Bonterms-derivative. This Privacy Notice substantially follows the Bonterms Privacy Notice framework with adaptations for ElasticD3M, LLC's services, U.S. operations, GDPR for EU/UK/Swiss data subjects, CCPA/CPRA and other comprehensive U.S. state privacy laws, and the technical scope of the AI AutoGRC™ platform (configuration metadata, not regulated payloads).
1. Scope
This Privacy Notice describes how ElasticD3M, LLC ("we", "us") collects, uses, and discloses Personal Information when you visit ai4aigrc.ai, run an AI AutoGRC AI Governance Check, subscribe to AI AutoGRC Continuous, or otherwise interact with our Services. For data we process on Customer's behalf as a Processor under enterprise agreements, the Data Processing Addendum governs.
This Notice applies to all visitors and customers. EU, UK, and Swiss data subjects have additional rights under GDPR / UK GDPR / Swiss FADP described in Section 5. California and other U.S. state residents have additional rights under CCPA/CPRA, VCDPA, CPA, CTDPA, UCPA, and analogous comprehensive privacy laws described in Section 6.
2. Controller and Processor Roles
For Personal Information processed when you interact with our marketing site, purchase a subscription, or correspond with us, ElasticD3M, LLC is the Controller (or "Business" under CCPA/CPRA).
For Personal Data processed on Customer's behalf when the AI AutoGRC™ Services process the AI system registry entries and governance evidence Customer submits, and generate governance deliverables, ElasticD3M, LLC is the Processor (or "Service Provider"). Customer is the Controller. The DPA governs those processing activities.
3. Information We Collect
We collect the following categories of Personal Information:
- Identity and contact information: name, business email address, phone number, company name, business address, job title, provided at intake, checkout, or via direct correspondence.
- Account information: organization details, framework scope (which of the EU AI Act, NIST AI RMF, ISO/IEC 42001, and applicable United States federal and state AI regulations apply), audit calendar, contractual posture, provided at intake.
- Governance evidence submitted to the platform (AI system attributes, evaluation metrics and test results, governance artifacts and attestations): used to generate governance assessments and deliverables. We do not read, store, or transmit regulated payload contents (PHI, cardholder data, GDPR Article 9 special categories): only governance evidence and configuration metadata.
- Billing information: limited payment metadata (last 4 of card, billing zip, expiration) provided to us by Stripe. We do not store full payment card numbers; Stripe is our payment processor and is PCI-DSS Level 1 compliant.
- Technical information: IP address, browser type, device type, referrer, pages visited, timestamps, collected automatically via server logs and Cloudflare Web Analytics. Cloudflare Web Analytics does not use cookies and does not track users across sites.
- Communications: emails you send to hello@ai4aigrc.ai or other ai4aigrc.ai addresses, including the content and attachments.
We do not use behavioral tracking pixels in outbound emails, cross-site advertising cookies, or session-replay tools. We do not sell Personal Information.
4. How We Use Information
We use Personal Information to:
- Provide, maintain, and improve the Services, including generating AI Governance Check analyses and AI AutoGRC Continuous subscription deliverables.
- Process payments, manage subscriptions, and send transactional emails (welcome emails, deliverable notifications, billing receipts).
- Respond to support requests and other communications.
- Comply with legal obligations, enforce our Terms of Service, and protect against fraud or misuse.
- Send service updates and infrequent product communications. You may opt out of non-essential communications at any time by clicking the unsubscribe link in any such message or emailing privacy@elasticd3m.com.
5. GDPR Rights (EU, UK, Switzerland)
If you are located in the European Economic Area, the United Kingdom, or Switzerland, you have the following rights regarding your Personal Data:
- Access: you may request a copy of the Personal Data we hold about you.
- Rectification: you may request correction of inaccurate or incomplete Personal Data.
- Erasure ("right to be forgotten"), you may request deletion subject to legal-retention obligations.
- Restriction: you may request that we limit Processing in specified circumstances.
- Portability: you may request export of your Personal Data in a structured, commonly used, machine-readable format.
- Objection: you may object to Processing based on legitimate interests, including direct marketing.
- Withdrawal of consent: where Processing is based on consent, you may withdraw consent at any time without affecting prior lawful Processing.
- Right to lodge a complaint: with your local Supervisory Authority.
Our lawful bases for Processing include: (i) performance of a contract; (ii) compliance with legal obligations; (iii) legitimate interests in operating, securing, and improving our Services; and (iv) consent where required. For international transfers, see Section 9. To exercise any GDPR right, email privacy@elasticd3m.com; we respond within thirty (30) days.
6. CCPA/CPRA Rights (California) and Other U.S. State Rights
California residents have the right to: (i) know what Personal Information we collect, (ii) request deletion of Personal Information, (iii) request correction of inaccurate information, (iv) opt out of sale or sharing of Personal Information (we do not sell or share), and (v) limit use of "sensitive Personal Information" (we do not knowingly process sensitive PI as defined under CPRA). To exercise any right, email privacy@elasticd3m.com. We respond within forty-five (45) days. We will not retaliate against you for exercising these rights.
If you are a resident of another U.S. state with comprehensive privacy law (Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, and others as enacted), you have substantially similar rights and may submit a request through the same channel.
7. Disclosure to Third Parties
We disclose Personal Information to:
- Subprocessors: third-party service providers acting on our instructions. The full list with each provider's purpose, data scope, and location is published at /subprocessors and updated whenever a Subprocessor is added, removed or changes what it handles.
- Legal authorities when required by valid subpoena, court order, or other legal process. We notify Customer of the request unless legally prohibited.
- Successors in connection with a merger, acquisition, or sale of substantially all assets, subject to confidentiality protections consistent with this Notice.
We do not disclose Personal Information to advertising networks, data brokers, or other parties for marketing purposes. We do not engage in "cross-context behavioral advertising" as defined by CCPA/CPRA.
8. Data Retention
Active account data is retained for the duration of the customer relationship. Following termination, AI system registry entries and submitted governance evidence are deleted 30 days after the subscription ends, deliverable records are deleted 13 months after they are produced, and account records are anonymized 90 days after the subscription ends, unless: (a) retention is required by law (tax records: seven years); or (b) the data is still held in the hosting provider's database backups, which are overwritten as they rotate out. Governance evidence Customer submits is used only to provide the Services.
Two exemptions, stated rather than implied. The tamper-evident governance ledger is not deleted on the schedule above. It is the hash-chained record an auditor recomputes, and removing entries from it would destroy the evidence it exists to preserve; it holds governance decisions and the names Customer records as approvers or responders. Payment-event records are likewise retained, as the idempotency record that stops a payment being processed twice. Registry entries, submitted evidence, deliverable records and account records are deleted or anonymized on schedule by an automated weekly sweep. Anonymizing an account clears the email address, company name, Stripe customer identifier and the IP address recorded with terms acceptance, and deletes access credentials; the row keeps only its Stripe subscription reference, so a late billing event can still be matched and ledger entries are not orphaned. Email, server logs, backups and billing records are held by Google Workspace, Railway, Cloudflare and Stripe under those providers' own retention settings. A subscription that is unpaid but can still be reactivated is not treated as terminated.
| Category | Retention period |
|---|---|
| Active-account identity and contact | Duration of relationship |
| Account records after termination (identity, contact, access credentials) | 90 days, then anonymized |
| Tamper-evident governance ledger and payment-event records | Retained for the life of the account (see exemption below) |
| AI system registry entries and submitted governance evidence | Cycle duration + 30 days |
| Deliverables (coverage reports, evidence exports, etc.) | 13 months rolling |
| Billing and tax records | 7 years (legal obligation) |
| Email correspondence | Held in Google Workspace under its retention settings |
| Server logs and analytics | Held by Railway and Cloudflare under their retention settings |
| Backups | Held by Railway, overwritten as they rotate out |
9. International Data Transfers
Our Services are operated from the United States. All Subprocessors are located in the United States; the Subprocessors List identifies each provider's location. For EU/UK/Swiss data subjects, transfers to the United States are made pursuant to Standard Contractual Clauses (Module 2: Controller to Processor) and the UK International Data Transfer Addendum, available on request to privacy@elasticd3m.com. Where applicable, we conduct transfer-impact assessments consistent with EDPB guidance.
10. Security
We maintain industry-standard administrative, physical, and technical safeguards to protect Personal Information. Specifics include: encryption at rest provided by the hosting platform's managed storage, TLS 1.2+ in transit, tenant access tokens stored only as one-way hashes, role-based access control with least-privilege defaults, isolated production credentials encrypted with a dedicated key management service, signed audit logs for material database actions, and a documented incident-response plan. We notify Customer of any confirmed Personal Data Breach within seventy-two (72) hours.
11. Children's Data
The Services are intended for business use by adults representing organizations. We do not knowingly collect Personal Information from anyone under the age of eighteen (18). If we discover we have collected such information, we will delete it promptly.
12. Changes to This Notice
We may update this Privacy Notice from time to time. For material changes, we will give at least thirty (30) days' advance notice via email or platform notice before the change becomes effective. The "Effective Date" at the bottom of this page indicates when the most recent version took effect.
13. Contact
Privacy questions, data subject requests, or general inquiries: privacy@elasticd3m.com
Postal address:
ElasticD3M, LLC
Attn: Privacy
7700 Broadway St, Ste 104 PMB1083
San Antonio, TX 78209, United States
Effective Date: October 7, 2026 · Version: 2.1 (Bonterms-derivative)
Replaces all prior versions of the Privacy Policy published at ai4aigrc.ai before this date.