Gale procurement policy evidence
Only topics backed by verified findings appear below. Each row preserves the platform's exact policy words and capture provenance.
| Topic | Plan or tier | Risk | Their words | Source |
|---|---|---|---|---|
| Data retention | All applicable tiers | unknown | “ Processing orders; billing. For clarity, we do not store or retain complete credit or debit card numbers. However, we do keep certain transaction information that can be used to retrieve—and, in some cases, submit—information related to your transaction” | Captured 2026-09-25Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “ To the extent that Gale is processing any of your Personal Data in scope of the Colorado Privacy Act, Connecticut Data Privacy Act, Montana Consumer Data Privacy Act, Oregon Consumer Privacy Act, Texas Data Privacy and Security Act, Utah Consumer Privacy Act and/or Virginia Consumer Data Protection Act, Gale will: Ensure that each person authorized to process Personal Data is subject to a duty of confidentiality with respect to the Personal Data; If you are employed by a Customer, at their direction, delete or return all your Personal Data as they may request at the end of the provision of the Services, unless retention of the Personal Data is required by law; Adhere to instructions from Customers to Gale regarding treatment of your Personal Data. Customers shall ensure that their instructions to Gale adhere to all applicable laws. Upon the reasonable request of a Customer, make available to all information in its possession necessary to demonstrate its compliance with the obligations under the foregoing laws; Allow, and cooperate with, reasonable assessments by Customer's designated assessor; alternatively, Gale may arrange for a qualified and independent assessor to conduct an assessment of Gale's policies and technical and organizational measures in support of the obligations under the foregoing laws using an appropriate and accepted control standard or framework and assessment procedure for such assessments. ” | Captured 2026-09-25Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “Gale shall provide a report of such assessment to Customer upon request; and Engage any subcontractor pursuant to a written contract in accordance with the foregoing laws that requires the subcontractor to meet the obligations of Gale with respect to the Personal Data; and the parties (subcontractor and Gale) shall, taking into account the context of the processing, implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk and establish a clear allocation of the responsibilities between them to implement the measures. Customer may object to such an engagement of a subcontractor.” | Captured 2026-09-25Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ Service Providers (e.g., Analytics Tool Providers)” | Captured 2026-09-25Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ We disclose your Personal Data to the categories of service providers and other parties listed in this section. Depending on state laws that may be applicable to you, some of these disclosures may constitute a "sale" of your Personal Data. For more information, please refer to the state-specific sections below. Service Providers. These parties help us provide the Services or perform business functions on our behalf:” | Captured 2026-09-25Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ We may share any Personal Data that we collect with third parties in conjunction with any of the activities set forth under "Meeting Legal Requirements and Enforcing Legal Terms" in the "Our Commercial or Business Purposes for Collecting Personal Data" section above.” | Captured 2026-09-25Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ All of your Personal Data that we collect may be transferred to a third party if we undergo a merger, acquisition, bankruptcy or other transaction in which that third party assumes control of our business (in whole or in part). Should one of these events occur, we will make reasonable efforts to notify you before your information becomes subject to different privacy and security policies and practices.” | Captured 2026-09-25Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ Vendors: We may use analytics providers to analyze how you interact and engage with the Services, or third parties may help us provide you with customer support Marketing Automation Platforms: We may share your Personal Data with marketing automation platforms that help us manage our marketing campaigns, customer engagement, and outreach” | Captured 2026-09-25Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ Payment processors and financial institutions that facilitate referral reward payments to our referral partners Marketing and Advertising Partners. We may share your Personal Data with marketing and advertising partners that assist us in promoting our Services, delivering targeted advertisements, and analyzing campaign effectiveness. Analytics Partners. These parties provide analytics on web traffic or usage of the Services. They include: Companies that track how users found or were referred to the Services” | Captured 2026-09-25Open source →Finding permalink → |
| Tier differences | All applicable tiers | unknown | “ If you are granted access to the Services by entering into an Order Form with us, any terms of such Order Form shall control in the event of conflict with these Terms. References to a registration page in these Terms shall have the corresponding meanings ascribed to them in the Order Form.” | Captured 2026-09-25Open source →Finding permalink → |
Informational only, not legal advice. Terms can change; verify every cited source and capture date during procurement review.
📢 POLICY UPDATES ALERT
AIRIN Brief
Built for compliance officers, legal counsel, and SaaS founders. Subscribe to the email digest — one short brief when a tracked vendor materially changes its terms, training policy, or risk rating. Prefer in-app? Watch platforms in your alerts inbox instead.