When you create an AssurAI account, we collect your name, email address, company name, and role. This information is required to provide you with access to the platform.
Controls, evidence, findings, workpapers, and projects you create within AssurAI. This data belongs entirely to you. We act as a data processor on your behalf.
When you use Evidence Intelligence, RCM Auto-Reader, Walkthrough AI, Reconciliation AI, or Prior Year Workpaper Ingestion, you upload documents for AI processing.
Features accessed, AI tools used, session duration, IP address, browser type, and device information — used for security, fraud prevention, and platform improvement.
When you submit your email via our website, advisory consultation, or ROI calculator, we store your email to send relevant information about AssurAI products. You can unsubscribe at any time by emailing privacy@getassurai.com. We do not sell your data to third parties.
| Purpose | Legal Basis (GDPR) | Can Opt-Out |
|---|---|---|
| Providing and improving AssurAI | Contract performance | No (essential) |
| Processing AI requests on your behalf | Contract performance | No (essential) |
| Service notifications and updates | Contract performance | No (essential) |
| Security monitoring and fraud prevention | Legitimate interest | No |
| Product analytics | Legitimate interest | Yes |
| Marketing emails | Consent | Yes (unsubscribe anytime) |
| Legal compliance | Legal obligation | No |
We do not sell your personal data. We share data only with essential sub-processors bound by Data Processing Agreements.
| Sub-Processor | Category | Purpose | Certification |
|---|---|---|---|
| Supabase | Infrastructure | Database & authentication | SOC 2 Type II |
| Anthropic | AI Processing | Claude API — no training on your data | ZDR Agreement |
| AI Processing | Gemini API — subject to Google API Terms | Google DPA | |
| OpenAI | AI Processing | GPT-4o API — subject to OpenAI API Terms | OpenAI DPA |
| Netlify | Infrastructure | Platform hosting | SOC 2 Type II |
| Stripe | Payments | Payment processing | PCI DSS Level 1 |
| Resend | Transactional email delivery | Standard DPA |
Full security details: getassurai.com/security.
| Data Type | Retention Period |
|---|---|
| Account data (name, email, org) | Life of account + 90 days |
| Workpapers, findings, controls, projects | Life of account + 90 days |
| Evidence integrity hashes (SHA-256) | Life of account |
| Support tickets | 3 years from creation |
| Uploaded document content | Not retained — session only |
| AI conversation logs | Subject to Anthropic's policy |
| Auth / access logs | 90 days |
Upon account closure, all personal data is deleted within 90 days except where required by law. Immediate deletion is available on request — privacy@getassurai.com.
Depending on your location, you have the following rights regarding your personal data. To exercise any right,
We respond within 30 days (avg. 5 business days). EU/EEA residents may lodge a complaint with their local data protection authority.
AssurAI uses browser localStorage (not traditional cookies) to store:
We do not use advertising cookies or tracking pixels. Google Ads conversion tracking may place a cookie if you arrive via a Google Ad — governed by Google's privacy policy. Manage cookie preferences via the .
AssurAI is a professional B2B platform intended for use by individuals who are at least 18 years of age. We do not knowingly collect personal information from children under 16. If you believe we have inadvertently collected information from a child, please contact privacy@getassurai.com immediately and we will promptly delete that information.
We may update this Privacy Policy from time to time. When we make significant changes, we will:
Continued use of AssurAI after changes are posted constitutes acceptance of the updated policy. If you object to any changes, you may close your account and request data deletion.
Policy version history is available on request. Email privacy@getassurai.com to request a prior version.
For privacy questions, data requests, or to request our Data Processing Agreement (DPA):
AssurAI Inc., San Jose, California, USA
© 2024–2025 AssurAI Inc. All rights reserved. AssurAI™ is a trademark of AssurAI Inc. USPTO WUID 901030615 · Terms · Security · Disclaimers