Credal procurement policy evidence
Only topics backed by verified findings appear below. Each row preserves the platform's exact policy words and capture provenance.
| Topic | Plan or tier | Risk | Their words | Source |
|---|---|---|---|---|
| DPA, audit rights & data residency | All applicable tiers | unknown | “ Economic Area (EEA) or United Kingdom (UK), our legal bases for collecting and using your personal information is as follows:” | Captured 2026-08-17Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “Credal AI complies with the EU-U.S. Data Privacy Framework (“EU-U.S. DPF”), the UK Extension to the EU-U.S. DPF (“UK-U.S. DPF”), and the Swiss-U.S. Data Privacy Framework (“Swiss-U.S. DPF”) (collectively, the “DPF”) as set forth by the US Department of Commerce. Credal AI has certified that it adheres to the EU-U.S. Data Privacy Framework Principles (“EU-U.S. DPF Principles”) with regard to the processing of personal data received from the European Union in reliance on the EU-U.S. DPF and from the United Kingdom (and Gibraltar) in reliance on the UK Extension to the EU-U.S. DPF. Credal AI has certified to the U.S. Department of Commerce that it adheres to the Swiss-U.S. Data Privacy Framework Principles (“Swiss-U.S. DPF Principles”) with regard to the processing of personal data received from Switzerland in reliance on the Swiss-U.S. DPF. If there is any conflict between the terms in this privacy policy and the EU-U.S. DPF Principles and/or the Swiss-U.S. DPF Principles (collectively, the “DPF Principles”), the DPF Principles shall govern.” | Captured 2026-06-08Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “DPF Complaints Involving Personal Data We Process as a Controller. For EU, UK, and Swiss individuals with inquiries or complaints regarding our handling of personal data received or collected as a controller in reliance on the EU-U.S. DPF, the UK-U.S. DPF, and the Swiss-U.S. DPF, please first contact us at: privacy@credal.ai.” | Captured 2026-06-08Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “We encourage you to review our Data Processing Addendum to learn more about how we process and safeguard employee information as a service provider to our Customers. Please contact your employer directly for information regarding how your employer uses and shares your personal information gathered from our Services.” | Captured 2026-06-08Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | unknown | “ ● Correct inaccurate information in your personal information;” | Captured 2026-08-17Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | unknown | “ Lawful Bases for Processing (EEA and UK Individuals). If you are from the European” | Captured 2026-08-17Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “ Data Privacy Frameworks & International Transfers of Data . We may transfer information from or about you or your devices to countries other than the country where you are located (including to the United States), which may not have the same data protection laws as your jurisdiction. For more information regarding our compliance with the EU-U.S. Data Privacy Framework, the UK Extension to the EU-U.S. Data Privacy Framework, and the Swiss-U.S. Data Privacy Framework to authorize these data transfers, please review the following disclosures.” | Captured 2026-06-10Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | unknown | “ Right to Lodge a Complaint. If you have any issues with our compliance, you have the right to lodge a complaint with an EEA supervisory authority. We would, however, appreciate the opportunity to first address your concerns and would welcome you directing an inquiry to us via the contact information at the bottom of this Privacy Policy.” | Captured 2026-08-17Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | unknown | “**Data Privacy Frameworks & International Transfers of Data**. We may transfer information from or about you or your devices to countries other than the country where you are located (including to the United States), which may not have the same data protection laws as your jurisdiction. For more information regarding our compliance with the EU-U.S. Data Privacy Framework, the UK Extension to the EU-U.S. Data Privacy Framework, and the Swiss-U.S. Data Privacy Framework to authorize these data transfers, please review the following disclosures.” | Captured 2026-07-20Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “Pursuant to the DPF Principles, EU, UK, and Swiss individuals have the right to obtain our confirmation of whether we maintain personal information relating to you in the United States. Upon request, we will provide you with access to the personal information that we hold about you. You may also correct, amend, or delete the personal information we hold about you. An individual who seeks access, or who seeks to correct, amend, or delete inaccurate data transferred to the United States under the DPF should direct their query to privacy@credal.ai. If requested to remove data, we will respond within a reasonable timeframe.” | Captured 2026-06-08Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “This Privacy Policy does not apply to the way we process information in our role as a service provider to our Customers. We encourage you to review our Data Processing Addendum to learn more about how we process and safeguard information as a service provider to our Customers.” | Captured 2026-06-08Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | unknown | “ If you have questions about or need further information concerning the legal basis on which we collect and use your personal information, please contact us using the contact details provided at the end of this Privacy Policy.” | Captured 2026-08-17Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “**Data Privacy Frameworks & International Transfers of Data**. We may transfer information from or about you or your devices to countries other than the country where you are located (including to the United States), which may not have the same data protection laws as your jurisdiction. For more information regarding our compliance with the U.S. Data Privacy Framework, the UK Extension to the EU-U.S. Data Privacy Framework, and the Swiss-U.S. Data Privacy Framework to authorize these data transfers, please review the following disclosures.” | Captured 2026-06-08Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “If your DPF complaint cannot be resolved through this channel, Credal AI commits to cooperate and comply respectively with the advice of the panel established by the EU data protection authorities, the UK Information Commissioner’s Office and the Gibraltar Regulatory Authority, and the Swiss Federal Data Protection and Information Commissioner with regard to unresolved complaints concerning our handling of human resources data received in reliance on the DPF in the context of the employment relationship.” | Captured 2026-06-08Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “ To learn more about the, DPF program, and to view our certification, please visit https://www.dataprivacyframework.gov .” | Captured 2026-06-10Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “ DPF Complaints Involving Human Resources Data We Receive from Customers. For EU, UK, and Swiss individuals with inquiries or complaints concerning human resources data that we process on behalf of our employment customers, please first refer to your employer’s privacy notice and contact them to resolve the issue.” | Captured 2026-06-10Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “To learn more about the, DPF program, and to view our certification, please visit [https://www.dataprivacyframework.gov](https://www.dataprivacyframework.gov/).” | Captured 2026-06-08Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “With respect to personal data received or transferred pursuant to the DPF, Credal AI is subject to the investigatory and enforcement powers of the U.S. Federal Trade Commission.” | Captured 2026-06-08Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | unknown | “ EEA or UK Individuals’ Rights . If you are from the EEA or UK, you have the right, under” | Captured 2026-08-17Open source →Finding permalink → |
| Data retention | All applicable tiers | low | “requirements, which are subject to mandatory retention periods. We may also collect your” | Captured 2026-06-08Open source →Finding permalink → |
| Data retention | All applicable tiers | medium | “We retain information from or about you for so long as necessary to fulfill the purposes outlined in this Privacy Policy. When the information is no longer necessary for these purposes, we delete it or keep it in a form that does not identify you, unless we are required by law to keep this information for a longer period. When determining the retention period, we take into account various criteria, such as the type of products and services requested by or provided to you, the nature and length of our relationship with you, possible re-enrollment with our products or services, the impact on the services we provide to you if we delete some information from or about you, mandatory retention periods provided by law and the statute of limitations.” | Captured 2026-06-08Open source →Finding permalink → |
| Data retention | All applicable tiers | low | “**Data Retention**” | Captured 2026-06-08Open source →Finding permalink → |
| Data retention | All applicable tiers | low | “ 10. Data Retention” | Captured 2026-06-10Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “Some external service providers may also collect information directly from you (for example, a payment processor may request your billing and financial information) in accordance with their own privacy policy. These external service providers do not share your financial information, like credit card number, with us, but may share limited information with us related to your purchase, like your zip code.” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “Aggregated Data. We may also aggregate or otherwise strip information of all personally identifying characteristics and may share that aggregated, anonymized data with third parties or publish it. This data does not personally identify you and helps us to measure the success of our Sites and its features and to improve your experience. We reserve the right to make use of any such aggregated data as we see fit.” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “As explained in this Privacy Policy, we sometimes provide your information to third parties to perform services on our behalf. If we transfer personal information received under the DPF to a third party, the third party's access, use, and disclosure of the personal data must also be in compliance with our DPF obligations, and we will remain liable under the DPF for any failure to do so by the third party unless we prove we are not responsible for the event giving rise to the damage. We may be required to disclose personal information that we handle under the DPF in response to lawful requests by public authorities, including to meet national security or law enforcement requirements.” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “**Third Party Marketing**.” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “Change of Control Personal information may be transferred to a third party because of a sale, acquisition, merger, reorganization, or other change in control. If we sell, merge, or transfer any part of the business, part of the sale may include your personal information.” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “ - Service Providers: when you become a service provider to Credal AI.” | Captured 2026-06-10Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “information from you in response to lawful requests by public authorities, including to” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ ● In some limited cases, we may also have a legal obligation to collect personal” | Captured 2026-08-17Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “ Third Party Marketing . ” | Captured 2026-06-10Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “DPF Complaints Involving Human Resources Data We Receive from Customers. For EU, UK, and Swiss individuals with inquiries or complaints concerning human resources data that we process on behalf of our employment customers, please first refer to your employer’s privacy notice and contact them to resolve the issue.” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “\- The categories of third parties with whom we share your personal information.” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “If you are one of our customers, California Civil Code Section 1798.83 permits you to request information regarding the disclosure of your personal information to third” | Captured 2026-07-20Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “parties for the third parties’ direct marketing purposes. However, we do not disclose your personal information to third parties for the third parties’ direct marketing purposes.” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “\- Run, operate, and maintain our Sites and Services through third-party platforms and” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “\- Provide technical and customer support.” | Captured 2026-07-20Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ - Provide technical and customer support.” | Captured 2026-08-17Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “ - Provide payment attribution; and” | Captured 2026-06-10Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “Disclosures Required by Law. We may be required to disclose your data in response to lawful requests by public authorities, including to meet law enforcement requirements. We may be under a duty to disclose or share your personal information to comply with any legal obligation, to enforce or apply our terms and conditions and other agreements, to protect our rights, property, or safety, or to protect the rights, property, or safety of others. This includes exchanging information with other companies and organizations for the purposes of fraud protection.” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “We will provide an individual opt-out or opt-in choice before we share your data with third parties other than our agents, or before we use it for a purpose other than which it was originally collected or subsequently authorized. To request to limit the use and disclosure of your personal information, please submit a written request to privacy@credal.ai.” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “\- Service Providers: when you become a service provider to Credal AI.” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “Affiliates and Service Providers. We share your information with our third-party service” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ Information We Collect From Third Parties . If you access our Sites or Services through third parties (e.g., Facebook or Google), or if you share content from our Sites or Services to a third-party social media service, the third-party service may send us certain information about you if the third-party service and your account settings allow such sharing. The information we receive will depend on the policies and your account settings with the third-party service.” | Captured 2026-06-10Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “To Users or the Public with Your Consent. We may share your information with other users or the public with your consent. The settings you choose will determine how much information is shared with other users and/or the public.” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “\- processing payments.” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “ - The categories of third parties with whom we share your personal information.” | Captured 2026-06-10Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “ - processing payments.” | Captured 2026-06-10Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “\- Provide measurement services (you can opt out of these services at websites such as http://www.aboutads.info/choices and http://www.youronlinechoices.eu/);” | Captured 2026-07-20Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “providers and any subcontractors as required to offer you our products and services. The service providers we use help us to:” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ As explained in this Privacy Policy, we sometimes provide your information to third parties to perform services on our behalf. If we transfer personal information received under the DPF to a third party, the third party's access, use, and disclosure of the personal data must also be in compliance with our DPF obligations, and we will remain liable under the DPF for any failure to do so by the third party unless we prove we are not responsible for the event giving rise to the damage. We may be required to disclose personal information that we handle under the DPF in response to lawful requests by public authorities, including to meet national security or law enforcement requirements.” | Captured 2026-06-10Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “ - Run, operate, and maintain our Sites and Services through third-party platforms and” | Captured 2026-06-10Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ - Provide measurement services (you can opt out of these services at websites such as http://www.aboutads.info/choices and http://www.youronlinechoices.eu/);” | Captured 2026-08-17Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “**Information We Collect From Third Parties**. If you access our Sites or Services through third parties (e.g., Facebook or Google), or if you share content from our Sites or Services to a third-party social media service, the third-party service may send us certain information about you if the third-party service and your account settings allow such sharing. The information we receive will depend on the policies and your account settings with the third-party service.” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “meet law enforcement requirements, as described above in the “How We Share Your” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “We encourage you to review our Data Processing Addendum to learn more about how we process and safeguard employee information as a service provider to our Customers. Please contact your employer directly for information regarding how your employer uses and shares your personal information gathered from our Services.” | Captured 2026-07-20Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “● To share your website visitor activity, through website cookies, with third-party partners to analyze your usage of our Sites.” | Captured 2026-06-08Open source →Finding permalink → |
Informational only, not legal advice. Terms can change; verify every cited source and capture date during procurement review.
📢 POLICY UPDATES ALERT
AIRIN Brief
Built for compliance officers, legal counsel, and SaaS founders. Subscribe to the email digest — one short brief when a tracked vendor materially changes its terms, training policy, or risk rating. Prefer in-app? Watch platforms in your alerts inbox instead.