StallionOS -- Privacy Policy

Version: 1.3
Effective: October 22, 2026
Provider: Valeor LLC, a Minnesota limited liability company ("we", "us", "our")
Product: StallionOS (the "Platform")
Contact: nate@valeor.io

This policy describes what the Platform actually collects and does today. It is not a statement of what we reserve the right to collect. Where a practice is not yet in place, this policy does not describe it as if it were.

1. Scope

This policy applies to StallionOS and to the account you create to use it. It covers information we hold about you and your firm.

It is a disclosure, not a contract. Your agreement with us is the Terms of Service. Where this policy and the Terms address the same subject, the Terms control.

2. Private deal data never reaches us

The Platform separates a public path from a private path.

Private deal data -- the target company financials, the operating model inputs, the documents you upload on the private path -- is processed entirely in your browser. It is not transmitted to our servers, and we cannot read it. We do not hold it, cannot produce it in response to a request, and cannot lose it in a breach of our systems, because it is never in our systems.

3. What we collect

Account information. Your email address, a cryptographic hash of your password, your display name, your account status, timestamps for account creation and last sign-in.

Firm and entitlement information. The firm your account belongs to, other members of that firm, and what your account is entitled to use.

Terms acceptance. Which version of the Terms of Service you accepted, when, and which account accepted it.

Session information. An opaque session identifier while you are signed in.

Saved models. The models, scenarios and tags you save to your account. Private deal models are never saved to your account.

Firm settings. Your firm profile (firm name, preferred deal types, carried interest and default assumptions such as your usual multiples, leverage, rates, tax rate and discount-rate assumptions), your export formatting, and a dated history of changes to them, so they are available wherever you sign in. They are your conventions, not deal data. Private deal data is still never sent to us.

Server access logs. Our hosting provider records standard web-server logs for requests to the Platform: IP address, requested path, user agent, and timestamp. These are operational records used for availability and abuse investigation.

That is the complete list.

4. Cookies

The Platform sets two cookies, both strictly necessary:

• A session cookie, which keeps you signed in.
• A CSRF token cookie, which protects form submissions against cross-site request forgery.

We set no advertising cookies, no tracking cookies, and no third-party cookies.

5. Analytics and telemetry

We collect none.

The Platform contains no analytics service, no product-telemetry service, and no error-reporting service. There is no Google Analytics, Mixpanel, Segment, PostHog, or equivalent. We do not record page views, feature usage, click streams, or session replays. Our servers make no outbound requests to third-party services on your behalf.

6. Sub-processors

One third party processes data on our behalf:

We will update this list before adding a sub-processor. If you are evaluating the Platform and need current sub-processor detail for a vendor review, ask.

7. Backups

We do not yet run scheduled backups of server-held data.

Backups do not contain private deal data, because our servers never hold private deal data.

8. How we use information

We use the information in Section 3 only to:

• operate your account and keep you signed in;
• keep your saved firm settings available wherever you sign in;
• enforce entitlements and firm membership;
• record which version of the Terms you accepted;
• maintain availability, investigate faults, and investigate abuse;
• contact you about your account or the service.

We do not use Customer Data to train models. We do not use it to build features for other customers. We do not sell it, rent it, or share it for advertising. Customer Data is isolated by account.

9. When we disclose information

We disclose information in three circumstances only:

• to the sub-processors in Section 6, for the purposes stated there;
• when required by law, by valid legal process, or to protect the safety of a person;
• in connection with a merger, acquisition, sale of assets, or reorganization, including a transfer to a corporate entity formed to operate the Platform, on the same terms as the assignment provision of the Terms.

We do not disclose Customer Data to any other party.

10. Retention and deletion

We retain account information for as long as your account is open.

On termination, you may request, within thirty (30) days, an export of the data we store about you, after which we may delete it. We cannot export data that never left your device. This matches the Terms of Service.

Server access logs are retained on the standard schedule of our hosting provider and are not retained by us separately.

11. Security

Passwords are stored as PBKDF2 hashes, never in readable form. Sessions use opaque tokens that can be revoked. Traffic to the Platform is served over TLS.

The strongest security property of the Platform is architectural rather than procedural: private deal data is not exposed to a breach of our servers because it is never sent to them.

No system is perfectly secure, and we do not claim otherwise.

12. Your choices and requests

Write to nate@valeor.io to:

• request a copy of the information we hold about you;
• correct information that is wrong;
• close your account and request deletion;
• ask for current sub-processor detail for a vendor or compliance review.

We will respond within thirty (30) days.

13. Children

The Platform is a professional tool sold to firms. It is not directed to anyone under 18, and we do not knowingly collect information from anyone under 18.

14. Where information is processed

The Platform is operated from the United States, and the sub-processors in Section 6 store data in the United States. If you access the Platform from outside the United States, your information is processed in the United States.

15. Changes to this policy

We may update this policy. The version and effective date at the top of this document always identify the current version. Material changes take effect thirty (30) days after we notify you.

Because this policy is a disclosure rather than an agreement, we publish revisions; we do not ask you to re-accept them. Your agreement remains governed by the Terms of Service.

16. Contact

nate@valeor.io