Privacy Policy

1. Scope

This Privacy Policy explains how Civerent collects, uses, discloses, retains, and protects personal information when you visit our website, request a consultation, create an account, or use the Civerent governance platform.

This policy applies to information Civerent handles as the operator of its website and services. Customer organizations may also submit information to Civerent for processing on their behalf. In those situations, the customer organization controls the information and its instructions may govern how requests concerning that information are handled.

2. Information we collect

We collect information you provide directly, information generated through your use of Civerent, and limited technical information needed to operate and secure the service.

• Account information, such as your email address, display name, authentication identifiers, and account timestamps.
• Organization information, such as organization name, workspace membership, role, and team invitation information.
• Consultation information, such as your name, work email, organization, role, organization size, sector, country, governance priorities, timeline, budget range, and message.
• Governance content submitted to a workspace, including AI system records, risk assessments, policies, compliance controls, evidence, ownership information, implementation notes, and activity history.
• Security and operational information, such as session cookies, authentication claims, request timing, audit events, and information used to prevent abuse.
• Communications you send to Civerent, including support, procurement, privacy, and commercial inquiries.

3. How we use information

• Provide, maintain, secure, and improve the Civerent website and governance platform.
• Create and administer accounts, organizations, workspace memberships, and permissions.
• Process consultation requests and communicate about requested services.
• Operate AI inventory, risk, policy, compliance, evidence, reporting, and audit-history features.
• Detect spam, fraud, misuse, security incidents, and unauthorized access.
• Troubleshoot problems, monitor reliability, and maintain service performance.
• Comply with applicable legal obligations and enforce contractual terms.
• Develop and evaluate product improvements using information handled in accordance with this policy and applicable customer agreements.

4. Reasons for processing

Where applicable law requires a legal basis, Civerent processes personal information to provide requested services or take steps before entering a contract, comply with legal obligations, pursue legitimate interests such as securing and improving the service, or act with your consent.

You may withdraw consent where processing depends on consent. Withdrawal does not affect processing that occurred before consent was withdrawn.

5. How information may be disclosed

Civerent does not sell personal information. Civerent does not share personal information for cross-context behavioral advertising.

• Service providers that support hosting, authentication, databases, communications, security, and other necessary operations, subject to appropriate restrictions.
• Your organization and authorized workspace members according to configured roles and permissions.
• Professional advisers, auditors, insurers, or financing parties when reasonably necessary and subject to confidentiality obligations.
• Authorities or other parties when disclosure is legally required or reasonably necessary to protect rights, safety, security, or the integrity of the service.
• A successor or transaction participant in connection with a merger, financing, acquisition, restructuring, or sale of assets, subject to appropriate protections.
• Other parties when you direct or authorize the disclosure.

6. Cookies and similar technologies

Civerent currently uses cookies and related browser storage that are necessary for authentication, session management, security, and core service operation.

Civerent does not currently use third-party behavioral advertising cookies on the website. If our practices materially change, this policy and any required consent controls will be updated before those technologies are used.

7. Retention

Civerent retains personal information only for as long as reasonably necessary for the purposes described in this policy, including providing services, maintaining security and audit records, resolving disputes, meeting contractual commitments, and complying with legal obligations.

Retention periods vary according to the type of information, the customer relationship, workspace settings, security needs, and applicable law. Information may remain in protected backups for a limited period after deletion from active systems.

8. Security

Civerent uses administrative, technical, and organizational safeguards designed to protect information against unauthorized access, alteration, disclosure, or destruction. Current controls include authenticated access, role-based authorization, organization-scoped database controls, row-level security, controlled database operations, audit history, and secure session handling.

No system can guarantee absolute security. Users are responsible for protecting their credentials, using appropriate devices and networks, and promptly reporting suspected unauthorized access.

9. Privacy choices and rights

Depending on where you live and subject to applicable exceptions, you may have rights concerning your personal information.

• Request access to personal information associated with you.
• Request correction of inaccurate or incomplete information.
• Request deletion of eligible personal information.
• Request restriction of or object to certain processing.
• Request a portable copy of eligible information.
• Withdraw consent when processing depends on consent.
• Opt out of direct marketing communications.
• Appeal or complain to an applicable privacy or data-protection authority.
• Receive equal service and pricing without unlawful discrimination for exercising applicable privacy rights.

10. Submitting a privacy request

To submit a privacy request, email the address listed in the Contact section with the subject line Privacy Request. Describe the request and identify the email address connected with your Civerent account or consultation request.

Civerent may need to verify your identity and authority before completing a request. We will use information provided for verification only to evaluate and respond to the request. Authorized agents may be required to provide evidence of their authority.

If Civerent processes information solely on behalf of your organization, we may direct the request to that organization.

11. International use

Civerent and its service providers may process information in the United States and other countries where they operate. Those locations may have data-protection laws different from the laws where you live.

Where required, Civerent will use appropriate contractual or legal mechanisms for international transfers.

12. Children

Civerent is a business and government governance service and is not directed to children. We do not knowingly collect personal information from children under 13 through the public website. If you believe a child provided personal information, contact us so the information can be reviewed and, where appropriate, deleted.

13. Automated processing

Civerent may use deterministic rules to prioritize consultation requests based on information submitted, such as organization size, timeline, and stated governance needs. This prioritization helps organize follow-up and does not make legal, employment, credit, insurance, housing, or similarly significant decisions about individuals.

14. Changes to this policy

Civerent may update this Privacy Policy as the service, legal requirements, or privacy practices change. The effective date at the top of this page will be updated when revisions are published.

If a change materially affects how previously collected personal information is used, Civerent will provide additional notice when required.