chrt procurement policy evidence
Only topics backed by verified findings appear below. Each row preserves the platform's exact policy words and capture provenance.
| Topic | Plan or tier | Risk | Their words | Source |
|---|---|---|---|---|
| DPA, audit rights & data residency | All applicable tiers | unknown | “ We rely on different lawful bases for collecting and processing personal data about you. For a detailed mapping of our processing purposes to their specific lawful bases and your associated data subject rights under European laws, please refer to the table in the How CHRT uses your information section above.” | Captured 2026-09-24Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “ CHRT processes personal data both inside and outside of the United States and relies on legal mechanisms such as Standard Contractual Clauses to lawfully transfer data from the European Economic Area, the United Kingdom, and Switzerland to the United States. You may request a copy of the Standard Contractual Clauses by contacting privacy@chrt.com with the subject line “Standard Contractual Clauses”.” | Captured 2026-09-24Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | unknown | “ As CHRT does not have an establishment in the European Union or the United Kingdom, we have appointed EU and UK Representatives pursuant to Article 27 of the GDPR and UK GDPR to act as points of contact on our behalf:” | Captured 2026-09-24Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | unknown | “ Questions or concerns regarding CHRT’s Privacy Statement or information practices should be directed to our Privacy Contact or Data Protection Officer (DPO):” | Captured 2026-09-24Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | unknown | “ You can request access to, and rectification or erasure of, personal data; If any automated processing of personal data is based on your consent or a contract with you, you have a right to transfer or receive a copy of the personal data in a usable and portable format; If the processing of personal data is based on your consent, you can withdraw consent at any time for future processing; You can object to, or obtain a restriction of, the processing of personal data under certain circumstances; You can object to automated decision-making, including profiling, in accordance with Art. 22 of the GDPR (https://gdpr-info.eu/art-22-gdpr/); and For residents of France, you can send us specific instructions regarding the use of your data after your death.” | Captured 2026-09-24Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | unknown | “ To make such requests, please use the contact information in the “Contacting CHRT” section of this Privacy Statement. When we are processing data on behalf of another party (i.e., where CHRT is acting as a data processor) you should direct your request to that party. You also have the right to lodge a complaint with a supervisory authority, but we encourage you to first contact us with any questions or concerns. If you remain dissatisfied, then you have the right to apply directly to your local data protection authority.” | Captured 2026-09-24Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | unknown | “ Role: Monitors data protection activities, GDPR compliance, handles data subject requests, and cooperates with supervisory authorities.” | Captured 2026-09-24Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | unknown | “ If the processing of personal data about you is subject to European Union data protection law, you have certain rights with respect to that data:” | Captured 2026-09-24Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “profile within 90 days of your request. After an account has been deleted, certain data, such as contributions to communities, comments in communities, and messages to other users, may remain.” | Captured 2026-09-24Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “ Store: We store the minimal amount of Google user data necessary to provide our Service. Data stored includes metadata about the files accessed, changes made to them, and the outputs of any advanced processing features you use as part of our Service.” | Captured 2026-09-24Open source →Finding permalink → |
| Data retention | All applicable tiers | medium | “ We retain personal data for as long as necessary to provide the services and fulfill the transactions you have requested, comply with our legal obligations, resolve disputes, enforce our agreements, and other legitimate and lawful business purposes. Because these needs can vary for different data types in the context of different services, actual retention periods can vary significantly based on criteria such as user expectations or consent, the sensitivity of the data, the availability of automated controls that enable users to delete data, and our legal or contractual obligations. For example, we may retain your personal data for longer periods, where necessary, subject to applicable law, for security purposes.” | Captured 2026-09-24Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ We will disclose personal data if we believe it is necessary to:” | Captured 2026-09-24Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ WorkOS — Authentication and user account management. Receives and stores your name, email address, profile picture, and password or password hash where password-based authentication is used. WorkOS Privacy Policy ” | Captured 2026-09-24Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ Stripe — Payment processing. Receives billing and payment information. Stripe Privacy Policy ” | Captured 2026-09-24Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ Other companies with whom you choose to engage. CHRT may collect personal data about you from third parties. For example, this may happen if you sign up for training or to receive information about CHRT from one of our vendors, partners, or affiliates. CHRT does not purchase personal data from third-party data brokers.” | Captured 2026-09-24Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ We share your personal data with third parties when you tell us to do so. For example, if you purchase an application listed on our site, we share your username to allow the application developer to provide you with services. Additionally, you may direct us through your actions on CHRT to share your personal data. For example, if you join any sort of community through CHRT, you indicate your willingness to provide the admin of the community with the ability to view your activity within the community.” | Captured 2026-09-24Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ Limited Use Policy. CHRT’s use and transfer to any other app of information received from Google APIs will adhere to Google API Services User Data Policy , including the Limited Use requirements.” | Captured 2026-09-24Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ PostHog — Product analytics (with your consent). Receives page view events, feature usage events, error events, and user identification data (email, name, user ID, organization context) to help us understand how the Service is used and improve it. PostHog Privacy Policy ” | Captured 2026-09-24Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ CHRT Affiliates and contractors. CHRT may perform its obligations under this Agreement through its Affiliates and use contractors to provide certain services. CHRT remains responsible for their performance.” | Captured 2026-09-25Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ Mapbox — Mapping and route calculation. Receives geographic coordinates when you use map-based features. Mapbox Privacy Policy ” | Captured 2026-09-24Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ operate and maintain the security of the Service, including to prevent or stop an attack on our systems or networks; or” | Captured 2026-09-24Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ We share personal data with your consent or as necessary to complete your transactions or provide the services you have requested or authorized. In addition, we may share each of the categories of your personal data described above with the types of third parties described below for the following business purposes:” | Captured 2026-09-24Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “and related companies, for example, where we share common data systems or where access is needed to operate and provide the Service.” | Captured 2026-09-24Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ We share your personal data with service providers who process the information on our behalf to provide or improve our Service. For example, our service providers may perform payment processing, customer support ticketing, network data transmission, security, and other similar services. While CHRT processes all personal data in the United States, our service providers may process data outside of the United States or the European Union. Such processing by service providers will be in compliance with applicable law including any relevant transfer mechanism.” | Captured 2026-09-24Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ Please note that some of the features on our Service include integrations, references, or links to services provided by third parties whose privacy practices differ from ours. If you provide personal data to any of those third parties, or allow us to share personal data with them, that data is governed by their privacy statements.” | Captured 2026-09-24Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ Co-branding/marketing partners. We may receive information from partners with which we offer co-branded services or engage in joint marketing activities.” | Captured 2026-09-24Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “ Additionally, under California Civil Code section 1798.83, also known as the “Shine the Light” law, California residents who have provided personal information to a business with which the individual has established a business relationship for personal, family, or household purposes (“California Customers”) may request information about whether the business has disclosed personal information to any third parties for the third parties’ direct marketing purposes. Please be aware that we do not disclose personal information to any third parties for their direct marketing purposes as defined by this law. California Customers may request further information about our compliance with this law by emailing privacy@chrt.com with the subject line “California Civil Code section 1798.83”. Please note that businesses are required to respond to one request per California Customer each year and may not be required to respond to requests made by means other than through the designated email address.” | Captured 2026-09-24Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “ Share: We do not share Google user data with third parties except as described in the “Third-party Processors” section and in accordance with the Limited Use Policy.” | Captured 2026-09-24Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ Service Providers. We may also receive information from processors or service providers who process the data on our behalf, such as our payment processor(s) who process payment and billing information in connection with our Service.” | Captured 2026-09-24Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “ CHRT does not share, sell, rent, or disclose end-user mobile phone numbers or SMS consent data with third parties or affiliates for marketing or promotional purposes.” | Captured 2026-09-24Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ We may share your personal data if we are involved in a merger, sale, or acquisition of corporate entities or business units as described in this Privacy Statement.” | Captured 2026-09-24Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ protect our customers and others, for example to prevent spam or attempts to commit fraud, or to help prevent the loss of life or serious injury of anyone;” | Captured 2026-09-24Open source →Finding permalink → |
| Tier differences | All applicable tiers | unknown | “ “SLA” means CHRT Online Services SLA which specifies the minimum service level for the Online Services.” | Captured 2026-09-25Open source →Finding permalink → |
| Tier differences | All applicable tiers | unknown | “ Accounts. Customer may assign each Subscription License to one individual End User for use or access on any number of devices. End User accounts may not be shared by individuals.” | Captured 2026-09-25Open source →Finding permalink → |
| Tier differences | All applicable tiers | unknown | “ “Previews” means Products provided for preview, evaluation, demonstration or trial purposes, or pre-release versions of the Products.” | Captured 2026-09-25Open source →Finding permalink → |
Informational only, not legal advice. Terms can change; verify every cited source and capture date during procurement review.
📢 POLICY UPDATES ALERT
AIRIN Brief
Built for compliance officers, legal counsel, and SaaS founders. Subscribe to the email digest — one short brief when a tracked vendor materially changes its terms, training policy, or risk rating. Prefer in-app? Watch platforms in your alerts inbox instead.