How we handle information.

1. Who we are

Turris Group, Inc. (“Turris”, “we”) is a Florida corporation with its principal office at 170 SE Caldo Street, Port St. Lucie, Florida 34984. Questions about this policy go to privacy@turrisgroup.com.

2. What we collect, and why

Enquiries. When you use the contact form, request an Opinion of Value, or ask for portal access, we collect your name, company, email address, and what you tell us about the business (for example a revenue range or timeframe). We use it to respond to you and for no other purpose.

The newsletter. If you subscribe, we keep your email address to send it. Every issue carries a one-click unsubscribe. We do not sell or share the list.

The client portal. If your company engages Turris, the portal holds the records of that engagement: documents you upload, agreements you sign, the buyer log, messages between you and the firm, invoices and payment records, and a log of activity on the engagement. Access is granted by the firm to named individuals and is scoped to your engagement only.

Technical data. Our hosting provider records standard server logs (IP address, browser type, pages requested, timestamps) for security and reliability. We do not run advertising trackers, and we do not use third-party analytics cookies. The portal stores a session token in your browser so you stay signed in; it expires after thirty minutes of inactivity and twelve hours in any case.

3. Who processes it for us

We use a small number of providers, each under contract, each receiving only what its function requires:

• Supabase (database, authentication and file storage) holds portal records in the United States, encrypted at rest and in transit.
• Vercel hosts the website and the portal’s server functions.
• Stripe processes card, Apple Pay and ACH payments. Card and bank details are entered on Stripe’s own pages and never reach Turris systems. Stripe’s privacy policy governs that data.
• Docusign handles electronic signature of confidentiality and engagement agreements.
• Resend delivers transactional email (sign-in links, invoices, reminders) and the newsletter.

We do not sell personal information. We do not share it with anyone else except as required by law, to enforce an agreement, or with your direction (for example, releasing a memorandum to a buyer who has signed a confidentiality agreement you approved).

4. Confidentiality in a transaction

Information about a company in a sale process is shared only with counterparties who have executed a confidentiality agreement, only in the form and at the stage the engagement letter provides for, and never with a party the client has excluded. Counterparties are identified to the client by number until they are admitted to diligence.

5. How long we keep it

Enquiries that do not lead to an engagement are deleted after twenty-four months. Engagement records are kept for seven years after the engagement closes, which is the period our professional obligations and tax law require, then deleted. Newsletter subscriptions are kept until you unsubscribe.

6. Your choices

You may ask us at any time what we hold about you, ask us to correct it, or ask us to delete it where we are not required to keep it. Write to privacy@turrisgroup.com and we will respond within thirty days. Portal users may export their own documents and invoices from the portal at any time.

7. Security

Portal access is by one-time emailed sign-in link, not a password. All traffic is encrypted. Database access is governed by row-level rules that prevent one client from reading another’s records, enforced by the database itself rather than by application code. If we become aware of a breach affecting your information we will tell you without undue delay.

8. Children

Our services are for businesses and their owners. We do not knowingly collect information from anyone under eighteen.

9. Changes

If this policy changes materially, we will post the revision here with a new date and, for portal users, note it in the portal.