Hyperspell procurement policy evidence
Only topics backed by verified findings appear below. Each row preserves the platform's exact policy words and capture provenance.
| Topic | Plan or tier | Risk | Their words | Source |
|---|---|---|---|---|
| DPA, audit rights & data residency | All applicable tiers | low | “ Company will maintain administrative, physical, and technical safeguards designed to protect Customer Data, consistent with the technical and organizational measures described in the DPA and Company’s SOC 2 Type II attestation covering the Security Trust Services Criteria, available via trust.hyperspell.com. Within the Services, permissions are inherited from the underlying source systems; users only access context derived from data to which they already have access. The processing of personal data is governed by the DPA, which is incorporated into the Agreement by reference.” | Captured 2026-09-25Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “ The Agreement (comprising the Order Form, these Terms, and the DPA, each as in effect on the Effective Date) is the complete and exclusive statement of the mutual understanding of the parties and supersedes all previous written and oral agreements, communications and other understandings relating to its subject matter. Except for prospective updates by Company as expressly provided above, all waivers and modifications must be in a writing signed by both parties.” | Captured 2026-09-25Open source →Finding permalink → |
| Data retention | All applicable tiers | medium | “ In Short: We keep your information for as long as necessary to fulfill the purposes outlined in this privacy notice unless otherwise required by law. We will only keep your personal information for as long as it is necessary for the purposes set out in this privacy notice, unless a longer retention period is required or permitted by law (such as tax, accounting, or other legal requirements). No purpose in this notice will require us keeping your personal information for longer than the period of time in which users have an account with us. When we have no ongoing legitimate business need to process your personal information, we will either delete or anonymize such information, or, if this is not possible (for example, because your personal information has been stored in backup archives), then we will securely store your personal information and isolate it from any further processing until deletion is possible.” | Captured 2026-09-25Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “ If you would at any time like to review or change the information in your account or terminate your account, you can: Contact us using the contact information provided. Upon your request to terminate your account, we will deactivate or delete your account and information from our active databases. However, we may retain some information in our files to prevent fraud, troubleshoot problems, assist with any investigations, enforce our legal terms and/or comply with applicable legal requirements. If you have questions or comments about your privacy rights, you may email us at hello@hyperspell.com.” | Captured 2026-09-25Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “ All sections of the Agreement which by their nature should survive termination will survive, including accrued rights to payment, confidentiality obligations, data return and deletion obligations (Section 3.4), warranty disclaimers, limitations of liability, indemnification obligations (Section 7), and Sections 2.5, 11.10, and 11.11.” | Captured 2026-09-25Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “ Upon expiration or termination of the Agreement, Company will, upon Customer’s written request made within thirty (30) days of such expiration or termination, make Customer Data available to Customer for electronic export in a commercially reasonable format. After such 30-day period, Company may, and upon Customer’s written request will, delete Customer Data from Company’s production systems, subject to standard backup retention cycles and applicable legal hold requirements. Secure deletion follows NIST SP 800-88 Rev. 1.” | Captured 2026-09-25Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “ We will use and retain the collected personal information as needed to provide the Services or for as long as the user has an account with us” | Captured 2026-09-25Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ California Civil Code Section 1798.83, also known as the "Shine The Light" law, permits our users who are California residents to request and obtain from us, once a year and free of charge, information about categories of personal information (if any) we disclosed to third parties for direct marketing purposes and the names and addresses of all third parties with which we shared personal information in the immediately preceding calendar year. If you are a California resident and would like to make such a request, please submit your request in writing to us by using the contact details provided in the section "HOW CAN YOU CONTACT US ABOUT THIS NOTICE?"” | Captured 2026-09-25Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ Depending upon the state where you live, you may also have the following rights: Right to obtain a list of the categories of third parties to which we have disclosed personal data (as permitted by applicable law, including California's and Delaware's privacy law)” | Captured 2026-09-25Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ We may disclose your personal information with our service providers pursuant to a written contract between us and each service provider. Learn more about how we disclose personal information to in the section, "WHEN AND WITH WHOM DO WE SHARE YOUR PERSONAL INFORMATION?" We may use your personal information for our own business purposes, such as for undertaking internal research for technological development and demonstration. This is not considered to be "selling" of your personal information. We have not sold or shared any personal information to third parties for a business or commercial purpose in the preceding twelve (12) months. We have disclosed personal information to third parties for a business or commercial purpose in the preceding twelve (12) months as detailed in "WHEN AND WITH WHOM DO WE SHARE YOUR PERSONAL INFORMATION?"” | Captured 2026-09-25Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ Right to obtain a list of specific third parties to which we have disclosed personal data (as permitted by applicable law, including Oregon’s privacy law)” | Captured 2026-09-25Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ We also may need to share your personal information in the following situations: Business Transfers. We may share or transfer your information in connection with, or during negotiations of, any merger, sale of company assets, financing, or acquisition of all or a portion of our business to another company.” | Captured 2026-09-25Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ In Short: We may share information in specific situations described in this section and/or with the following third parties. Vendors, Consultants, and Other Third-Party Service Providers. We may share your data with third-party vendors, service providers, contractors, or agents ("third parties") who perform services for us or on our behalf and require access to such information to do that work. We have contracts in place with our third parties, which are designed to help safeguard your personal information. This means that they cannot do anything with your personal information unless we have instructed them to do it. They will also not share your personal information with any organization apart from us. They also commit to protect the data they hold on our behalf and to retain it for the period we instruct. The third parties we may share personal information with are as follows: Allow Users to Connect to Their Third-Party Accounts: Slack account, Google account, and Notion account” | Captured 2026-09-25Open source →Finding permalink → |
| Tier differences | All applicable tiers | unknown | “ The Subscription Fee includes the number of named user licenses set forth in the Order Form (the “Named Users”), as adjusted pursuant to any Evaluation Period mechanics in the Order Form. Customer may add users at any time; users above the Named Users count will be billed as set forth in the Order Form, prorated for and co-terminous with the then-current term. A named user license may be reassigned to a replacement individual when the prior user no longer requires access, but may not be shared concurrently among multiple individuals.” | Captured 2026-09-25Open source →Finding permalink → |
| Tier differences | All applicable tiers | unknown | “ Customer will pay Company the fees set forth in the Order Form (the “Fees”). The “Subscription Fee” is the recurring annual fee set forth in the Order Form; any Evaluation Fee or implementation fee is a separate one-time charge, due as stated in the Order Form, and is not part of the Subscription Fee. Unless the Order Form specifies otherwise, the Subscription Fee is invoiced annually in advance; Customer may instead select quarterly or monthly invoicing on the Order Form. Regardless of cadence, Customer is committed to the full annual Subscription Fee for each twelve (12) month term; the selected cadence governs invoice timing only and does not reduce that commitment. Unless otherwise stated on the Order Form, invoiced amounts are due net thirty (30) days from the invoice date; where Customer selects card or auto-charge billing, amounts are charged on or about the invoice date. Unpaid amounts are subject to a finance charge of 1.5% per month on any outstanding balance, or the maximum permitted by law, whichever is lower, plus all expenses of collection. Customer is responsible for all taxes associated with the Services other than U.S. taxes based on Company’s net income.” | Captured 2026-09-25Open source →Finding permalink → |
Informational only, not legal advice. Terms can change; verify every cited source and capture date during procurement review.
📢 POLICY UPDATES ALERT
AIRIN Brief
Built for compliance officers, legal counsel, and SaaS founders. Subscribe to the email digest — one short brief when a tracked vendor materially changes its terms, training policy, or risk rating. Prefer in-app? Watch platforms in your alerts inbox instead.