Privacy Policy

Scope

This policy applies to SponsorPact's website, interactive demo, support interactions, and limited pilot service. Customer organizations control the sponsorship content they submit and are responsible for having a lawful basis to provide it.

Data we collect

• Account and organization data, including names, work email addresses, roles, and invitation status.
• Customer content, including sponsorship agreements, prospectuses, deliverables, sponsor contacts, proof files, links, user-supplied metrics, logos, and report snapshots.
• Service data, including authentication events, audit events, explicit product events, device and request metadata needed for security, and support correspondence.
• Billing records supplied by a payment provider. SponsorPact does not intend to store full payment card details.

How data is used

• Provide, secure, support, and improve the service.
• Extract and verify potential sponsorship obligations for human review.
• Generate reports and preserve version history requested by authorized users.
• Communicate about accounts, security, support, and material policy changes.
• Meet legal obligations and protect customers, SponsorPact, and the public from abuse.

AI processing

SponsorPact uses Replicate to convert documents, extract potential obligations, and independently verify them for human review. Replicate documents that API prediction input parameters, output values, output files, and logs are automatically removed after one hour by default. SponsorPact does not claim contractual zero data retention. Executed agreements remain disabled until Replicate retention and DPA terms are contractually cleared; current model processing is limited to public prospectuses and approved test documents. Users confirm extracted content before it becomes an operational record.

Sharing and subprocessors

Data may be shared with infrastructure, authentication, storage, model, observability, email, analytics, and payment subprocessors only as needed to provide the service. SponsorPact does not sell personal data or use customer documents for advertising.

Retention and deletion

Customer content remains available while an account is active and as required by the selected plan. Deleted customer data is soft-deleted for 30 days, then database records and private objects are scheduled for purge unless law requires longer retention. Immutable report versions remain subject to the same account deletion process.

Rights and choices

Depending on location, individuals may request access, correction, deletion, portability, restriction, or an objection to certain processing. Authorized organization owners can export and delete customer data. Identity and authority may be verified before a request is completed.

Security and changes

SponsorPact uses technical and organizational controls intended to protect data, but no service can guarantee absolute security. Material changes to this policy will be posted here and communicated when required.