This regional notice supplements the Privacy Policy where the GDPR applies.
Updated 9 November 2026 · Version 3.2
Controller and scope
For Safety Group Inc. (4SI), 11201 North Tatum Boulevard, Suite 300 PMB #365, Phoenix, AZ 85028, United States. Contact: contact@by4si.com.
4SI is operated by its US company and has no EU/EEA establishment. This regional notice describes public-website processing; it does not replace the separate notices for Presence or the Fellowship portal. The applicability of the GDPR depends on the relevant activity and territorial-scope rules, not on an assumption that every visit is identical.
Information processed
Technical request and security data are collected through hosting infrastructure. Contact/workflow details, release reservations and purchase selections are supplied by you. Stripe supplies checkout contact/address details and payment, tax and refund information; delivery status comes from the email service. The precise fields and purposes are set out in the Privacy Policy. Required fields are identified in each form and must be supplied to use that form. Fields marked optional may be omitted.
The public website uses cookieless Vercel Web Analytics for aggregate visitor and public-page statistics, with browser opt-out controls described in the Privacy Policy. It does not use network-to-organization enrichment or biometric identification. Checkout automatically checks availability, destination, payment and order acceptance conditions; contact 4SI if a check prevents an order. Appearance and audience choices, plus the Store bag and setup, use device storage for the interface functions you request. A selected setup or use case can also be included in the inquiry URL and request logs. Submitted product choices and organization/rollout details are described in the Privacy Policy. Research publications and historical records are covered by the Research Privacy Notice.
Purposes and legal bases
- Page delivery, security and abuse prevention: legitimate interests in providing a reliable, secure public service and preventing fraudulent requests (Article 6(1)(f)).
- Requested contact and workflow discussions: steps you request before a possible contract or performance of a relationship where applicable (Article 6(1)(b)); otherwise legitimate interests in answering correspondence, including business contacts acting for an organization (Article 6(1)(f)).
- Release-interest administration: steps you request for the free reservation arrangement where Article 6(1)(b) applies, and legitimate interests in keeping an accurate acknowledgement record and preventing duplicate or abusive submissions (Article 6(1)(f)). A release invitation is limited to the interest you requested; unrelated marketing requires its own lawful basis and any required consent.
- Orders, payment, delivery and support: requested pre-contractual steps and performance of the purchase (Article 6(1)(b)); relevant legal duties (Article 6(1)(c)) and legitimate interests in reconciliation, fraud prevention and protecting legal claims (Article 6(1)(f)).
- Optional newsletter: consent (Article 6(1)(a)), confirmed by email and withdrawable at any time without affecting the purchase. Minimal consent and suppression records support accountability and respect for an opt-out.
- Research and correction records: legitimate interests in maintaining an attributable research record and correcting it, subject to necessity, proportionality and the rights of affected individuals (Article 6(1)(f)).
- Legal and rights requests: applicable legal obligations or establishment, exercise or defense of claims (Articles 6(1)(c) and 6(1)(f)).
A privacy acknowledgement records that information was presented; it is not blanket consent to unrelated processing. Where consent is the applicable basis for a historical record or a separately requested service, you may withdraw it without affecting earlier lawful processing. For legitimate-interest processing you may object on grounds relating to your situation.
Recipients and processing abroad
Current public-website providers are Vercel for hosting, security, cookieless web analytics, endpoint processing and private reservation/order records; Stripe for checkout, payments, tax calculation and fraud prevention; and Resend for requested messages, order emails and newsletter confirmations. Engaged fulfilment and delivery providers receive the information necessary for accepted purchases. Authorized 4SI personnel and advisers receive information when necessary. Historical-service recipients are identified separately in the Privacy Policy.
4SI is based in the United States. Hosting, private storage and email providers may process data in the United States and other service locations. A submission can therefore involve processing outside your country.
Vercel and Resend process service data under their respective data processing agreements. Those agreements include EU Standard Contractual Clauses for transfers to which those clauses apply. Resend stores customer data, including message content and delivery logs, in the United States; an email sending region does not change that storage location. Contact contact@by4si.com to request information about the countries, applicable transfer mechanism and a copy of safeguards relevant to your data, subject to necessary redaction. This notice does not claim that all providers or processing activities are covered by an adequacy decision or a particular certification. Stripe’s processing and international transfers are described in its Privacy Policy (opens in a new tab). Provider terms: Vercel DPA (opens in a new tab) and Resend DPA (opens in a new tab).
Retention
Swipe or scroll the table to read every column.
| Category | Normal period or criterion |
|---|---|
| Contact, Store, volume and workflow correspondence | Normally up to 24 months; longer only for an active relationship, legal obligation or claim. |
| Presence Key release reservations | Until withdrawal, program closure or replacement by a separately agreed product relationship. Limited acknowledgement, withdrawal and delivery records may remain where needed to document the request, respect an opt-out or protect legal rights. |
| Appearance and audience settings | On your device until changed or cleared; the website does not send these preferences to an analytics service. |
| Store bag and setup | Product, finish and quantity choices remain in session storage for the tab session, until removed or cleared; browser session restoration may preserve them. Inquiry URL/history can retain the selected setup under browser settings. Submitted selections follow the correspondence retention period. |
| Founding Edition purchases | For order processing and fulfilment, ongoing contractual benefits, support, refunds and applicable accounting, tax or other legal duties; relevant records may remain while needed for a claim. Uncompleted checkout records are limited to reconciliation, abuse prevention and resolving related enquiries or disputes. Records are not deleted merely because a checkout or secure link expires. |
| Newsletter choices | Subscription details while subscribed. After withdrawal, only the consent/withdrawal evidence and suppression information needed to respect the opt-out or resolve a legal claim. Necessary purchase records follow their separate criteria. |
| Temporary anti-abuse data | Application rate-limit keys use a window of up to 10 minutes; expired stored keys are removed on later requests. Hosting security logs have separate retention under the provider configuration and operational need. |
| Current web analytics | Aggregate reports are viewable for up to 12 months under our Vercel plan. Vercel discards the request-derived visitor hash after 24 hours. We do not export visitor profiles or join statistics to orders or accounts. |
| Earlier optional analytics | The former notice specified a normal 90-day retention period for raw events and associated pseudonymous network and attribution fields. No new Signal Analytics records are collected by this version of the website. Existing records remain subject to applicable rights and retention limits. |
| Closed briefing subscriptions | Delivery has stopped. Prior subscription data are kept only where still necessary to close the service, handle a request or meet a legal obligation. Minimal suppression data may remain to honor an opt-out. |
| Public-source research archives | While needed for the sourced research record, corrections, version history and methodological accountability, with periodic review for continued necessity. |
| Privacy and legal requests | For handling the request and then only as needed to demonstrate compliance, meet a legal duty or establish, exercise or defend claims. |
Rights and complaints
Depending on the law that applies, you may request access, correction, deletion, restriction, a portable copy or other information; object to processing; withdraw consent; appeal a denied request; and exercise applicable opt-out or limitation rights. 4SI does not discriminate against people for exercising an applicable privacy right.
Send a request to contact@by4si.com or the postal address above. Identify the service or record and your jurisdiction. We may request proportionate verification and, for an agent, evidence of authority. Do not send an identity document unless we explain why a particular verification step is necessary and provide an appropriate channel.
Where applicable, you may also complain to the supervisory authority in your habitual residence, place of work or the place of the alleged infringement. Responses follow the applicable statutory deadlines; any necessary extension or refusal will be explained.
Official framework
General Data Protection Regulation — official text (opens in a new tab)