Privacy Policy

CU Risk Advisors is a sole proprietorship of Jeff L. Bassill (mycurisk.com). This policy explains what personal information we collect through our website and products, how we use it, and who else touches it.

Version 1.1  ·  Effective August 1, 2026

The short version

We sell compliance documents and software to financial institutions. We collect what we need to process an order, deliver files, provide support, and send messages you've asked for. We do not sell, rent, or share personal information, and we run no advertising trackers. ExpressHold processes everything inside your browser and transmits nothing to us; our document products are ordinary Word and Excel files that never phone home.

1. Information We Collect

Purchase information. When you buy a product, we receive your name, email address, billing address, institution name, and order details. Payments are processed by Stripe and PayPal; we never receive or store your full card number.

Contact form and email. Submissions go to jeff@mycurisk.com and stay in that mailbox.

Mailing list. If you subscribe to product announcements, regulatory updates, or ExpressHold threshold notifications, we keep your email and institution in Squarespace Email Campaigns, which records ordinary open/click statistics. Every message includes an unsubscribe link.

Website analytics. We use Squarespace's built-in analytics only — IP address, browser/device type, pages viewed, time of visit, referring site. No Google Analytics, no advertising pixels, no third-party trackers.

Cookies. Squarespace sets cookies necessary to run the site and cart, and cookies supporting the analytics above. Blocking essential cookies may prevent checkout from working.

2. Information We Do Not Collect

• Member or customer names, account numbers, deposit amounts, transaction details, or any other nonpublic personal information belonging to your institution's members or customers.
• The contents of any document you create from our templates — our document products are self-contained Word/Excel files that transmit nothing to us.
• Any data entered into ExpressHold — a client-side application. Hold calculation inputs, results, and printed notice content are processed entirely in the user's browser and never transmitted to us, in either the hosted or local license form.

We do not sell, rent, trade, or share personal information with anyone for their own marketing purposes, and we don't use it for cross-context behavioral advertising.

3. How We Use Information

• Process your order and deliver files or access credentials;
• Re-send download links and provide support;
• Communicate about your purchase, subscription, or renewal;
• Send announcements and regulatory update notices to those who've asked for them;
• Understand which pages and products draw interest, to improve the site;
• Maintain site and software security and integrity; and
• Meet legal, tax, and accounting obligations.

4. Service Providers

We use no other processors, and don't transfer personal information to anyone else except where required by law.

5. Retention & Security

Order records are kept for tax/accounting needs, generally seven years. Mailing list entries persist until you unsubscribe. We use reasonable measures to protect what we hold, but no transmission or storage method is completely secure. If you believe your ExpressHold URL or password was accessed without authorization, contact us promptly.

6. Your Choices and Rights

Unsubscribe any time via the link in the message, or by emailing info@mycurisk.com. You may ask what we hold about you, ask us to correct it, or ask us to delete it — we respond within a reasonable period, and honor these requests regardless of whether a specific privacy law technically applies to us, subject to information we must retain for tax or legal reasons.

7. Information for Institutional Customers

This section is intended for credit unions and banks conducting vendor due diligence on CU Risk Advisors.

Institutions subscribing to the ExpressHold hosted version should note it runs on Squarespace, which may retain standard web server logs as an independent third party. Full technical detail is at the ExpressHold Security & Data page, and a signable Data Privacy Agreement is available on request.

The following documentation supports most due diligence reviews without further correspondence:

• Statement of Client-Side Processing, Encryption and Security Statement, Threshold Maintenance Statement (incorporated into the Software Products Supplement)
• Data Privacy Agreement

Need a completed vendor questionnaire, a W-9, proof of our EIN, or this policy on letterhead? Email info@mycurisk.com.

8. Children

Our site and products are directed to financial institutions and their staff, not children. We do not knowingly collect personal information from anyone under 16.