Privacy Policy

By using the Service, you agree to the practices described in this Privacy Policy. If you do not agree, please do not use the Service. For details on our technical security architecture — including encryption standards, tenant data segregation, and benchmark anonymization — please visit our Trust & Security page (/trust).

This Privacy Policy explains how we collect, use, store, process, disclose, and protect information when you access or use the aptAIvisor platform, website, applications, APIs, integrations, and related services (collectively, the "Services").

aptAIvisor is an AI-powered business platform designed to support contract intelligence, commercial deal intelligence, pricing analysis, procurement workflows, contract generation, financial analysis, collaboration, and related business processes. The platform may process sensitive business information, including contracts, pricing information, financial data, commercial terms, organizational policies, and AI conversations. This Privacy Policy is intended to help you understand:

• What information we collect
• How we collect information
• How we use information
• How AI features process information
• How organizational and workspace data is separated
• How we share information with service providers and integrations
• How we protect information
• How long information may be retained
• Your privacy rights
• How organizations and administrators control access
• How to contact us about privacy matters

By accessing or using the Services, you acknowledge that you have read and understood this Privacy Policy.

This Privacy Policy applies to:

• Visitors who browse our website without creating an account
• Users who register for and use the Service
• Administrators who manage an organization's account

This Privacy Policy does not apply to the practices of third parties whose websites or services may be linked from the Service, or to data we process on behalf of our customers in their capacity as data controllers (see Section 9).

2.1 Information You Provide to Us • Account Data: Name, business email address, company name, job title, and password when you register. • Profile Data: Role preferences, negotiation priorities, and settings you configure within the Service. • Contract and Deal Data: Contracts, deal records, pricing terms, and related documents you upload or input ("Customer Data"). See Section 9 for how we handle this data. • Payment Information: Billing address and payment card details, processed by our third-party payment processor. We do not store full payment card numbers. • Communications: Messages you send us via email, support tickets, or in-app chat. • Feedback and Surveys: Responses to surveys, feature requests, or other feedback you choose to submit. 2.2 Information We Collect Automatically • Usage Data: Pages visited, features used, session duration, click patterns, and interactions with the Service. • Device and Log Data: IP address, browser type, operating system, referring URLs, and error logs. • Cookie Data: We use cookies and similar tracking technologies as described in Section 5. 2.3 Information from Other Sources We may receive information about you from third-party integrations you connect to the Service (such as CRM or procurement platforms), or from publicly available sources to supplement account data.

We use the information we collect to:

• Provide and operate the Service — process your account, authenticate you, and deliver features.
• Generate AI-powered insights — analyze Customer Data to produce contract analysis, risk flags, benchmark comparisons, and negotiation recommendations.
• Improve the Service — analyze aggregated, de-identified usage patterns to fix bugs, develop features, and enhance performance. We do not use your identifiable Customer Data to train shared AI models. See Section 9.
• Communicate with you — send transactional emails (receipts, trial reminders, security alerts), product updates, and marketing communications (you may opt out of marketing at any time).
• Process payments — manage billing, subscriptions, and invoices.
• Ensure security and prevent fraud — monitor for unauthorized access, abuse, and policy violations.
• Comply with legal obligations — respond to lawful requests from government authorities and enforce our Terms of Service.
• Benchmark analytics — contribute anonymized, consent-gated deal data to aggregate market benchmarks, subject to the safeguards described in Section 9 and our Trust & Security page (/trust).

We do not sell your personal information. We may share information in the following circumstances:

• Service Providers: Third-party vendors who perform services on our behalf (cloud hosting, payment processing, analytics, customer support tools), bound by confidentiality obligations.
• Business Transfers: In connection with a merger, acquisition, financing, or sale of assets, your information may be transferred as part of that transaction. We will notify you before your information is subject to a materially different privacy policy.
• Legal Requirements: When required by applicable law, court order, or government authority, or to protect the rights, property, or safety of aptAI Solutions, our users, or the public.
• With Your Consent: In any other circumstances where you have given explicit consent.
• Aggregated or De-Identified Data: We may share anonymized, aggregated data that does not identify any individual or organization for industry research, benchmarking, or marketing purposes.

We do not share Customer Data with third parties for their independent marketing or advertising purposes.

We use cookies and similar technologies (pixels, local storage) to keep you signed in, remember your preferences, understand how you navigate and use the Service, measure communications effectiveness, and prevent fraud. Types of cookies we use: • Strictly Necessary: Required for the Service to function. Cannot be disabled. • Analytics: Help us understand usage patterns (e.g., session counts, feature engagement). You may opt out via your browser settings or cookie preference center. • Marketing: Used to deliver relevant communications. You may opt out at any time. Most browsers allow you to control cookies through their settings. Disabling certain cookies may limit your ability to use some features of the Service.

We use third-party analytics tools (such as Google Analytics) to understand how the Service is used. These tools may set their own cookies. We do not use cross-site behavioral advertising that tracks you outside of the Service. Do Not Track: We do not currently respond to browser-level Do Not Track signals, as no uniform standard exists. We do honor opt-out signals via our cookie preference center.

Depending on your location, you may have the following rights:

• Access: Request a copy of the personal information we hold about you.
• Correction: Request correction of inaccurate or incomplete information.
• Deletion: Request deletion of your personal information, subject to legal retention requirements.
• Portability: Receive your data in a structured, machine-readable format.
• Opt-Out of Marketing: Unsubscribe from marketing emails at any time via the link in any email or by contacting us at privacy@aptaivisor.com.
• Withdraw Consent: Where processing is based on consent, withdraw it at any time without affecting prior processing.

To exercise any of these rights, contact us at privacy@aptaivisor.com. We will respond within 30 days, or as required by applicable law.

We retain personal information for as long as necessary to provide the Service, comply with legal obligations, resolve disputes, and enforce our agreements. Specifically:

• Account Data is retained for the duration of your subscription plus a reasonable wind-down period (up to 90 days after termination), after which it is deleted or anonymized.
• Customer Data (contracts and deal records) is retained for the term of your subscription. You may request earlier deletion or export at any time.
• Usage and Log Data is retained for up to 24 months for security, debugging, and analytics purposes.
• Payment Records are retained as required by applicable tax and accounting laws (typically 7 years).

Customer Data — the contracts, deal records, and documents you upload — is yours. We process it only to provide the Service to you, under these principles:

• Your data never leaves your side of the table by default. Raw contract data is cryptographically segregated per tenant at the database layer, not merely at the UI.
• We do not use your Customer Data to train shared AI models. Contracts and profile data are processed within your isolated tenant environment only.
• Benchmark contributions are consent-gated. Nothing enters our aggregate benchmark pool unless you explicitly opt in. Each deal passes four anonymization gates before contributing: identifying fields are stripped, sensitive values are generalized into bands, a human reviewer approves it, and it is held until at least five independent companies have contributed comparable data. Only structured, anonymized fields reach the pool.
• Benchmarks are shown as percentile ranges, never as line items that could be traced to any individual organization.

For a full technical description of our data architecture, anonymization algorithm, and security controls, see our Trust & Security page (/trust). A detailed technical specification is available under NDA upon request.

We take the security of your information seriously and implement industry-standard technical and organizational measures, including:

• Encryption at rest and in transit using AES-256 via AWS KMS, with keys scoped and rotated independently of application code.
• Tenant data segregation enforced at the database layer — each organization's data is stored in its own encrypted store.
• Role-based access controls so that users see only what their function requires.
• Audit logging of logins, uploads, AI requests, and approvals — reviewable by your administrators.
• Multi-model AI oversight — outputs are checked across multiple AI providers and carry confidence scores; low-confidence outputs are flagged.

DESPITE THESE MEASURES, NO TRANSMISSION OVER THE INTERNET AND NO DATA STORAGE SYSTEM IS COMPLETELY SECURE. WE CANNOT GUARANTEE THE ABSOLUTE SECURITY OF YOUR INFORMATION. IN THE EVENT OF A DATA BREACH THAT AFFECTS YOUR RIGHTS, WE WILL NOTIFY YOU AS REQUIRED BY APPLICABLE LAW. To report a security concern, contact security@aptaivisor.com. For full details on our security architecture, visit our Trust & Security page (/trust).

The Service may contain links to third-party websites or integrate with third-party platforms. aptAI Solutions is not responsible for the privacy practices or content of those third parties. We encourage you to review the privacy policies of any third-party services you use in connection with aptAIvisor.

The Service is not directed at children under 18 years of age, and we do not knowingly collect personal information from children. If we learn that we have collected personal information from a child under 18, we will delete it promptly. If you believe we may have such information, please contact us at privacy@aptaivisor.com.

If you are located in the European Economic Area, United Kingdom, or Switzerland, the following applies: Legal Bases for Processing. We process your personal information on the following legal bases: • Performance of a contract — to provide the Service you have subscribed to. • Legitimate interests — to improve the Service, prevent fraud, and communicate about your account (where these interests are not overridden by your rights). • Legal obligation — to comply with applicable laws. • Consent — for marketing communications and optional benchmark contributions (withdrawable at any time). Data Subject Rights. In addition to the rights in Section 7, you have the right to lodge a complaint with your local data protection authority. International Transfers. aptAI Solutions is based in the United States. If you are located outside the United States, your information will be transferred to and processed in the United States. We rely on appropriate transfer mechanisms (such as Standard Contractual Clauses) for transfers from the EEA, UK, or Switzerland to the United States.

If you are a California resident, the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA) provide you with additional rights: • Know what personal information we collect, use, and disclose. • Delete your personal information (subject to exceptions). • Correct inaccurate personal information. • Opt out of the sale or sharing of your personal information. We do not sell or share personal information as defined by the CCPA. • Limit use of sensitive personal information. We do not use sensitive personal information for purposes beyond those permitted by the CPRA. • Non-discrimination for exercising your privacy rights. To exercise your California rights, contact us at privacy@aptaivisor.com or submit a request through the Service. We will verify your identity and respond within 45 days. Shine the Light. California Civil Code Section 1798.83 permits California residents to request information about personal information shared with third parties for direct marketing purposes. We do not share personal information for third-party direct marketing purposes.

We may update this Privacy Policy from time to time. We will notify you of material changes by email or by posting a prominent notice in the Service at least 14 days before the changes take effect. The "Effective Date" at the top of this page reflects the date of the most recent revision. Your continued use of the Service after the effective date constitutes your acceptance of the revised Privacy Policy.

If you have questions, concerns, or requests related to this Privacy Policy, please contact us: aptAI Solutions, Inc. legal@aptaisolutions.com For security-related concerns: security@aptaisolutions.com For general support: support@aptaisolutions.com For a full description of our security and data protection practices, visit our Trust & Security page (/trust).