Scope
This policy describes how Attestloom Inc. (“Attestloom”, “we”), a Delaware C-Corp headquartered at 1910 Pacific Avenue, Suite 1450, Dallas, TX 75201, handles personal data on attestloom.com, in the Attestloom application, and in the public demo. When a business customer uploads documents to Attestloom, that customer controls that content and we process it on its instructions under our Data Processing Agreement.
What we collect
- Account data: name, work email, a password hash (bcrypt) or a Google account identifier, workspace name, and role.
- Billing data: plan, billing period, and a Stripe customer identifier. Card details are collected and held by Stripe; we never see full card numbers.
- Form submissions: what you send through contact, support, help, careers, and waitlist forms.
- Technical data: IP address and request metadata used for rate limiting and security, kept in short-lived server logs.
We do not use advertising pixels, cross-site trackers, or analytics cookies. See the Cookie Policy.
Customer content
Customer content means the sources, questionnaires, answers, comments, and audit records you put in a workspace. We store it to provide the service, isolate it by workspace on every query, and seal original files with AES-256-GCM using a key derived for your workspace. We do not sell it, mine it for marketing, or use it to train any model.
How we use data
- To run your workspace: retrieval, drafting, review, export, and the audit log.
- To send transactional email: verification, password reset, and assignment notices.
- To bill paid plans and prevent abuse of the free tier and the public demo.
- To answer you when you write to us.
AI and model providers
When Attestloom drafts an answer, it sends the question and the retrieved source passages needed for that one request to the configured model provider through its API. API data is not used by providers to train models under their business terms, and OpenAI requests are sent with storage disabled. Attestloom does not train or fine-tune models on customer content. Questions pasted into the public demo are processed in memory and never stored.
Sharing and subprocessors
We share data only with the subprocessors listed on the Trust page, each bound by a written agreement, and when the law requires it. We give customers 30 days notice before adding a subprocessor that will process customer content.
Retention and deletion
- Customer content is kept until you delete it or your workspace. Deleting a source removes its passages and embeddings immediately.
- Deleting a workspace removes all of its data from the application immediately. Encrypted database backups held by our host expire within 30 days.
- Form submissions are kept for up to 24 months, then deleted.
- Account data is deleted when you delete your account, except billing records we must keep for tax law.
Your rights
Wherever you are, you can ask us to access, correct, export, or delete your personal data, or object to a use of it. Workspace owners can export and delete everything from Settings without contacting us; see Your data. California residents have the rights described in the CCPA as amended by the CPRA; we do not sell or share personal information for cross-context behavioral advertising. People in the EU, UK, and Switzerland may also complain to their supervisory authority.
Security
Data is encrypted in transit with TLS and at rest on encrypted storage, with original files additionally sealed per workspace. Access is limited by role. Details and our disclosure policy are on the Trust page.
Contact
Write to privacy@attestloom.com or to Attestloom Inc., Attn: Privacy, 1910 Pacific Avenue, Suite 1450, Dallas, TX 75201. Phone (214) 555-0147. We answer privacy requests within 30 days, usually much sooner.