StickRate Privacy Policy

StickRate, Inc. (“StickRate,” “we,” “us,” or “our”) operates the StickRate commitment intelligence platform (“Service”). This Privacy Policy explains how we collect, use, disclose, and protect information about you when you use the Service or visit stickrate.io. Capitalized terms not defined here, including Customer Data, Usage Data, and Connected Applications, have the meanings given in our Terms of Service.

For enterprise customers, personal data processing under the Service is governed by the Data Processing Agreement at stickrate.io/legal/dpa. This Privacy Policy applies to all other personal data we process, including that of website visitors, prospective customers, and contact persons. Section 5 (Google User Data) and Section 6 (Customer Data and Usage Data) apply whether or not a Data Processing Agreement applies.

Account and contact data: Name, email address, job title, company name, and account credentials provided when you sign up or contact us.

Service usage data: Log files, feature usage, deal and signal data you upload or generate through the Service, API request metadata, and error reports.

Communications: Contents of emails, support requests, and feedback you send to us.

Automatically collected data: IP address, browser type and version, device identifiers, referring URLs, and pages visited, collected via standard server logs and cookies.

Customer-provided data: Any personal data contained in Customer Data, including data about your customers’ contacts and deal stakeholders, is processed pursuant to our DPA. Sections 5 and 6 of this Privacy Policy also apply.

We use the information we collect to:

• Provide, operate, and improve the Service.
• Authenticate users and enforce security controls.
• Send transactional and product communications, including onboarding emails and service notifications.
• Respond to support requests and inquiries.
• Comply with legal obligations and enforce our agreements.
• Create Usage Data, as described in Section 6.

We do not sell or share personal data to third parties as those terms are defined under applicable privacy law, and we do not use Customer Data for advertising purposes.

The Service uses artificial intelligence and machine learning to analyze data and produce commitment scores, risk signals, and deal narratives. The following applies to AI-powered features:

Third-party AI providers. We use third-party AI providers for certain inference tasks. We do not use Customer Data to train AI models, and our AI providers are contractually prohibited from using Customer Data to train or improve their models. Our current sub-processors are listed at stickrate.io/legal/sub-processors. If your organization connects its own AI provider account to the Service, your organization’s agreement with that provider governs how the provider handles the data.

No cross-customer use. We do not use one customer’s Customer Data for any other customer, or to train models that are made available to other StickRate customers.

Usage Data. We may use Usage Data to improve the Service, subject to the limits in Section 6.

Customer review. AI-extracted signals are automatically scored for confidence. Signals extracted from emails and documents that fall below our confidence threshold, and score-affecting signals from unverified sources, are routed to a review queue in the customer’s account. There, the customer’s own authorized users confirm or reject them before they are used in customer-facing outputs. StickRate personnel do not review or decide items in this queue. Any access by personnel follows Section 6 and, for Google user data, Section 5. Signals synced from customer-connected revenue tools are applied under trusted-source rules. All AI-extracted data remains subject to correction, audit, and override by the customer’s authorized users at any time.

This section explains how StickRate handles information it receives through Google APIs when a user, or an organization’s administrator, connects Gmail or Google Calendar to the Service. It applies to all Google user data StickRate receives, in addition to Section 6 and any Data Processing Agreement. Where this section is more restrictive, it controls.

What we access. With a user’s permission, or with authorization from their organization’s administrator for mailboxes the administrator selects, StickRate reads Gmail messages (sender, recipients, date, subject, and message text) and Google Calendar events (title, organizer, time, attendees and their organizations, and description). For attachments to messages and events, StickRate records only metadata: file name, file type, and, where available, size and whether the attachment came from the buyer or the seller. StickRate does not download or read attachment contents. Our access is read-only: StickRate never sends, changes, or deletes email or calendar events.

How we use it. We use Google user data only to provide and improve the Service’s user-facing features for that user and their organization. We use it to identify messages and meetings related to sales opportunities the organization tracks in StickRate. We also use it to extract evidence of the buyer’s progress, such as legal, security, procurement, approval, and contracting activity. That evidence is shown with supporting excerpts to authorized users of the organization’s account.

We match messages and calendar events to tracked opportunities using rules based on senders, recipients, attendees and their domains, and the account’s name in a meeting title. Content that matches no tracked opportunity is never sent to any AI provider. For matched content, the AI provider first reviews limited information. For email, that is the sender, subject, and opening text. For calendar events, it is the title, attendees from the buyer’s organization, and the opening of the description. The AI provider then analyzes the matched messages and events to extract evidence. Aggregated statistics compiled from the operation of the Service form part of Usage Data and are handled as described in Section 6. We do not use Google user data for any other purpose.

AI processing. Matched message and event content is processed by our third-party AI provider to extract this evidence. If the organization connects its own AI provider account as a Connected Application, that provider processes it instead. Our cloud AI provider receives only structured deal attributes and short machine-generated signal labels derived from that content, never the content itself. It uses them to create embeddings that compare opportunities within the organization’s account. StickRate’s AI providers are bound by terms that prohibit them from using the data to train or improve their models. If an organization connects its own AI provider account, the organization’s agreement with that provider governs. We do not use Google user data, or data obtained through Google Workspace APIs, to create, train, or improve any machine learning or artificial intelligence model.

What we store. We do not store email message bodies or attachment files. We store short excerpts that support each piece of evidence. These may include the names and job titles of people appearing in the source. We store them together with the subject, sender, recipients, date, and attachment names and types associated with that evidence. From calendar events we store the title, organizer, date and time, attachment names and types, and short supporting excerpts. We do not store full event descriptions or attendee lists. We store embeddings built from structured deal attributes, not from message or event text, in our database. Routing details used only to match messages to opportunities are generally deleted within 90 days. Backup copies are deleted under our standard backup retention schedule. Access credentials are encrypted and stored in a dedicated secrets service. Our error-monitoring service receives identifiers and technical details only, never message, event, or attachment content.

Who can see it. Google user data, including evidence and excerpts derived from it, is shown only to authorized users of the connecting organization’s StickRate account, according to the roles the organization assigns. Because the purpose of connecting a work mailbox or calendar is to give the organization visibility into deal progress, evidence from one user’s connected account may be visible to other authorized users in the same organization. StickRate personnel do not read Google user data unless (a) the user has first agreed to let us view specific messages, events, or other data; (b) it is necessary for security purposes, such as investigating a bug or abuse; (c) it is necessary to comply with applicable law; or (d) the data, including derivations, is aggregated and anonymized and used for internal operations in accordance with applicable privacy and other legal requirements.

Sharing. We do not sell Google user data, use it for advertising, or use it to determine creditworthiness or for lending. We share it only (a) with the sub-processors listed at stickrate.io/legal/sub-processors, as needed to provide features the user has chosen to enable; (b) with an AI provider account the organization connects as a Connected Application, limited to matched content and only to provide the features described in this section; (c) for security purposes, such as investigating abuse; (d) to comply with applicable law; or (e) as part of a merger, acquisition, or sale of assets, after obtaining the user’s explicit prior consent.

Disconnecting and deletion. A user can disconnect Gmail or Google Calendar at any time from the Integrations page in StickRate, or revoke access in their Google Account settings. When a user disconnects, StickRate stops reading the account, revokes its access with Google, and deletes the stored access credentials. If an administrator authorized access for the organization, the administrator removes that authorization in the organization’s Google admin console. StickRate then can no longer read those mailboxes. Disconnecting does not delete evidence already extracted. Evidence remains part of the organization’s StickRate account until the organization deletes it or the account is closed. When evidence expires under the organization’s retention settings, its excerpt is permanently destroyed. Related details, such as subject, sender, file names, and embeddings, are kept until the opportunity or the account is deleted. To request deletion, contact privacy@stickrate.io.

Limited Use. StickRate’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Customer Data. Each customer owns its Customer Data. We process Customer Data to provide the Service to that customer, including generating evidence, scores, and other content for that customer. We do not use one customer’s Customer Data for any other customer, and we do not use Customer Data to train AI models.

Usage Data. In operating the Service, we create Usage Data, which we own. Usage Data includes feature events, configurations, performance metrics, and statistics compiled from the operation of the Service, such as counts of signal types by source type and deal stage. Statistics compiled from Customer Data, from any source, are de-identified or aggregated. Statistics that include Google user data are aggregated and anonymized. These statistics contain no content from Customer Data, and they do not identify any customer, user, or deal. We use them only to operate, improve, and develop the Service’s features. We never use them to create, train, or improve any machine learning or artificial intelligence model. We disclose Usage Data outside StickRate only in de-identified or aggregated form that does not identify any customer or its authorized users.

Personnel access. Access to Customer Data is limited to StickRate personnel who need it to respond to support you request, for security purposes, or to comply with legal requirements. Access to Google user data is further limited as described in Section 5.

If you are located in the European Economic Area or United Kingdom, we process your personal data on the following legal bases:

• Contract: Processing necessary to perform the contract with you or your employer.
• Legitimate interests: Processing for our legitimate interests in operating and improving the Service, detecting fraud, and communicating with prospects, where these interests are not overridden by your rights.
• Legal obligation: Processing required by applicable law.
• Consent: Where required by law and not covered by the above, we will ask for your consent.

We share personal data only in the following circumstances:

• Sub-processors: We share data with vendors and sub-processors listed at stickrate.io/legal/sub-processors, solely to provide the Service.
• Connected Applications: We share data with Connected Applications your organization connects to the Service, including an AI provider account, at your organization’s direction.
• Legal requirements: We may disclose data when required by law, court order, or governmental authority.
• Business transfers: In the event of a merger, acquisition, or sale of assets, personal data may be transferred to the acquiring entity. Google user data is shared, including in connection with a business transfer, only as described in Section 5.
• With your consent: We may share data with third parties when you have given explicit consent.

We retain personal data for as long as necessary to provide the Service and fulfill the purposes described in this Policy, or as required by law. Account data is retained for the duration of the subscription and deleted or anonymized within a commercially reasonable period following termination. When you disconnect a Connected Application other than Google, we delete its stored credentials. For some providers, deleted credentials remain recoverable, and are not used, for up to 30 days. Retention of Google user data is described in Section 5.

StickRate is based in the United States. If you are located outside the United States, your personal data will be transferred to and processed in the United States. For transfers from the EEA, we rely on the EU Standard Contractual Clauses (SCCs). For transfers from the UK, we rely on the UK International Data Transfer Addendum. Details of transfer mechanisms are set forth in our DPA. A copy is available upon request at privacy@stickrate.io.

Depending on your location, you may have the following rights regarding your personal data:

• Access and portability: obtain a copy of your data.
• Correction: request correction of inaccurate data.
• Deletion: request deletion, subject to legal obligations.
• Restriction: limit how we use your data.
• Objection: object to processing based on legitimate interests.
• CCPA/CPRA rights for California residents: including the right to know, delete, and opt out of sale (we do not sell personal data).

To exercise these rights, contact us at privacy@stickrate.io. We will respond within 30 days (or as required by applicable law). We will not discriminate against you for exercising any of these rights. EEA and UK residents may also lodge a complaint with their local data protection authority.

We use strictly necessary cookies for authentication and session management. We do not use third-party advertising or tracking cookies. You may disable cookies in your browser settings; however, this may impair Service functionality. We do not respond to Do Not Track signals because no uniform standard for compliance has been adopted.

We implement technical and organizational measures to protect personal data, as described in our Information Security Overview at stickrate.io/legal/security. No method of transmission over the internet is 100% secure; we cannot guarantee absolute security.

We may update this Privacy Policy periodically. If we change how we use Google user data, we will notify affected users and obtain their consent before using that data in a new way or for a different purpose. We will notify you of material changes by email or via an in-product notice at least 30 days before the changes take effect. Your continued use of the Service after the effective date constitutes acceptance of the updated Policy.

The Service is intended for business use. We do not knowingly collect personal information from individuals under 18. If we learn we have collected such information, we will delete it promptly.

For privacy inquiries, data subject requests, or sub-processor change notifications, contact us at privacy@stickrate.io.

Questions? Contact legal@stickrate.io.