CharacterQuilt procurement policy evidence
Only topics backed by verified findings appear below. Each row preserves the platform's exact policy words and capture provenance.
| Topic | Plan or tier | Risk | Their words | Source |
|---|---|---|---|---|
| DPA, audit rights & data residency | All applicable tiers | unknown | “ In Short: Depending on your state of residence in the US or in some regions, such as the European Economic Area (EEA), United Kingdom (UK), Switzerland, and Canada, you have rights that allow you greater access to and control over your personal information. You may review, change, or terminate your account at any time, depending on your country, province, or state of residence. In some regions (like the EEA, UK, Switzerland, and Canada), you have certain rights under applicable data protection laws. These may include the right (i) to request access and obtain a copy of your personal information, (ii) to request rectification or erasure; (iii) to restrict the processing of your personal information; (iv) if applicable, to data portability; and (v) not to be subject to automated decision-making. If a decision that produces legal or similarly significant effects is made solely by automated means, we will inform you, explain the main factors, and offer a simple way to request human review. In certain circumstances, you may also have the right to object to the processing of your personal information. You can make such a request by contacting us by using the contact details provided in the section "HOW CAN YOU CONTACT US ABOUT THIS NOTICE?" below. We will consider and act upon any request in accordance with applicable data protection laws. If you are located in the EEA or UK and you believe we are unlawfully processing your personal information, you also have the right to complain to your Member State data protection authority or UK data protection authority . ” | Captured 2026-09-24Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | unknown | “ If you are located in Switzerland, you may contact the Federal Data Protection and Information Commissioner . Withdrawing your consent: If we are relying on your consent to process your personal information, which may be express and/or implied consent depending on the applicable law, you have the right to withdraw your consent at any time. You can withdraw your consent at any time by contacting us by using the contact details provided in the section "HOW CAN YOU CONTACT US ABOUT THIS NOTICE?" below. However, please note that this will not affect the lawfulness of the processing before its withdrawal nor, when applicable law allows, will it affect the processing of your personal information conducted in reliance on lawful processing grounds other than consent. Opting out of marketing and promotional communications: You can unsubscribe from our marketing and promotional communications at any time by clicking on the unsubscribe link in the emails that we send, or by contacting us using the details provided in the section "HOW CAN YOU CONTACT US ABOUT THIS NOTICE?" below. You will then be removed from the marketing lists. However, we may still communicate with you — for example, to send you service-related messages that are necessary for the administration and use of your account, to respond to service requests, or for other non-marketing purposes. If you have questions or comments about your privacy rights, you may email us at bhairav@characterquilt.com .” | Captured 2026-09-24Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “ During the term of this Agreement and for one (1) year thereafter, no more than once in any twelve (12) month period, Innabox may audit Customer's use of the Service (" Audit "). An Audit will generally consist of Customer providing a system-generated deployment report evidencing Customer's deployment of the Service. Customer will reasonably cooperate with Innabox and any auditor retained by Innabox in the conduct of the Audit. Audits will be conducted during Customer's normal business hours. Customer will immediately remit payment for any Service deployed in excess of the Service licenses purchased by Customer under this Agreement.” | Captured 2026-09-24Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | unknown | “ In Short: If you are a resident of California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, or Virginia, you may have the right to request access to and receive details about the personal information we maintain about you and how we have processed it, correct inaccuracies, get a copy of, or delete your personal information. You may also have the right to withdraw your consent to our processing of your personal information. These rights may be limited in some circumstances by applicable law. More information is provided below. ” | Captured 2026-09-24Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “ Facilitation in the delivery of our Services and to respond to your inquiries. We will use and retain the collected personal information as needed to provide the Services or for: Category A — As long as the user has an account with us” | Captured 2026-09-24Open source →Finding permalink → |
| Data retention | All applicable tiers | medium | “ In Short: We keep your information for as long as necessary to fulfill the purposes outlined in this Privacy Notice unless otherwise required by law. We will only keep your personal information for as long as it is necessary for the purposes set out in this Privacy Notice, unless a longer retention period is required or permitted by law (such as tax, accounting, or other legal requirements). When we have no ongoing legitimate business need to process your personal information, we will either delete or anonymize such information, or, if this is not possible (for example, because your personal information has been stored in backup archives), then we will securely store your personal information and isolate it from any further processing until deletion is possible.” | Captured 2026-09-24Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ California Civil Code Section 1798.83, also known as the "Shine The Light" law, permits our users who are California residents to request and obtain from us, once a year and free of charge, information about categories of personal information (if any) we disclosed to third parties for direct marketing purposes and the names and addresses of all third parties with which we shared personal information in the immediately preceding calendar year. If you are a California resident and would like to make such a request, please submit your request in writing to us by using the contact details provided in the section "HOW CAN YOU CONTACT US ABOUT THIS NOTICE?"” | Captured 2026-09-24Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ We may share your information with Google Analytics to track and analyze the use of the Services. To opt out of being tracked by Google Analytics across the Services, visit https://tools.google.com/dlpage/gaoptout . For more information on the privacy practices of Google, please visit the Google Privacy & Terms page .” | Captured 2026-09-24Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ Learn more about how we use your personal information in the section, "HOW DO WE PROCESS YOUR INFORMATION?" Will your information be shared with anyone else? We may disclose your personal information with our service providers pursuant to a written contract between us and each service provider. Learn more about how we disclose personal information to in the section, "WHEN AND WITH WHOM DO WE SHARE YOUR PERSONAL INFORMATION?" We may use your personal information for our own business purposes, such as for undertaking internal research for technological development and demonstration. This is not considered to be "selling" of your personal information. We have not disclosed, sold, or shared any personal information to third parties for a business or commercial purpose in the preceding twelve (12) months. We will not sell or share personal information in the future belonging to website visitors, users, and other consumers.” | Captured 2026-09-24Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ Our use of information received from Google APIs will adhere to Google API Services User Data Policy , including the Limited Use requirements .” | Captured 2026-09-24Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ In Short: We may share information in specific situations described in this section and/or with the following third parties. We may need to share your personal information in the following situations: Business Transfers. We may share or transfer your information in connection with, or during negotiations of, any merger, sale of company assets, financing, or acquisition of all or a portion of our business to another company.” | Captured 2026-09-24Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “In addition, any Shared Content generated using third-party AI models, including models from OpenAI, may be subject to sharing and use policies, with which Customer agrees to comply. In no way will Innabox be responsible for the Customer Content or other content that is stored within the scope of these Services. 1.3 Customer shall be solely responsible for the legality, reliability, integrity, accuracy and quality of all Shared Content. To the extent Shared Content contains any personally identifiable information, Customer warrants and represents that it has provided all appropriate notices, received the required consents or permits and/or have any and all ongoing legal bases, and has acted in compliance with applicable privacy laws and regulations, as to allow Innabox to use the Shared Content to perform the Services in accordance with this Agreement. 1.4 Pursuant to the terms of this Agreement, Innabox allows Customer to access and retrieve market research through the internet-based service it provides (" Platform ") which includes Shared Content included from synthetic buyer personas that are compilations of Shared Content created in a manner to represent individuals fabricated by the Platform as representative of individuals that Customer would generally care about (" Persona(s) "). Each Persona is created from multiple live video stream or recorded interviews that are transcribed to create searchable reference data for the Platform (" Transcribed Interview(s) "). ” | Captured 2026-09-24Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ When you visit or log in to our website, cookies and similar technologies may be used by our online data partners or vendors to associate these activities with other personal information they or others have about you, including by association with your email. We (or service providers on our behalf) may then send communications and marketing to these email. You may opt out of receiving this advertising by visiting https://app.retention.com/optout .” | Captured 2026-09-24Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ Customer acknowledges that the Service may link to third party websites, applications or services that are integrated, connected or relevant to the Service (" Third Party Service(s) "). Customer's use of such Third Party Services is optional. To use such features, Customer must either obtain access to the Third Party Service via the third party provider or permit Innabox to obtain access on Customer's behalf. If Customer uses such Third Party Services, it acknowledges and agrees that: (a) any link from the Service does not imply any Innabox endorsement, approval or recommendation of, or responsibility for, those Third Party Services or their content or operators and the use of such Third Party Services are subject to the terms and conditions of the Third Party Services provider; (b) Customer may be required to grant Innabox access to its Third Party Services account and/or to grant the Third Party Services provider access to its Innabox account; and (c) Customer Content may be transferred between Innabox and the Third Party Services provider as required for the interoperation with the Service. To the maximum extent permitted by law, Innabox shall not bear and expressly disclaims all responsibility or liability of any kind relating to such Third Party Services, including, without limitation, for any disclosure of, access to, or other processing of Customer Content by Third Party Services providers.” | Captured 2026-09-24Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ We provide the AI Products through third-party service providers ("AI Service Providers"), including OpenAI and Anthropic. As outlined in this Privacy Notice, your input, output, and personal information will be shared with and processed by these AI Service Providers to enable your use of our AI Products for purposes outlined in "WHAT LEGAL BASES DO WE RELY ON TO PROCESS YOUR PERSONAL INFORMATION?" You must not use the AI Products in any way that violates the terms or policies of any AI Service Provider.” | Captured 2026-09-24Open source →Finding permalink → |
| Tier differences | All applicable tiers | medium | “ This Section only applies to any Service provided by Innabox free of charge for evaluation or lab development (collectively, "Evaluation Service(s)"). Subject to Section 4 (Prohibited Use), Innabox grants to Customer a non-transferable, non-exclusive limited license to use the Evaluation Service(s) for its internal lab development, demonstration, evaluation, training, and testing only. The term of this license is for the term set forth on the applicable license key notice email or Order, or if no term is described, a period of thirty (30) days following delivery of the Evaluation Service(s) ("Evaluation Period"). Innabox may extend the Evaluation Period in writing at its discretion. Unless otherwise agreed in writing by Innabox, Customer agrees to use the Evaluation Service(s) in a non-production environment. Customer bears the sole risk of using the Evaluation Service(s). INNABOX PROVIDES THE EVALUATION SERVICE(S) TO CUSTOMER "AS-IS" AND GIVES NO REPRESENTATION, WARRANTY, INDEMNITY, GUARANTEE OR CONDITION OF ANY KIND. TO THE MAXIMUM EXTENT PERMITTED BY LAW, INNABOX'S TOTAL AGGREGATE LIABILITY AND THAT OF ITS SUPPLIERS IS EXPRESSLY LIMITED TO FIVE HUNDRED DOLLARS ($500) FOR ANY AND ALL DAMAGES REGARDLESS OF THE NATURE OF THE CLAIM OR THEORY OF LIABILITY. Because the Evaluation Service(s) are provided "AS-IS," INNABOX is not obligated to provide support for them. Innabox may receive service credits from its subprocessors in association with the Evaluation Service. This Section supersedes any inconsistent term in the Agreement for purposes of the Evaluation Service(s).” | Captured 2026-09-24Open source →Finding permalink → |
| Tier differences | All applicable tiers | unknown | “ Customer understands that its Subscription License and related Fees are based on the License Metrics specified in the Order for the applicable portion of the Service, Platform and/or each Creative Components on an individual Authorized User basis, which represent minimum and maximum amounts that Customer has committed to for the Service Period. There shall be no fee adjustments or refunds for any decreases in usage or License Metrics during the Service Period. Additional License Metrics must be purchased in the event usage or actual metrics, as applicable, exceed the License Metrics specified in the Order.” | Captured 2026-09-24Open source →Finding permalink → |
Informational only, not legal advice. Terms can change; verify every cited source and capture date during procurement review.
📢 POLICY UPDATES ALERT
AIRIN Brief
Built for compliance officers, legal counsel, and SaaS founders. Subscribe to the email digest — one short brief when a tracked vendor materially changes its terms, training policy, or risk rating. Prefer in-app? Watch platforms in your alerts inbox instead.