Terms of Service

PolicyAlign is operated by PolicyAlign LLC, a California limited liability company (“PolicyAlign,” “we,” “us”). We provide a web-based tool that analyzes the security and privacy policy documents you upload and maps them to recognized frameworks (such as the NIST Cybersecurity Framework, the HIPAA Security Rule, and others) to produce gap reports and prioritized action plans. These Terms of Service (the “Terms”) govern your access to and use of the PolicyAlign website and application (the “Service”). By creating an account or using the Service, you agree to these Terms. If you are agreeing on behalf of an organization, you represent that you are authorized to bind that organization.

You must provide accurate account information and keep your credentials secure. You are responsible for all activity under your account. Two-factor authentication is available and recommended for every account. You must be at least 18 years old and able to form a binding contract. Access is currently offered on an invitation basis; we may grant, limit, or revoke access at our discretion.

You agree not to:

• Upload content you do not have the right to upload, or that infringes others' rights
• Attempt to access another organization's data, or to circumvent tenant isolation, rate limits, or security controls
• Use the Service to build a competing product, or scrape, resell, or sublicense it
• Upload malware, or use the Service to violate any law or regulation
• Probe or load-test the Service without our written permission

Your documents are yours. You retain all rights to the policy documents you upload and to the reports you generate and download. You grant us a limited license to process your documents solely to provide the Service to you — including sending document text to our AI provider to produce your control mappings, as described in our Privacy Policy. We do not sell, share, or use your documents for any other purpose, and reports you have already downloaded remain yours even after you cancel.

Our software is ours. The Service, its underlying software, framework crosswalks, scoring methodology, and branding are our intellectual property. These Terms grant you a limited, non-exclusive, non-transferable right to use the Service; they do not transfer any ownership in it.

PolicyAlign is an informational tool. Its reports, scores, action plans, and questionnaire drafts are guidance to help you assess your own posture — they are not legal, compliance, audit, or professional advice, and they are not a certification, attestation, or guarantee of compliance with any framework, law, or regulation. You are solely responsible for your compliance decisions and for any submission you make to a regulator, auditor, insurer, or other third party. You should review all output and consult qualified professionals before relying on it. A passing score in PolicyAlign does not mean you are compliant, and we are not responsible for outcomes of audits, assessments, or claims.

The Service is designed to analyze governance and policy documents — not records about individuals. You agree not to upload Protected Health Information (PHI), patient or client records, payment card data, government identifiers, or other sensitive personal information beyond what is genuinely necessary to describe your policies. PolicyAlign is not intended to function as a HIPAA business associate and does not, by default, offer a Business Associate Agreement. If your use genuinely requires processing such data, contact us first — do not upload it until we have agreed in writing on appropriate terms.

Where we process personal data on your behalf, our Data Processing Agreement (DPA) applies in addition to these Terms and governs the controller/processor relationship, security measures, sub-processors, and breach notification. If you require a signed DPA for your records, you can request one; it is provided pre-filled with your organization's details. In the event of a conflict on data-processing matters, the signed DPA controls.

Some plans are or will be offered on a paid subscription basis, billed in advance through our payment processor. Fees, quotas (such as assessments per month), and any one-time setup fees are shown at the point of purchase. Unless required by law, fees are non-refundable for the period already started. You can cancel at any time; cancellation stops future billing and takes effect at the end of the current period. We may change pricing on renewal with reasonable notice. During any invitation-only or free period, no fees apply until you choose a paid plan.

We work to keep the Service available but do not guarantee uninterrupted or error-free operation, and we may modify, suspend, or discontinue features. We will give reasonable notice of material changes where practical. The Service is provided “as is” and “as available” without warranties of any kind, whether express or implied, including merchantability, fitness for a particular purpose, and non-infringement, to the fullest extent permitted by law.

To the fullest extent permitted by law, PolicyAlign and its owners will not be liable for any indirect, incidental, special, consequential, or punitive damages, or for lost profits, revenue, data, or goodwill, arising out of or relating to the Service. Our total liability for any claim relating to the Service will not exceed the greater of the amounts you paid us in the twelve months before the claim or one hundred U.S. dollars (USD $100). Some jurisdictions do not allow certain limitations, so some of these may not apply to you.

You will defend and hold PolicyAlign harmless from third-party claims arising out of the content you upload, your compliance decisions and submissions to regulators, auditors, insurers, or funders, or your use of the Service in violation of these Terms — except to the extent a claim results from our own breach of these Terms.

You may stop using the Service and delete your account at any time. We may suspend or terminate access if you breach these Terms or use the Service in a way that creates risk or legal exposure. On termination, the license to use the Service ends; provisions that by their nature should survive (ownership, disclaimers, limitation of liability, indemnification, and the informational-only and no-PHI clauses) survive. Your data is handled on termination as described in the Privacy Policy and on our security page.

We may update these Terms from time to time. If we make material changes, we will update the effective date above, ask you to review and accept the updated Terms the next time you sign in, and, where appropriate, notify you. Continued use of the Service after a change means you accept the updated Terms.

These Terms are governed by the laws of the State of California, without regard to its conflict of laws rules, and disputes will be resolved in the state or federal courts located there. For any questions about these Terms, contact policyalign.harpist439@passinbox.com.

Entire agreement. These Terms, together with the Privacy Policy and any signed DPA, are the entire agreement between you and PolicyAlign about the Service and supersede any prior discussions or understandings on the subject.

Severability and waiver. If any provision of these Terms is found unenforceable, the rest remain in full effect, and the unenforceable provision is modified to the minimum extent needed to make it enforceable. A failure to enforce a provision is not a waiver of the right to enforce it later.

Assignment. You may not assign or transfer these Terms without our written consent. We may assign them in connection with a merger, acquisition, or sale of assets, in which case they bind the successor.

Force majeure. Neither party is liable for delay or failure to perform caused by events beyond its reasonable control, such as outages of underlying infrastructure providers, natural disasters, or government action — except for your payment obligations.

Notices. We may provide notices through the Service or to the email on your account; you may send notices to the contact address in Section 13. Notices are effective when sent.