team controls your data, we may need to coordinate with them. We may need to verify your identity first.

9.4. [OPEN QUESTION: whether CCPA/CPRA or other state privacy laws apply, and whether a state-specific rights section is required. See README.]

10. Changes to this Policy

We may update this Policy. If a change is material, we will tell you in the Service or by email before it takes effect. The version you accepted is recorded.

11. Contact

[IOTA LEGAL ENTITY NAME] [IOTA ADDRESS] Email: [privacy@salesmonarch.org?]