JSON Holdings LLC

Privacy Policy

How JSON Holdings LLC (d/b/a IsotopeReady) collects, uses, and protects your information when you use IsotopeReady.

Last updated: March 24, 2026

Who We Are

IsotopeReady is a nuclear compliance platform operated by JSON Holdings LLC, d/b/a IsotopeReady, a compliance technology company. We provide multi-tenant compliance management software for nuclear supply chain organizations, including suppliers to Centrus Energy, Fluor-BWXT, and other HALEU program participants.

This Privacy Policy explains how we collect, use, disclose, and protect information about you when you use our platform at isotopeready.ai, related APIs, and associated services (collectively, the "Service").

By using IsotopeReady, you agree to the collection and use of information in accordance with this policy. For questions, contact us at [email protected].

Information We Collect

Account & Identity Information

When you register or are invited to IsotopeReady, we collect:

  • ▸Full name and work email address
  • ▸Job title and organizational role
  • ▸Company name, address, and CAGE code (if applicable)
  • ▸Phone number (optional, used for SMS notifications on White Glove and Premium tiers)
  • ▸Login credentials (passwords are hashed using bcrypt and never stored in plaintext)

Compliance & Operational Data

To deliver compliance management services, we process:

  • ▸Bid information: bid numbers, values, COGS, due dates, and status
  • ▸Uploaded documents: PDFs, images, and certificates submitted for OCR processing
  • ▸OCR-extracted content: heat numbers, lot numbers, procedure references, NDT flags
  • ▸Risk event data: descriptions, probability estimates, impact assessments
  • ▸Compliance check results: Pass/Fail/Partial status per framework requirement
  • ▸Supplier records: names, CAGE codes, DUNS numbers, contact information

Technical & Usage Data

  • ▸IP address and approximate geographic location
  • ▸Browser type, operating system, and device identifiers
  • ▸Pages visited, actions taken, and time spent in the platform
  • ▸API request logs (endpoint, timestamp, response status)
  • ▸Error logs and diagnostic information

Payment Information

Billing is processed by Stripe, Inc. IsotopeReady does not store full credit card numbers. We receive and retain payment metadata such as last four digits, card type, billing address, and transaction IDs. For manual payments (check, ACH, money order), we store receipt documentation in encrypted cloud storage.

How We Use Your Information

  • ▸Providing, operating, and improving the IsotopeReady platform
  • ▸Running automated compliance checks against your uploaded documents
  • ▸Calculating Shop Health Scores, risk impacts, and margin projections
  • ▸Sending transactional emails: account verification, password resets, invoice notifications
  • ▸Delivering scheduled weekly compliance summary reports (White Glove and Premium tiers)
  • ▸Sending SMS notifications for compliance deadlines (with your explicit consent)
  • ▸Processing payments and managing subscription billing
  • ▸Maintaining audit logs required by NQA-1, 10 CFR 50 Appendix B, and ITAR recordkeeping obligations
  • ▸Responding to support requests and technical inquiries
  • ▸Detecting, preventing, and investigating security incidents or fraud
  • ▸Complying with applicable legal obligations

Data Sharing & Disclosure

We do not sell, rent, or trade your personal information to third parties for their marketing purposes. We share information only in the following circumstances:

Service Providers

We use trusted third-party vendors to operate our platform:

  • ▸Stripe (payment processing) — PCI DSS compliant
  • ▸Amazon Web Services / Azure (infrastructure hosting and blob storage)
  • ▸SendGrid (transactional email delivery)
  • ▸Twilio (SMS notifications, White Glove and Premium only)
  • ▸These providers are contractually bound to use your data only to provide services to us.

Legal & Regulatory Requirements

We may disclose information when required by law, court order, or government authority, including obligations under the Nuclear Regulatory Commission (NRC), Department of Energy (DOE), or the Department of State Directorate of Defense Trade Controls (DDTC/ITAR). We will notify you of such disclosures to the extent permitted by law.

Business Transfers

In the event of a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you before your personal data is transferred and becomes subject to a different privacy policy.

Data Retention

We retain data for as long as your account is active or as needed to provide services.

  • ▸Account and user data: retained for the life of your subscription plus 3 years
  • ▸Compliance documents and OCR extractions: retained per your applicable framework retention requirements (NQA-1 recommends 10+ years for nuclear records)
  • ▸Bid and risk data: retained for subscription life plus 5 years (ITAR recordkeeping requirement)
  • ▸Audit logs: retained for 7 years
  • ▸Payment records: retained for 7 years (IRS requirement)
  • ▸After account deletion, anonymized aggregate data may be retained for analytics

Data Security

We implement industry-standard security measures appropriate for nuclear-adjacent compliance data. See our Security Policy for full details. Key measures include:

  • ▸AES-256 encryption at rest for all stored documents and sensitive fields
  • ▸TLS 1.3 encryption in transit for all API and web traffic
  • ▸Bcrypt password hashing (no plaintext passwords ever stored)
  • ▸JWT-based authentication with configurable expiration
  • ▸Row-level SQL isolation between tenants (your data is never mixed with other organizations)
  • ▸Optional two-factor authentication per user
  • ▸Comprehensive audit logging of all data access and changes

Your Rights

Depending on your location, you may have the following rights regarding your personal data:

  • ▸Access: Request a copy of the personal data we hold about you
  • ▸Correction: Request correction of inaccurate or incomplete data
  • ▸Deletion: Request deletion of your personal data (subject to legal retention requirements)
  • ▸Portability: Request your data in a machine-readable format
  • ▸Objection: Object to processing of your data for certain purposes
  • ▸Restriction: Request restriction of processing in certain circumstances

To exercise any of these rights, email [email protected]. We will respond within 30 days. Note that some requests may be limited by legal obligations, particularly ITAR and NRC recordkeeping requirements.

Cookies & Tracking

IsotopeReady uses only essential session cookies necessary for platform operation (authentication tokens). We do not use advertising cookies, behavioral tracking, or third-party analytics beyond what is necessary to diagnose errors and monitor platform health. We do not display advertisements.

GDPR (European Users)

If you are located in the European Economic Area, our lawful basis for processing your data is:

  • ▸Contract performance: processing necessary to provide the services you subscribed to
  • ▸Legal obligation: compliance with applicable laws including NRC, DOE, and ITAR regulations
  • ▸Legitimate interests: security monitoring, fraud prevention, and platform improvement
  • ▸Consent: where we have asked for your explicit consent (e.g., SMS notifications)

You have the right to lodge a complaint with your national supervisory authority. Our EU representative can be reached at [email protected].

Changes to This Policy

We may update this Privacy Policy periodically. We will notify you of material changes by email or by posting a prominent notice in the IsotopeReady platform at least 30 days before the changes take effect. Continued use of the Service after changes constitutes acceptance of the updated policy.

Contact Us

JSON Holdings LLC (d/b/a IsotopeReady)
United States
Email: [email protected]
Support: [email protected]