Privacy Policy

1. Scope

This policy covers three groups: (a) visitors to our Site; (b) people who contact us or request a demo; and (c) customers and their authorized users who access the Service. Where we act as a service provider or processor on behalf of a customer institution, our handling of that customer's data is also governed by the agreement between us and that customer.

2. Information we collect

Information you provide

When you request a demo, schedule a call, or otherwise contact us, we collect the information you choose to provide—typically your name, work email address, institution or agency name, the number of institutions you manage, the CRM you use, and any message you include. Customers also provide account and configuration information when setting up the Service.

Information collected automatically

When you visit the Site, our servers and infrastructure providers may automatically log standard technical information such as IP address, browser type, device information, and pages viewed, for security and reliability. With your permission, we also use Google Analytics 4 to understand aggregate website usage and conversion activity. Analytics storage is denied by default until you allow it, and you can change your choice using Cookie settings in the footer. See our Cookie Notice for details.

Information within the Service

The Service connects to a customer's existing CRM, advertising, analytics, and reporting platforms (such as Salesforce, HubSpot, LeadSquared, Google Sheets, Google Ads, Meta Ads, Google Analytics, and Google Search Console) to produce enrollment marketing analytics. The Service is designed to ingest pseudonymous CRM record identifiers, funnel stage dates and statuses, source and attribution fields, and campaign and spend data. It is designed not to ingest or store student personal information—no names, email addresses, phone numbers, or mailing addresses. Connector credentials are encrypted at rest.

3. How we use information

• To respond to your inquiries, schedule and conduct demos, and provide requested information.
• To provide, maintain, secure, and improve the Site and the Service.
• To communicate with you about your account, the Service, and—where permitted—relevant updates you can opt out of at any time.
• To monitor and protect the security and integrity of our systems, including sync-health monitoring and audit logging.
• To comply with legal obligations and enforce our agreements.

4. How we share information

We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We share information only as follows:

• Service providers / subprocessors. With vendors who host our infrastructure and support our operations, under contractual confidentiality and security obligations.
• Legal and safety. When required by law, subpoena, or legal process, or to protect the rights, property, or safety of Pennant, our customers, or others.
• Business transfers. In connection with a merger, acquisition, financing, or sale of assets, subject to this policy.

5. Data retention

We retain information for as long as needed to fulfill the purposes described in this policy, to provide the Service, and to meet legal, accounting, or reporting requirements, after which it is deleted or de-identified. Data processed within the Service follows a documented retention policy, and the Service supports erasure with re-import suppression so that erased records are not reintroduced on subsequent syncs.

6. Security

We use administrative, technical, and organizational safeguards designed to protect information, including encryption of connector credentials at rest (AES-256-GCM), role-based access controls, audit logging, per-tenant isolation, and monitoring. No method of transmission or storage is completely secure, but these measures reflect our privacy-by-design approach. See Security & Trust.

7. Your rights and choices

Depending on your location, you may have rights to access, correct, delete, or restrict the processing of your personal information, or to obtain a copy of it. You may opt out of marketing emails at any time using the unsubscribe link or by contacting us. To exercise a right, contact us using the details below; we will respond as required by applicable law. Where we process data on behalf of a customer institution, we will direct qualifying requests to that customer.

8. Student data, children, and FERPA

The Site and Service are intended for higher education institutions, agencies, and their staff, and are not directed to children. The Service is architected so that it does not collect or store student personal information; analytics run on pseudonymous record identifiers. Where an institution uses the Service, Pennant acts under the institution's direction with respect to any education records, consistent with the institution's obligations under the Family Educational Rights and Privacy Act (FERPA) and applicable state student-privacy laws.

9. International visitors

We are based in the United States and process information in the United States. If you access the Site from outside the United States, you understand that your information may be transferred to and processed in the United States.

10. Third-party links

The Site may link to third-party websites and services we do not control. This policy does not apply to those third parties, and we encourage you to review their privacy practices.

11. Changes to this policy

We may update this policy from time to time. When we do, we will revise the “Last updated” date above and, where appropriate, provide additional notice.

Contact