Privacy Policy

Last updated: October 10, 2026

GapLedger is operated by Stratiback LLC (Louisiana, USA). This policy describes what personal data we collect when you use gapledger.com, why, and the choices you have. The short version: we collect what the service needs to function, we sell nothing, and the only third-party analytics on this site is Google's, which loads only if you accept cookies.

What we collect

Account data: your name (if provided), work email address, and a salted hash of your password — never the password itself. Multi-factor authentication secrets are stored encrypted. Signup context: the IP address used at registration, kept for abuse prevention, and, only if you accepted analytics cookies beforehand, the campaign that first brought you to the site (described under Cookies). Content you add: the compliance material your organization puts into the service — controls, risks, notes, evidence files — which may incidentally contain personal data your organization chooses to include. Operational records: an append-only audit trail of actions in your workspace (who did what, when), and server logs kept for security and troubleshooting.

What we use it for

Operating the service, authenticating you, sending the emails the service depends on (verification links, task and deadline reminders, billing notices), preventing abuse, and providing support when you contact us. We send no marketing email without separate consent. We do not sell or share personal data for advertising.

Policy acceptance records

A customer organization can ask its staff to read and accept its own policies, including staff who don’t have a GapLedger account. For those staff, the organization supplies each person’s name and email address, and we email them, on the organization’s behalf, a personal link to the policy, plus reminders until they accept. Opening the link does not sign anyone in, and the analytics tag described under Cookies never loads on that page.

Whenever anyone accepts a policy, by that link or signed in to the app, we record who accepted it (name and email), the time, the IP address and browser user agent it came from, and a fingerprint of the exact version they were shown. We also keep a log of the reminders sent. This exists so the organization has evidence that its people were told about its policies and accepted them, for example for its own audits. Acceptance records can’t be edited afterwards, so they stay reliable as evidence.

The customer organization is the controller of this data: it decides whose details to add and which policies they must accept. We act as its processor and use the data only to send those emails and keep the record. It is retained as part of the organization’s workspace data (see Retention). If you were asked to accept a policy and want to exercise your data rights, contact that organization; if you contact us instead, we will pass your request on.

Who else touches your data

We use a small number of service providers: Stripe (payment processing — we never see your card number), Postmark (transactional email delivery), and US-based hosting infrastructure operated by Stratiback LLC. These providers process data only as needed to provide their service to us. We disclose data if required by law, and we will tell you when we are permitted to.

Cookies

Essential cookies, always set: a session cookie to keep you signed in and, where applicable, a cookie recording a consultant’s active client context. We also store your cookie choice itself in your browser’s local storage so we don’t ask again.

Analytics and advertising cookies from Google Analytics and Google Ads, used to measure which campaigns bring people here. We load Google’s tag only after you accept. Until you choose, and if you decline, the tag is never loaded at all — so no cookies are written, no advertising identifiers are collected, and nothing about your visit is sent to Google, not even a cookieless page view. Declining changes nothing about how the product works. Accepting also lets us set one first-party cookie of our own, gl_attr (kept 90 days), recording the campaign tags of your first visit: the utm_source, utm_medium, utm_campaign, utm_term and utm_content parameters, the Google Ads click ID (gclid) and the page you landed on. If you then start a trial, open the demo or send us a message, we store or forward those values with it so we can tell which campaigns work. Nothing from this cookie is sent to Google or anyone else, and declining deletes it. You can change your choice at any time:

Accepting means Google receives your IP address and page-view information and may use it to attribute advertising. Google acts as an independent controller for that data; see Google’s own privacy policy for what it does with it. If you accept and then decline again, the tag stops loading from that point on; a tag already running on the page you are looking at is told to deny all storage immediately, and is gone on your next page view.

We also keep the tag out of your workspace. It loads only on our public pages and on the billing page — never on the pages holding your scopes, controls, risks or evidence — so those addresses, which contain your record identifiers, are never sent to Google.

Demo video. The walkthrough on our demo page is hosted on YouTube. Until you press play it is only an image we serve ourselves, and nothing is sent to YouTube. Pressing play loads YouTube’s privacy-enhanced player (youtube-nocookie.com); from then on YouTube, a Google service, receives your IP address and viewing information and may set cookies or use local storage to play the video. YouTube acts as an independent controller for that data under Google’s privacy policy. This is separate from your analytics choice above.

Retention

Account and workspace data is retained while your account exists and for a reasonable period afterwards to allow reactivation and export. Evidence files are special: they are stored in write-once storage under a one-year compliance retention lock, and cannot be deleted by anyone — including us — until that lock expires. If you ask us to erase your data, we will delete or de-identify everything within our control and confirm the date on which locked evidence will be destroyed. Database backups are retained for 14 days.

Security

Every account requires multi-factor authentication. Customer workspaces are isolated at the database layer with row-level security. Evidence is content-hashed and stored write-once. The audit trail is append-only and cannot be modified even by our own application. Data is encrypted in transit; MFA secrets are encrypted at rest.

Your rights

You can access and export your organization’s data at any time from within the service. You may request correction or deletion of personal data, subject to the evidence retention lock described above. If you are in the UK, EU, or another jurisdiction with statutory data rights, we will honor access, rectification, erasure, portability, and objection requests as those laws provide. Contact us via the contact form — it is the fastest route to a human.

International transfers

The service is hosted in the United States. If you use it from elsewhere, your data is processed in the US. Customers needing a data processing agreement for their own compliance obligations can request one via the contact form.

Changes

We will update this policy as the service evolves and note the date above. Material changes will be announced by email or in-app notice before they take effect.