Privacy Policy

StickRate, Inc. ("StickRate," "we," "us," or "our") operates the StickRate commitment intelligence platform ("Service"). This Privacy Policy explains how we collect, use, disclose, and protect information about you when you use the Service or visit stickrate.io.

For enterprise customers, personal data processing under the Service is governed by the Data Processing Agreement at stickrate.io/legal/dpa. This Privacy Policy applies to all other personal data we process, including that of website visitors, prospective customers, and contact persons.

Account and contact data: Name, email address, job title, company name, and account credentials provided when you sign up or contact us.

Service usage data: Log files, feature usage, deal and signal data you upload or generate through the Service, API request metadata, and error reports.

Communications: Contents of emails, support requests, and feedback you send to us.

Automatically collected data: IP address, browser type and version, device identifiers, referring URLs, and pages visited, collected via standard server logs and cookies.

Customer-provided data: Any personal data contained in Customer Data (as defined in the Terms of Service), including data about your customers' contacts and deal stakeholders, is processed pursuant to our DPA, not this Privacy Policy.

We use the information we collect to:

• Provide, operate, and improve the Service.
• Authenticate users and enforce security controls.
• Send transactional and product communications, including onboarding emails and service notifications.
• Respond to support requests and inquiries.
• Comply with legal obligations and enforce our agreements.
• Generate anonymized, aggregated analytics to improve our products.

We do not sell or share personal data to third parties as those terms are defined under applicable privacy law, and we do not use Customer Data for advertising purposes.

The Service uses artificial intelligence and machine learning to analyze data and produce commitment scores, risk signals, and deal narratives. The following applies to AI-powered features:

Third-party AI providers. We use third-party AI providers for certain inference tasks. We do not use your data to train AI models, and our AI providers are contractually prohibited from using your data to train or improve their models. A current list of sub-processors is available upon request at legal@stickrate.io.

No cross-customer training. We do not use your data, or your organization's Customer Data, to train models that are made available to other StickRate customers.

Anonymized data. We may use anonymized and aggregated data to improve our scoring algorithms and benchmarks.

Human review. AI-extracted signals are automatically scored for confidence. Signals extracted from emails and documents that fall below our confidence threshold, and score-affecting signals from unverified sources, are routed to a human review queue before they are used in customer-facing outputs. Signals synced from customer-connected revenue tools are applied under trusted-source rules. All AI-extracted data remains subject to manual correction, audit, and override at any time.

If you are located in the European Economic Area or United Kingdom, we process your personal data on the following legal bases:

• Contract: Processing necessary to perform the contract with you or your employer.
• Legitimate interests: Processing for our legitimate interests in operating and improving the Service, detecting fraud, and communicating with prospects, where these interests are not overridden by your rights.
• Legal obligation: Processing required by applicable law.
• Consent: Where required by law and not covered by the above, we will ask for your consent.

We share personal data only in the following circumstances:

• Sub-processors: We share data with vendors and sub-processors listed at stickrate.io/legal/sub-processors, solely to provide the Service.
• Legal requirements: We may disclose data when required by law, court order, or governmental authority.
• Business transfers: In the event of a merger, acquisition, or sale of assets, personal data may be transferred to the acquiring entity.
• With your consent: We may share data with third parties when you have given explicit consent.

We retain personal data for as long as necessary to provide the Service and fulfill the purposes described in this Policy, or as required by law. Account data is retained for the duration of the subscription and deleted or anonymized within a commercially reasonable period following termination.

StickRate is based in the United States. If you are located outside the United States, your personal data will be transferred to and processed in the United States. For transfers from the EEA, we rely on the EU Standard Contractual Clauses (SCCs). For transfers from the UK, we rely on the UK International Data Transfer Addendum. Details of transfer mechanisms are set forth in our DPA. A copy is available upon request at privacy@stickrate.io.

Depending on your location, you may have the following rights regarding your personal data:

• Access and portability — obtain a copy of your data.
• Correction — request correction of inaccurate data.
• Deletion — request deletion, subject to legal obligations.
• Restriction — limit how we use your data.
• Objection — object to processing based on legitimate interests.
• CCPA/CPRA rights for California residents, including the right to know, delete, and opt out of sale (we do not sell personal data).

To exercise these rights, contact us at privacy@stickrate.io. We will respond within 30 days (or as required by applicable law). We will not discriminate against you for exercising any of these rights. EEA and UK residents may also lodge a complaint with their local data protection authority.

We use strictly necessary cookies for authentication and session management. We do not use third-party advertising or tracking cookies. You may disable cookies in your browser settings; however, this may impair Service functionality. We do not respond to Do Not Track signals because no uniform standard for compliance has been adopted.

We implement technical and organizational measures to protect personal data, as described in our Information Security Overview at stickrate.io/legal/security. No method of transmission over the internet is 100% secure; we cannot guarantee absolute security.

We may update this Privacy Policy periodically. We will notify you of material changes by email or via an in-product notice at least 30 days before the changes take effect. Your continued use of the Service after the effective date constitutes acceptance of the updated Policy.

The Service is intended for business use. We do not knowingly collect personal information from individuals under 18. If we learn we have collected such information, we will delete it promptly.

For privacy inquiries, data subject requests, or sub-processor change notifications, contact us at privacy@stickrate.io.

Questions? Contact legal@stickrate.io