Portfolio privacy policy

.win is the website and application building service operated by DotWin LLC at Entrepreneurs.win. You can verify your email, submit a business brief, follow your build, review a private website preview and arrange a call with our team. This notice supplements the portfolio privacy policy below for .win's Google sign-in and staff calendar connection. It does not authorize unrelated portfolio services to access your Google information.

If you choose Continue with Google, our authentication service receives your Google account identifier, email address, email-verification status and basic profile information that Google provides, such as your name and profile picture. We use this information to verify your identity, sign you in and associate your .win profile with your build request. We do not receive your Google password. You can also sign in with an email link.

Calendar access is a separate connection authorized by DotWin staff. It is not required from customers to request a build or book a call. The connection reads free/busy time intervals for the team's host calendars to offer available appointments. Free/busy access does not provide the titles, descriptions, guests or contents of unrelated personal calendar events.

The calendar connection can create a dedicated booking calendar and read, create, update or delete events on calendars the application creates. We use it for build-review appointments and Google Meet links. Appointment information includes the customer's email address, the assigned host, the appointment time, a meeting link and internal identifiers used to match the appointment to its build request. We do not request access to Gmail messages, Google Drive files or Google Contacts for these features.

Google processes the identity and calendar requests. Supabase provides authentication and database storage; Vercel hosts the application and its server processing. These providers process information needed to operate these features. Authorized DotWin staff can access relevant lead and appointment records for build review, scheduling and support. Customers receive available appointment times, not another host's personal event details.

When an appointment is booked or cancelled, Google receives the appointment details and sends calendar invitations or updates to the customer and assigned host. Appointment participants can see information included in their invitation, including attendee email addresses and the meeting link. Do not put sensitive personal information into a build brief or calendar invitation.

Google user data from these features is not sold, used for targeted advertising or used to develop, improve or train generalized or non-personalized AI or machine-learning models. Any sharing is limited to providing these features, security, legal requirements and permitted transfers under Google's API Services User Data Policy.

Google identity details and appointment records are stored in our access-controlled Supabase database. Connections to Google and our services use HTTPS. The staff calendar refresh credential is encrypted in Supabase Vault and retrieved only by authorized server processing; it is not exposed to customers or included in their browser pages. Access tokens are used by the server to make authorized Google requests.

The latest free/busy snapshot is refreshed regularly and is used to offer appointments only while it is fresh. Calendar identifiers and the encrypted refresh credential are retained to maintain the staff connection until it is removed. Identity and appointment records are retained while needed to provide the service and handle support, security or legal obligations, subject to the retention and deletion rules in the portfolio policy below. Revoking Google access does not automatically delete existing .win records or calendar invitations.

You can review or revoke .win's Google permissions through the third-party connections page in your Google Account. Revocation prevents further authorized access through that grant; it does not cancel a previously booked appointment. Use DotWin's appointment controls or contact us for booking changes.

To request access, correction, removal of a calendar connection, or deletion of Google-derived information held by .win, email privacy@dotwin.win from the relevant account address. Include enough information to locate the account or appointment, but never send a password or authorization token. We may verify your identity and retain limited records where required for security, legal obligations or disputes, as explained below.

DotWin LLC is a privately held holding company organized as a Wyoming limited liability company, with a Texas home office and business activities throughout the United States. This Privacy Policy covers personal information handled by DotWin LLC and participating portfolio services offered under Entrepreneurs.win, Businesses.win, CEOS.win, DotWin.win, PlaySolo.Soccer, ARKZ.AI, NOTA.AI, BeyondMom.App and THS.Social, including their related websites, applications, portals, subdomains and successor brands. It also covers current and future portfolio businesses and holdings when DotWin LLC operates the relevant service or its authorized operator adopts this policy. Effective October 5, 2026; portfolio revision 2026-10-05.2.

DotWin, we and us mean the entity responsible for the processing described here. DotWin LLC is the responsible entity unless the service's privacy notice, accepted order or other applicable notice identifies a separate portfolio operator. A separate legal entity that determines its own processing purposes is responsible for those activities and applicable privacy duties. Portfolio ownership alone does not merge independent companies into a single controller or give every portfolio company access to every customer's information. A service-specific privacy notice supplements this policy and controls a direct conflict about that service's actual processing.

This policy covers visits, proposals, communications, accounts, purchases, hosting, business tools and other supported portfolio features. For our own account administration, sales, billing, security and service operations, the responsible entity determines processing purposes. When we process a customer business's information on its instructions, we generally act as a service provider or processor and that business controls its data. A customer-operated site, independent vendor or independently operated investment may have its own privacy notice. A separately executed data-processing agreement controls a conflict concerning processing on a customer's behalf. Contact privacy@dotwin.win if you need help identifying the responsible operator or submitting a request.

Information you provide includes names, email addresses, phone numbers, organization and business details, account profile and permissions, support requests, correspondence, files, website content, business records, customer lists and information entered into features you choose to use. We receive information from account administrators, authorized collaborators and integrations you connect, and may receive relevant public business information in connection with a service inquiry.

Transaction information includes products, amounts, billing frequency, invoices, receipts, subscription status, payment and refund identifiers, and limited payment-method details supplied by a processor, such as brand and last four digits. Payment details entered in Stripe's secure components go to Stripe; DotWin does not store full payment-card numbers or card security codes.

Agreement records include your purchase email and name if supplied, the terms and privacy versions shown, disclosed billing schedule, checkbox and recurring-payment authorization, acceptance time, order reference, a screenshot of the agreement panel, and integrity checks. We may retain browser information and a hashed network address for fraud prevention and evidentiary context. Agreement screenshots exclude payment-entry fields. A browser-submitted screenshot is a supporting record of submission, not independent identity verification or proof of a completed charge.

Technical and usage information may include IP address, device and browser type, operating system, language, approximate city or region derived from network information, referring pages, page visits, timestamps, interactions, errors and security logs. Cookies, local storage and similar tools support sign-in, preferences, security and first-party measurement. We do not use these technologies to collect precise location unless a feature separately requests permission.

We use information to supply and administer services; create and protect accounts; host, maintain, troubleshoot and migrate sites; process authorized charges, renewals, cancellations and refunds; manage customer relationships; provide support; deliver service notices; understand and improve our products; investigate abuse and fraud; preserve agreements; and meet legal, tax, accounting and dispute-resolution obligations.

Where a lawful basis is required, we rely as appropriate on performing a contract or taking requested precontract steps, complying with law, legitimate interests such as securing and administering the service where not overridden by your rights, and consent where required. You may withdraw consent for optional processing without affecting earlier lawful processing. Declining information essential to a service may prevent us from supplying that service.

Agreement acceptance and payment authorization are not consent to promotional email, automated marketing calls or marketing texts. Those communications require their own applicable permissions and opt-out mechanisms. Transactional, security and legally required notices may continue after you opt out of marketing.

On proposal pages, first-party measurement may record time spent, sections read, scrolling, clicks, device and browser information, approximate network location and a session identifier. A recipient-specific link can associate activity with its intended recipient. A shared link does not reliably identify an individual; attribution from context may be an assumption rather than verified identity.

Proposal session replay reconstructs page appearance and pointer, scroll and click activity so we can understand usability and follow up on the proposal. Form input is masked, and passwords and payment-card fields are not intended to be recorded. Payment fields are supplied in the processor's secure frame. Avoid placing sensitive personal information in unrestricted website content or support messages.

Our proposal tracking is disabled when it detects a Global Privacy Control or Do Not Track signal. Browser settings may also restrict cookies or local storage, although essential sign-in functions can be affected. Where law requires consent for optional tracking, that consent must be obtained separately; agreement to this policy does not substitute for it. You may contact privacy@dotwin.win about proposal information or request deletion subject to legal exceptions.

We disclose information as needed to service providers for hosting and storage, account authentication, payments, communications, analytics, support, security, professional advice and service delivery. Our infrastructure may use Supabase, Vercel, Stripe, Resend and Quo/OpenPhone. Hosting and website providers may include Wix Studio, Simvoly, Square, Shopify and Framer. Only the providers relevant to a particular service receive the information needed for that role; not every customer uses every provider.

Portfolio shared services. DotWin LLC and the portfolio entities involved in your service may receive the limited information necessary for authorized account administration, consolidated billing that you requested, technical hosting, support, fraud prevention, security and legal compliance. Access follows the relevant purpose, account permissions, confidentiality duties and applicable data-processing restrictions. We do not treat common ownership, a shared sign-in or acceptance of these Terms as blanket permission to combine unrelated customer records, share sensitive information across the portfolio, or market every portfolio product to you. Separate consent, notice or opt-out rights are honored where required. An affiliate using information for its own independent purposes must have a lawful basis and provide the applicable notice.

Authorized members of your organization and your designated collaborators may see information according to their account permissions. If you connect an external integration or ask us to share a file or publish a site, information is disclosed as needed to carry out your instructions. Publicly published website content can be viewed, indexed or copied by others.

We may disclose information to legal, accounting and insurance advisers under appropriate confidentiality duties, in response to valid legal process, to protect rights and safety or investigate fraud, and in connection with a proposed or completed business transaction such as a merger or sale subject to appropriate protections. We may disclose genuinely deidentified or aggregated information that does not identify you, subject to applicable law.

DotWin does not sell personal information for money, and does not share personal information with advertising networks for cross-context behavioral advertising through the service described here. We do not treat a purchase or an agreement screenshot as permission for such sharing. Customer-enabled advertising tools on separately operated sites are governed by those businesses' notices and applicable consent requirements.

A new holding or acquisition does not automatically authorize a new use of your information. Transfers connected with a merger, acquisition, reorganization or sale of an entity, business or assets remain subject to appropriate confidentiality and security protections, existing contractual restrictions, applicable notices and any legally required consent. Materially different uses require the applicable legal basis before they occur.

To supply managed hosting, DotWin may move sites and their necessary data between its platform and selected hosts at any time during the service term, as authorized in the Terms and accepted order. This may involve copying content, databases, user records, configuration and backup data to a replacement provider and retaining transitional copies while we verify the move. We limit transfers to the service purpose and applicable instructions and use appropriate contractual protections.

We and our providers may process information in the United States and other countries where we operate. Data-protection laws may differ. Where legally required, international transfers use an approved safeguard, such as applicable standard contractual clauses or another lawful mechanism. Contact privacy@dotwin.win about the arrangements relevant to your service. Hosting-migration authority does not waive mandatory transfer restrictions, required notices or data-subject rights.

When you enable an integration or AI feature, relevant instructions, content or records may be sent to that provider to complete the requested function. Provider terms and the configuration of your service also apply. Do not submit sensitive or regulated information unless the service is intended for it and the necessary agreements and permissions are in place. We do not grant a blanket right to train external models on private customer information through acceptance of this policy; any materially different use requires the notices, authority and consent required by law.

We retain information for as long as reasonably needed for the purposes described here, considering the service relationship, type and sensitivity of information, legal obligations, security needs and limitation periods. Active account content generally remains while the service is active. After termination, available content may have a limited recovery period described in the Terms or order, after which deletion follows our operational and backup cycles.

Billing, tax and transaction records, including accepted policy versions, agreement screenshots and authorization evidence, are generally retained for seven years after the relevant transaction or the end of the service relationship, and longer when a legal hold or applicable obligation requires. Security and audit information is retained according to operational and legal needs; ordinary audit logs are generally retained for up to two years, while records supporting a transaction or dispute may be retained with that record. These periods are not promises of unlimited recoverability.

A deletion request may be limited where retention is necessary to complete a requested service, comply with law, prevent fraud, protect security or establish, exercise or defend legal claims. We restrict retained information to those purposes. Deleted information may remain temporarily in isolated backups until those backups expire.

Depending on where you live and which laws apply, you may have rights to know or confirm processing, access a copy, correct inaccuracies, delete information, obtain portable data, restrict processing, object to certain uses, withdraw consent, or opt out of sale, targeted advertising or certain consequential profiling. DotWin does not use the processing described here to make solely automated decisions producing legal or similarly significant effects about you. We will not unlawfully discriminate against you for exercising a privacy right.

Send requests to privacy@dotwin.win with your relationship to DotWin and enough detail to identify the information. Do not send a full card number, password or unnecessary identification. We may reasonably verify identity and an authorized agent's authority before acting. Account settings may provide additional controls. If we process information for a customer business, we may direct you to that business and assist it under our agreement.

We aim to acknowledge requests promptly and respond within 30 days; applicable statutory deadlines and permitted extensions control, and we will explain any required extension. If we deny a request, you may appeal by emailing privacy@dotwin.win with the subject Privacy appeal. We will review the decision and respond within the applicable legal period. You may also complain to your local privacy regulator or state attorney general. For Texas residents, this includes the Texas Attorney General when the Texas Data Privacy and Security Act applies; for EEA or UK residents, the competent supervisory authority.

We use administrative, technical and organizational safeguards appropriate to the information and service, including access controls, tenant isolation, encrypted connections and restricted access to private transaction records. Agreement screenshots are not public website assets. No safeguard can guarantee absolute security, and customers must also protect credentials and authorized access. Report a suspected security issue to security@dotwin.win. If a personal-data breach requires notice, we will provide it as required by applicable law.

Business administration and purchases are intended for adults authorized to enter a contract. Some portfolio offerings may expressly support youth profiles, supervised educational or community participation, or family services. The applicable service describes permitted ages, the role of the parent or guardian, visibility settings and any required additional notices or permissions. A general checkout checkbox does not constitute verifiable parental consent where the law requires a separate process. Where children's privacy law requires direct notice and parental consent, the operator must provide that notice and obtain the required consent before covered collection, use or disclosure, except where a lawful exception applies.

Adults or organizations supplying a child's information must have the required authority, but their statement alone does not replace any independently required verification or consent process. Do not publish a child's private contact details, precise location or other sensitive information without appropriate authority and safeguards. Contact privacy@dotwin.win if you believe a child's information was collected or shared improperly, or to request information about applicable parental rights, access or deletion.

Do not submit regulated health, financial-account, biometric, precise-location or other sensitive information into a general-purpose feature without a lawful basis and appropriate arrangements. Supported features requiring sensitive information must provide applicable purpose-specific notices and permissions. Common portfolio ownership does not supply sensitive-data consent or permit unrelated reuse.

We may update this policy to reflect service, legal or operational changes. We will post the effective date and provide direct or prominent notice of material changes where required. If a new use requires consent, we will obtain it before that use. An archived policy version and the relevant acceptance record are retained for purchases made under that version.

Privacy questions, requests and appeals: privacy@dotwin.win. Security reports: security@dotwin.win. Billing or cancellation: billing@dotwin.win. Legal notices: legal@dotwin.win. DotWin LLC.