Privacy and data consent

Last updated November 8, 2026

PART C: AUTHORIZATION AND CONSENT TO HANDLE PERSONAL AND FINANCIAL INFORMATION

Firm: ___ Owner: ___

What I'm sharing. I authorize Steadcert to collect and use, for preparing my Firm's DBE reevaluation package only:
my statements about my personal experiences, which may include sensitive information such as disability, health, national origin, race, sex, or discrimination I've experienced
my financial documents and figures: bank, brokerage and retirement statements, real-estate and debt information, and tax returns
Confidentiality. I understand that USDOT treats Personal Narratives and Personal Net Worth statements as confidential, and that UCPs can't release them without my Firm's written consent. Steadcert agrees to apply the same standard: it won't disclose my information to anyone, including any sponsor or prime contractor, without my Firm's written consent. The exceptions:
(a) service providers that host, transcribe or process data for Steadcert under written confidentiality and security terms. Current list at steadcert.com/privacy.html. This includes an AI model provider, used under terms that don't allow it to train on my data.
(b) where the law requires it
Minimum necessary. I'll redact Social Security numbers and full account numbers before uploading. If I upload them anyway, Steadcert may redact or delete them.
Security. Steadcert keeps a written security program, including:
encryption in transit and at rest
multi-factor authentication for staff
access limited to the people working on my file
a breach-response plan

If my unencrypted personal information is breached, Steadcert will notify me as required by law, and within 30 days of discovery in any case. 5. Retention and deletion. - Uploaded financial documents are deleted 90 days after I tell Steadcert my UCP has decided, or 12 months after delivery, whichever comes first. - The interview transcript, source notes, approvals and final package are kept encrypted for six years (Part A, section 10), then deleted. - I can ask for earlier deletion of anything except those records by emailing privacy@steadcert.com. 6. No sale, no marketing use. Steadcert won't sell or share my information, or use my story or figures in marketing, examples or training, without separate written permission. 7. I can withdraw this consent at any time, after which Steadcert will stop work, subject to the retention in item 5.

Service providers we use: website hosting (Vercel), encrypted interview storage (Supabase), sign-up forms and email (Google Workspace), payments (Stripe), and an AI model provider (Anthropic) under terms that don't allow training on your data.

Questions or deletion requests: privacy@steadcert.com