Hedra procurement policy evidence
Only topics backed by verified findings appear below. Each row preserves the platform's exact policy words and capture provenance.
| Topic | Plan or tier | Risk | Their words | Source |
|---|---|---|---|---|
| DPA, audit rights & data residency | All applicable tiers | medium | “ We are headquartered in the United States and may use service providers that operate in other countries. Your personal information may be transferred to the United States or other locations where privacy laws may not be as protective as those in your state, province, or country. Users in Europe should read the important information provided below about transfer of personal information outside of Europe. ” | Captured 2026-06-08Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “ Where this Notice to European users applies . The information provided in this 'Notice to European Users' section applies only to individuals located in the European Economic Area (EEA) or United Kingdom (UK) (i.e., "Europe" as defined at the top of this Privacy Policy). Controller . Hedra is the "controller" in respect of the processing of your personal information covered by this Privacy Policy for purposes of the GDPR. See the 'How to contact us' section above for our contact details. For more information about your rights under European data protection laws, please contact us using the contact details set forth in the How to contact us section, above.” | Captured 2026-06-08Open source →Finding permalink → |
| Data retention | All applicable tiers | medium | “ We generally retain personal information to fulfill the purposes for which we collected it, including for the purposes of satisfying any legal, accounting, or reporting requirements, to establish or defend legal claims, or for fraud prevention purposes. To determine the appropriate retention period for personal information, we may consider factors such as the amount, nature, and sensitivity of the personal information, the potential risk of harm from unauthorized use or disclosure of your personal information, the purposes for which we process your personal information and whether we can achieve those purposes through other means, and the applicable legal requirements. When we no longer require the personal information we have collected about you, we may either delete it, anonymize it, or isolate it from further processing.” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ We are headquartered in the United States and may use service providers that operate in other countries. Your personal information may be transferred to the United States or other locations where privacy laws may not be as protective as those in your state, province, or country. Users in Europe should read the important information provided below about transfer of personal information outside of Europe. ” | Captured 2026-07-20Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “ 6.1 Third-Party Websites, Applications and Ads. The Service may use AI Services, and/or contain links to third-party websites, applications and advertisements. Such Third-Party Services are not under the control of Hedra.” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ We may share your personal information, including derived data, with the following parties (or as otherwise described in other applicable notices or at the time of collection): Service providers. Third parties that provide services on our behalf or help us operate the Service or our business. Professional advisors. Professional advisors, such as lawyers, auditors, bankers and insurers, where necessary in the course of the professional services that they render to us. Authorities and others. Law enforcement, government authorities, and private parties, as we believe in good faith to be necessary or appropriate for the Compliance and protection purposes described above. Business transferees. We may disclose personal information in the context of actual or prospective business transactions.” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ Partners , such as marketing partners and event co-sponsors. Service providers that provide services on our behalf or help us operate the Service or our business. Business transaction partners. We may receive personal information in connection with an actual or prospective business transaction. Third-party services, such as social media services, that you use to log into, or otherwise link to, your Service account. Automatic data collection. We, our service providers, and our business partners may automatically log information about you, your computer or mobile device, and your interaction over time with the Service, our communications and other online services, such as: Device data , such as your computer or mobile device's operating system type and version, manufacturer and model, browser type, screen resolution, RAM and disk size, CPU usage, device type (e.g., phone, tablet), IP address, unique identifiers (including identifiers used for advertising purposes), language settings, mobile device carrier, radio/network information (e.g., Wi-Fi, LTE, 3G), and general location information such as city, state or geographic area. Online activity data , such as pages or screens you viewed, how long you spent on a page or screen, the website you visited before browsing to the Service, navigation paths between pages or screens, information about your activity on a page or screen, access times and duration of access, and whether you have opened our emails or clicked links within them. ” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “ The Service may contain links to websites, mobile applications, and other online services operated by third parties. We do not control websites, mobile applications or online services operated by third parties, and we are not responsible for their actions. We encourage you to read the privacy policies of the other websites, mobile applications and online services you use.” | Captured 2026-06-08Open source →Finding permalink → |
| Tier differences | All applicable tiers | unknown | “ (a) Automatic Renewal and Cancelling Subscriptions. If you elect to purchase a Subscription, your Subscription will continue and automatically renew at Hedra's then-current price for such Subscription until terminated in accordance with this Agreement. ” | Captured 2026-07-20Open source →Finding permalink → |
| Tier differences | All applicable tiers | unknown | “ 7.1 Third-Party Service Provider. The Hedra uses Stripe, Inc. and its affiliates as its third-party service provider for payment services. 7.2 Payment. You shall pay all fees or charges to your Account in accordance with the fees, charges and billing terms in effect at the time a Fee is due and payable. 7.3 Subscriptions. If you purchase access to certain features and functionality of the Services on a time-limited basis (a "Subscription" ), the Fee for such Subscription will be billed at the start of the Subscription and at regular intervals.” | Captured 2026-07-20Open source →Finding permalink → |
Informational only, not legal advice. Terms can change; verify every cited source and capture date during procurement review.
📢 POLICY UPDATES ALERT
AIRIN Brief
Built for compliance officers, legal counsel, and SaaS founders. Subscribe to the email digest — one short brief when a tracked vendor materially changes its terms, training policy, or risk rating. Prefer in-app? Watch platforms in your alerts inbox instead.