Sphinx procurement policy evidence
Only topics backed by verified findings appear below. Each row preserves the platform's exact policy words and capture provenance.
| Topic | Plan or tier | Risk | Their words | Source |
|---|---|---|---|---|
| DPA, audit rights & data residency | All applicable tiers | low | “ Personal Data may be transferred to the United States and processed there under standard contractual clauses. ” | Captured 2026-09-25Open source →Finding permalink → |
| Data retention | All applicable tiers | medium | “ We retain Personal Data about you for as long as necessary to provide you with our Services or to perform our business or commercial purposes for collecting your Personal Data. When establishing a retention period, we consider who we collected the data from, our need for it, and the sensitivity of the data. In some cases, we may retain Personal Data longer if needed to comply with legal obligations or resolve disputes. We may also retain anonymized data for analysis. Examples: Profile information and credentials — retained while you have an account. Payment data — retained as long as needed to process transactions. Device/IP data — retained as long as needed to ensure system integrity. ” | Captured 2026-09-25Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ All of your Personal Data that we collect may be transferred to a third party if we undergo a merger, acquisition, bankruptcy or other transaction in which that third party assumes control of our business (in whole or in part). Should one of these events occur, we will make reasonable efforts to notify you before your information becomes subject to different privacy and security policies and practices. ” | Captured 2026-09-25Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ Identifying information in emails, letters, texts, or other communications you send us Shared with: Service Providers, Analytics Partners, Other Parties at Your Direction ” | Captured 2026-09-25Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ Analytics Partners. These parties provide analytics on web traffic or usage of the Services.They include: Companies that track how users found or were referred to the Services. Companies that track how users interact with the Services.” | Captured 2026-09-25Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ Vendors: We may use analytics providers to analyze how you interact and engage with the Services, or third parties may help us provide you with customer support. We may use vendors to obtain information to generate leads and create user profiles. Advertising Partners: We receive information about you from some of our vendors who assist us with marketing or promotional services related to how you interact with our websites, applications, products, Services, advertisements or communications. ” | Captured 2026-09-25Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ Advertising Partners. These parties help us market our services and provide you with other offers that may be of interest to you.They include: Ad networks or related third parties who assist us to market and sell our Services. Companies that we partner with to offer joint promotional offers or opportunities.” | Captured 2026-09-25Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ Statistics associated with interactions between device or browser and the Services Shared with: Service Providers, Advertising Partners, Analytics Partners ” | Captured 2026-09-25Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ Shared with: Service Providers, Analytics Partners, Enterprise Customer Administrator, Other Parties at Your Direction ” | Captured 2026-09-25Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ Shared with: Service Providers, Advertising Partners, Analytics Partners, Other Parties at Your Direction ” | Captured 2026-09-25Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ Enterprise Customer Administrator. This includes the administrator(s) of the entity or enterprise that you utilize our Services through, if any, such as your employer. Other Parties at Your Direction. Third parties who you access through the Services. Other parties authorized by you.” | Captured 2026-09-25Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ We may disclose any Personal Data that we collect with third parties in conjunction with any of the activities set forth under the “Meeting Legal Requirements and Enforcing Legal Terms” section above. ” | Captured 2026-09-25Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ The Website may link to or integrate with third-party websites, platforms, tools, or services, such as scheduling tools, applicant-tracking systems, trust-center providers, event websites, social media platforms, customer websites, or partner websites. Sphinx does not control and is not responsible for third-party websites or services. Your use of third-party websites and services is governed by their own terms, policies, and practices. Links to third-party websites or references to third-party names, logos, products, or services do not imply endorsement by Sphinx unless expressly stated. ” | Captured 2026-09-25Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ We do not sell your Personal Data or share your Personal Data with third parties for them to market or advertise their products to you. We disclose your Personal Data to the following categories of service providers and other parties: Service Providers. These parties help us provide the Services or perform business functions on our behalf.They include: Security and fraud prevention consultants. Hosting and other technology and communications providers. Staff augmentation and contract personnel. Marketing-related services providers.” | Captured 2026-09-25Open source →Finding permalink → |
Informational only, not legal advice. Terms can change; verify every cited source and capture date during procurement review.
📢 POLICY UPDATES ALERT
AIRIN Brief
Built for compliance officers, legal counsel, and SaaS founders. Subscribe to the email digest — one short brief when a tracked vendor materially changes its terms, training policy, or risk rating. Prefer in-app? Watch platforms in your alerts inbox instead.