Privacy policy

1. Who we are and scope of this policy

AcuityRFP is operated by AcuityRFP, Inc., with its registered office at 69 Columbia Road, Wrangle Hill, DE 19720 (“AcuityRFP”, “we”, “us”, “our”).

This Privacy Policy explains how we collect, use, disclose, and safeguard personal data when you:

• access or use the AcuityRFP web application, browser extension, or chat bots as a User of an organization;
• visit a customer organization’s Trust Center or open a shared export link; or
• browse our marketing website (acuityrfp.com) or communicate with us for sales or support.

Controller vs. Processor Roles:

• When we act as a Processor (Service Provider): For personal data contained within Customer Content that an organization uploads or creates in the Service (such as documents, questionnaires, answers, and comments) and for personal data submitted by visitors to an organization’s Trust Center, the customer organization is the data controller (or business) and AcuityRFP processes that data solely on the organization’s instructions under our Data Processing Agreement (“DPA”). If your personal data is held within an organization’s workspace or Trust Center, that organization’s own privacy notice governs how it uses your data, and you should direct privacy inquiries to that organization first.
• When we act as a Controller: For User account registration profiles, billing contact metadata, security and usage telemetry, support communications, and visitors to our own website (acuityrfp.com), AcuityRFP acts as an independent data controller.

2. Personal data we collect

Account and profile data

When you create or are invited to an account, we collect your name, business email address, password hash (managed securely by our authentication provider) or SAML Single Sign-On identifier, whether your email is verified, two-factor sign-in details (the authenticator secret is held by our authentication provider, and recovery codes are stored only as keyed hashes), organization memberships, assigned role (owner, admin, editor, or viewer), and email notification preferences.

Sign-in and account security

We record your sign-in history and your signed-in devices (device, IP address, and sign-in and last-active times), which you can see on your account page. A random identifier in a cookie, stored by us only as a keyed hash, lets us recognize a browser you have used before and email you about a sign-in from a new one. At sign-up, a bot-check provider receives your IP address and browser signals, and we check that your email domain can receive mail. When you set a password, only the first five characters of a hash of it are sent to a breached-password service; your password itself is never sent.

Customer Content

Your organization and its Users upload, import, and generate documents, web pages, questionnaires, questions, answers, comments, @mentions, task assignments, library entries, and exports. These materials may incidentally contain personal data (for example, names or business contact details of employees mentioned in a company security policy or historical RFP).

Activity, usage, and security logs

We record an organization audit log of actions taken within the workspace (such as answer approvals, exports, file downloads, deletions, and role changes), plan usage counters, and standard technical server logs (including IP address, browser user-agent, request path, and timestamps) to enforce rate limits, maintain tenant security, and troubleshoot errors.

Error reports

When something goes wrong in the web application or a background job, we send an error report to our error monitoring provider so we can diagnose and fix it. A report contains the error type and message, a stack trace, the page address, your browser and device type, and, for background jobs, an organization identifier. Before sending, we remove your account details, request contents, cookies, email addresses, tokens and quoted text. An error message may still contain a short fragment of other text. Error reporting sets no cookies and doesn’t track your usage.

Third-party integrations

If your organization connects Slack, Microsoft Teams, Google Drive, Microsoft SharePoint, or OneDrive, we receive the external account identifiers needed to link the integration (such as your Slack or Microsoft user ID and email address), metadata and content of the specific files selected for synchronization, and queries submitted to our Slack or Teams bots. OAuth access tokens are stored encrypted at rest.

Browser extension

When you use the AcuityRFP browser extension, it stores your authenticated session token inside the browser’s isolated extension storage (which external websites cannot read). Each time you click to insert or copy an answer from your library, the extension logs the library entry ID, the action taken, your User account, the timestamp, and the hostname (domain only, not the full URL or page contents) into your organization’s audit log. The extension never reads keystrokes, form inputs, or password fields.

Trust center visitors

When you visit a customer’s hosted Trust Center to request or download documents, we collect—on behalf of the customer organization operating that Trust Center—your email address, email verification status, and (if you accept an NDA or submit an access request) your full name, company name, stated reason for access, the timestamp and version of the NDA accepted, and a log of the documents you download.

Billing and payment data

Self-serve paid subscriptions are processed by Stripe. Stripe collects your billing contact name, billing address, tax identification number, and payment card or bank details directly. We never receive or store your full payment card number; we receive only Stripe reference identifiers (customer ID, subscription ID, price ID), subscription status, and billing period dates.

Website visitors and direct communications

When you visit acuityrfp.com, our hosting provider records standard HTTP server logs (IP address, browser type, referring URL, and timestamp) strictly for security, DDoS mitigation, and reliability. If you email us or submit a support request, we collect your contact details and the contents of your message. Our marketing website sets no cookies and uses no third-party analytics or advertising trackers.

3. How we use personal data and our legal bases (EEA/UK/Switzerland)

Where the EU GDPR, UK GDPR, or Swiss FADP applies, we rely on the following legal bases to process personal data:

We never use personal data for targeted advertising, behavioral profiling, or automated decision-making that produces legal or similarly significant effects on individuals.

4. Artificial intelligence processing

To search your organization’s knowledge base and draft, rewrite, or translate questionnaire answers, the relevant questions and retrieved document excerpts are transmitted to our AI Subprocessors. We never use Customer Content or personal data to train, fine-tune, or improve any AI models, and all AI Subprocessors are bound by contractual and technical prohibitions against training on Customer data. We do not log document contents or raw AI prompts in production application logs. Error reports, described above, are scrubbed before they are sent.

5. How we disclose personal data

We disclose personal data only to the following categories of recipients:

• Authorized Service Providers and Subprocessors: vetted infrastructure, background compute, AI processing, error monitoring, transactional email, bot protection, and payment providers that process data solely on our behalf under binding confidentiality and data protection contracts. Customer organizations may request our current Subprocessor list at privacy@example.com.
• Your Organization and Administrators: if you use the Service as a member of an organization, your organization’s owners and admins can view your profile, role, and activity in the workspace audit log. Similarly, if you visit an organization’s Trust Center, that organization’s administrators can view your access request, NDA acceptance, and download history.
• Customer-Connected Integrations: third-party platforms (such as Slack, Microsoft Teams, Google Drive, SharePoint, OneDrive, or a SAML Identity Provider) that your organization affirmatively connects, governed by your organization’s agreements with those providers.
• Recipients of Share Links: anyone with whom your organization shares a read-only export link can view the contents of that snapshot until the link expires or is revoked.
• Legal Compliance and Safety: courts, law enforcement, regulators, or legal advisors when we believe in good faith that disclosure is required by applicable law, subpoena, or legal process, or is necessary to protect the security, rights, or safety of AcuityRFP, our customers, or the public.
• Corporate Transactions: a successor entity or acquirer (and its professional advisors) in connection with a merger, acquisition, financing, corporate reorganization, or sale of assets, subject to standard confidentiality protections and notice to affected organizations.

No Sale or Sharing of Personal Information (California Notice): AcuityRFP does not “sell” personal information or “share” personal information for cross-context behavioral advertising (as those terms are defined under the California Consumer Privacy Act / CPRA), and we have not done so in the preceding 12 months. We also do not infer characteristics from sensitive personal information.

6. Google API and Microsoft API user data compliance

Google API Limited Use Disclosure: AcuityRFP’s use and transfer to any other app of information received from Google APIs adheres strictly to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

• We access only the specific Google Drive files that an authorized User explicitly selects via the file picker.
• We use Google user data solely to import and synchronize those selected files into your organization’s AcuityRFP knowledge base.
• We do not use Google user data for serving advertisements or for any marketing purposes.
• We do not transfer or disclose Google user data to third parties except as strictly necessary to provide the user-facing features of the Service (via our bound Subprocessors), with your explicit consent, or as required by applicable law.
• We do not allow humans to read Google user data unless we have obtained your affirmative agreement for specific support troubleshooting, doing so is necessary for security purposes (such as investigating abuse), or it is required to comply with applicable law.
• We never use Google user data to train, fine-tune, or improve any generalized or foundation AI/ML models.

We apply these exact same data protection and limited-use standards to files accessed via Microsoft Graph APIs (Microsoft SharePoint and OneDrive).

7. International data transfers

Customer Content is stored in the primary cloud region designated for your organization’s workspace. Some of our Subprocessors or support operations may process data in other countries, including the United States. Whenever we transfer personal data originating from the EEA, the UK, or Switzerland to a country not subject to an adequacy decision, we safeguard the transfer using the European Commission’s Standard Contractual Clauses (SCCs), the UK International Data Transfer Addendum, and the Swiss FADP amendments, or rely on the recipient’s certification under the EU-U.S. Data Privacy Framework (and its UK and Swiss extensions), as detailed in our DPA.

8. Data retention

We retain personal data only for as long as necessary to fulfill the purposes described in this Privacy Policy:

When an organization owner deletes an organization in Settings, the workspace is locked immediately, all Users are notified by email, and after a 7-day grace period, all Customer Content and stored files are permanently deleted from active production systems. We retain only a minimal record of the deletion event (the organization’s name and address, who requested the deletion, and when) containing no Customer Content. Any error reports expire on their own schedule, within 90 days.

9. Security

We protect personal data using database-enforced Row-Level Security (RLS) tenant isolation, TLS encryption in transit, AES-256 encryption at rest, role-based access controls, and comprehensive audit logging, as detailed in our Security Addendum. While we implement rigorous safeguards, no internet transmission or storage system can be guaranteed to be 100% impenetrable; in the event of a confirmed breach affecting your personal data, we will notify affected parties and regulators as required by applicable law and our DPA.

10. Your privacy rights

Depending on your jurisdiction (including the EEA, UK, Switzerland, California, and other U.S. states with comprehensive privacy laws), you may have the right to:

• Access and Portability: request confirmation of whether we process your personal data and obtain a copy of your data in a structured, portable format;
• Rectification: request correction of inaccurate or incomplete personal data;
• Erasure (Deletion): request deletion of your personal data, subject to legal retention exceptions;
• Restriction and Objection: object to or request restriction of processing conducted under legitimate interests;
• Withdraw Consent: withdraw your consent at any time where processing is based on consent (without affecting the lawfulness of prior processing); and
• Non-Discrimination: not receive discriminatory treatment for exercising your privacy rights.

How to Exercise Your Rights:

• For Account, Billing, or Website Data (where AcuityRFP is Controller): Email us at privacy@example.com. We will verify your identity (for example, by confirming control of the registered email address) and respond within the timeframe required by applicable law (generally 30 days under GDPR, or 45 days under CCPA). If you wish to appeal our decision regarding a privacy request, you may reply directly to our response and our privacy lead will review it.
• For Workspace or Trust Center Data (where Your Organization is Controller): Because we process Customer Content and Trust Center logs strictly on behalf of the relevant customer organization, please direct your request to that organization’s administrator. If you send such a request to us, we will promptly forward it to the responsible organization and assist them in responding.
• Supervisory Authority Complaints: If you are located in the EEA, UK, or Switzerland, you also have the right to lodge a complaint with your local data protection supervisory authority.

11. Children’s privacy

The Service is a business-to-business platform and is not directed to children. We do not knowingly collect personal data from anyone under the age of 16. If we learn that we have inadvertently collected personal data from a child under 16, we will promptly delete it.

12. Cookies

We use only strictly necessary cookies required for authentication and security inside the application and Trust Center, and set no cookies on our marketing website. Please see our Cookie Policy for full details.

13. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect operational, legal, or regulatory changes. When we make updates, we will revise the “Last updated” date at the top of this page. For material changes, we will notify organization owners by email or in-app notice prior to the change taking effect.

14. Contact us

For any privacy questions, data subject requests, or DPA inquiries, please contact us at:

• Email: privacy@example.com
• Postal Address: AcuityRFP, Inc., Attn: Privacy Officer, 69 Columbia Road, Wrangle Hill, DE 19720