Privacy Policy

1. Who We Are

equitly is operated by LexCap Venture Advisory Group FZ LLE.

Privacy enquiries: privacy@equitly.ai

This policy reflects our commitment to data privacy across the jurisdictions we operate in, including GDPR where applicable.

2. What We Collect

• Account data: Full name, email address, password (salted hash — we never see plain text), organisation name, primary jurisdiction.
• Platform usage data: Conversations with Elias and Layla, documents you upload or generate, Playbook content, compliance policies, template content, signing envelope data, credit transactions.
• Billing data: Subscription plan, billing history, Stripe customer ID. We do not store card details.
• Deal and invitation data: Deals you create, the parties to them, the people you invite and the access you give them, and the access log of who viewed what.
• Technical data: IP address, browser type, OS, log data, cookie data.
• Consent records: Timestamp and IP address of disclaimer acceptance, and version of Terms and Privacy Policy accepted.
• Google Drive files (only if you import from Google Drive): The files and folders you pick in Google's file picker. See section 4.

3. AI Processing — Important Disclosure

• Anthropic acts as a data processor under a Data Processing Agreement with equitly
• Anthropic does not use API inputs to train its models
• Anthropic's infrastructure is in the United States — we have implemented standard contractual clauses for international data transfers
• equitly does not use your documents, Playbook, or conversations to train any AI model
• If you include third-party personal data in documents or conversations, you are responsible for having a legal basis for that processing

4. Google Drive Import

If you choose to import documents from Google Drive, this is how equitly accesses, uses, stores and shares data from your Google account.

• What we access: Only the files and folders you pick in Google's own file picker. equitly asks Google for one permission, called drive.file, which covers the items you pick and nothing else in your Drive or your Google account. equitly does not ask for offline access, and does not keep the access Google gives once your import finishes.
• How we use it: We copy the files you pick into your equitly vault, where you and the people you give access to can use them, and where Elias reads and files them like any document you upload. We use data from Google for nothing else.
• How we store it: The copies are stored in your vault in the EU (Ireland), encrypted at rest, with each file's name and the folder it came from. They are kept until you or your organisation delete them (see Data Retention).
• Who we share it with: Only the people you give access to in equitly, and the processors in section 6 that run the service, such as Anthropic, which reads documents for Elias and Layla and does not train on them. We do not sell data from Google, use it for advertising, or pass it to anyone else, unless the law requires it.
• No AI training: equitly does not use data from Google, including the documents you import, to develop, improve or train any AI or machine learning model.
• People reading it: equitly staff do not read the files you import unless you ask us to (for example in a support request), it is needed for security (such as investigating abuse), or the law requires it.
• Removing access: You can remove equitly's access at any time on the linked apps page of your Google account (myaccount.google.com/linkedapps). Files you have already imported stay in your vault until you delete them there.

5. How We Use Your Data

6. Data Sharing & Processors

We share your data only with these processors, only as necessary:

7. Data Retention

8. Your Rights

Depending on your jurisdiction, you may have rights to: access your data, correct inaccuracies, request erasure, restrict processing, receive your data in portable format, object to processing, and withdraw consent.

9. Security

• AES-256 encryption at rest for all stored documents and personal data
• TLS 1.3 encryption in transit
• Row-level security in Supabase — your data is logically isolated from other users
• Bcrypt password hashing — we never store or see plain-text passwords
• API keys stored as server-side environment variables only
• Staff access restricted on a need-to-know basis

To report a security issue: security@equitly.ai

10. International Transfers

Your data may be transferred to the United States in connection with our processors (Anthropic, Netlify, Resend, Stripe and Sentry, and BoldSign where its US service is used). All transfers are subject to appropriate safeguards including standard contractual clauses. If you are in the UK, Canada, Australia, or another jurisdiction with specific transfer requirements, we apply equivalent safeguards. Contact privacy@equitly.ai for jurisdiction-specific information.

11. Cookies

12. Children

The Platform is not directed at anyone under 18. Contact privacy@equitly.ai if you believe we have inadvertently collected data from a minor.

13. Changes to This Policy

We will notify you of material changes by email at least 14 days before they take effect.

14. Complaints

If you believe we have not handled your data appropriately, you can complain to:

• DIFC: DIFC Commissioner of Data Protection — dataprivacy.difc.ae
• EU residents: Your local supervisory authority
• UK residents: Information Commissioner's Office — ico.org.uk
• Canadian residents: Office of the Privacy Commissioner — priv.gc.ca

We would always prefer to resolve concerns directly — contact privacy@equitly.ai first.