Privacy Policy

1. Introduction

Banner Technologies, Inc. ("Banner", "we", "our", "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard information when you use our enterprise CapEx management platform and related services (the "Service").

This policy applies to our customers ("Customers"), their authorized users ("Users"), and visitors to our website. By accessing or using the Service, you acknowledge that you have read and understood this Privacy Policy.

2. Information We Collect

2.1 Information You Provide

We collect information you voluntarily provide, including:

• Account Information: Name, email address, phone number, job title, company name, and billing information when you create an account or subscribe to our Service
• Customer Data: Project information, financial data, documents, vendor details, invoices, contracts, and other information you upload to the Service
• Communications: Information you provide when you contact us for support, submit feedback, or respond to surveys

2.2 Information Collected Automatically

When you use our Service, we automatically collect:

• Usage Data: Features accessed, actions taken, time spent, and navigation patterns within the Service
• Device Information: Browser type, operating system, device identifiers, and IP address
• Log Data: Server logs including access times, pages viewed, and referring URLs

2.3 Cookies and Tracking Technologies

We use cookies and similar technologies on our website and in the Service. Cookies that are not strictly necessary are governed by a consent banner, which appears the first time you visit withbanner.com.

How consent works:

• Nothing non-essential is stored until you choose. Until you respond to the banner, we do not set or read analytics, advertising, functional, or performance cookies on your device. Only the strictly necessary cookies listed below are used.
• You can accept all, reject all, or choose by category. The banner offers all three. Rejecting is a single click and is as easy as accepting.
• You can change your mind at any time. Use the cookie preferences link, or the cookie icon shown in the corner of every page, to reopen the banner and change or withdraw your choices.
• Browser controls still work. You can also block or delete cookies in your browser settings, though doing so may limit how parts of the Service function.

One thing we want to state plainly: our analytics tag is loaded on page view but starts in a “consent denied” state. In that state it does not read or write cookies and does not create a persistent identifier for you, but a basic request — which necessarily includes your IP address and the page address — is still sent to the analytics provider. If you reject, it stays in that state. We describe this rather than claim that no data leaves your browser before you answer the banner.

2.4 Cookies We Use

The table below reflects our most recent cookie scan of withbanner.com. Durations are the maximum lifetime set by the issuer.

Where a duration reads “Set by” the named provider, the cookie is placed by that third party and its lifetime is controlled by them rather than by us; their own cookie policy is the authoritative source. We list the cookie here so you know it exists.

Previously used, no longer running. Our website formerly loaded a visitor-identification tool (RB2B, which incorporates LiveIntent’s LiveConnect), along with advertising tags. None of these run on the site any more. If you visited before September 2026, cookies they set — including names beginning _reb2b, and _lc2_fpi — may still be present in your browser until they expire or you clear them. We no longer set them and no longer receive data from them.

3. How We Use Information

We use collected information to:

• Provide, maintain, and improve the Service
• Process transactions and manage subscriptions
• Send technical notices, updates, and support messages
• Respond to inquiries and provide customer support
• Monitor and analyze usage trends and preferences
• Detect, prevent, and address technical issues and security threats
• Comply with legal obligations and enforce our terms
• Develop new features and services based on aggregated insights

4. Data Sharing and Disclosure

We do not sell your personal information, and we do not share it for cross-context behavioural advertising as described in Section 8.1. We may share information in the following circumstances:

4.1 Service Providers

We engage trusted third-party service providers to perform functions on our behalf, including cloud hosting, payment processing, analytics, and customer support. These providers are contractually bound to protect your information and use it only for specified purposes.

4.2 Business Transfers

In connection with a merger, acquisition, or sale of assets, your information may be transferred to the acquiring entity. We will provide notice before your information becomes subject to a different privacy policy.

4.3 Legal Requirements

We may disclose information if required by law, subpoena, or government request, or if we believe disclosure is necessary to protect our rights, your safety, or the safety of others.

4.4 With Your Consent

We may share information with third parties when you give us explicit consent to do so.

5. Data Security

We implement industry-standard security measures to protect your information, including:

• Encryption of data in transit (TLS 1.2+) and at rest (AES-256)
• Regular security assessments and penetration testing
• Access controls and authentication requirements
• Employee security training and background checks
• Incident response procedures and monitoring

While we strive to protect your information, no method of transmission or storage is 100% secure. We cannot guarantee absolute security.

6. Data Retention

We retain personal information for as long as necessary to provide the Service and fulfill the purposes described in this policy, unless a longer retention period is required by law.

Customer Data is retained for the duration of the subscription. Upon termination, Customers may request data export within 30 days. After this period, data is deleted in accordance with our data retention schedule.

7. Your Rights and Choices

Depending on your location, you may have the following rights:

• Access: Request a copy of the personal information we hold about you
• Correction: Request correction of inaccurate or incomplete information
• Deletion: Request deletion of your personal information, subject to legal retention requirements
• Portability: Request your data in a structured, machine-readable format
• Objection: Object to certain processing activities
• Withdrawal of Consent: Withdraw consent where processing is based on consent

To exercise these rights, contact us at [email protected]. We will respond within the timeframe required by applicable law.

8. California Privacy Rights (CCPA)

California residents have additional rights under the California Consumer Privacy Act (CCPA), including:

• Right to know what personal information is collected, used, and shared
• Right to delete personal information
• Right to opt out of the sale or sharing of personal information (see Section 8.1)
• Right to non-discrimination for exercising privacy rights

To submit a CCPA request, email [email protected] with "CCPA Request" in the subject line.

8.1 Sale, Sharing, and Cross-Context Behavioural Advertising

California law defines “cross-context behavioural advertising” at Cal. Civ. Code § 1798.140(k) as advertising directed to you based on personal information obtained from your activity across businesses, websites, or services other than the one you are interacting with. The CCPA treats disclosing personal information for that purpose as a “share”, whether or not money changes hands.

We do not sell personal information, and we do not currently share personal information for cross-context behavioural advertising. The advertising and visitor-identification tags previously used on our website no longer run, as described in Section 2.4.

If we reinstate advertising tags in the future, they will load only for visitors who have accepted the advertising category in our cookie banner, and we will update this policy before doing so. You can withdraw that consent at any time through the cookie preferences link. You may also email [email protected] with “Do Not Sell or Share My Personal Information” in the subject line, and we will honour the request regardless of your cookie settings.

9. European Privacy Rights (GDPR)

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, you have rights under the General Data Protection Regulation (GDPR), including the rights described in Section 7 above.

Banner processes personal data as a data processor on behalf of our Customers (data controllers). For data subject requests related to Customer Data, please contact your organization's administrator.

Legal Basis for Processing: We process personal data based on:

• Performance of a contract (providing the Service)
• Legitimate interests (improving and securing the Service)
• Compliance with legal obligations
• Consent (where applicable)

International Transfers: Data may be transferred to and processed in the United States. We use Standard Contractual Clauses and other appropriate safeguards for international data transfers.

10. Third-Party Services

Our Service integrates with third-party applications and services. This Privacy Policy does not apply to third-party services. We encourage you to review the privacy policies of any third-party services you connect to Banner.

These are the third-party services that run on our website or in the Service, and what each one does:

• Amazon Web Services (AWS): hosting and data storage
• Cloudflare: content delivery, bot management, and denial-of-service protection
• Auth0: authentication and sign-in
• Stripe: payment processing
• Google Tag Manager: loads and manages the tags listed here
• Google Analytics 4: website analytics. Cookies are set only if you accept the analytics category
• CookieYes: operates our cookie banner and records your consent choice
• HubSpot: customer relationship management and handling of forms you submit
• Intercom: support chat
• Calendly: demo scheduling on our contact page
• New Relic: application performance monitoring
• Fullstory: session replay. This runs only for signed-in users of the Service — it is triggered on authenticated sessions and is configured not to run on pages viewed by anonymous visitors. It is not used on our public marketing website
• WhatFix: in-product guidance and walkthroughs, signed-in users only

We periodically review this list against what actually loads on the site. If you believe something is running that is not listed here, please tell us at [email protected] and we will investigate and correct the record.

11. Children's Privacy

The Service is designed for business use and is not directed to individuals under 18 years of age. We do not knowingly collect personal information from children. If we learn that we have collected information from a child, we will delete it promptly.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting a notice on our website or sending an email to the address associated with your account at least 30 days before the changes take effect.

Your continued use of the Service after the effective date of any changes constitutes acceptance of the updated Privacy Policy.

13. Contact Us

If you have questions about this Privacy Policy or our data practices, please contact us:

• Email: [email protected]
• Support: [email protected]
• Phone: 415-231-7512

Banner Technologies, Inc.
San Francisco, CA
United States