Privacy Policy

1. Who this applies to

This Policy applies to visitors, account holders, and people invited to review, comment on, or sign documents through the Service.

2. Information we may collect

• Account and contact data — such as name, email address, and organization, when you or your company creates an account or sends invitations.
• Usage and technical data — such as IP address, device/browser type, approximate location derived from IP, pages viewed, and timestamps, collected through logs and analytics we enable.
• Content you submit — documents, comments, and metadata stored in the Service as part of normal operation.
• E-signature-related data — when envelopes are sent via DocuSign (or a similar provider), signing may occur on that provider's site. We may receive status events, envelope identifiers, signer email addresses, and related metadata needed to operate workflows. The provider's own privacy notice governs its collection and use when you use its interface.

We do not intentionally collect special-category (sensitive) personal information, and we ask that you not submit it except where required by a document you are governing.

3. How we use information

We use the information above to:

• Provide, secure, and improve the Service;
• Authenticate users, enforce permissions, and prevent abuse;
• Send operational messages (e.g., invitations, and notifications related to documents you are party to);
• Comply with law and respond to lawful requests.

4. Cookies and similar technologies

We use cookies and similar technologies to operate and secure the Service. Strictly necessary cookies are always enabled. Optional functional and analytics cookies are used only where permitted and, where required by law, with your consent. For details, see our Cookie Policy and cookie preferences.

5. AI and automated processing

Certain features use third-party AI service providers (including OpenAI and Anthropic) as subprocessors to extract and organize information from documents. Customer content processed through these providers is subject to enterprise/API terms that prohibit using that content to train their models. We do not use customer content to train our own machine-learning models, and we do not sell your personal information.

6. Sharing

We share information with service providers that help us host, secure, and operate the Service (for example, cloud hosting, authentication, email delivery, AI processing, and e-signature platforms). A current list of our subprocessors is available on request and is included in our Data Processing Agreement. We may disclose information if required by law or to protect the rights, safety, and integrity of users and the Service.

7. Retention

We retain information for as long as needed to provide the Service, comply with legal obligations, resolve disputes, and enforce agreements. Retention periods may depend on your organization's settings and contractual terms. On termination, customer data can be exported and is deleted in accordance with your agreement.

8. Your choices and rights

Depending on where you live, you may have rights to access, correct, delete, or restrict certain processing of your personal information, or to object or lodge a complaint with a supervisory authority. Because CorpTeam often processes content on behalf of the organization that invited you (your data controller), you may exercise many rights by contacting that organization directly; you can also reach us as described below and we will assist.

9. Security

We implement reasonable technical and organizational measures designed to protect information, including encryption in transit and at rest, access controls, and multi-factor authentication. A Security Overview and our vendor security documentation are available to customers and prospective partners on request. No method of transmission or storage is completely secure.

10. International transfers and data location

Our systems are hosted in the United States. If you access the Service from outside the United States, your information may be processed in a country that may not provide the same level of data protection as your home jurisdiction.

11. Children

The Service is not directed to children under 16, and we do not knowingly collect their personal information.

12. Changes

We may update this Privacy Policy from time to time. We will post the updated version on this page and adjust the effective date above.

13. Contact

Questions about this Privacy Policy: privacy@corpteam.ai