Avallon AI procurement policy evidence
Only topics backed by verified findings appear below. Each row preserves the platform's exact policy words and capture provenance.
| Topic | Plan or tier | Risk | Their words | Source |
|---|---|---|---|---|
| DPA, audit rights & data residency | All applicable tiers | low | “ Cloud Infrastructure. Personal Information and Content are stored and processed using secure cloud infrastructure and vetted service providers located primarily in the United States. Certain customer deployments may be configured to store and process data within the European Union or other jurisdictions, depending on the applicable customer configuration and agreement. Service Providers. Personal Information may be processed by third-party service providers that support the operation, hosting, security, analytics, monitoring, and AI functionality of the Services. These providers process information on our behalf pursuant to written confidentiality, data protection, and security obligations. International Transfers. If you access the Services from outside the United States, your Personal Information may be transferred to and processed in the United States or other jurisdictions where our service providers operate. By using the Services, you acknowledge that your Personal Information may be transferred to jurisdictions with data protection laws different from those in your country of residence. Cross-Border Safeguards. Where required by applicable law, including the General Data Protection Regulation (“ GDPR ”) and applicable UK data protection law, we rely on recognized legal transfer mechanisms for cross-border transfers of Personal Information, which may include standard contractual clauses approved by the European Commission or other appropriate safeguards. Customers subject to GDPR or UK data protection law may be required to execute a separate Data Processing Agreement (“ DPA ”) with the Company prior to processing personal data of data subjects located in the European Economic Area or United Kingdom through the Services.” | Captured 2026-07-19Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “ We will retain your Personal Information only for as long as is necessary to provide the Services and in accordance with our internal retention and deletion policies. We will retain and use your Personal Information to the extent necessary to comply with our legal obligations, resolve disputes, and enforce our legal agreements and policies. We will also retain usage data for internal analysis purposes. Usage data is generally retained for a shorter period of time, except when this data is used to strengthen the security or to improve the functionality of our products and services, or we are legally obligated to retain this data for longer time periods. Upon account termination or expiration, we will delete or de-identify Content and Personal Information in accordance with our retention policies unless continued retention is required by law. You may request deletion of your account at any time by contacting us at the address listed in Section XV below, and the Company will process such requests” | Captured 2026-07-19Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “We collect this information to maintain security, ensure system reliability, prevent fraud, and improve the Services. · Marketing and Website Visitor Information: When you visit our marketing website, we and our service providers (including third-party identity resolution and enrichment providers) may collect online identifiers such as IP address, cookie and device identifiers, browser and device metadata, pages viewed, timestamps, and referrer parameters. In some cases, our service providers may associate your website session with professional or firmographic information derived from third-party professional data sources, such as your name, job title, company name, business email address, and company attributes. This information is used for sales and marketing purposes and is governed by our service providers’ own privacy practices. · Call Recordings, Transcripts, and Voice Communications: If you or your end users interact with our AI voice agents (including inbound call reception or outbound dialing features), we may record and transcribe those calls to provide the Services, generate claim data, and maintain audit logs. The Company’s AI voice features may involve the use of automated technology to initiate or receive telephone calls. Call recordings and transcripts are processed and stored in accordance with this Privacy Policy. You are solely responsible for ensuring that your use of the Company’s voice and calling features complies with all applicable laws, including the Telephone Consumer Protection Act (“ TCPA ”), applicable state telemarketing and mini-TCPA statutes, and federal and state recording and wiretapping laws. ” | Captured 2026-07-19Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ We may share your Personal Information with third parties under the following circumstances: · At your direction. We may share your Personal Information or Content at your express direction and with your authorization. · With service providers. We may share Personal Information with vendors and contractors who assist us with hosting, infrastructure, analytics, monitoring, security, billing, payment processing, customer support, identity resolution and firmographic enrichment for sales and marketing purposes, AI infrastructure and model serving, and related service operations. We require service providers to use Personal Information only as instructed and to implement appropriate security measures. · To comply with applicable law. We may share your information with appropriate authorities if we believe disclosure is required by applicable law. Where permitted by law, we will provide prompt notice of any such required disclosure so that you may seek a protective order or other appropriate remedy. · To protect the rights and property of the Company. We may share your Personal Information with third parties to protect the property and rights belonging to us or a third party, to protect the safety of the public or any person, or to prevent or stop activity we consider to be illegal, fraudulent, or legally actionable. · In connection with a sale or merger. In the event of a reorganization, merger, or sale, we may transfer your Personal Information to the relevant third party. We will continue to protect Personal Information as described in this Privacy Policy and will notify you of any material changes as required by law.” | Captured 2026-07-19Open source →Finding permalink → |
Informational only, not legal advice. Terms can change; verify every cited source and capture date during procurement review.
📢 POLICY UPDATES ALERT
AIRIN Brief
Built for compliance officers, legal counsel, and SaaS founders. Subscribe to the email digest — one short brief when a tracked vendor materially changes its terms, training policy, or risk rating. Prefer in-app? Watch platforms in your alerts inbox instead.