Privacy Policy

Effective Date: September 19, 2026
Last Updated: September 19, 2026

At Exponential Industry (“we,” “us,” or “our”), accessible from exponentialindustry.com, we prioritize user privacy, data minimization, and platform security. This Privacy Policy describes how we collect, process, secure, and protect your information when you access our website, use our Scholar platform, or sign in to your account. It also explains your statutory privacy rights under global regulations, including the European Union General Data Protection Regulation (EU GDPR), the United Kingdom General Data Protection Regulation and Data Protection Act 2018 (UK GDPR / DPA 2018), the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA / CPRA) and comprehensive US state privacy laws, the Canadian Personal Information Protection and Electronic Documents Act (PIPEDA) and Quebec Law 25, and the Brazilian General Data Protection Law (LGPD).

---

1. Information Collection & Processing

We practice strict data minimization. We only collect information that is reasonably necessary to deliver our publications, provide engineering talent intelligence, authenticate members, and secure our systems:

A. Account Creation & Passwordless Authentication

When you sign in to access your membership benefits, we process:

• Email Address: Provided voluntarily to identify your account and dispatch one-time login credentials.
• One-Time Passcodes (OTP): When you request a sign-in link, a cryptographically secure 6-digit verification code is delivered via Cloudflare Zero Trust Access (noreply@notify.cloudflare.com). Verification credentials have a strict 10-minute lifetime, are invalidated immediately upon first use or renewal, and are protected at Cloudflare’s edge with automated rate limiting and brute-force defenses. No passwords are ever created, stored, or processed.
• Membership & Subscriber Status: We record whether your account is a paid or free subscriber, subscription timestamps, and your last login date to deliver the appropriate access level across the platform.
• Session Tokens: Upon successful verification, we issue an edge JSON Web Token (JWT) stored in a secure first-party HTTP cookie (ei_session) with HttpOnly; Secure; SameSite=Lax flags, ensuring cross-page authentication without persistent tracking.

B. Scholar Platform & Job Intelligence

Our Scholar platform provides industrial technology and engineering requisition search:

• Candidate Preference Queries: Search parameters you select (such as target technology areas, geographic metro hubs, and prior university or corporate alumni affiliations) are processed solely to query and filter verified job postings.
• Zero Third-Party Data Brokering: We do not sell your search queries, contact details, or profile information to recruiters, employers, or third-party data brokers. When you click an external direct application link, you navigate directly to that employer’s verified applicant tracking system (ATS) or career portal under their respective privacy policies.

C. Automated Technical & Security Logs

Our edge hosting and serverless infrastructure (Cloudflare Pages, Workers, and D1) automatically processes standard technical request metadata to operate and protect the website:

• Anonymized IP addresses (processed for geographic edge routing, DDoS mitigation, and brute-force login rate limiting)
• Browser user agent, operating system, and screen specifications
• Requested URLs, HTTP response headers, and access timestamps

Security Auditing: Rate-limiting records (enforcing a maximum of 3 verification code requests per 10 minutes and temporary lockouts after 5 consecutive failed attempts) are logged transiently to prevent brute-force attacks and abuse.

D. Newsletter Communications

If you subscribe to our newsletter via Substack, your email address and subscription preferences are managed under Substack’s privacy terms and can be modified or unsubscribed at any time via the link in each email.

---

2. Legal Bases for Processing (EU GDPR / UK GDPR / LGPD)

For individuals located in the European Economic Area (EEA), the United Kingdom, or jurisdictions governed by similar standards, we process personal data under the following lawful bases:

• Performance of a Contract (Art. 6(1)(b) GDPR): Processing your email address, subscription status (paid vs. free), and session tokens is necessary to create your account, authenticate your access, and deliver paid membership features or Scholar requisitions that you have requested.
• Legitimate Interests (Art. 6(1)(f) GDPR): Processing technical logs and salted security credentials is necessary for our legitimate interests in safeguarding platform security, preventing fraud and brute-force abuse, and optimizing site performance, balanced against your fundamental rights.
• Consent (Art. 6(1)(a) GDPR): Where you have chosen to enable optional interactive third-party media embeds (e.g. YouTube or Twitter/X widgets) through our Cookie Settings.
• Legal Compliance (Art. 6(1)(c) GDPR): Where data processing is required to comply with statutory legal, tax, or regulatory obligations.

---

3. Subprocessors & Service Providers

We never sell, rent, or trade your personal information. We disclose information only to vetted third-party service providers (subprocessors) bound by strict confidentiality and data protection agreements:

---

4. United States Privacy Rights (CCPA / CPRA & State Laws)

This section applies to residents of California, Virginia, Colorado, Connecticut, Utah, Texas, and other US states with comprehensive privacy legislation.

A. Categories of Personal Information Collected (Past 12 Months)

• Identifiers: Email address, unique session identifier, edge IP address.
• Commercial Information: Membership tier (paid or free), subscription status, transaction history from Substack.
• Internet or Electronic Network Activity: Request URLs, edge log timestamps, browser type, interaction with site features.

B. Notice of Sale and Sharing

• No Sale of Personal Information: We do not sell personal information to third parties for monetary or other valuable consideration.
• No Sharing for Cross-Context Behavioral Advertising: We do not share your personal information with third parties for cross-context behavioral or targeted advertising.
• Sensitive Personal Information: We do not collect or process Sensitive Personal Information (SPI) for the purpose of inferring characteristics about consumers, and only process security credentials as strictly permitted under Cal. Civ. Code § 1798.121.

C. Global Privacy Control (GPC)

Our website recognizes and respects the Global Privacy Control (GPC) browser signal (navigator.globalPrivacyControl). When detected, non-essential cookies and interactive embeds are automatically set to disabled.

D. US Consumer Rights

Subject to statutory verification, residents of qualifying US states have the right to:

1. Right to Know / Access: Request disclosure of the categories and specific pieces of personal information collected.
2. Right to Delete: Request deletion of personal information, subject to statutory exceptions (such as system security and legal record retention).
3. Right to Correct: Request correction of inaccurate personal data.
4. Right to Non-Discrimination: We will never discriminate, alter service quality, or deny access because you exercised your statutory privacy rights.

---

5. Canadian Privacy Disclosures (PIPEDA & Quebec Law 25)

For visitors located in Canada, personal information is collected with meaningful consent for specified purposes (account access, subscription validation, security, and communications).

• Cross-Border Transfers: Because our hosting and edge infrastructure partners maintain servers globally, your personal data may be processed outside Canada (primarily in the United States), subject to the legal jurisdictions of those countries.
• Access & Correction: Canadian residents may request access to, or correction of, their personal information by contacting our Privacy Officer at privacy@exponentialindustry.com.

---

6. Data Retention Schedule

We retain personal information only for as long as strictly necessary to fulfill the purposes outlined in this policy:

• Authentication Codes (OTP): Retained for a maximum of 10 minutes, after which they are invalidated, consumed, or expired.

• Session Tokens (ei_session): Valid for 30 days from creation, or immediately erased upon user logout.

• User Account Records: Retained for the active duration of your account. Inactive accounts or accounts requesting deletion will be expunged within 30 days of a verified request.

• Security Logs: Edge rate-limiting and DDoS security logs are automatically rotated and purged in accordance with standard infrastructure security cycles.

---

7. Exercising Your Rights (DSAR Procedures)

To submit a Data Subject Access Request (DSAR), request account deletion, or exercise any rights under GDPR, CCPA/CPRA, PIPEDA, or LGPD:

1. Email: Send your request to privacy@exponentialindustry.com with the subject line “Data Subject Privacy Request”.
2. Verification: To protect your account security, we will verify your identity by sending a confirmation code to the email address associated with your account before acting on the request.
3. Response Timeline: We will acknowledge and respond to verified requests within thirty (30) days (or forty-five (45) days where permitted by US state laws).

---

8. Children’s Privacy

Our services and content are directed at adult professionals and engineering practitioners. We do not knowingly collect personal information from individuals under the age of 16. If we learn that we have inadvertently collected data from a child under 16 without parental consent, we will promptly delete that information.

---

9. Policy Modifications & Contact

We reserve the right to revise this Privacy Policy to reflect technological improvements, product updates, or statutory developments. Significant revisions will be highlighted with an updated “Last Updated” date.

Contact Us:
Exponential Industry
Email: privacy@exponentialindustry.com
Website: https://exponentialindustry.com
Privacy Settings: Cookie Settings