Privacy Policy

Last updated: October 6, 2026 Effective: November 5, 2026

Until November 5, 2026, the July 31, 2026 version of this policy remains in effect.

RK Sterling, LLC ("Sterling," "we," "us") provides a software platform for registered investment advisors and financial-services professionals. This Privacy Policy describes what we collect, how we use and share it, how long we keep it, and your choices.

By using the Services, you acknowledge you have read and understood this Privacy Policy and represent you are 18 or older and a U.S. resident. If you do not agree, do not access the Site or the Services. Our Terms of Service: https://www.rksterling.com/legal/terms-of-service.

Roles: Who Controls What

Customer means the organization (e.g., your advisory firm or broker-dealer) that entered into an agreement with Sterling; the Customer controls its instance of the Services and the client information within it.

For information about a Customer's clients ("Client Data"), Sterling is a service provider (processor) acting on the Customer's behalf and documented instructions, and does not retain, use, or disclose Client Data for any purpose other than performing the Services, except as applicable law permits. For account, billing, and usage information about you as a user, Sterling is the controller (business). Sterling makes a Data Processing Addendum ("DPA") available to every Customer in its standard agreement.

Information We Collect

Information you provide: account information (name, email, phone, professional credentials, authentication identifiers); business information (firm name, address, regulatory registrations, team membership); Client Data (information about your clients that you enter or upload, including household composition, income, expenses, investments, real estate, liabilities, insurance, tax, and estate-planning information); documents you upload to the document vault (statements, tax returns, estate documents); payment information (processed by our payment provider; Sterling does not store full card numbers); and support communications.

Information from services you connect. Connections to third-party systems are made at the Customer's or user's initiative and are revocable. Sterling does not collect or store your clients' banking or brokerage login credentials.

Email and calendar. If you connect a mailbox or calendar (e.g., Outlook or Google Workspace), we sync messages, events, attachments, and related metadata for the accounts you authorize so client communications appear alongside the household record; access is via OAuth, revocable at any time. Synchronization necessarily collects information about everyone who corresponds with a connected mailbox, including non-clients. Sterling processes that information solely to present your communications history and associate messages with the correct household; we do not use it for any independent purpose, build profiles from it, or use it to contact anyone. You are responsible for deciding which mailboxes to connect and for any notices your firm's policies or applicable law require. When you disconnect, we stop syncing; previously synced content remains in the household record until deleted.

Google API disclosure. Sterling's use and transfer of information received from Google APIs to any other app adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically: we use Google user data only to provide and improve the user-facing features described in this policy; we do not transfer that data except as necessary to provide those features, to comply with applicable law, or as part of a merger or acquisition; we do not use it for advertising; we do not use it to develop, improve, or train generalized or non-personalized AI or machine-learning models; and we do not allow humans to read it except with your affirmative consent, for security purposes, to comply with applicable law, or where the data has been aggregated and de-identified.

Microsoft API disclosure. Sterling's use of data from Microsoft Graph and related Microsoft APIs is limited to providing the user-facing features described in this policy, subject to the same restrictions stated above.

Meeting recordings and transcripts. If you enable meeting capture, transcripts of client meetings (e.g., Zoom, Teams, Google Meet) are processed into notes and structured data. Meeting capture is off by default and is user-initiated. See Customer Responsibilities regarding recording-consent laws.

Custodial and financial-account data. Where a Customer authorizes a data feed from a custodian or financial institution, we receive positions, balances, transactions, and account attributes through the institution's own integration channels under authorizations executed with it. Such data is used solely to serve the client it belongs to and is subject to the institution's agreements in addition to this policy.

Information we collect automatically: usage information (features used, actions taken, and metered AI usage for billing); log data (IP address, browser type, operating system, referring URLs, pages viewed); audit records (logs of permission and policy changes and of AI-mediated actions, supporting Customers' regulatory obligations); and device information and cookies (see Cookies below).

How We Use Information

We use information to provide the Services (financial planning and tax analysis, advice generation, CRM and workflows, document management, communications history, and reporting); to create and authenticate accounts; to maintain, troubleshoot, and improve the Services and perform internal functions; to meter usage and bill the Customer; to send administrative, billing, support, and service notices, and marketing only where you have opted in (opt out at any time); to detect and respond to fraud, abuse, security incidents, and technical issues; and to comply with applicable law and enforce our Terms of Service.

We do not use Client Data for advertising. We do not sell personal information, yours or your clients'. We do not share personal information for cross-context behavioral advertising.

De-identified and aggregated information. Where we create de-identified or aggregated information, we remove identifiers so it cannot reasonably be linked to any individual, household, or Customer firm; we maintain it in de-identified form, will not attempt to re-identify it, and contractually prohibit recipients from doing so. Client Data is not used to create products or benchmarks for other Customers unless the Customer has separately opted in in writing.

How AI Processing Works

Certain features use large language models: planning recommendations for advisor review, the advisor chat assistant, document data extraction, meeting-transcript summaries, and drafting emails and reports. These features operate under specific commitments:

AI is off until the advisor turns it on. No Client Data is sent to any AI model until an advisor deliberately enables AI processing for that household; the control is enforced on the server and fails closed.
LLM inference runs on enterprise cloud infrastructure (currently AWS Bedrock and Google Cloud Vertex AI) in U.S. regions, under agreements that exclude use of our customers' data for model training, retention beyond transient processing, and provider human review. Document data extraction is performed by a specialized document-processing subprocessor (currently Landing AI) under the contractual restrictions described under Service Providers and Subprocessors.
Sterling does not use Client Data to develop, train, or fine-tune any AI model.
Output is advisor-facing. AI output is presented to the advisor for review and is never delivered directly to a Customer's clients; the advisor remains responsible for reviewing it before relying on or communicating it.
Deterministic calculations stay deterministic. Tax and cash-flow projections are computed by Sterling's calculation engine, not by an AI model.

Connecting an external AI assistant. An optional read-only connector lets a user query their firm's Sterling data from an external AI assistant. It is supported only with assistants under an enterprise or business agreement of your firm providing equivalent protections (no training, no retention beyond transient processing, no human review); consumer-tier AI products are not supported. The connector is disabled by default, enabled and revocable by a firm administrator, authenticated with the user's Sterling identity, and read-only, scoped to households the user may already see. Data retrieved through an external assistant is handled under that provider's agreement with your firm, not this policy; your firm is responsible for confirming that agreement meets this standard and its obligations under GLBA, Regulation S-P, and its client agreements.

Customer Responsibilities

You are responsible for using the Services in accordance with laws applicable to your business, and for any notices to and consents from your clients that those laws require for your use of service providers such as Sterling. Relevant obligations include GLBA and Regulation S-P (privacy-notice, opt-out, safeguards, incident-response, and oversight requirements), SEC and state recordkeeping rules (including Advisers Act Rule 204-2 where applicable), state consumer privacy statutes, and your own client agreements. If you enable meeting capture, you are solely responsible for obtaining any consent required by federal and state recording and wiretapping laws. Many states (including California, Florida, Illinois, and Washington) require the consent of all parties, and the applicable rule may depend on where each participant is located. Sterling does not obtain consent on your behalf or determine which law applies to your meeting.

Data Security

Encryption: in transit over HTTPS (TLS) and at rest by the underlying cloud platforms.
Firm isolation: the platform is multi-tenant, firm identity is part of every data query, and every request for household data is authorized on the server, with automated checks that fail any change shipping a household endpoint without its authorization check.
Authentication: sign-in uses an enterprise identity platform; Sterling never stores passwords; sessions expire after 12 hours and 1 hour of inactivity.
Access control: household access requires an authenticated session, membership in the owning firm, and granted permission to that household; Sterling personnel access to Customer environments is limited to a business need.
Audit trail: permission and policy changes, and all AI-mediated actions, are logged.
Independent assessment: a SOC 2 Type II attestation is in progress, with a 90-day observation period beginning September 15, 2026; the report is expected following completion and will be available to Customers under NDA.

No system is impenetrable; we cannot guarantee absolute security.

Security incident notification. If we become aware of a security incident involving unauthorized access to or use of Client Data, we will notify the affected Customer without undue delay, consistent with the notification timelines in our agreement with the Customer (including our DPA) and the requirements applicable to Customers as covered institutions under SEC Regulation S-P. We will provide the information reasonably available to us so the Customer can meet its own notification obligations, cooperate with its investigation and remediation, and not delay notice because our investigation is incomplete. Where Sterling is the controller, we will notify affected individuals and regulators as required by applicable law.

Service Providers and Subprocessors

We share information with vendors that process it on our behalf under written contracts restricting use to providing their service to us, with confidentiality and security protections no less protective than this policy. Categories currently in use: cloud hosting and storage; AI infrastructure (enterprise model inference with no training, no retention, and no human review); identity and authentication; payments; email and calendar sync; transactional email; real-time infrastructure; document processing; meeting transcription; and error monitoring. A current, named subprocessor list is available to Customers on request at info@rksterling.com. We provide Customers reasonable advance notice before a new subprocessor begins processing Client Data; any specific notice period is set out in the Customer's agreement with Sterling.

Information Sharing and Disclosure

Beyond the service providers above, we may share information: within your firm, per permissions your firm's administrators configure; at your direction, with third parties you choose to connect, which handle data under their own terms; for legal reasons, when disclosure is required by law or necessary to protect rights, safety, or property (where Client Data is sought by legal process, we will, unless legally prohibited, notify the Customer promptly so it can seek protective relief, and will direct the requesting party to the Customer where appropriate); in connection with a merger, acquisition, financing, or sale of all or part of our business, subject to this policy's commitments; and with your consent.

Cookies

We use strictly necessary cookies (authentication, session, security, and load balancing; these cannot be disabled), functional cookies (preferences and interface state), and first-party analytics (feature usage and performance). We do not use advertising or cross-context behavioral tracking cookies and do not permit third parties to collect information about your activity across other sites through the Services. Because we do not sell or share personal information, there is no sale or sharing for an opt-out preference signal (such as Global Privacy Control) to apply to. Blocking strictly necessary cookies will prevent the Services from functioning.

Data Retention and Deletion

We retain information only as long as needed for the purposes in this policy and applicable legal requirements. Client Data is under the Customer's control; Customers may delete client records at any time. After termination of a Customer agreement, Client Data is available for export for a reasonable period, then deleted within a commercially reasonable period, subject to legal retention obligations; specific timelines are in the Customer's agreement. Synced email and calendar content remains part of the household record and is deleted when the Customer deletes the associated records or household. Raw meeting recordings and transcripts are kept only as long as needed to produce derived notes, which are retained with the household record. Audit records are kept for the period the Customer's regulatory obligations require; logs for a limited period; billing records as required for accounting, tax, and audit; account information for the account's duration plus a reasonable period; and support communications for a reasonable period. Backups purge on a rolling cycle. Data deleted from the live system persists in backups until the cycle completes and is not restored to production. Deletion requests are executed against live systems promptly.

Your Rights and Choices

Depending on your jurisdiction, you may have the right to access, correct, delete, restrict, or port personal information about you, or to withdraw consent. To exercise these rights, contact info@rksterling.com. We verify requests using account information we already hold and do not discriminate for exercising these rights. Where a request concerns Client Data controlled by a Customer, Sterling cannot act unilaterally; we will refer it to the relevant Customer without undue delay and support their response. Advisory clients should contact their firm directly.

State privacy rights and the GLBA exemption. Client Data consists largely of nonpublic personal information collected in connection with financial services subject to the Gramm-Leach-Bliley Act. Most state consumer privacy statutes (including the CCPA/CPRA, Colorado CPA, VCDPA, and CTDPA) exempt such information at the data level or exempt the entities that handle it; where an exemption applies, the corresponding statutory rights do not attach, and client rights in that information run through the advisory firm's own GLBA and Regulation S-P privacy notice. User and business-contact information about advisors and firm personnel is processed in a commercial context; most states exclude such individuals from the definition of "consumer," but California does not, so California residents using the Services in a business capacity retain CCPA/CPRA rights in their user account, usage, and log information. Website visitors who are not users have rights in the limited information we collect about them where applicable state law provides.

CCPA/CPRA categories. In the preceding 12 months we collected the categories described under Information We Collect: identifiers, professional and employment information, commercial information, internet and network activity, geolocation inferred from IP address, and, in Client Data, financial and other sensitive information. We disclosed each category to the service-provider categories above for the business purposes described in this policy. We did not sell or share (for cross-context behavioral advertising) any category of personal information and have no actual knowledge of selling or sharing personal information of anyone under 16.

Sensitive personal information. We collect information that qualifies as sensitive personal information (including financial account information and, in Client Data, details that may reveal health or other sensitive information). We use and disclose it only to provide the Services you requested and for related operational purposes, as permitted under California Civil Code § 1798.121(a), and therefore do not offer a "Limit the Use of My Sensitive Personal Information" election.

Appeals and agents. If we decline a rights request, you may appeal by writing to info@rksterling.com with "Privacy Appeal" in the subject line; we will respond within the time required by applicable law with a written explanation. If your appeal is denied, you may contact your state attorney general (Colorado: coag.gov/file-complaint). An authorized agent may submit a request, subject to proof of authorization and identity verification.

Marketing emails include an unsubscribe link; administrative and service notices are required to operate the Services and cannot be opted out of while your account is active.

International Data Transfers

We are based in, and process and store information in, the United States; LLM inference is performed in U.S. regions. By using the Services you consent to the processing and storage of your information in the U.S.

Children's Privacy

The Site and Services are offered only to business users and are not directed to children under 18. We do not knowingly collect information from children and will promptly delete any such information and close the associated account if discovered. Client Data entered by an advisor may include information about a client's minor children; it is provided by the advisor as part of the Customer's records, is subject to the Customer's obligations to its clients, and is not collected by Sterling from the child.

Changes to This Policy

We may update this policy periodically. Material changes will be announced by email (if provided) or within the Services a reasonable time before they take effect. Continued use after changes take effect constitutes acceptance. Prior versions are maintained at https://www.rksterling.com/legal/privacy-policy/archive.

Contact Us

RK Sterling, LLC 2431 Quitman Street, Denver, CO 80212

Privacy inquiries, rights requests, and general inquiries: info@rksterling.com