Privacy Policy

Confuorto Consultancy Inc.

Effective date: September 16, 2026

Last updated: September 16, 2026

1. Who we are and what this policy covers

Confuorto Consultancy Inc. ("Confuorto," "we," "us," "our") is an Illinois corporation with its principal place of business in South Barrington, Illinois. We provide consulting, title research, public records research, due diligence support, and international research services to businesses, law firms, and institutional clients.

This policy explains what personal information we collect through www.confuorto.com (the "Site"), why we collect it, who it goes to, and what you can do about it.

It applies to visitors to the Site, people who submit an inquiry or request a quote, people who subscribe to updates, and people who correspond with us through the Site's contact channels.

The Site is built and hosted on the Marblism platform, operated by Marblism, Inc. and Marblism UK Ltd ("Marblism"). Marblism processes information on our behalf and under our instructions.

Marblism's own handling of that data is described in its privacy policy at marblism.com/privacy-policy and its Trust Center at marblism.com/trust-center.

Where this policy and Marblism's platform documentation describe the same processing, they are meant to be read together — we don't claim practices the platform doesn't actually support.

2. What this policy does not cover

This is a website privacy policy. It is not a description of how we handle client matter files or research work product. Specifically, this policy does not govern:

• Personal information about third parties that appears in research, title, or due diligence work performed for a client. That information is handled under the applicable client engagement agreement, professional confidentiality obligations, and the federal and state laws that govern the source records — including the Driver's Privacy Protection Act (18 U.S.C. § 2721 et seq.), the Gramm-Leach-Bliley Act (15 U.S.C. § 6801 et seq.), the Fair Credit Reporting Act (15 U.S.C. § 1681 et seq.) where a report is furnished for a permissible purpose, and the recording statutes of the jurisdiction where a record originates. The rights described in Section 11 of this policy do not apply to that information and cannot be used to obtain, correct, or delete it.
• Client confidential information and materials delivered to us or produced by us in the course of an engagement.
• Information collected offline other than through the Site — for example, in a signed engagement, by direct email correspondence outside the Site's forms, or in person.
• Third-party websites we link to. Their practices are their own.

If you are the subject of a record request and you want to know what was collected about you or why, the party who commissioned the work is the correct place to start, not this form.

3. Information we collect

Information you give us. When you fill out a contact form, request a quote, open an account, or email us through the Site, we collect the information you choose to provide. That typically means your name, business name, email address, telephone number, the service you're asking about, and whatever you write in the message field. If you are opening a wholesale or recurring account, we also collect billing contact details and the information needed to set up invoicing.

Information collected automatically. When you visit the Site, our hosting platform records technical information about the visit: IP address, browser type and version, operating system, device type, referring URL, the pages you view, and the date and time of access. This happens through server logs and, where enabled, cookies and similar technologies.

Cookies and similar technologies. The Site uses cookies that are strictly necessary to serve pages, maintain session state, and keep the Site secure. Where analytics or error-monitoring cookies are enabled, they are used to understand aggregate traffic patterns and to detect faults — not to build advertising profiles. We do not sell personal information, and we do not use the Site to serve behavioral or cross-context targeted advertising. Most browsers let you block or delete cookies. Blocking strictly necessary cookies will break parts of the Site. We honor Global Privacy Control signals where your browser transmits one.

What we do not collect. We do not collect biometric identifiers or biometric information through the Site — no fingerprints, no retina or iris scans, no voiceprints, no scans of hand or face geometry — within the meaning of the Illinois Biometric Information Privacy Act, 740 ILCS 14. We do not knowingly collect Social Security numbers, financial account numbers, driver's license numbers, health information, or government identification numbers through Site forms, and we ask that you not submit them there. If you need to send sensitive material, contact us first and we will provide a secure channel.

4. Why we use your information

We use the information described above to:

• Respond to your inquiry and provide a quote or scope of work.
• Set up, administer, and invoice an account or engagement.
• Deliver the services you've asked for and communicate with you about them.
• Operate, secure, monitor, and improve the Site, including diagnosing errors and defending against abuse.
• Send business communications about our services where you've asked for them or where you're an existing client. Every marketing email includes an unsubscribe link, and we honor it.
• Meet our legal, regulatory, accounting, and recordkeeping obligations, and establish or defend legal claims.

Where the EU or UK General Data Protection Regulation applies to you, our lawful bases are: performance of a contract or steps taken at your request before entering one; our legitimate interests in operating and securing our business and communicating with prospective and existing clients (Art. 6(1)(f)); compliance with a legal obligation; and, for optional analytics or marketing, your consent, which you may withdraw at any time.

5. Artificial intelligence and automated processing

The Marblism platform that runs this Site includes AI-assisted features. Depending on the features we have enabled, an AI system may help draft a reply to your inquiry, route your message internally, or summarize correspondence. Where that happens:

• A person reviews and approves anything that goes out. AI assistance drafts; we decide.
• No AI system makes a decision about you that produces a legal or similarly significant effect without human review.
• Your data is not used to train AI models. Marblism has committed that customer content is not used to train its own models or those of any third-party provider, and that inference is routed only to contracted providers under terms prohibiting training on that data and requiring zero or short-term retention.
• AI inference providers act as processors. The current providers used by the platform are listed in Section 6.

If you would prefer that your correspondence not be processed by AI-assisted features, tell us and we will handle your matter manually.

6. Who we share your information with

We do not sell, rent, or trade personal information. We share it only as follows.

Service providers and platform subprocessors. The Marblism platform relies on the following vendors to operate. They process data on our and Marblism's instructions under contract, and are not permitted to use it for their own purposes:

• Amazon Web Services — compute, storage, and databases. United States.
• OpenAI — large language model inference. United States.
• Anthropic — large language model inference. United States.
• Google Cloud — Workspace OAuth and Gemini inference. United States.
• Stripe — payment processing. United States.
• Loops — transactional email delivery. United States.
• Sentry — application error monitoring. United States.
• Mixpanel — product analytics. United States.

This list reflects Marblism's published subprocessor register as of the date of this policy and may change as the platform changes. We also use separate providers for business email, accounting, and document storage outside the Marblism platform.

Professional advisors. Our attorneys, accountants, insurers, and auditors, under professional or contractual duties of confidentiality.

Legal and protective disclosures. Where we are required to disclose information by law, subpoena, court order, or other valid legal process, or where disclosure is necessary to investigate suspected fraud, enforce our agreements, protect the safety of any person, or establish or defend a legal claim.

Business transfers. If Confuorto is involved in a merger, acquisition, financing, or sale of assets, information may be transferred as part of that transaction, subject to this policy or a successor policy that provides equivalent protection.

7. Where your information is stored and international transfers

Data processed through the Marblism platform is stored on Amazon Web Services infrastructure in the United States.

If you are located in the European Economic Area, the United Kingdom, or another jurisdiction with data export restrictions, submitting information through the Site means it will be transferred to and processed in the United States, which may not provide the same level of protection as your home jurisdiction.

Where required, transfers are made under the European Commission's Standard Contractual Clauses (and the UK International Data Transfer Addendum), supplemented by the technical measures described in Section 9.

8. How long we keep your information

We keep personal information for the shortest period that does the job, and no longer. Where a law sets a minimum retention period, we keep the record for that period and delete it after. Where no law requires us to keep it, we delete it once the purpose it was collected for is finished.

• Inquiries that do not become engagements — 12 months from last contact.
• Client and engagement records — the duration of the engagement, then 10 years. That matches the limitations period for written contracts in Illinois, 735 ILCS 5/13-206, so a file survives as long as a claim can be brought on it.
• Billing, accounting, and tax records — 7 years, per federal tax recordkeeping requirements, 26 U.S.C. § 6001.
• Marketing list membership — until you unsubscribe. We then keep a minimal suppression record, your email address only, so that we can continue to honor the opt-out.
• Server and security logs — 90 days.

Where a legal hold, audit, insurance requirement, or pending claim applies, we keep the affected records until it lifts, then delete them.

When a retention period ends, records containing personal information are disposed of in a manner consistent with the Illinois Personal Information Protection Act, 815 ILCS 530 — physical media destroyed, electronic records deleted or rendered unreadable.

9. How we protect your information

Data handled through the Site is encrypted in transit using TLS 1.2 or higher and encrypted at rest using AES-256.

The platform runs on infrastructure covered by SOC 2 Type II and ISO 27001 attestations, behind a web application firewall with rate limiting and DDoS mitigation, with centralized logging and anomaly detection.

Marblism has passed a Cloud Application Security Assessment at Tier 2, assessed by an independent third-party lab.

On our side, access to client and inquiry data is limited to personnel who need it, accounts require multi-factor authentication, and staff and subcontractors are bound by written confidentiality obligations.

No system is perfectly secure, and we don't claim otherwise.

If a breach of the security, confidentiality, or integrity of personal information occurs, we will notify affected Illinois residents in the most expedient time possible and without unreasonable delay as required by the Illinois Personal Information Protection Act, 815 ILCS 530, and will meet the notification requirements of any other state or country whose law applies.

10. Telephone and electronic communications

If you call us or we call you, we do not record the conversation unless we tell you at the outset and you consent.

Illinois is an all-party consent jurisdiction for the recording of private conversations under the Illinois Eavesdropping Act, 720 ILCS 5/14.

We comply with it, and we expect the same of anyone recording us.

Where an AI-assisted receptionist feature is in use, that fact is disclosed at the start of the call.

11. Your choices and your rights

Everyone. You can ask us what personal information we hold about you as a Site visitor or business contact, ask us to correct it, ask us to delete it, or ask us to stop sending marketing email. Use the contact details in Section 14. We will respond within 30 days, or tell you why we need longer.

EEA and UK residents. Where the GDPR or UK GDPR applies, you have the rights of access, rectification, erasure, restriction of processing, data portability, and objection to processing based on legitimate interests, plus the right to withdraw consent and the right to lodge a complaint with your supervisory authority.

California and other US state residents. Where a state comprehensive privacy law applies to us, you have the rights that law provides, including access, deletion, correction, and opt-out of sale or targeted advertising.

We do not sell personal information and we do not share it for cross-context behavioral advertising, so there is nothing to opt out of on that front.

We will not discriminate against you for exercising any privacy right.

What we will ask of you. We verify requests before acting on them, because acting on an unverified request is itself a disclosure. Expect to confirm the email address associated with the information, or to provide enough detail for us to locate the right records. Agents acting for someone else need written authorization.

The limit, restated. These rights run to your own information as a Site visitor or business contact. They do not reach personal information about you that appears in research, title, or due diligence work product prepared for a client. See Section 2.

12. About our services and our licensing

Confuorto Consultancy Inc. is not a law firm. We do not practice law and we do not provide legal advice.

Nothing on the Site and nothing in this policy creates an attorney-client relationship.

Confuorto Consultancy Inc. provides consulting, research, and due diligence support services.

Where an engagement calls for work that requires a professional or agency license we do not hold, we coordinate with licensed professionals who do.

Marco Confuorto holds an individual Illinois private detective license issued under the Private Detective, Private Alarm, Private Security, Fingerprint Vendor Act of 2004, 225 ILCS 447; that license is personal to him and is not an agency license held by the corporation.

13. Children

The Site is a business-to-business service and is not directed to children.

We do not knowingly collect personal information from anyone under 16, and we do not knowingly collect personal information from children under 13 within the meaning of the Children's Online Privacy Protection Act, 15 U.S.C. § 6501 et seq.

If you believe a child has provided us information, contact us and we will delete it.

14. How to reach us

Questions, requests, and complaints about this policy go to:

We would rather hear from you directly than have you go to a regulator first.

If you're not satisfied with our response and a supervisory authority has jurisdiction over your information, you're free to go to them.

15. Changes to this policy

We may update this policy as our services, our platform, or the law changes.

The current version always sits at this URL with the effective date at the top.

Material changes — a new category of collection, a new purpose, a new class of recipient — get a notice on the Site, and direct notice to active clients where the change affects them.

Continued use of the Site after an update means you accept the revised policy.

16. Governing law

This policy is governed by the laws of the State of Illinois, without regard to its conflict-of-laws rules.

Any dispute arising out of or relating to this policy is subject to the dispute resolution provisions of the agreement between us or, absent an agreement, to mediation followed by litigation in the state courts of DuPage County, Illinois, where we consent to jurisdiction and venue.

This does not limit any right you have to bring a complaint before a supervisory authority with jurisdiction over you.