Privacy Notice

Version 2026-09-30

Effective date: 2026-09-30

1. Who we are

applicable.ai is operated by Applicable.ai LLC, a Delaware limited liability company ("we", "us", "our").

Privacy contact: [email protected]

This notice covers personal information we handle through:

• our website at https://getapplicable.ai;
• our app at https://app.getapplicable.ai;
• the emails the app sends.

It explains what we collect, why we collect it, who else handles it, how long we keep it, and what you can ask us to do.

2. The short version

• Launch list: if you ask to be told when access opens, we keep your email address (plus your name and company, if you give them) and use it only for that purpose (section 3.1).
• Demo accounts (sign-up on https://getapplicable.ai) can only read our regulatory library. Nothing a demo account does is sent to an AI model provider (section 3.2).
• Customer organisations: to work out which rules may apply to an organisation, and to run the app's other AI features, including the in-app assistant, we send parts of that organisation's information to OpenAI, an AI model provider. This happens whenever someone in a workspace uses those features. Organisations cannot currently switch it off (sections 3.5 and 3.8).
• In-app assistant: when you ask the assistant a question, we send your question, recent turns of your conversation and relevant records from your organisation's workspace to OpenAI to write the answer. We keep your conversations until your organisation's profile or workspace is deleted (section 3.8).
• We have signed a data processing agreement with OpenAI (sections 3.5, 3.8 and 6).
• Google Drive: if your organisation connects Google Drive, we read the policy documents you choose and keep copies of their text. We do not change your documents (section 3.6).
• We do not sell personal information, and we do not use advertising or analytics trackers (sections 6 and 11).

3. What we collect and why

3.1 Launch list ("Get Notified")

If you use a "Get Notified" form on our website, we store:

• your email address, which we store in lower case with spaces removed. We keep one record per address;
• your first name and company, if you give them;
• which page of our website you used;
• the date and time, your IP address and your browser's user agent.

Why: to tell you when access to applicable.ai opens. We do not use the launch list for anything else. We do not send a confirmation email when you join.

Our platform administrators can see the launch list and export it. To be removed, email us (section 10). When we delete an entry, we keep a record that a deletion happened, including who carried it out and when. That record does not include your email address.

3.2 Demo access (a view-only account created on https://getapplicable.ai)

To limit repeated attempts, the running server also counts requests by IP address and by email address in its memory. These counts are not written to our database.

What a demo account can do. Read the regulatory library, and nothing else. A demo account cannot enter information about an organisation, and nothing it does is sent to an AI model provider.

We do not send marketing email to demo users.

3.3 App users (people at our customer organisations)

App accounts are created by an administrator. Nobody signs up for one. For each app user we store:

• email address, name (if given) and account dates;
• a password, stored only as a one-way (bcrypt) hash, and whether a temporary password must be changed at the next sign-in;
• which organisations' workspaces you belong to, and your role;
• a session cookie while you are signed in (section 11);
• a sign-in record. Each time anyone tries to sign in with a password, we record the email address that was entered, whether the attempt succeeded (and, if it failed, a general reason such as a wrong password), the date and time, the IP address and the browser user agent. Sign-outs and password changes are recorded too. These records cannot be edited or deleted, and they are kept after the account is deleted (section 9);
• your conversations with the in-app assistant: your questions, the answers you were shown, and any thumbs-up or thumbs-down you give (section 3.8);
• a record of who did what. Many actions are recorded with the email address of the person who took them. Examples: who answered or reviewed a question, who changed which regulatory sources apply, who granted or removed access, who connected Google Drive, and who sent or cancelled an "Ask someone" email. Some of these records are kept after your account, or your organisation's account, is deleted (section 9).

When you use "Ask someone", we also record your IP address and browser user agent (section 3.4).

Why: to provide the service to your organisation, secure it, keep a record of who did what (that record is part of what the product provides), and support you.

A small number of people who work on applicable.ai can access customer organisations' information to run and support the service.

3.4 People asked a question by email ("Ask someone")

A signed-in app user can email one question to someone, usually a colleague. That person answers on a web page, without an account. Either the app sends the email for the user, with replies going to the user, or the user sends it from their own mailbox.

We store the recipient's email address; the sender's note and who sent it; when it was sent and when the link expires (14 days by default); whether it was cancelled; when the answer page was first opened (an email security scanner can do this, not only a person); and when it was answered, and the answer.

The answer becomes part of the organisation's information, with a note that it came through an emailed link from the recipient's address. A history log records each event (link created, resent or cancelled; answer recorded, refused, accepted, rejected or undone). Each entry holds the recipient's email address, the person acting, the question and answer, and the IP address and browser user agent of the request.

Why: so the organisation can get an answer it needs and keep a record of where the answer came from. Answers can be used by the AI features in section 3.5. We do not add recipients to any mailing list.

3.5 Information about customer organisations, and our AI model provider

Customer organisations enter or confirm information about themselves: profile facts, legal entities, where they operate, answers to questions, decisions about which rules apply, and notes. Most of this is about the organisation, not about individuals. It can still include people's names (for example, named officers, directors or owners), staff email addresses, and anything a person types into a free-text field.

Please do not enter personal information about your organisation's customers or members. The service is designed for information about organisations.

Our AI model provider is OpenAI. We have signed a data processing agreement with OpenAI.

What is sent to OpenAI. When anyone in a workspace uses the features below, the app sends parts of that organisation's information to OpenAI, together with regulation text:

• working out which rules may apply, including sorting topics, estimating which questions matter and grouping questions. This sends relevant profile facts and answers, the organisation's name and summary, where it operates, and details about its legal entities;
• grouping the questions the app still needs your organisation to answer, estimating which of them matter, and ranking them. This sends the text of those open questions, which can name the organisation or restate facts about it;
• drafting control mappings and requirement summaries, using the organisation's profile;
• judging whether a regulatory change may be relevant to the organisation, and suggesting changes to controls;
• the in-app assistant, which is described in section 3.8;
• company research. When an app user presses "Research company", the app reads pages from the organisation's website and looks up public US records that match the organisation's name: an SEC filing (normally the most recent annual report, which can be many years old; if there is none, the most recent quarterly report) with related SEC data, and an FDIC BankFind record for an FDIC-insured bank, which can include some of the latest financial figures the FDIC publishes from that bank's Call Report. For a US credit union, the app can also look up that credit union's NCUA 5300 report in public data published by the NCUA. Records are matched by name, so a match can belong to a different organisation. The app sends the website text and any SEC and FDIC material it finds to OpenAI, along with the organisation's web address and its recorded name, if there is one. If the app finds no SEC or FDIC material, it sends nothing beyond the website text, the web address and the recorded name. Company research does not send the NCUA 5300 report to OpenAI, but facts taken from it are added to the profile as described below, and the app's other AI features can then send them to OpenAI with the organisation's other profile facts. The facts the model proposes are added to the organisation's profile where it has no value for them yet. Facts the app takes directly from public regulator records, such as SEC data, an FDIC-insured bank's Call Report or FDIC record, or a credit union's NCUA 5300 report, are also added. Facts from SEC data are added only where the profile has no value for them yet. Facts from a Call Report, an FDIC record or an NCUA 5300 report can replace facts that no person has entered, confirmed or disputed. They replace a fact a person entered or confirmed only if an app user chooses that in the app. An app user can also press "Refresh from Call Report", and our staff can run the same refresh for an organisation. It looks up only the Call Report and FDIC record of the bank matched to the organisation, or the NCUA 5300 report of the credit union matched to it, and adds facts from them in the same way. It does not read the website or SEC records. The refresh itself sends nothing to OpenAI, but the app's other AI features can then send the facts it adds to OpenAI with the organisation's other profile facts. A refresh our staff run never replaces a fact a person entered or confirmed. All of these facts are marked as unverified. The app, including its other AI features, can use them before a person reviews them. Disputing a fact does not remove it: when working out which rules may apply, the app still uses a disputed fact, but flags the conflict and limits how confident any result that relies on that fact can be. This public material often names people, such as executives and directors.

Nothing from another organisation's workspace is included. We do not currently offer organisations a setting to turn this processing off.

The app's answers and suggestions are preparation material. They are not legal advice, and they are not an audit, an audit opinion, an attestation or a certification of compliance.

Retention at OpenAI. OpenAI may keep information it receives, for example to monitor for abuse or where the law requires it. We cannot currently tell you how long OpenAI keeps it.

3.6 Google Drive (policy documents)

This section applies only if someone in your workspace connects a Google account to applicable.ai.

What we access. When you connect, Google asks you to allow three things: identifying your Google account, seeing its email address, and access to the specific Google Drive files you choose with our app (Google's drive.file permission). We cannot list, search or open any other file in your Drive.

Google's consent screen describes the drive.file permission as letting an app see, edit, create and delete the files you choose with it. Our app only reads those files. It does not edit, create, move, share or delete them. If that ever changes, we will publish a new version of this notice first.

• For the connected Google account: its identifier, its email address (so you can see which account is connected), the permissions granted, and the long-term credential Google issues. We do not store the short-lived credentials Google issues for each request.
• For each file you add: its Drive file identifier, its title, and Google's version and modification details. Each time the file's wording changes, we also store a plain-text copy of it, with fingerprints (hashes) of that text.

How we check for changes. Using the credential you granted, the app checks connected files about once an hour, including when nobody is signed in. A change can take an hour or more to appear.

How we use it. Only to show you, and the other members of your workspace, the saved versions of the documents you added and when each one changed. We do not use information from Google to train AI models or for advertising. We do not sell it, and we do not give it to data brokers.

Our use of information received from Google APIs follows the Google API Services User Data Policy.

Who can see it. Members of your workspace can read the saved versions. A small number of people who work on applicable.ai can access stored information, including saved policy text, to run and support the service.

• When the Google account is disconnected, we ask Google to revoke our access and we delete the stored credential. The same happens when the person who connected it leaves your workspace or loses the role that allowed them to connect it, and when your workspace is suspended.
• Saved versions stay in your workspace after a disconnect, marked as disconnected, until the organisation's profile or workspace is deleted.
• A workspace administrator can ask us to delete the saved text of a document without deleting the workspace. We then keep only internal identifiers, dates, fingerprints (hashes) and counts.
• You can also remove our app's access at any time from your Google Account's third-party access settings. That stops new versions being saved, but it does not delete versions already saved.

3.7 Emails

The app sends sign-in links, "Ask someone" emails and service notifications from an address at https://getapplicable.ai, through Google Workspace (Gmail). Occasionally a member of our team sends a sign-in link from their own https://getapplicable.ai mailbox. A copy of each email sent this way, including any link in it, is kept in the sending mailbox (section 9).

If you email us, we receive your email address and your message. They are stored in our Google Workspace mailboxes.

3.8 The in-app assistant

Signed-in app users can ask the assistant questions about their organisation's workspace. Anyone who can open a workspace can use it, including view-only users. Demo accounts cannot use it.

What you type. Questions can be up to 1,000 characters. Please do not type personal information about your organisation's customers or members, or non-public information such as a planned merger, into the assistant. Anything you type is sent to OpenAI, as described below.

What we send to OpenAI, for each question. The app makes up to two requests to OpenAI:

1. Understanding the question. We send your question and a list of the profile fields the app knows about. That list holds field names only, not your organisation's answers.
2. Writing the answer. We send:
   • your question;
   • up to the last three questions and answers in the same conversation;
   • a limited number of the rules the app has recorded for your organisation's workspace. For each rule we send its citation, its title, a short extract of its text, its status for your organisation, the reasons already recorded for that status, and up to 8 of your organisation's profile facts that the rule matched. Profile facts can include people's names, for example a named officer;
   • the titles (not the text) of controls linked to those rules;
   • for a "what if" question, the changes you asked about and the rules that would be affected;
   • if you asked from a specific open question in the app, that question, the reason it is still open, and definitions taken from public regulation text.

If none of your organisation's records match the question, or the answer would rest on a definition we do not hold, no answer request is sent.

What we do not attach. The app does not attach your email address, your name or any account or workspace identifier to the request. It does not send the text of controls, or anything from another organisation's workspace. The information described above can still include names, including your organisation's name and your own, if you appear in your organisation's profile or type your name.

Our AI model provider is OpenAI. The assistant uses only OpenAI. It does not fall back to any other provider. We have signed a data processing agreement with OpenAI. OpenAI may keep information it receives, for example to monitor for abuse or where the law requires it. We cannot currently tell you how long OpenAI keeps it.

This happens whenever someone uses the assistant. We do not currently offer organisations a setting to turn it off.

What we store. In our database (section 7) we keep:

• each conversation: the organisation, the profile, the person who asked, the first 120 characters of the first question as its title, and the date and time;
• each question as typed, and each answer as it was shown to you;
• internal references to the rules the answer drew on, and for a "what if" question, the changes you asked about;
• the model name and usage and cost figures;
• any thumbs-up or thumbs-down. There is no free-text feedback box.

We do not store the full request sent to OpenAI. Our server logs for the assistant record reference numbers, timings and usage figures, not the text of your question or the answer.

Who can see your conversations. In the app, only you can see your own conversations. Other members and administrators of your workspace cannot open them. As section 3.3 says, a small number of people who work on applicable.ai can access customer information to run and support the service, and that includes these conversations.

How long we keep them. Until your organisation's profile or workspace is deleted. There is no automatic time limit. You cannot yet delete a single conversation yourself. To ask us to delete one, email [email protected] (section 10).

What the answers are. The assistant's answers are preparation material. The app gives the model only the information described above, but the model can still make mistakes or say things that information does not support. The answers are not legal advice, and they are not an audit, an audit opinion, an attestation or a certification of compliance. A person should review them before relying on them.

3.9 Visiting our website or app

No trackers. Our website and app do not use analytics, advertising or social-media tracking tools, and they load no third-party scripts. Our website's fonts are served from our own site.

Hosting. When your browser connects, our hosting provider receives your IP address and request details, as any web server does. Our app's request logs record the request method, the page address (with query strings removed and one-time link codes masked), the response status and an internal request number. They do not record your IP address or browser user agent.

4. Why we are allowed to use your information

We do not rely on your consent to handle your information. The sign-up checkboxes record that you agree to the Demo Terms of Use and that you have read this notice. We use your information:

• to provide the service to you or your organisation;
• for our legitimate interests in keeping the service secure, preventing abuse, telling people on the launch list when access opens, and keeping the "Ask someone" record for the organisation that sent the question;
• to comply with the law.

If you are in the United Kingdom or the European Economic Area and UK or EU data protection law applies to our handling of your information: the legal bases above are, respectively, performance of a contract, legitimate interests, and legal obligation. Our systems are in the United States, so your information is transferred there (section 7). You have the rights in section 10, plus the rights to object to processing based on legitimate interests, to restrict processing, and to receive your information in a portable form. You may complain to your data protection authority (in the UK, the Information Commissioner's Office).

5. Our role for customer organisations

We handle app users', "Ask someone" recipients' and organisations' information on behalf of the customer organisation. We may refer your requests to your organisation.

6. Who we share information with

We do not sell personal information, and we do not share it for cross-context behavioural advertising.

These service providers handle personal information for us:

Google Drive is not our service provider for the feature in section 3.6. When your organisation connects its own Google Drive, it uses its own Google account, under its own agreement with Google.

We may also disclose information:

• to your organisation, if you are an app user or an "Ask someone" recipient. Its administrators can see the activity described in sections 3.3 and 3.4, except in-app assistant conversations, which in the app only the person who asked can see (section 3.8);
• to our professional advisers, under confidentiality;
• when the law requires it, or to protect people, the service or our rights;
• to a buyer or successor if applicable.ai or Applicable.ai LLC is sold, merged, converted into another type of company or otherwise reorganised;
• when you ask us to.

7. Where information is stored

Our app and database are hosted in the United States. Our email and AI providers may process information in the United States or other countries.

8. How we protect information

No method of storing or sending information is completely secure, and we cannot guarantee security. Measures we use today:

• our website and app are served over HTTPS;
• passwords are stored only as one-way hashes;
• sign-in links and "Ask someone" links are stored in our database only as one-way hashes, and each one works once and expires;
• session cookies cannot be read by page scripts and are sent only over HTTPS;
• only our platform administrators can see the demo sign-up list and the launch list;
• sign-ups, sign-ins, access changes and "Ask someone" events are recorded in history logs.

If a security incident affects your personal information, we will notify you where the law requires.

9. How long we keep information

We have not yet set automatic deletion periods for most information. The table describes what actually happens today. When we set periods, we will publish a new version of this notice.

10. Your choices and rights

Wherever you live, you can ask us to:

• tell you what personal information we hold about you, and give you a copy;
• correct it;
• delete it.

We will not treat you differently for making a request.

Deleting demo access or a launch-list entry. We delete your email address, username, demo account, sign-in link records and active sessions, or your launch-list entry. We keep the security and acceptance records (dates, times, IP addresses, browser user agents and internal reference numbers, without your email address or username), and a record that we handled your deletion. We keep these to investigate abuse and to show that we handled your request.

App users. Your organisation controls your account. We may refer your request to your organisation. The sign-in records and history logs described in section 9 are kept.

"Ask someone" recipients. Ask the organisation that emailed you, or ask us and we will pass your request on.

How to ask. Email [email protected] from the address your request is about. We may ask you to confirm the request from that address before we act. Someone you authorise can ask for you, and we may ask for proof of that authority. We aim to respond within 30 days. If we decline your request, reply to our response and ask us to reconsider.

Do Not Track and Global Privacy Control. We do not track you across other websites, and we do not sell or share personal information for advertising. Our website and app therefore do nothing different when your browser sends a Do Not Track or Global Privacy Control signal.

11. Cookies and similar technologies

• https://app.getapplicable.ai sets one cookie, connect.sid, when you sign in. It keeps you signed in, and the app does not work without it. Page scripts cannot read it, it is sent only over HTTPS, and it expires 14 days after your last activity. Signing out ends the session.
• Theme. The app saves your light or dark theme choice in your browser's local storage. It is not sent to us.
• https://getapplicable.ai, our website, sets no cookies.
• We use no advertising or analytics cookies.

12. Children

applicable.ai is for professionals. It is not directed at children, and the Demo Terms of Use require users to be at least 18. We do not knowingly collect personal information from children under 13. If we learn that we have, we will delete it.

13. Changes to this notice

Each version of this notice has a version identifier and an effective date, shown at the top.

• Any change is a new version, with a new identifier and effective date.
• Earlier versions stay available at https://getapplicable.ai/privacy/[version].
• Demo users are asked to acknowledge a new version before they continue using demo access.

14. Contact

Applicable.ai LLC
[email protected]