Rulebase procurement policy evidence
Only topics backed by verified findings appear below. Each row preserves the platform's exact policy words and capture provenance.
| Topic | Plan or tier | Risk | Their words | Source |
|---|---|---|---|---|
| DPA, audit rights & data residency | All applicable tiers | unknown | “ Depending on your jurisdiction, you may have rights to access, correct, delete, or restrict the processing of your personal information. If your data is processed on behalf of one of our customers, we will direct your request to that organization. To exercise your rights, reach out through the contact page .” | Captured 2026-09-25Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | unknown | “ For privacy questions or requests, contact us through the contact page .” | Captured 2026-09-25Open source →Finding permalink → |
| Data retention | All applicable tiers | medium | “ We retain personal information only as long as necessary for the purposes described in this policy, to comply with legal obligations, or as instructed by the organization that controls the data. Customer Data is deleted or returned in accordance with our contractual commitments upon termination of services.” | Captured 2026-09-25Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “ Either party may terminate as set out in the applicable order form or subscription agreement. Upon termination, your right to use the services ceases, and we will delete or return Customer Data in accordance with our data retention commitments.” | Captured 2026-09-25Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ PostHog measures page views and interactions. It uses in-memory identifiers, and session recording is disabled.” | Captured 2026-09-25Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ We share information only with service providers who process it on our behalf under contractual confidentiality obligations, when required by law, or in connection with a corporate transaction. We require all subprocessors to meet security standards consistent with our own.” | Captured 2026-09-25Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ Mesh by Avina records session and form interactions and can use device or IP data to resolve business visitors through providers such as Vector or RB2B.” | Captured 2026-09-25Open source →Finding permalink → |
Informational only, not legal advice. Terms can change; verify every cited source and capture date during procurement review.
📢 POLICY UPDATES ALERT
AIRIN Brief
Built for compliance officers, legal counsel, and SaaS founders. Subscribe to the email digest — one short brief when a tracked vendor materially changes its terms, training policy, or risk rating. Prefer in-app? Watch platforms in your alerts inbox instead.