1. Who we are
LegisGate™ Inc. ("LegisGate™", "we", "us", "our") operates the LegisGate™ compliance intelligence platform at legisgate.com and app.legisgate.com. LegisGate™ produces LegisGate Compass™ Reports for any AI application for enterprise Data Protection Teams.
If you use a free trial of the LegisGate™ platform, the Trial Terms of Service also apply to your trial access.
For privacy inquiries, contact us at: privacy@legisgate.com
legisgate.com/contact
2. What this notice covers
This Privacy Notice explains how LegisGate™ collects, uses, stores, and shares personal data when you:
- Visit our website at legisgate.com
- Use the LegisGate™ platform at app.legisgate.com
- Contact us for information or support
- Enter into a Founding Partner or customer agreement with us
3. Personal data we collect
3.1 — Data you provide directly
Account registration:
- Name and email address
- Organization name and role
- Password (stored in encrypted form — we never see your plain text password)
Platform usage:
- AI application information submitted through the intake form
- Organization profile data including operating regions and industry
- Vendor documentation you upload for assessment purposes
- Deployment decisions recorded in the platform
Communications:
- Email address and message content when you contact us
- Feedback you provide about the platform
3.2 — Data collected automatically
Website and platform usage data:
- IP address and approximate location
- Browser type and version
- Pages visited and time spent
- Referring URLs
- Device type and operating system
Platform performance data:
- Report generation logs
- Error and diagnostic logs
- Feature usage patterns
3.3 — Data we do not collect
LegisGate™ does not collect:
- Patient health records or protected health information (PHI) — your LegisGate Compass™ Reports reference PHI handling by your vendors, but you do not upload actual PHI to LegisGate™
- Payment card or payment-method data — payments are powered by Stripe, Inc. Card numbers, CVV, and payment-method vault data are collected and stored by Stripe on Stripe's systems. They are not collected or stored by LegisGate™. See Stripe's Privacy Policy, Stripe Legal & data terms, and Stripe's Data Processing Agreement. LegisGate™ receives limited billing metadata from Stripe (for example customer and session identifiers, payment status, amount, and card brand / last four digits when Stripe provides them) to fulfill orders, support, tax, and fraud prevention.
- Special category personal data about our users
- Personal data about your customers or patients
4. Legal basis for processing (GDPR and UK GDPR)
For users in the European Economic Area, United Kingdom, and Switzerland, we process your personal data on the following legal bases:
Contract performance (Art. 6(1)(b) GDPR): Account registration data, platform usage data, and billing data are processed to perform our contract with you and deliver the LegisGate™ platform.
Legitimate interests (Art. 6(1)(f) GDPR): Website analytics, platform performance monitoring, security monitoring, and product improvement are processed based on our legitimate interest in operating and improving a secure, functional platform. We have conducted legitimate interests assessments for these processing activities and determined that our interests are not overridden by your data protection rights.
Legal obligation (Art. 6(1)(c) GDPR): We process data as required to comply with applicable law including tax obligations and regulatory requirements.
Consent (Art. 6(1)(a) GDPR): Marketing communications are sent only with your explicit consent. You may withdraw consent at any time by unsubscribing or contacting privacy@legisgate.com.
Optional AI-backed narrative features in the platform (executive summaries, vendor research prose, and conversational tools) involve a separate sub-processor and are described in our AI Transparency Notice.
5. How we use your data
We use your personal data to:
- Provide and operate the LegisGate™ platform
- Generate LegisGate Compass™ Reports based on your submissions
- Send transactional emails including report notifications and account communications
- Respond to your support and sales inquiries
- Improve the platform based on usage patterns
- Maintain platform security and prevent fraud
- Comply with legal obligations
- Enforce our Terms of Service
We do not:
- Sell your personal data to third parties
- Use your data to train AI models without your explicit consent
- Share your data with advertisers
- Use your organizational or vendor data to generate intelligence reports for other customers
6. Data processors and sub-processors
LegisGate™ uses the following third party processors to operate the platform. All processors are bound by data processing agreements meeting applicable legal requirements.
| Processor | Purpose | Location | Safeguard |
|---|---|---|---|
| Stripe, Inc. | Payment processing for orders and subscriptions — card and payment-method data are collected and stored by Stripe, not by LegisGate | United States (Stripe’s global infrastructure as described in Stripe’s notices) | Stripe DPA / SCCs as published by Stripe |
| Anthropic, Inc. | Executive narrative, vendor documentation research summaries, and optional conversational features — not regulatory finding substance | United States | Standard Contractual Clauses |
| Supabase, Inc. | Database infrastructure and authentication | United States | Standard Contractual Clauses |
| Vercel, Inc. | Platform hosting and edge computing | United States | Standard Contractual Clauses |
| Resend, Inc. | Transactional email delivery | United States | Standard Contractual Clauses |
| Microsoft Corporation | Productivity and communication (Microsoft 365) | United States | Standard Contractual Clauses |
For payment processing specifically: checkout on legisgate.com embeds Stripe Checkout. Stripe is LegisGate™'s payment processor for card and payment-method data. Retention, security, and privacy practices for that payment data are governed by Stripe's published policies linked above — not by a LegisGate™ card-vault retention schedule. Our own retention of order and billing metadata is described in Section 8.
We will notify you of any changes to this sub-processor list that materially affect the processing of your personal data.
7. International data transfers
LegisGate™ is incorporated in the United States. If you are located in the European Economic Area, United Kingdom, or Switzerland, your personal data is transferred to the United States when you use our platform.
We rely on the following transfer mechanisms:
European Economic Area: European Commission Standard Contractual Clauses (2021) with supplementary measures including encryption in transit and at rest, access controls, and contractual commitments against unauthorized government access.
United Kingdom: ICO-approved International Data Transfer Agreement (IDTA) or UK Addendum to EU Standard Contractual Clauses.
Switzerland: Swiss Federal Data Protection and Information Commissioner (FDPIC) approved standard contractual clauses.
A copy of our transfer impact assessment is available to enterprise customers upon request.
8. Data retention
We retain your personal data for the following periods:
| Data type | Retention period |
|---|---|
| Account data | Duration of account plus 2 years |
| LegisGate Compass™ Reports | Duration of account plus 7 years |
| Final Designation Reports | Duration of account plus 7 years |
| Billing records (order identity, amounts, Stripe transaction metadata) | 7 years (tax obligation) |
| Payment card / payment-method vault data | Held by Stripe under Stripe’s retention practices — not stored by LegisGate™ |
| Support communications | 3 years |
| Website analytics | 13 months |
| Security logs | 12 months |
Upon account deletion we will delete or anonymize your personal data within 30 days except where retention is required by law or legitimate business interest.
9. Your rights
Depending on your location you may have the following rights regarding your personal data:
Right of access: Request a copy of the personal data we hold about you.
Right to rectification: Request correction of inaccurate personal data.
Right to erasure: Request deletion of your personal data subject to legal retention obligations.
Right to restriction: Request that we restrict processing of your personal data in certain circumstances.
Right to data portability: Receive your personal data in a structured, commonly used, machine-readable format.
Right to object: Object to processing based on legitimate interests.
Right to withdraw consent: Where processing is based on consent, withdraw consent at any time without affecting the lawfulness of prior processing.
Right to lodge a complaint: Lodge a complaint with your local supervisory authority:
- EU/EEA: Your national data protection authority
- United Kingdom: Information Commissioner's Office (ico.org.uk)
- Switzerland: Federal Data Protection and Information Commissioner (edoeb.admin.ch)
- United States (California): California Privacy Protection Agency
To exercise any of these rights contact us at privacy@legisgate.com. We will respond within 30 days.
10. Cookies
LegisGate™ uses strictly necessary cookies only. These are limited to authentication and session cookies required to keep you securely signed in and to operate core platform functionality. They cannot be disabled without breaking the Service.
We do not use analytics, performance, advertising, or cross-site tracking cookies, and we do not use persistent preference or marketing cookies. We do not share cookie data with third parties. Because we rely solely on strictly necessary cookies, no cookie consent banner or preference center is required.
11. Children's privacy
The LegisGate™ platform is intended for enterprise professionals and is not directed at individuals under the age of 18. We do not knowingly collect personal data from children. If you believe we have inadvertently collected data from a child please contact us at privacy@legisgate.com.
12. Changes to this notice
We will notify you of material changes to this Privacy Notice by email to your registered address and by posting the updated notice at legisgate.com/privacy with a revised "Last updated" date. Continued use of the platform following notification constitutes acceptance of the updated notice.
13. EU and UK Representatives
LegisGate™ is established in the United States and has no establishment in the European Union or the United Kingdom. As required by Article 27 of the GDPR and Article 27 of the UK GDPR, we have appointed representatives whom data subjects and supervisory authorities may contact on all matters relating to the processing of their personal data. You may contact the relevant representative below in addition to, or instead of, contacting us directly.
EU Representative (GDPR Article 27):
[EU representative name]
[Street address], [City], [Postal code], [EU member state]
eu-rep@legisgate.com
UK Representative (UK GDPR Article 27):
[UK representative name]
[Street address], [City], [Postcode], United Kingdom
uk-rep@legisgate.com
14. Contact us
For privacy inquiries, data subject rights requests, or questions about this notice:
Email: privacy@legisgate.com
For enterprise customers with a Data Processing Agreement in place, please use the contact details specified in your DPA.