Certus AI procurement policy evidence
Only topics backed by verified findings appear below. Each row preserves the platform's exact policy words and capture provenance.
| Topic | Plan or tier | Risk | Their words | Source |
|---|---|---|---|---|
| Data retention | All applicable tiers | medium | “ We retain your personal information for as long as necessary to fulfill the purposes outlined in this Privacy Policy, unless a longer retention period is required or permitted by law. Voice recordings and call data are retained for the duration of our service agreement with the relevant restaurant partner and for a reasonable period thereafter. Account information is retained for the duration of your account and for a reasonable period thereafter. Cookie and tracking data is retained for the periods specified in Section 3.2 above, or until you withdraw consent. When we no longer need to retain your information, we will securely delete or anonymize it.” | Captured 2026-07-19Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ In connection with any merger, acquisition, reorganization, sale of assets, or bankruptcy, your information may be transferred to the acquiring entity.” | Captured 2026-07-19Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “ 9.5 No Sharing of SMS Opt-In Data We will not sell, rent, or share your phone number or SMS opt-in consent with any third parties or affiliates for their own marketing purposes. Your SMS opt-in information is used solely by Certus AI for the purposes described in this Section 9. 9.6 Supported Carriers Our SMS program is supported by major U.S. carriers. Carriers are not liable for delayed or undelivered messages. T-Mobile is not liable for delayed or undelivered messages. ” | Captured 2026-07-19Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “Convuu — Website call demo widget enabling visitors to interact with our AI phone agent. Sets a device fingerprint cookie. Data is sent to the United States.” | Captured 2026-07-19Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “Google Analytics (GA4) — Website analytics as described above.” | Captured 2026-07-19Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ We may disclose your information if required by law, regulation, legal process, or governmental request, or to protect the rights, property, or safety of Certus AI, our users, or others.” | Captured 2026-07-19Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “SalesLoft — Sales engagement platform that tracks visitor behavior to optimize outreach and identify interested prospects. Sets cookies including sliguid, slirequested, slireg, and site_identity with a maximum duration of 1 year. Data is sent to the United States and Germany.” | Captured 2026-07-19Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ We share information with third-party vendors, service providers, and contractors who perform services on our behalf, including but not limited to: cloud hosting and infrastructure providers (AWS, Google Cloud, etc.), payment processors, POS system integrations (Toast, Square, Clover, NCR, and others), analytics and marketing platforms (Google Analytics, Hyros, SalesLoft), advertising platforms (Meta), customer support tools, email and communication service providers, and consent management (CookieYes).” | Captured 2026-07-19Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “Webflow Optimize (Intellimize) — Website personalization and optimization tool integrated with our website platform. Sets cookies for visitor identification and experience optimization. Data is sent to Ireland and the United Kingdom. ” | Captured 2026-07-19Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “Hyros — Marketing attribution as described above.” | Captured 2026-07-19Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ Meta Pixel (Facebook/Instagram) — Advertising pixel for conversion tracking, retargeting, and measuring the effectiveness of our advertising campaigns on Meta platforms. Data is sent to the United States.” | Captured 2026-07-19Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ When you interact with our AI agents on behalf of a restaurant, we share relevant information with that restaurant partner, including order details, contact information, and conversation records necessary to fulfill your orders and provide customer service.” | Captured 2026-07-19Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “Typeform — Embedded forms for demo requests and inquiries. Sets cookies including tf_random_id, tf_respondent_cc, attribution_user_id, and tracking_session_id for form functionality and analytics. Data is sent to the United States.” | Captured 2026-07-19Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “Our Services may integrate with or require the use of third-party services, including but not limited to POS systems (Toast, Square, Clover, NCR, Skytab, and others), telephony providers, payment processors, and other software platforms. Your use of such third-party services is subject to their respective terms of service and privacy policies. Certus AI is not responsible for the availability, accuracy, or performance of any third-party services, and we make no warranties regarding their operation or compatibility with our Services. ” | Captured 2026-07-19Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “YouTube — Embedded video content on our website. YouTube (owned by Google) sets cookies to track interactions with embedded videos, store video player preferences, and enable video functionality. Sets multiple cookies with varying durations. Data is sent to the United States.” | Captured 2026-07-19Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ Your information may be transferred to and processed in countries other than your country of residence, including the United States. These countries may have data protection laws that are different from the laws of your country. We take appropriate safeguards to ensure that your personal information remains protected in accordance with this Privacy Policy, including the use of Standard Contractual Clauses where required.” | Captured 2026-07-19Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ Google Analytics (GA4) — Website analytics to understand visitor behavior, page views, and navigation patterns. Sets cookies including _ga and ga # with a maximum duration of 2 years. Data is sent to the United States.Hyros — Marketing attribution platform to measure advertising campaign performance and track conversion paths. Sets cookies including __mh_tt_s with a maximum duration of 400 days. Data is sent to the United States.” | Captured 2026-07-19Open source →Finding permalink → |
Informational only, not legal advice. Terms can change; verify every cited source and capture date during procurement review.
📢 POLICY UPDATES ALERT
AIRIN Brief
Built for compliance officers, legal counsel, and SaaS founders. Subscribe to the email digest — one short brief when a tracked vendor materially changes its terms, training policy, or risk rating. Prefer in-app? Watch platforms in your alerts inbox instead.