Pieces procurement policy evidence
Only topics backed by verified findings appear below. Each row preserves the platform's exact policy words and capture provenance.
| Topic | Plan or tier | Risk | Their words | Source |
|---|---|---|---|---|
| DPA, audit rights & data residency | All applicable tiers | medium | “ To provide you with the Services, your personal information may be transferred, stored, or processed on servers outside of your home country. Where this is the case, we transfer information on the basis of mechanisms approved under applicable laws, and will take steps to make sure the right security measures are taken so that your privacy rights continue to be protected as outlined in this Privacy Policy. By submitting your personal information, you're agreeing to this transfer, storing, and/or processing.” | Captured 2026-06-08Open source →Finding permalink → |
| Data retention | All applicable tiers | low | “ How we store and protect Google user data. Google user data is transmitted over TLS and stored on servers operated by reputable cloud providers using encryption at rest. Access to Google user data within Pieces is restricted to authorized personnel who require access to operate or support the connected feature, subject to access controls, logging, and the human-access limitations described above. We maintain administrative, technical, and physical safeguards designed to protect Google user data against unauthorized access, alteration, disclosure, or destruction. Retention of Google user data. We retain Google user data only for as long as is necessary to provide the connected feature to you. You may disconnect a Google account from Pieces at any time from within the Pieces application, which will cause Pieces to stop accessing further Google user data from that account. Upon disconnection or upon a deletion request from you (see "Your Control and Access of Your Data" and "Deletion/Erasure of Personal Information" below), Pieces will delete Google user data we hold from that account within thirty (30) days, except where retention is required to comply with our legal obligations or to establish, exercise, or defend legal claims. Revoking Pieces's access to your Google account. You can revoke Pieces's access to your Google account at any time by visiting your Google Account permissions page at https://myaccount.google.com/permissions . You can also disconnect Google from within Pieces. To request deletion of Google user data we hold, email privacy@pieces.app .” | Captured 2026-06-08Open source →Finding permalink → |
| Data retention | All applicable tiers | medium | “ When you sign up for an account with us, we'll retain information you store on our Services for as long as your account exists or as long as we need it to provide you with the Services. Collected personal information will be retained for no longer than is necessary to fulfill the purposes for which it was collected, or as required by applicable laws or regulations. Server log information and email communications are generally retained for no longer than a period of one year. Google user data is retained only as long as necessary to provide the connected user-facing feature to you, as further described in the "Google User Data" section above.” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “ In the preceding 12 months, the personal information disclosed by Pieces for a business purpose includes the following categories:” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “ The categories of third parties with whom we have shared your personal information.” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “ As part of a merger, acquisition, or sale of assets, but only with your explicit prior consent for the transfer of Google user data.” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “ In the preceding 12 months, Pieces has not sold personal information.” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “ Your use of our Services must comply with this Agreement, and Pieces may review your conduct, Your Content, and your interactions with the Services for compliance. Certain content available via the Services may be protected by others' intellectual property rights. You may not copy, upload, download, or share content unless you have the right to do so. You are responsible for safeguarding your login and password and keeping your account information up to date. Do not share your account credentials or give others access to your account. You are responsible for all activity that occurs under your account. You may use our Services only as permitted by applicable law, including copyright, trademark, export control, and sanctions laws. To use our Services, you must be at least 13 years old. If you reside in a country outside the United States, your country's minimum age may be older, and you are responsible for complying with your country's laws. Your use of the Services is also governed by our Acceptable Use Policy below. ” | Captured 2026-08-17Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ We may share personal information as discussed below. Sharing of Google user data is additionally governed by the "Google User Data" section above; where this section and that section conflict with respect to Google user data, the "Google User Data" section controls. Third Parties, Data Processors, and Agents. In some cases, Pieces uses third-party service providers as agents and/or data processors for the business purposes of helping us provide, improve, protect, and promote our Services. These third parties may access your personal information to perform tasks on our behalf. Examples include sending email, analyzing data, and providing user services. Personal information is collected and/or shared to the extent necessary to enable such processing. Unless we tell you otherwise, third parties, data processors, and agents do not have any right to use personal information we share with them beyond what is necessary to assist us. Other Users. Our Services may display information like your name, profile picture, email address, and usage information to other users with whom you collaborate or choose to share. The email address displayed in this context is the address you registered with Pieces. Where the email address you registered with Pieces happens to match an email address returned by Google OAuth, Pieces displays only the copy collected directly through account registration and does not display, share, or otherwise expose Google user data (including any data obtained via Google APIs) to other users except where you have explicitly directed Pieces to share specific Google user data with a specified user. ” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “ Disclosures for a business purpose, identifying the personal information categories that each category of recipient obtained.” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ Business Transfers. In some cases, Pieces may choose to buy or sell assets. In these types of transactions, personal information is typically one of the business assets that is transferred. If Pieces, or substantially all of its assets, were acquired, or in the event that Pieces goes out of business or enters bankruptcy, personal information would be one of the assets that is transferred or acquired by a third party. You acknowledge that such transfers may occur, and that any acquirer of Pieces may continue to use your personal information as set forth in this Privacy Policy. With respect to Google user data, any transfer in connection with a merger, acquisition, sale of assets, bankruptcy, or insolvency proceeding will occur only with your explicit prior consent, as required by the Google API Services User Data Policy. ” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ Other Applications. You may choose to connect your Pieces account with certain third-party services––for example, via Pieces APIs. This enables Pieces and those third parties to exchange information about you and data in your account so that Pieces and those third parties can provide, improve, protect, and promote their services. Please note that third parties' use of your information will be governed by their own privacy policies and terms of service. Pieces does not transmit Google user data through Pieces APIs to third-party applications. Google user data is never exchanged with third-party applications for promotional, advertising, or marketing purposes, on any basis. Where you affirmatively initiate, through the Pieces user interface, a specific share of specific Google user data with a specifically identified third party, we will transmit only the Google user data you have authorized for that share. Legal Purposes, Protection, and the Public Interest. Pieces may release personal information if required in response to a valid subpoena, court order, search warrant, a similar government order, or when we believe in good faith that disclosure is necessary to comply with our legal obligations; to enforce or apply our Terms of Use and other agreements; or protect the rights, property, safety, or security of Pieces, our employees, our users, third parties, or the public at large. This includes, without limitation, exchanging information with other companies and organizations for fraud protection. ” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “ We disclose your personal information for a business purpose to the following categories of third parties:” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “ Transfer or sell Google user data to advertising platforms, data brokers, or information resellers.” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “ How we share Google user data. We do not share Google user data with third parties except in the following limited circumstances: With sub-processors and service providers that host or operate infrastructure on our behalf (for example, cloud hosting and serverless-runtime providers that operate the infrastructure for our connector services, and transactional email providers used to deliver service notifications), strictly to deliver the user-facing features you have connected, under contractual obligations consistent with the Google API Services User Data Policy.” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “ Comply with the law or a legal obligation.” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ As necessary for security investigations or to comply with applicable law.” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “ In the preceding 12 months, Pieces has disclosed personal information for the following business purposes: Performing services such as maintaining accounts, providing customer service, and fulfilling orders” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “ Where you have given us explicit consent to share specific Google user data with a specified third party.” | Captured 2026-06-08Open source →Finding permalink → |
| Tier differences | All applicable tiers | medium | “ You may add paid features to your Pieces account (a "Paid Account"). We'll automatically bill you from the date you convert to a Paid Account and on each periodic renewal until you cancel. If you're on an annual plan, we'll email you a renewal reminder a reasonable time before the renewal date. If you do not timely pay, we reserve the right to suspend your Paid Account or remove paid features. We may change the fees in effect on Paid Accounts at any time in our sole discretion, but will give you reasonable advance notice via email. You're responsible for all applicable taxes. Payments are processed by our Merchant of Record, Paddle (Paddle.com, Inc. and its affiliates). Your purchase may also be subject to Paddle's terms. Your Paid Account remains in effect until cancelled or terminated under this Agreement. You may cancel at any time; cancellation prevents future billing but does not automatically refund prior charges. Refunds are governed by our Refund Policy and are otherwise only issued where required by law or as specifically stated in this Agreement. Fair use. Paid plans are intended for ordinary individual use, and for that use we do not set predetermined monthly message or token quotas on the AI models available in the Services. We may still act where your usage materially exceeds ordinary individual use, or where it imposes unusually high resource consumption or costs on us or our model providers, even if it does not otherwise violate the Acceptable Use Policy. ” | Captured 2026-08-17Open source →Finding permalink → |
Informational only, not legal advice. Terms can change; verify every cited source and capture date during procurement review.
📢 POLICY UPDATES ALERT
AIRIN Brief
Built for compliance officers, legal counsel, and SaaS founders. Subscribe to the email digest — one short brief when a tracked vendor materially changes its terms, training policy, or risk rating. Prefer in-app? Watch platforms in your alerts inbox instead.