At SmartPolicy (a product of Ecognix), privacy is fundamentally built into our compliance intelligence architecture. This Privacy Policy details how we collect, process, secure, and protect organizational datasets and personal information when you use our platform.
1. Overview & Data Philosophy
SmartPolicy is designed to scan organizational datasets against corporate compliance rules. We operate under strict data minimization principles: we only process data necessary to provide compliance analysis and evidence explanations to your designated workspace members.
2. Information We Collect
We collect the following categories of information:
- Account & Auth Information: Email address, name, profile picture (via Google Sign-In), and unique user identifier (UID) provided during authentication.
- Workspace Metadata: Organization name, team member emails, and subscription tier status.
- Uploaded Compliance Assets: CSV files, policy text rules, custom compliance standards, and database connection strings.
- Scan Analytics & History: Timestamps of scan runs, violation flags detected, AI explanation summaries, and scan execution logs.
3. AI Model Training & Data Isolation
When SmartPolicy processes a CSV scan or policy check, dataset chunks are evaluated in isolated memory blocks solely to produce violation evidence for your session.
4. How We Use Your Data
We process your information strictly for the following purposes:
- To perform AI-powered compliance violation scans and display evidence explanations in your dashboard.
- To manage workspace authentication, seat permissions, and access controls.
- To process subscription payments and invoices via our Merchant of Record (Paddle).
- To send critical system alerts, billing updates, and security notifications.
5. Third-Party Sub-processors
We partner with leading, enterprise-grade cloud providers to operate SmartPolicy:
| Sub-processor | Role / Function | Data Handled |
|---|---|---|
| Google Firebase | User Authentication & Database | User UID, Email, Auth tokens |
| Paddle | Payment Processing & Invoicing | Billing details, Subscription tier |
| Cloudinary | Secure CSV Asset Storage | Encrypted CSV files |
| OpenAI / Anthropic APIs | LLM Inference Engine | Ephemeral policy analysis prompts |
6. Security & Storage Standards
We implement technical and organizational security measures to protect your compliance data:
- Encryption in Transit: All web traffic and API calls use TLS 1.3 encryption.
- Encryption at Rest: CSV datasets and database storage utilize AES-256 standard encryption.
- Access Control: Strict role-based access control (RBAC) ensures workspace isolation.
7. Your Rights & Data Deletion
Depending on your location (including GDPR & CCPA rights), you have the right to access, export, rectify, or permanently delete your organizational data:
- Data Export: You can export your scan history, policy rules, and violation reports at any time in CSV/PDF format.
- Right to Erasure: You can request permanent deletion of your workspace, account, and stored datasets by contacting support@ecognix.com.
9. Contact Data Protection Officer
For privacy inquiries, data subject requests, or security reports, please contact the Ecognix Privacy Team: