Gander procurement policy evidence
Only topics backed by verified findings appear below. Each row preserves the platform's exact policy words and capture provenance.
| Topic | Plan or tier | Risk | Their words | Source |
|---|---|---|---|---|
| DPA, audit rights & data residency | All applicable tiers | low | “ We may transfer data to countries with different privacy laws (e.g., to the United States). Where required, we rely on approved transfer mechanisms (e.g., EU Standard Contractual Clauses) and implement additional safeguards.” | Captured 2026-07-20Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “ Gander offers a Data Protection Addendum (DPA) incorporating SCCs for international transfers and sub‑processor commitments. Contact privacy@[your-domain].com to request the DPA.” | Captured 2026-07-20Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “ When an operator deletes data or your account is closed, we will delete or irreversibly de‑identify data within reasonable timeframes unless retention is required by law or legitimate interests (e.g., dispute resolution, security).” | Captured 2026-07-20Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “ We keep data only as long as needed for the purposes described, or as required by law/contract. Typical periods (subject to operator contracts and legal requirements):” | Captured 2026-07-20Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ Business transfers (e.g., merger, acquisition) with safeguards and notice where required.” | Captured 2026-07-20Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ Service providers (Section 7) under contract.” | Captured 2026-07-20Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ We engage vetted providers to deliver the Services. Typical categories include:” | Captured 2026-07-20Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ (Web only, if applicable) : OpenAI (NLP), VAPI (voice), Twilio/Resend (communications)” | Captured 2026-07-20Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ SDK telemetry: vendors like Mapbox and Sentry may generate telemetry strictly to provide their services (see Section 7).” | Captured 2026-07-20Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ We use service providers for analytics and operations.” | Captured 2026-07-20Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ We require providers to process personal data only to deliver the contracted service and to apply appropriate security. A current list of sub‑processors is available upon request and may be updated as services evolve.” | Captured 2026-07-20Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ We may share personal data with: Your operator/employer (if your account is managed by them) and other users per your role/permissions.” | Captured 2026-07-20Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ Regulators/authorities where legally required (e.g., safety, tax, law enforcement) or to protect rights and safety.” | Captured 2026-07-20Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ Ensure SDK privacy manifests are up to date and that you have appropriate DPA/terms with each provider. Limit data sent to SDKs (PII scrubbing in Sentry; IP anonymization/sampling in PostHog; disable any ad/marketing features).” | Captured 2026-07-20Open source →Finding permalink → |
Informational only, not legal advice. Terms can change; verify every cited source and capture date during procurement review.
📢 POLICY UPDATES ALERT
AIRIN Brief
Built for compliance officers, legal counsel, and SaaS founders. Subscribe to the email digest — one short brief when a tracked vendor materially changes its terms, training policy, or risk rating. Prefer in-app? Watch platforms in your alerts inbox instead.