Privacy Policy

Introduction

Welcome to WinBench by Digital Command.

We built this platform differently from traditional sales and marketing systems.

Most commercial platforms are designed to maximize seller reach, outbound activity, and engagement volume. Our platform is designed to help buyers control their decision environment, reduce noise, govern commercial interactions, and manage how vendors gain access to organizational attention — while also providing SaaS tools for subscriber organizations (strategy, seller execution, and related workspace services).

This Privacy Policy explains:

• what information we collect,
• how we use it and on what legal bases,
• our roles as controller and processor,
• how buyer-controlled agent systems operate,
• how organizational and buyer decision data is protected,
• international transfers,
• and the rights available to individuals, including in the EEA, UK, and Switzerland.

This notice is provided for transparency. It is not a contract you “accept” by browsing. Where the law requires consent (for example, certain cookies or optional calendar connections), we will ask for it separately.

1. Buyer-Centric Privacy Principles

Our platform operates on several core principles:

Buyer Control

Buyers control visibility, routing, approvals, workflow configuration, and interaction permissions within their realm.

Minimum Necessary Access

Participants only receive access to information necessary to participate in an approved workflow or interaction.

Explicit Governance

Sensitive actions, escalations, disclosures, and automated decisions may require explicit buyer approval before execution.

Auditability

Important actions and workflow events may be recorded in immutable or append-only audit systems to support accountability, governance, and dispute resolution.

Realm Separation

Buyer and seller environments are logically separated to reduce unauthorized visibility and protect organizational decision data.

No Sale of Personal Information

We do not sell personal information. We do not sell buyer decision details, private notes, private invites, non-public account information, or unpublished evaluation criteria to third parties, data brokers, advertisers, or lead marketplaces. Privacy is not a paid upgrade: subscriber payment does not purchase broader access to another party's private buyer data.

2. Who We Are and Our Roles

Digital Command (“we”, “us”) operates WinBench. Our contact details appear in the Contact section below.

Depending on the activity, we act as:

• Controller — for account registration, authentication, billing and subscription administration, platform security and abuse prevention, product analytics we decide to run, marketing communications we send, and our own website cookies where we determine the means and purposes.
• Processor — for Customer Content that subscriber organizations (and their authorized users) upload or generate inside workspaces and related SaaS tools, when we process that content solely to provide the service on the customer’s documented instructions. That relationship is governed by our Data Processing Agreement (DPA) at /dpa and the applicable order form or subscription agreement.
• Controller or joint arrangements may also apply for free buyer inbound / portal surfaces where an individual interacts with us directly rather than solely through a customer workspace — we still apply the principles in this Policy.

Where we are a processor, the customer (typically the workspace or tenant organization) is the controller of Customer Content and is responsible for its own privacy notices to end users and for lawful instructions to us.

3. Information We Collect

Subscriber and Workspace Information

For SaaS subscribers and their workspaces, we may collect:

• account and organization information,
• workspace membership and role information,
• strategy and lever content,
• opportunity and meeting context,
• uploaded files and documents,
• configuration and preference settings,
• usage and collaboration metadata.

Buyer Information

Where buyers use inbound or portal features (including free buyer capabilities), we may collect:

• account information,
• organization information,
• stakeholder information,
• workflow configurations,
• approval settings,
• buyer preferences,
• evaluation criteria,
• scheduling preferences,
• uploaded files and documents,
• communication preferences,
• interaction history,
• internal notes and metadata,
• buyer agent configuration settings,
• visibility settings and public-page content the buyer chooses to publish.

Connected Calendars (Optional)

If you connect Google Calendar or Microsoft Outlook, we receive OAuth tokens and limited calendar data needed to help you schedule meetings in WinBench (for example, checking availability and creating events you authorize). We use this access only for scheduling you authorize. We do not sell calendar data or use it for advertising. Connecting a calendar is optional and based on your consent, which you may withdraw by disconnecting the integration.

Seller Submission Information

We may collect:

• company information,
• contact information,
• product and service submissions,
• pricing information,
• supporting documents,
• communication history,
• contextual business information,
• proposal metadata,
• engagement signals.

Technical Information

We may collect:

• device information,
• browser information,
• IP address,
• operating system,
• session identifiers,
• usage telemetry,
• API activity,
• security logs,
• performance metrics,
• AI agent execution metadata,
• cookie and similar technology data as described in our Cookie Policy at /cookies.

4. Legal Bases (EEA, UK, and Switzerland)

Where the EU/UK GDPR (or Swiss FADP) applies and we act as controller, we rely on one or more of the following bases:

• Contract — to create and administer your account, provide the services you request, and support authenticated use of the platform.
• Legitimate interests — to secure the platform, prevent fraud and abuse, improve reliability and product quality using aggregated or carefully scoped telemetry, enforce our Terms, and communicate service-related messages — balanced against your rights and expectations.
• Consent — where required, including non-essential cookies/trackers, optional calendar connections, and marketing emails where consent is the applicable basis. You may withdraw consent at any time without affecting prior lawful processing.
• Legal obligation — to comply with applicable law, lawful requests, and record-keeping duties.

Where we act as processor, the customer’s documented instructions and the DPA supply the processing framework; the customer is responsible for establishing its own lawful bases for Customer Content.

5. Buyer Agent Systems

The platform may allow buyers to configure AI-assisted agents that support:

• filtering,
• prioritization,
• scheduling,
• routing,
• analysis,
• approval workflows,
• recommendation generation.

Buyer agents may operate using buyer-defined governance settings including:

• confidence thresholds,
• approval requirements,
• escalation rules,
• notification preferences,
• autonomy boundaries,
• feature controls.

Buyer agents assist workflows but do not independently bind organizations to contractual, financial, procurement, or legal commitments.

Human oversight remains important when evaluating automated outputs.

6. How We Use Information

We may use information to:

• operate and maintain the platform and SaaS subscriber services,
• process commercial submissions,
• support buyer workflows and inbound screening,
• route interactions,
• generate AI-assisted recommendations,
• improve relevance and prioritization,
• provide analytics and reporting,
• maintain security and auditability,
• detect abuse, fraud, or misuse,
• support scheduling when you connect a calendar and authorize bookings,
• comply with legal obligations.

Core buyer inbound capabilities may be offered without charge. Paid SaaS subscriptions (when offered) cover subscriber organization tools such as workspace strategy and seller execution. Payment status does not change the privacy floor for buyer data: paid access does not unlock private buyer data dumps or bypass buyer governance.

We may also use aggregated or de-identified data to improve platform performance, analytics, and system quality. That use is not a sale of personal information.

We do not sell personal information. We do not sell identifiable buyer organizational decision data. We do not work with data brokers to monetize buyer identity, and we do not operate a marketplace in which buyers are the product sold to sellers.

7. Buyer-Controlled Visibility

Buyers may control:

• who can contact stakeholders,
• what information vendors can access,
• approval workflows,
• escalation permissions,
• scheduling permissions,
• interaction pathways,
• notification settings,
• agent behavior and autonomy,
• what appears on a public intake page versus what remains private.

Public content a buyer chooses to publish may be visible to senders by design. That does not license us — or others — to sell, broker, or commercially re-identify private buyer data. Non-public account details, private invites, internal notes, unpublished criteria, and other restricted fields remain private unless the buyer discloses them through governance.

Some information may remain hidden unless:

• explicitly approved,
• required for workflow execution,
• required for legal, compliance, or security purposes.

We aim for minimum necessary disclosure and do not require buyers to expose more real-world identity than they choose for their public surfaces.

8. AI and Automated Systems

The platform may use machine learning systems, large language models, ranking systems, scoring systems, and recommendation systems.

These systems may assist with:

• relevance scoring,
• summarization,
• categorization,
• prioritization,
• workflow routing,
• recommendation generation.

AI systems receive only the context authorized for the relevant workflow. We do not sell private buyer content to third parties for their advertising or training products. Where we use third-party model providers as subprocessors, they process data under contract and our DPA / subprocessors practices.

AI-generated outputs may contain inaccuracies or incomplete information and should not be treated as a substitute for human judgment.

Organizations remain responsible for their business, procurement, legal, compliance, and operational decisions.

Automated assistance and profiling. Scoring, routing, filtering, and prioritization features may involve automated processing of personal data. These features are designed to assist human workflows; they are not intended to produce solely automated decisions that produce legal or similarly significant effects about an individual without meaningful human involvement. Where buyer governance requires human approval before a consequential action, that approval path remains available. If you believe an automated output has unfairly affected you, contact us using the details below and we will review the relevant processing.

9. Audit Trails and Governance

To support accountability and governance, the platform may maintain immutable or append-only records of:

• approvals,
• workflow actions,
• routing decisions,
• configuration changes,
• access events,
• agent activity,
• recommendation events,
• submission history.

These records may include:

• timestamps,
• actor identifiers,
• workflow metadata,
• confidence scores,
• reasoning metadata,
• system references.

10. Data Sharing and Recipients

We may share personal information with the following categories of recipients, only as needed for the purposes in this Policy:

• authorized users within your organization or buyer realm (per roles and governance),
• integrated enterprise systems you connect or instruct us to use,
• infrastructure, hosting, email, analytics, authentication, and AI model service providers acting as processors/subprocessors,
• professional advisors (legal, accounting) under confidentiality,
• authorities when legally required,
• parties to a corporate transaction (merger, acquisition, financing), subject to appropriate safeguards.

We do not permit sellers to bypass buyer governance controls through paid access arrangements. We do not share private buyer data with data brokers for commercial identity monetization.

A current list of material subprocessors is described in our Data Processing Agreement at /dpa. We will update that list as providers change and provide notice consistent with the DPA.

11. International Transfers

Digital Command is established in the United States. If you access the platform from the EEA, UK, or Switzerland, your personal data may be transferred to and processed in the United States and other countries that may not provide the same level of data protection as your home jurisdiction.

Where required, we use appropriate safeguards for such transfers, which may include:

• European Commission (or UK) Standard Contractual Clauses (SCCs),
• adequacy decisions where available,
• and supplementary measures as appropriate to the transfer.

Transfers of Customer Content we process as a processor are addressed in the DPA. You may request information about the safeguards that apply to a specific transfer by contacting us.

12. Data Retention

We retain information only as long as needed for the purposes described in this Policy, including to:

• operate the platform,
• support auditability,
• resolve disputes,
• comply with legal obligations,
• maintain security records,
• enforce agreements.

Typical retention (subject to longer legal holds or customer instructions under a DPA):

• Account and profile data — for the life of the account, then deleted or anonymized within a reasonable period after closure unless law requires longer retention.
• Customer Content (processor) — per the customer’s instructions and the DPA; after termination we provide an export window and then delete or return as described in the DPA / Terms.
• Security and audit logs — often retained longer than day-to-day operational records (for example, up to several years) to investigate incidents and meet governance needs.
• Billing records — as required by tax and commercial record-keeping laws.
• Cookie data — as described in the Cookie Policy.

Certain governance and audit records may be retained longer than operational records when necessary for accountability, fraud prevention, or legal claims.

13. Security

We implement administrative, technical, and organizational safeguards designed to protect information, including:

• role-based permissions,
• encryption,
• tenant isolation,
• authentication controls,
• monitoring systems,
• access controls,
• logging and audit protections.

No system can guarantee absolute security.

14. Cookies and Similar Technologies

We use cookies and similar technologies as described in our Cookie Policy at /cookies. Essential cookies are required to operate the service. Non-essential cookies (for example analytics or marketing) are used only where permitted — including with consent where ePrivacy / GDPR require it.

15. Your Rights

Depending on your jurisdiction, you may have rights to access, correct, delete, restrict, or object to certain processing; to data portability; and to withdraw consent.

EEA, UK, and Switzerland. Where GDPR (or UK GDPR / FADP) applies and we are the controller, you may have the right to:

• access your personal data,
• rectify inaccurate data,
• erase data (subject to legal exceptions),
• restrict processing,
• object to processing based on legitimate interests,
• data portability,
• withdraw consent where processing is consent-based,
• lodge a complaint with your supervisory authority (for example your local data protection authority in the EEA, the UK ICO, or the relevant Swiss authority).

To exercise these rights, email us at the address below. We may need to verify your identity. We aim to respond within one month (or the period required by applicable law). Some requests may be limited where governance, audit, security, legal obligations, or another party’s controller role apply. If we process your data only as a processor for a customer, we will direct you to that customer where appropriate.

16. Children

The platform is directed to business users and is not intended for children. We do not knowingly collect personal data from children under 16 (or the higher age required in your country for information society services). If you believe a child has provided us personal data, contact us and we will take appropriate steps.

17. Changes to This Policy

We may update this Privacy Policy periodically to reflect changes in our practices, services, or legal requirements.

Updated versions will be posted with a revised effective date. For material changes, we will provide additional notice appropriate to the change (for example, email to account holders or an in-product notice) before the new version takes effect where required by law.

Continued use of the platform after an update means you should review the revised Policy; it does not waive your statutory privacy rights.

18. Contact

For privacy or data protection questions, or to exercise your rights, contact:

Digital Command (makers of WinBench)

8120 Torringdon Way, Charlotte, NC

[email protected]

If EU/EEA law requires us to appoint an EU representative and we have done so, we will publish that representative’s contact details here or in an update to this Policy.