Privacy Policy

Welcome to PonoInsights, a service of PonoAudit, LLC ("PonoAudit," "we," "us," or "our"). We are committed to protecting the privacy and security of the personal and business information entrusted to us by our customers and their users. This Privacy Policy explains how we collect, use, disclose, and safeguard information when you use the PonoInsights web application and related services (collectively, the "Services").

PonoInsights gives organizations visibility into how their employees use AI services, currently Anthropic Claude and OpenAI ChatGPT Enterprise and Edu. It reports usage, adoption, cost, and models, and it scans AI conversations for sensitive data (such as personal information, payment cards, credentials, student records, health information, and terms the customer defines) and measures the results against the customer's own AI policies. Because the Services read information about how people use AI, we take privacy extremely seriously and are designed so that conversation text is never stored.

Our customers are organizations. The Services are not offered to individuals for personal use. Where we process information about a customer's employees on that customer's behalf, the customer decides why and how that information is processed (see Section 16.1).

By accessing or using our Services, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with this Privacy Policy, please do not access or use our Services.

We collect information through the following means when you or your organization interact with our Services:

2.1 Information You Provide Directly

• Account Information: Your name, email address, the name and logo of your organization, and the roles assigned to you within your organization.
• Invitations: The email addresses of people your administrators invite, one at a time or many at once, which our authentication provider uses to send each invitation.
• AI Provider API Keys: API keys for your organization's own Anthropic and OpenAI accounts that an administrator enters to connect those accounts. The Services only read from those accounts and never change anything there; where a provider lets a key be limited, we ask only for read access. Keys are encrypted at rest, bound to your organization, and only their last four characters are ever shown.
• Configuration: The AI policies, custom sensitive terms, groups, seat price, retention period, and other settings your organization configures.
• Reporting Lines: If your organization uploads them, each person's email address and name and their manager's email address and name.
• Communications: Messages, feedback, support requests, and any other content you send to us.

2.2 Information We Read From Your Organization's AI Accounts

Using the keys your organization provides, the Services read the following from your organization's Anthropic and OpenAI accounts:

• Usage Data: Daily usage per person, including user identifiers, email addresses, and names as the provider reports them, along with tokens, messages, cost, models, products, group and directory membership, seats, and active user counts, and the names of the Claude projects, skills, connectors, and plugins each person used and how often (never their contents).
• Conversations: Conversations made available through the providers' compliance APIs. Conversation text is never stored. It is scanned in memory and discarded. We keep only values derived from it: per-conversation counts and classifications (such as use case and outcome) and, for each sensitive-data detection, a masked excerpt of up to about 60 characters on each side of the match, with digits and likely names scrubbed, together with a keyed fingerprint (HMAC) used to avoid recording the same detection twice. Raw sensitive values are never stored.

2.3 Information Collected Automatically

• Sign-In and Security Events: Sign-in events and a record of security-relevant actions, including who took the action, what it was, when it happened, the IP address, and the browser user agent.
• Operational Logs: Server logs and an internal error log recording an error code, a short message, where it happened, and the organization and account concerned. These logs do not contain customer content.
• Website Visits: When you view a page of our public website (such as the home, security, legal, resources, sign-in and sign-up pages), we record the page, the referring website's domain (not its full address), any campaign tags in the link (utm_source, utm_medium and utm_campaign), and whether the device is a computer, phone or tablet. To count visitors without cookies, we combine your IP address and browser type with a random value that we replace and discard every day, and store only the resulting one-way code; we do not store your IP address, and we cannot link your visits across days or trace a code back to you. Pages inside the application are not recorded this way.
• Signup Steps: We record when an account or organization reaches each step from signing up to subscribing (for example, viewing the plans or starting checkout), so that we can understand and improve the signup process. When someone starts checkout, we also record the email address of the account that started it, so that we can follow up if checkout isn't finished.
• Sign-In Activity: When each person last signed in, so that administrators can see who isn't using their account and, if your organization turns it on, for the automatic steps for inactive accounts described in Section 3.3.
• Time Zone: If you allow functional cookies, your time zone, so that times are shown in your local zone. Otherwise times are shown in UTC.
• Cookies and Local Storage: Information stored through the cookies and browser storage described in Section 8.

2.4 Information from Third-Party Sources

• Authentication Provider: Our authentication provider, Clerk, confirms your identity and provides us with your name, email address, and sign-in events.
• Single Sign-On (SSO): If your organization uses SAML or OIDC single sign-on with its own identity provider, we receive your name and email address as authorized by your organization's identity provider settings.
• Payment Processor: Stripe provides us with your organization's subscription status and plan. We never receive or store card numbers.
• Sales Partners: If you arrive through a partner's referral link and allow referral cookies, we record that the partner referred your organization, so that we can pay the partner's commission. We do not share your organization's data with the partner.

We use the information we collect for the following purposes:

3.1 Service Delivery and Operations

• To create and manage accounts and authenticate users.
• To provide, operate, maintain, and improve the Services.
• To produce your organization's usage, adoption, cost, model, and compliance reports, and to apply your organization's policies and access rules.
• To classify conversations (for example, by use case and outcome) and to detect sensitive data, using rules applied in memory while conversations are scanned. No AI model is used for this.
• To manage subscriptions, trials, and billing.

3.2 AI-Powered Features

• When an administrator of your organization asks for one, to prepare an AI-written leadership briefing. For a briefing, we send only aggregate numbers, such as counts, team names, and policy names, and the names of AI products, models, skills, connectors, and plugins, to Anthropic's API using our own API key. No names of people, email addresses, project names, excerpts, or conversation text are sent.

Important: We do not use your organization's data to train AI models, and your organization's data is kept isolated from other customers' data.

3.3 Communication

• To send service-related notifications, updates, and alerts.
• To email a person with the Manager role, or another manager in your organization's managers list if an administrator turns it on (including people who do not sign in to the Services), a report on the people with an AI license below them in the managers list, directly or through other managers: their names, email addresses, which licenses they hold, whether they used them, and when they last did, with a spreadsheet of the same attached unless an administrator turns that off. It comes weekly, monthly, or quarterly, and each manager can change how often or stop it from their settings or from the link in each email, which needs no sign-in.
• To email the reports an administrator of your organization chooses, as PDFs, to the people that administrator names, on the schedule they set. Recipients may include people who do not use the Services. The reports cover your organization and may list people by name, with their AI usage, spend, and counts of sensitive-data findings; replies go to the administrator who set them up.
• If your administrators turn it on, to email people who haven't signed in for a set time asking them to sign in, to email administrators a summary of inactive accounts (names, email addresses, and how long since each signed in), and to deactivate those accounts and withdraw invitations nobody accepted, automatically.
• To respond to your support requests and inquiries.

3.4 Security and Improvement

• To monitor and improve the performance, security, and reliability of the Services.
• To detect, investigate, and prevent security incidents, fraud, and misuse.

3.5 Legal and Compliance

• To comply with applicable laws, regulations, and legal processes.
• To enforce our Terms of Service and other agreements.
• To protect the rights, property, and safety of PonoAudit, our customers, their users, and the public.

Where the law requires a legal basis for processing, we process personal information on the following grounds:

• Contractual Necessity: Processing is necessary to perform our contract with you or your organization (for example, providing the Services your organization subscribed to).
• Legitimate Interests: Processing is necessary for our legitimate business interests, such as securing the Services and preventing fraud, provided these interests are not overridden by your rights.
• Consent: Where we rely on your consent, you have the right to withdraw it at any time without affecting the lawfulness of processing based on consent before withdrawal.
• Legal Obligation: Processing is necessary to comply with a legal obligation to which we are subject.

For information we process on behalf of a customer about its employees, the customer, as controller, is responsible for establishing the legal basis for that processing (see Section 16.1).

We do not sell personal information. We may share information in the following limited circumstances:

5.1 Service Providers and Subprocessors

We engage the following third-party service providers, who process data on our behalf:

• Render: Application hosting and the PostgreSQL database, in the United States (Oregon region).
• Clerk: Authentication, multi-factor authentication, single sign-on, invitation emails, organization membership, roles and logo, and a copy of each organization's latest audit record, kept so that tampering with the audit log can be detected.
• Stripe: Payments and subscription billing. Stripe receives your organization's name and identifier, an administrator's email address, and your organization's head count.
• Anthropic: Only for the optional leadership briefing described in Section 3.2, which receives aggregate numbers only.
• Resend: Sending the report and account emails described in Section 3.3. Resend receives each recipient's email address and the email's contents, including attached reports.

Service providers are permitted to process data only to provide their services to us and are required to maintain appropriate security measures.

5.2 Your Organization's AI Providers

Your organization's Anthropic and OpenAI accounts are your organization's own providers, which the Services access with your organization's keys to read the data described in Section 2.2. They are not our subprocessors, and your organization's relationship with them is governed by its agreements with them.

5.3 Within Your Organization

Information in the Services is visible to other authorized users within your organization according to the roles (Admin, Usage, Compliance, and Manager) and group limits set by your organization's administrators.

5.4 Legal Requirements

We may disclose information if required to do so by law or in the good-faith belief that such action is necessary to comply with applicable law, respond to a court order, judicial or regulatory subpoena, or similar legal process.

5.5 Business Transfers

If PonoAudit is involved in a merger, acquisition, reorganization, bankruptcy, or sale of assets, information may be transferred as part of that transaction. We will notify you via email or prominent notice on our Services before your information becomes subject to a different privacy policy.

5.6 With Your Consent

We may share information with third parties when you have given us explicit consent to do so.

We retain information for as long as necessary to fulfill the purposes outlined in this Privacy Policy, unless a longer retention period is required or permitted by law. Specifically:

• Usage and Compliance Data: Stored for the period your organization’s administrators choose (from 30 days to 7 years; 400 days unless they change it), and purged hourly once older than that. Separately, your plan sets how far back reports can look; data older than that is not shown, but is kept until your organization’s own period ends.
• Conversation Text: Never stored. It is scanned in memory and discarded.
• Account Information: Retained for as long as your organization's account remains active.
• Security Audit Log: Retained, including after other data is deleted, so that the record of security-relevant actions remains complete and verifiable.
• People, Groups, and Managers List: The people and groups read from your AI accounts, and your managers list, are kept while the connection or list is in place. Removing a connection deletes the data read through it.
• Records of Emails Sent: The recipient, the kind of email, and the period it covered, retained for about 13 months.
• Support Requests: Retained while your organization's account is active.
• Error Log: Retained for 90 days. Server logs are kept by our hosting provider for a limited period.
• Website Visit Records: Retained for 13 months. Signup step records: retained for 25 months.
• Webhook Receipts: Retained for 30 days. Records of processed provider events are retained for about 35 days.
• Deleted Organizations: To delete your organization and its data, contact us. When an organization is deleted, its people, connections, synced data, reports, managers list, and email settings are removed, along with the sign-in accounts of people who belong to no other organization. Its security audit log, and a record that the organization existed, are kept.

When data is no longer required, it is deleted or anonymized.

We implement technical and organizational measures to protect the information we process. Our security page describes them in more detail. In summary:

7.1 Technical Safeguards

• Encryption: Data is encrypted in transit using TLS. Your organization's AI provider API keys are encrypted at rest using AES-256-GCM.
• Tenant Isolation: Every database query is limited to the requesting organization in code, and composite foreign keys prevent one organization's records from referring to another's.
• Access Controls: Role-based access (Admin, Usage, Compliance, and Manager roles, with optional group-limited views), multi-factor authentication required at sign-in (for single sign-on, by your organization's identity provider), and automatic sign-out after 15 minutes of inactivity.
• Audit Logging: Security-relevant actions are recorded in an append-only, hash-chained, and signed audit log that is anchored outside the database every hour.
• Application Security: Dependency and container image vulnerability scanning in our build pipeline, and a runtime image without npm, npx, or corepack.
• Data Minimization: Conversation text is never stored, and raw sensitive values are never stored, only masked excerpts and keyed fingerprints.

7.2 Organizational Safeguards

• Our security controls are designed around NIST SP 800-171.
• Access to production systems is restricted to the minimum necessary.
• We maintain procedures for responding to security incidents, including breach notification (see Section 13).

While we strive to protect your information, no method of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee absolute security but are committed to promptly addressing any security incident.

We use a small number of cookies and browser storage items. We do not use advertising cookies or analytics cookies. Visits to our public website are counted without cookies, as described in Section 2.3.

The first time you visit, a banner asks which optional cookies we may use: accept all, keep only the strictly necessary ones, or choose for each kind. Optional cookies are set only after you agree. You can change your choice at any time from Cookie settings at the bottom of our pages or in the application's Settings.

8.1 Strictly Necessary Cookies

• Sign-In: Our authentication provider, Clerk, sets cookies that keep you signed in and protect your session. The Services cannot function without them.
• Plan Choice: A cookie, kept for 1 day, that remembers the plan you picked on the pricing page while you sign up.
• Cookie Choice: A cookie, kept for 1 year, that remembers which optional cookies you allowed.

8.2 Functional Cookies (Optional)

• Time Zone: A cookie, kept for 1 year, that records your time zone so that times are shown in your local zone. Without it, times are shown in UTC.

8.3 Partner Referral Cookies (Optional)

• Referral: When you arrive through a partner's referral link, a cookie, kept for up to 60 days, that remembers the partner's referral code so that the organization you create is credited to that partner. It holds only the code, not information about you, and is removed once your organization is created.

8.4 Browser Storage

• The Services store a value in your browser's local storage so that the 15-minute idle sign-out applies across all of your open tabs.
• Two short-lived values are kept in session storage, so that a page is not reloaded more than once (after an update, or when your time zone changes). They are removed when you close the tab.

8.5 Managing Cookies

Besides Cookie settings, you can block or delete cookies and browser storage through your browser settings. Blocking strictly necessary cookies will prevent you from signing in.

Depending on your jurisdiction, you may have the following rights regarding your personal information:

9.1 General Rights

• Right to Access: You may request a copy of the personal information we hold about you.
• Right to Rectification: You may request correction of inaccurate or incomplete personal information.
• Right to Erasure: You may request deletion of your personal information, subject to certain legal exceptions.
• Right to Data Portability: You may request a machine-readable copy of your personal information.
• Right to Restrict Processing: You may request that we limit the processing of your personal information under certain circumstances.
• Right to Object: You may object to processing based on legitimate interests.
• Right to Withdraw Consent: Where processing is based on consent, you may withdraw consent at any time.

9.2 California Residents (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA):

• Right to Know: You may request details about the categories and specific pieces of personal information collected, the sources of collection, the purposes for collection, and the categories of third parties with whom it is shared.
• Right to Delete: You may request deletion of personal information collected from you, subject to certain exceptions.
• Right to Opt-Out of Sale/Sharing: PonoAudit does not sell personal information. We do not share personal information for cross-context behavioral advertising.
• Right to Non-Discrimination: We will not discriminate against you for exercising any of your CCPA/CPRA rights.
• Right to Limit Use of Sensitive Personal Information: You have the right to limit the use of sensitive personal information to what is necessary to provide the Services.

9.3 European Economic Area, UK, and Swiss Residents (GDPR/UK GDPR)

If you are located in the EEA, UK, or Switzerland, you have the rights described in Section 9.1 above under the General Data Protection Regulation (GDPR) or UK GDPR. You also have the right to lodge a complaint with your local data protection authority if you believe your rights have been violated.

9.4 Employees of Our Customers

If your employer uses PonoInsights, your employer controls the information the Services process about your use of AI. Please direct requests about that information to your employer. If you contact us, we will refer your request to your employer and assist your employer in responding to it as required by law.

9.5 Exercising Your Rights

To exercise any of these rights, please contact us at privacy@ponoaudit.com. We will respond to your request within the timeframe required by applicable law (typically 30 days for GDPR and 45 days for CCPA requests). We may need to verify your identity before processing your request.

PonoAudit is operated from the United States, and the Services and their data are hosted in the United States. If you access the Services from outside the United States, your information will be transferred to, stored in, and processed in the United States.

For transfers of personal data from the EEA, UK, or Switzerland, we rely on appropriate safeguards, including Standard Contractual Clauses (SCCs) approved by the European Commission, adequacy decisions, and other legally recognized transfer mechanisms.

We ensure that any international data transfer is subject to appropriate safeguards to protect your personal information in accordance with this Privacy Policy and applicable data protection laws.

Our Services integrate with third-party services and may contain links to third-party websites. This Privacy Policy does not apply to third-party services, and we are not responsible for the privacy practices of those third parties.

11.1 Single Sign-On (SSO)

When your organization uses SAML or OIDC single sign-on with its own identity provider, we receive limited profile information as authorized by that provider. Single sign-on confirms who you are; your access to the Services still comes from an invitation or an administrator's approval.

11.2 AI Provider Connections

When your organization connects its Anthropic or OpenAI account, the data exchanged is governed by both this Privacy Policy and your organization's agreements with that provider. The Services only read from those accounts, and access only the data needed to produce your organization's reports and compliance scans.

11.3 AI Service Providers

We use Anthropic's API, with our own key, only for the optional leadership briefing. We apply data minimization: a briefing request contains only aggregate numbers, such as counts, team names, and policy names, and the names of AI products, models, skills, connectors, and plugins, and no names of people, email addresses, project names, excerpts, or conversation text.

Our Services are offered to organizations and are not directed to individuals under the age of 16, and we do not knowingly collect personal information from children. If we become aware that we have inadvertently collected personal information from a child, we will take steps to delete such information promptly. If you believe a child has provided personal information to us, please contact us immediately at the email address provided below.

In the event of a data breach that affects personal information, we will notify affected customers, and individuals and the relevant supervisory authorities where we are required to, as required by applicable law. Where a breach affects information we process on a customer's behalf, we will notify that customer without undue delay so that it can meet its own obligations. Our notification will include:

• The nature of the breach and the types of data affected.
• The measures we have taken or propose to take to address the breach.
• Recommendations for steps you can take to protect yourself.
• Contact information for our privacy team for further inquiries.

We aim to notify within 72 hours of becoming aware of a qualifying breach, consistent with GDPR requirements and in compliance with all applicable breach notification laws.

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or other factors. When we make material changes, we will notify you by posting the updated policy on our website and, where appropriate, sending you a notification via email or through the Services.

The "Last Updated" date at the top of this Privacy Policy indicates when it was most recently revised. We encourage you to review this Privacy Policy periodically to stay informed about how we are protecting your information.

Your continued use of the Services after any changes to this Privacy Policy constitutes your acceptance of the updated policy.

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

PonoAudit, LLC

Email: privacy@ponoaudit.com

Website: https://ponoaudit.com

Data protection inquiries from the European Economic Area, the UK, or Switzerland may be sent to the same email address.

If you are not satisfied with our response to your privacy concern, you have the right to lodge a complaint with your local data protection authority.

16.1 Data Processor Role

When PonoAudit processes information on behalf of a customer, such as the usage data and conversation-derived values read from the customer's AI accounts about its employees, the customer is the data controller and PonoAudit acts as a data processor (or service provider, under applicable U.S. state laws). The customer is responsible for having an appropriate legal basis for that processing and for giving its employees any notices that applicable law requires. We process such information only as instructed by the customer and in accordance with our agreement with the customer. A Data Processing Agreement (DPA) is available on request.

16.2 Aggregate and De-Identified Data

We may create aggregate or de-identified data from the information we collect. Aggregate and de-identified data is not considered personal information and may be used for any lawful purpose, including improving our Services.

16.3 Do Not Track Signals

Our Services do not currently respond to "Do Not Track" (DNT) signals from web browsers. Because we do not use advertising or third-party analytics cookies, we do not track you across other websites.