legal

Last updated: June 11, 2026

Welcome. This page brings together the policies that govern your use of Stephens Advertising Inc. (d/b/a Stephens+)’s website at stephensplus.com (the "Site"), our use of cookies, our commitment to accessibility, and how we approach information security.

For information on how we collect, use, and protect personal information about visitors to this Site, our partners, and individuals whose data we may process on behalf of clients, see our Privacy Policy.

1. Terms of Use

These Terms of Use (the "Terms") are an agreement between you and Stephens+ ("the Agency," "we," "us," or "our"). They govern your access to and use of the Site. By using the Site, you accept these Terms. If you don't agree, please don't use the Site.

1.1 Who we are

Stephens+ is a full-service advertising agency. We work with brands across consumer and regulated categories—including healthcare and life sciences, financial services, and other categories with elevated compliance requirements. Some of our client engagements involve personal information, and a small subset may involve protected health information or other regulated data; in those engagements, additional written terms (such as a Master Services Agreement, Statement of Work, Data Processing Addendum, or Business Associate Agreement) apply. These Terms govern the Site only and do not replace those agreements.

1.2 Who can use the Site

The Site is intended for users who are at least 18 years old and capable of forming a binding contract. The Site is not directed to children, and we don't knowingly collect personal information from anyone under 13.

1.3 Acceptable use

When you use the Site, please don't:

  • Break the law, infringe anyone else’s rights, or help anyone else do either.
  • Try to access accounts, systems, or data that aren't yours.
  • Probe, scan, or test the vulnerability of the Site or our systems, or interfere with their normal operation.
  • Scrape, harvest, or otherwise collect information from the Site by automated means without our written consent.
  • Upload or transmit malware, malicious code, or material that is unlawful, harassing, defamatory, or obscene.
  • Misrepresent your identity or affiliation, or impersonate any person or entity.
  • Use the Site to train machine-learning models or generate derivative datasets without our written consent.

We may suspend or terminate your access to the Site at any time, with or without notice, if we believe you've violated these Terms, applicable law, or the rights of any third party.

1.4 Our content

The Site, including its design, copy, graphics, logos, photographs, video, audio, and code, is owned by Stephens+ or our licensors and is protected by copyright, trademark, and other intellectual property laws. Case studies and creative work shown on the Site may also be subject to client or third-party rights. We grant you a limited, non-exclusive, non-transferable, revocable license to view the Site for personal, non-commercial purposes. You may not copy, modify, distribute, publicly display, or create derivative works from any part of the Site without our prior written consent, except as expressly allowed by law (for example, fair use).

1.5 Trademarks

"Stephens+" and our logos are trademarks of Stephens Advertising, Inc. Other names, marks, and logos appearing on the Site are the property of their respective owners and are used with permission or for editorial reference. Nothing on the Site grants you any right to use any trademark without the written consent of its owner.

1.6 Submissions and feedback

If you send us comments, ideas, suggestions, RFPs, briefs, creative submissions, or other materials ("Submissions"), you agree they are non-confidential unless we agree otherwise in writing. You grant us a worldwide, royalty-free, perpetual, irrevocable, sublicensable license to use Submissions for any lawful business purpose. Please don't send us anything you consider confidential or proprietary through the Site’s public-facing forms; use a signed NDA or a secure intake we've agreed to.

1.7 Third-party links and content

The Site may link to third-party sites, services, and content (including embedded videos, social media, and analytics tools). We don't control those resources and aren't responsible for their content, privacy practices, or availability. Your use of third-party resources is at your own risk and subject to their terms.

1.8 Disclaimers

The Site is provided "as is" and "as available." To the fullest extent permitted by law, Stephens+ disclaims all warranties, express or implied, including warranties of merchantability, fitness for a particular purpose, non-infringement, accuracy, and uninterrupted operation. Information on the Site is for general informational and marketing purposes only and is not legal, medical, financial, or other professional advice. We do not warrant that the Site will be secure, error-free, or free from viruses or other harmful components.

1.9 Limitation of liability

To the fullest extent permitted by law, Stephens+ and our officers, directors, employees, contractors, and agents will not be liable for any indirect, incidental, special, consequential, exemplary, or punitive damages arising out of or related to your use of the Site—including lost profits, lost data, or business interruption—even if we've been advised of the possibility. Our total liability for any claim arising out of or related to the Site is limited to one hundred U.S. dollars (US$100). Some jurisdictions don't allow these limitations, so they may not apply to you.

1.10 Indemnification

You agree to defend, indemnify, and hold harmless Stephens+ from any claims, damages, liabilities, and expenses (including reasonable attorneys' fees) arising out of your use of the Site, your Submissions, or your violation of these Terms or any law or third-party right.

1.11 Governing law and disputes

These Terms are governed by the laws of the State of Ohio, excluding its conflict-of-laws rules. Any dispute arising out of or related to these Terms or the Site will be brought exclusively in the state or federal courts located in Montgomery County, OH, and you and we consent to personal jurisdiction there. Nothing in this section limits any right you may have under applicable consumer-protection laws that cannot be waived.

1.12 Changes

We may update these Terms from time to time. When we do, we'll change the "Last updated" date at the top of this page. Material changes will be highlighted on the Site. Continued use of the Site after an update means you accept the new Terms.

1.13 Contact

Questions about these Terms? Email us at .

2.1 What are cookies?

Cookies are small text files placed on your device when you visit a website. They're used to make sites work, remember your preferences, measure performance, and—in some cases—deliver advertising. "First-party" cookies are set by us; "third-party" cookies are set by partners we use. We use the term "cookies" loosely in this policy to cover similar technologies.

2.2 Categories of cookies we use

Strictly Necessary

These cookies are required for the Site to function—for example, to load pages securely, route traffic, remember consent choices, and prevent abuse. They can't be turned off through our consent tool because the Site won't work properly without them.

Performance and Analytics

These cookies help us understand how visitors use the Site so we can improve it—for example, which pages are visited, where traffic comes from, and where users encounter friction. We may use providers such as Google Analytics or similar tools. These cookies are set only with your consent where required by law.

Functional

These cookies remember choices you make—such as language or region—to give you a more personalized experience. They're not strictly required, but they make the Site more useful.

Marketing and Advertising

These cookies may be set by us or our advertising partners (for example, LinkedIn, Meta, or Google) to measure campaign performance, attribute conversions, and, in some cases, deliver relevant ads on other sites. Some of these activities may qualify as "sharing" or "sale" of personal information under U.S. state privacy laws (see Section 2.5).

2.3 Third-party cookies

Some cookies are set by third-party services we embed on the Site, including analytics, video players, social media widgets, and advertising platforms. Those third parties' use of cookies is governed by their own privacy policies. A current list of the third-party services we use is maintained in our consent tool, accessible from the "Cookie Settings" link in the Site footer.

2.4 Managing your preferences

You can control cookies in several ways:

  • Cookie banner / settings. Use the "Cookie Settings" link in the Site footer to change your choices at any time.
  • Browser controls. Most browsers let you block or delete cookies. See your browser’s help pages for instructions. Blocking some cookies may break parts of the Site.
  • Global Privacy Control (GPC). We treat a recognized GPC signal as an opt-out of "sale" and "sharing" for cross-context behavioral advertising in jurisdictions where the law requires it.
  • Industry opt-outs. You can opt out of many advertising cookies through aboutads.info/choices (DAA) and youronlinechoices.eu (EDAA).

2.5 Your U.S. state privacy rights

Depending on where you live, you may have the right to opt out of the "sale" or "sharing" of your personal information for cross-context behavioral advertising, the right to know or delete personal information we have about you, and other rights described in our Privacy Policy. To exercise these rights, use the "Do Not Sell or Share My Personal Information" link in the Site footer or contact us at . We don't discriminate against you for exercising these rights.

3. Accessibility Statement

Stephens+ is committed to making this Site usable by everyone, including people with disabilities. We design and build with accessibility in mind because it’s the right thing to do—and because the brands we work with deserve communications that reach the broadest possible audience.

3.1 Our standard

We aim to meet or exceed the Web Content Accessibility Guidelines (WCAG) 2.1, Level AA, published by the World Wide Web Consortium. WCAG defines requirements for designers and developers to make web content more accessible to people with visual, auditory, motor, cognitive, and other disabilities.

3.2 What we do

  • Build with semantic HTML and ARIA roles where appropriate.
  • Test for keyboard navigation, color contrast, and screen-reader compatibility.
  • Provide text alternatives for non-text content (alt text, captions, transcripts).
  • Review accessibility as part of our standard QA before launch and after major updates.
  • Train our designers, writers, and engineers on accessibility fundamentals.

3.3 Where we're still working

Accessibility is an ongoing effort. Some third-party content embedded in the Site (for example, social media posts or vendor widgets) may not fully meet our standard. When we identify gaps—either through our own testing or through your feedback, we work to fix them.

3.4 Tell us how we're doing

If you encounter a barrier on the Site, or if you need information from the Site in an alternative format, please contact us at . Tell us what you were trying to do, what page you were on, and what assistive technology you're using if applicable. We aim to respond within five business days.

4. Information Security Statement

Our clients trust us with brand assets, campaign strategy, audience data, and—in some engagements—personal information about their customers, patients, or members. We take that trust seriously. This statement describes, at a high level, how we approach information security. It is informational and does not by itself create contractual obligations; specific commitments are set out in our client agreements.

4.1 Security program

Our information security program is risk-based and aligned with recognized frameworks, including the NIST Cybersecurity Framework and the ISO/IEC 27001 family of standards. We maintain written policies covering access management, asset management, secure development, vendor risk, incident response, and business continuity. We review the program at least annually and update it as our business and the threat landscape change.

4.2 Governance

Leadership.

Our security program is led by a designated security owner who reports to executive leadership.

Policies.

We maintain written policies for information security, acceptable use, data handling, incident response, and vendor management. Personnel acknowledge them at hire and annually thereafter.

Training.

All employees and long-term contractors complete security and privacy awareness training at hire and annually, with role-based training for engineering, account, and data teams.

Risk management.

We conduct periodic risk assessments and remediate findings according to severity and business impact.

4.3 Access and identity

Least privilege.

Access to systems and data is granted on a need-to-know basis and reviewed on a regular schedule.

Authentication.

Single sign-on and multi-factor authentication are required for access to corporate systems containing client or sensitive data.

Endpoint controls.

Company-managed devices are encrypted at rest, run endpoint protection, and are subject to patching and configuration baselines.

4.4 Data protection

Encryption.

Data in transit is protected using TLS 1.2 or higher. Data at rest in our managed environments is encrypted using industry-standard algorithms.

Segregation.

Client data is logically segregated and access-controlled by engagement.

Data minimization.

We collect and retain only the data we need to deliver the engagement, and we work with clients to define retention and disposal up front.

Secure disposal.

Media and files containing sensitive data are destroyed using methods consistent with NIST SP 800-88 or equivalent.

4.5 Engagements involving personal information

Whether and how we handle personal information varies by engagement. When an engagement involves personal information, we work with the client to:

  • Document the categories of data, sources, purposes, and retention period.
  • Execute appropriate written terms (Data Processing Addendum, Business Associate Agreement under HIPAA where applicable, or equivalent).
  • Apply additional controls proportionate to the sensitivity of the data—for example, restricted access groups, hardened processing environments, audit logging, and stricter retention limits.
  • Limit subprocessors to vetted vendors under written contracts that flow down equivalent obligations.

Where an engagement does not require personal information, we ask clients not to send it, and we structure our intake and creative review processes to avoid receiving it.

4.6 Regulated industries

We routinely support clients in regulated industries (including healthcare and life sciences, financial services, insurance, and consumer products subject to FTC oversight). Our practices are designed to meet client compliance obligations under regimes such as HIPAA/HITECH, GLBA, FTC Section 5 and the FTC Health Breach Notification Rule, FDA promotional standards, and state privacy laws including the CCPA/CPRA. Specific compliance commitments are documented in the applicable client agreement.

4.7 Vendor and subprocessor management

Vendors and subprocessors that touch client or sensitive data are vetted before engagement, governed by written contracts that include security and confidentiality commitments, and reviewed periodically based on the risk of their access. We maintain a list of subprocessors that handle personal information on our behalf and make it available to clients on request.

4.8 Application and infrastructure security

Secure development.

Code that we write goes through peer review, dependency scanning, and pre-deployment checks.

Vulnerability management.

We monitor for vulnerabilities in our systems and dependencies and remediate based on severity and exposure.

Logging and monitoring.

Security-relevant events on our managed systems are logged and monitored, and logs are retained according to policy.

Independent testing.

We engage qualified third parties to perform periodic security assessments of our environment and remediate findings.

4.9 Incident response

We maintain a written incident response plan and a defined on-call rotation. If we identify or suspect a security incident affecting client data, we contain and investigate it, notify affected clients consistent with our contractual obligations and applicable law, and remediate root causes.

4.10 Business continuity

Critical systems are backed up on defined schedules, and we maintain business continuity and disaster recovery plans that we test periodically.

4.11 Reporting a vulnerability or concern

If you believe you've found a security vulnerability in this Site or in any system operated by Stephens+, please email . Please include enough detail to reproduce the issue, and please don't access data that isn't yours, disrupt our services, or publicly disclose the issue before we've had a reasonable opportunity to fix it. We appreciate good-faith reports and will work with you in good faith in return.

Thanks for reading. If anything on this page is unclear, or if you need this content in another format, contact us at .