Privacy Policy

• Account information — your email address, organization name, and role, plus authentication data managed by our auth provider (passwords are bcrypt-hashed; we never see them readable).
• Documents you upload — the security and privacy policy documents you choose to analyze, and the reports generated from them.
• Usage and activity logs — sign-ins, uploads, and report views, written to your organization's own audit log, plus standard technical logs (IP address, browser type) used to operate and secure the Service.

We ask you not to upload Protected Health Information, patient or client records, payment card data, or other sensitive personal data beyond what is necessary to describe your policies (see our Terms of Service).

We use your information solely to provide and secure the Service: to authenticate you, run the analysis you request, generate your reports, maintain your activity log, communicate with you about your account, and prevent abuse. We do not sell or rent your data, and we do not use your documents for advertising or for any purpose other than producing your own reports.

Analysis runs on Anthropic's Claude API. The text of your documents is sent to the API solely to produce your control mappings. Per Anthropic's commercial API terms, API inputs and outputs are not used to train their models.

We keep our vendor list short, and each one only receives what it needs to run the Service:

• Anthropic — AI analysis of document text (no training on your data, as above).
• Supabase — database, authentication, and encrypted file storage.
• Vercel — application hosting and delivery.

We do not otherwise share your data, except where required by law or to protect rights and safety. The authoritative, version-controlled list of sub-processors (and hosting regions) is maintained in Annex C of our Data Processing Agreement.

Your data is isolated per organization by database-level row-level security, encrypted in transit (TLS 1.2+) and at rest (AES-256), and protected by two-factor authentication, rate limiting, and audit logging. The full picture, including what we do not yet claim, is on our security page.

We deliberately keep as little as possible. If you cancel, your uploaded documents are deleted from storage within 14 days; reports you have already downloaded are yours and are unaffected. You can request earlier deletion or a full export at any time, and deletion requests are honored within 14 days. Account and audit records needed for security and legal obligations may be retained for a limited period after closure.

You can access and export your data, correct your account details, and request deletion at any time from your account or by contacting us. Depending on where you live, you may have additional rights under laws such as the GDPR or CCPA (for example, to access, correct, delete, or object to certain processing); we honor these requests and do not discriminate against you for exercising them. For most data you upload, you act as the controller and we act as your processor under our Data Processing Agreement.

The Service is for organizations, not individuals, and is not directed to children. We do not knowingly collect personal information from children. If you analyze policies for a program that serves minors, upload the policies — not records about the children themselves.

We may update this policy; if changes are material we will update the effective date above and, where appropriate, notify you. Questions, requests, or concerns? Contact policyalign.harpist439@passinbox.com.