Privacy Policy

GOVERNBOX.ai (“the Service,” “we,” “us”) is a product of Gradient Descent LLC (“Gradient Descent,” “the Company”), a privately held company that develops and operates software services. The Service helps organizations such as nonprofits, associations, public-sector bodies, and small and mid-size businesses build and maintain governance programs.

The Service is organized into five modules. Four are licensed individually or together — AI Governance, Enterprise Risk Management, IT Inventory & Management, and Data Management — and each collects a different category of information, described in Section 2. The fifth, Privacy, is included with the Professional and Agency plans rather than licensed separately, and collects no category of information beyond those described for the other modules.

This policy explains what personal information we collect through the Service, why we collect it, how it is used and shared, and the choices and rights available to you.

This policy applies to the Service itself. It does not apply to Gradient Descent LLC’s other activities, or to the separate federal service of Gradient Descent’s founder, which is entirely unrelated to the Service.

Our relationship to personal information differs depending on whose information it is:

• Where we act as a controller (we decide why and how information is used): account and identity information about the individuals who sign in to the Service; billing information; prospect and marketing information collected through our public website and free tools; and our own analytics and advertising data.
• Where we act as a processor (your organization decides why and how, and we act on its instructions): the governance content your organization enters into the Service, including information your organization records about its own personnel and other individuals. For example: staff members it enrolls in a policy attestation, individuals named as system owners, individuals whose privacy requests it logs, or its people whose use of AI tools is reported by our browser extension (Section 3.12). Your organization is the controller of that information and is responsible for having a lawful basis to provide it to us.

3.1 Account and identity information. When you or your organization sign up, we collect information through our authentication provider (Clerk): name, email address, and organization/workspace membership. We store your access role and account status (active, invited, suspended) directly, along with the date of your most recent sign-in.

The roles available in the Service are Owner, Admin and Member. The person who creates an organization is its Owner; an Owner or Admin invites people and chooses whether each is an Admin or a Member. Admins manage the organization’s account and settings; Members use the Service’s modules.

3.2 Organization profile information. During onboarding and in the Organization Profile settings, your organization provides: organization name, sector, size, data sensitivity level, risk appetite, fiscal year start, mission statement, selected compliance frameworks, an optional organization logo, and contact details for a primary business contact (name, title, business email address, business phone number, website).

3.3 Billing information. Subscription billing is operated by Clerk Billing, which settles payment through Stripe as its own downstream processor. We store your subscription tier, module entitlement, billing interval, plan identifier, and customer/subscription identifiers. We never receive or store payment card numbers. Those are handled entirely within the Clerk and Stripe environments under their own privacy policies.

3.4 Governance content your organization submits. The core of the Service is content your organization enters to generate governance artifacts. Depending on the modules licensed, this includes:

• AI Governance: AI use case inventory entries, risk register entries, impact assessment responses, AI project and AI agent inventory records, incident log entries, training plan records, policy documents and the inputs used to generate them, cost records, and Readiness Scorecard answers.
• Enterprise Risk Management: organization-wide risk register entries across risk categories, and key risk indicators including current values, thresholds, and review dates.
• IT Inventory & Management: device and hardware asset records, software subscription records (including seat counts, costs, and renewal dates), system records (including hosting, backup posture, single sign-on and multi-factor authentication status, and data classification), and access records.
• Data Management: data inventory entries, data flow records (including cross-border transfer indicators and processors), retention schedules, and individual rights request (DSAR) records.

3.5 Information your organization records about individuals. Several features are specifically designed to record information about people, most of whom are not users of the Service. Your organization is the controller of this information. Specifically:

• Attestation roster. To run a policy attestation campaign, your organization uploads a roster of staff consisting of name, business email address, and department by typing them into a text field or importing a spreadsheet. Roster members do not have accounts and do not sign in; they receive a unique one-time link by email.
• Attestation signatures. When a person completes an attestation, we record the name they type as their signature and the date and time. This record is intentionally permanent and cannot be edited or re-signed, because its purpose is to serve as evidence. The signer’s email address is also written to your organization’s audit log (see Section 3.9).
• Training completion. Completion of a training item can be recorded against each person on that same roster. Training records may also contain a free-text trainee name.
• IT access records. The IT module records a person’s name, business email address, which systems they can access, their access level, and whether and when they were offboarded.
• Individual rights requests. The Data Management module records the name and email address of the person making a privacy request to your organization, the type of request, the applicable legal regime, deadlines, and free-text notes and resolution details about that person’s request.
• Named individuals throughout. Many records include a free-text field naming a responsible person — for example a use case owner, risk owner, task assignee, data steward, system administrator, or the name and title of the person approving a policy document.
• External document reviewers. If your organization shares a document for review using a share link, anyone holding that link can submit a comment along with their name and email address, without signing in.

3.6 Prospect and marketing information. We collect information from visitors to our public website who are not customers:

• Readiness Scorecards (AI, Risk, IT, and Data): your answers, resulting score, and — to see your full results — your business email address, and optionally your name.
• Gated content: your business email address, and optionally name and organization, to download our executive briefing.
• Module waitlists and Regulatory Watch digest signups: business email address, optionally first name and organization, your topic and jurisdiction interests, and whether you affirmatively consented to marketing email.
• Contact and demonstration requests: name, business email address, organization, industry, and the content of your message. Some of our contact forms are hosted by our CRM provider and submit directly to that provider rather than to us.

We require a business email address for these forms and reject addresses from disposable/temporary email services. Rejected submissions are discarded and no record is retained.

3.7 Usage and product analytics. We use PostHog to record product usage events — for example which features are used, and when a document is generated and exported. When you are signed in, these events are associated with your user identifier, email address, and name, so that we can understand how individual accounts adopt the product. These events do not include the substantive content of the governance documents or records you create.

Website analytics. On our public website we also use HeyCatch to measure how visitors find and use our marketing pages and free tools: the pages viewed, the links and buttons clicked, the page you arrived from, and the campaign that brought you. HeyCatch stores your IP address with these events and derives an approximate location from it. It runs on public pages only. It sends nothing from inside the signed-in Service, and nothing from attestation links, shared-document links, Trust Pages, or a learner’s course link; if one of those links appears in an event from a public page (for example as the page you came from), its private part is masked in your browser before anything is sent. Opting out of analytics in the banner on our website stops it, including on the page you are viewing.

Session recordings. On our public website — our marketing pages and the free Readiness Scorecards — we also record a visual replay of the browsing session (page views, mouse movement, clicks, scrolling, and navigation) through the same product analytics provider. We do not record sessions anywhere inside the signed-in Service, so pages showing your organization’s governance records are never captured. On the public pages where recording does occur, all page text and every form field value are masked in your browser before anything is transmitted, so the characters you type are not captured in the recording; information you deliberately submit through a form is handled as described in Section 3.6. Recordings are retained for 30 days and then deleted. You can prevent recording entirely by opting out of analytics in the banner shown on our website; opting out also stops any recording already in progress.

3.8 Advertising, attribution, and cookies. Our public website loads third-party tags for advertising measurement and analytics, including Google Tag Manager (which in turn may load Google Analytics, the Meta pixel, and the LinkedIn Insight Tag) and a Google Ads conversion tag. We also store, in your browser’s local storage, the marketing campaign parameters and advertising click identifiers (including Google, Meta, and LinkedIn click identifiers), the page you first landed on, and the referring website. These are recorded on your first visit and retained until you clear your browser storage.

When an account is created, we send a conversion event to Google Ads that includes the account holder’s email address (Google’s “enhanced conversions” feature) together with a plan identifier and value. Campaign and click identifiers are also transmitted to our CRM alongside a submitted lead.

Website visitor identification. Our public website also loads a website-visitor tracking tag from Apollo.io. This tag does something different from the advertising tags described above, and we want to be direct about it: rather than counting an anonymous visit, it attempts to work out who is visiting. It sends your IP address and the pages you view to that provider, which matches them against its own third-party business datasets to identify the organization you are browsing from and, where its data allows, an individual and their business contact details — even if you have never contacted us, filled in a form, or clicked one of our emails. Any identification it returns is used for one purpose: so that our sales team can follow up with organizations that have shown interest in the Service.

Three limits apply to this tag, and they are enforced in our code rather than left to configuration:

• Public pages only. It runs on our marketing pages and free tools. It does not run anywhere inside the signed-in Service, so it is never active on a page showing your organization’s governance records.
• Never on pages your organization shares with its own people. It is disabled on attestation links, shared-document links, and Trust Pages. Someone signing an attestation for their employer, or an auditor reading a document you shared, is that organization’s audience — not a prospect of ours — and we do not attempt to identify them.
• It respects the opt-out. If you opt out of analytics using the banner on our website, this tag does not load. Because a script already running in the page you are currently viewing cannot be recalled, an opt-out takes full effect from your next page view onward.

Under some U.S. state privacy laws, including California’s, this kind of identification may be treated as “sharing” or a “sale” of personal information even though no money changes hands. The banner opt-out described above is how you exercise that right on our website; Section 10 describes your rights more fully, and Section 16 tells you how to reach us if you would rather we deleted any identification already recorded about you.

3.9 Audit log. Every create, edit, export, approval, and role-change action within your organization is recorded in an append-only audit log (actor, action, entity type, entity identifier, timestamp, and a short description). Through the Service, these entries cannot be modified or deleted by your organization or by us; the database enforces this directly. The log exists to give your organization a reliable accountability record. Note that audit entries can contain an email address — for example, the email of a person who completed an attestation, or of a person who was invited to the account.

3.10 Communications. If you contact us for support, book an advisory session, request a demonstration, or subscribe to a newsletter, we collect the information you provide in that communication.

3.11 Information we do not collect. We do not store IP addresses or device fingerprints. Within the Service, an IP address is used transiently, in memory only, to rate-limit public endpoints, and is never written to our storage. Our product analytics provider discards the IP address of website and product usage events rather than storing it; before discarding it, that provider derives and retains an approximate location — country, region, city, and time zone — which we use to understand where interest in the Service comes from. Third-party advertising and analytics tags loaded on our public website receive your IP address directly, as described in Section 3.8, and the website analytics provider described in Section 3.7 stores it with the events it records. One of them — the visitor-identification tag described in that section — receives it specifically in order to identify you, which is a different matter from the transient, in-memory use described above; that provider, not us, performs and stores that identification. We do not store payment card numbers. We do not have a phone number field on customer records other than the single business contact number in the organization profile and, where provided, on a demonstration request.

• Provide, operate, and maintain the Service, including authenticating users and enforcing access controls
• Generate governance documents by retrieving entries from our control library and using an AI model to tailor and phrase that language to your organization’s context (Section 5)
• Evaluate generated documents against regulatory requirements and surface coverage gaps and regulatory changes affecting your documents
• Process payments and manage subscriptions and module entitlements
• Deliver policy attestation invitations to the roster your organization provides, and record completion
• Provide customer support and respond to inquiries
• Monitor for and prevent fraud, abuse, and security incidents
• Improve and develop the Service, using aggregated or de-identified data wherever possible
• Send administrative communications (billing notices, security alerts, service updates) and, where you have opted in, marketing communications
• Measure the effectiveness of our advertising, attribute signups to marketing campaigns, and manage our sales pipeline
• Comply with legal obligations and enforce our Terms of Service

Generating a governance document involves sending relevant portions of your organization’s profile and inputs to a third-party large language model (currently Anthropic’s Claude, with Google’s Gemini as an automatic failover engine used only when the primary provider is unavailable) and to a third-party embedding provider used for semantic search across our control library. This is necessary to tailor plain-language document text to your organization.

Three commitments govern this process:

• Grounded generation only. The model retrieves and rephrases controls from our proprietary, human-authored control library. It does not invent new compliance controls, and every generated clause is required to cite a specific control from the library. Where retrieval finds nothing relevant, the Service is designed to say so rather than fabricate language.
• No training on your content. Your content is not used to train or fine-tune any AI model — ours or any third party’s. It is submitted to the AI provider solely to generate your requested output.
• Separation of generation from verification. Documents are drafted only from our control library. A separate, independent process compares the draft against the text of official regulations and standards to flag possible gaps. Official regulatory text is never used as source material for drafting.

Generated documents are always presented for human review before they are finalized or exported. The Service does not represent AI-generated output as legal or compliance advice.

We do not sell your organization’s governance content, and we do not sell personal information in exchange for money. Note that “sale” and “sharing” are defined broadly under some U.S. state privacy laws and can cover exchanges where no money changes hands — see Section 6.9, which describes the one activity on our public website that may fall within those definitions. We share information as follows:

6.1 Service providers. We use a limited number of third-party providers to operate the Service. Each is contractually and technically limited to using information only as necessary to perform its function for us. As of this revision they perform the following functions: identity and authentication; subscription billing and payment settlement; application and database hosting; AI document generation; semantic search embeddings; transactional email delivery; product analytics; error monitoring; customer relationship management; interactive product demonstrations; advertising measurement; and website visitor identification and sales outreach.

6.2 Advertising and analytics providers. As described in Section 3.8, information including an email address, campaign identifiers, and advertising click identifiers is transmitted to advertising and analytics providers. See Section 10 for the choices available to you.

6.3 Sales and customer relationship management. Information you submit through our public forms and the business contact details in a customer’s organization profile is synchronized to our CRM so we can respond and manage the customer relationship. This includes name, business email address, business phone number where provided, job title, organization details, and the marketing campaign that led to the inquiry.

6.4 Attestation delivery. When your organization launches an attestation campaign, we transmit each roster member’s name and email address to our transactional email provider in order to deliver their individual attestation link.

6.5 Advisory hand-off. If you click a “talk to an expert” call-to-action, a summary of your organization’s profile and identified gaps is sent to our sales pipeline so a member of our team can follow up with product support and guidance. This only happens when you initiate it.

6.6 Legal and safety. We may disclose information if required by law, subpoena, or other legal process, or where we believe in good faith it is necessary to protect the rights, property, or safety of Gradient Descent, our users, or the public.

6.7 Business transfers. If Gradient Descent is involved in a merger, acquisition, financing, or sale of assets, information may be transferred as part of that transaction, subject to this policy or a successor policy of which you will be notified.

6.8 Platform administration. A small number of authorized Gradient Descent staff have cross-tenant administrative access for support and platform-maintenance purposes. Every platform-administrator action is written to your organization’s audit log so it is visible to you.

6.9 Website visitor identification. As described in Section 3.8, when you browse our public website your IP address and the pages you view are transmitted to our visitor-identification provider, which returns the organization and, where its data allows, the individual it believes is behind the visit. We receive and retain that identification in our sales tooling in order to follow up. This applies to our public marketing pages only, never to the signed-in Service, and never to attestation links, shared documents, or Trust Pages. Depending on your state, this may be “sharing” or a “sale” of personal information; you can stop it using the opt-out on our website, and Section 10 sets out your rights.

6.10 Partners your organization engages. If your organization engages one of our program partners (a managed service provider, virtual CIO/CISO practice or consultancy) to run its governance program, named individuals at that firm can open your organization’s workspace from their own GOVERNBOX sign-in. They work through a partner seat that appears in your user list labelled with the firm’s name and, unless a narrower level is set, has the same permissions as your organization’s Owner, including reading, changing and exporting your organization’s records. If your organization requires two-step sign-in, the partner’s personnel must use it too. Every time a partner opens your workspace, and every change it makes, is recorded in your organization’s audit log, attributed to both the partner firm and the individual. A partner gets this access when it provisions your workspace for you, or, for an existing workspace, when one of your administrators authorizes it in writing. The access ends when your relationship with the partner ends, or sooner if you ask us at info@governbox.ai. The partner is your organization’s service provider, and its use of your information is also governed by your own agreement with it.

Two features publish information at your organization’s election:

• Trust Page and badge. If your organization publishes a Trust Page, a public web page becomes available at an unlisted address showing your organization’s name and sector, governance maturity scores, the framework names you have selected, counts of approved documents and inventory records, the generic types of documents you have approved (never their titles or contents), the date of your most recent approval, and your attestation completion rate and the campaign name you chose. No individual’s name and no document content is published. You can unpublish at any time, and the page automatically stops presenting your organization as current if your subscription lapses.
• Document share links. If you share a document for external review, anyone holding the link can read the full document and submit a comment with their name and email address. Treat these links as sensitive.

Your organization’s data is logically isolated from every other organization’s data using per-tenant access controls enforced both in application code and at the database level, through a database account that has no ability to bypass those controls. The isolation fails closed: a request without a valid organization context returns no records rather than another organization’s records. No organization can query or view another organization’s records through the Service. Authorized platform administrators are the documented exception described in Section 6.8. A partner your organization engages works inside your workspace as described in Section 6.10; it reaches only the workspaces of clients that engaged it, one at a time, under the same controls.

We retain information for as long as your account is active or as needed to provide the Service. We want to be precise about what deletion currently means:

• Deleting a record in the Service marks it inactive and removes it from the application. Most records are not immediately erased from the underlying database.
• Closing an organization account marks the organization inactive and ends access. It does not, by itself, erase the organization’s underlying records.
• We do not currently operate an automated retention schedule or purge process, except for the browser extension’s usage records, which are deleted automatically on the schedule described in Section 3.12. Otherwise, complete erasure of a specific record or of an organization’s data is performed manually on request.
• Audit log entries are retained permanently and are not deleted when the underlying record is deleted, because the log is designed as an append-only accountability record.
• Attestation records are retained permanently as evidence, including the signer’s typed name and the timestamp.
• Backups. Residual copies persist in encrypted backups and transaction archives after deletion from active systems, and are removed on our hosting provider’s backup retention cycle.

You can export your organization’s data at any time through the Admin Console, and account Owners can initiate deletion of organizational data through the Admin Console. To request complete erasure, contact us using Section 16 and we will process it manually.

All users. You may access, correct, or request deletion of your account information by contacting us or, where available, directly within the Service. You may opt out of marketing email at any time using the unsubscribe link; you will still receive administrative and billing communications necessary to the Service.

Individuals whose information was entered by an organization. If your employer or another organization has recorded information about you in the Service — for example on an attestation roster, in an access record, or in a privacy request log — that organization, not Gradient Descent, controls that information. Please direct access, correction, and deletion requests to that organization. If you contact us directly, we will refer you to them and will assist them in responding.

European Economic Area, UK, and Switzerland (GDPR). You have the right to access, rectify, erase, or port your personal data, to restrict or object to certain processing, and to lodge a complaint with your local supervisory authority. Our lawful bases include performance of a contract (providing the Service), legitimate interests (securing and improving the Service, and direct marketing to business contacts), and consent (marketing communications).

California and other U.S. state privacy laws. California residents have the right to know what personal information we collect and how it is used, to request deletion, to correct inaccurate information, to limit the use of sensitive personal information, and to opt out of the sale or sharing of personal information. We will not discriminate against you for exercising these rights.

To exercise any of these rights, contact us at the address in Section 16. We may need to verify your identity before fulfilling a request.

The Service supports optional frameworks relevant to regulated data — including HIPAA, GDPR, and CCPA — to help you draft governance documentation that references those frameworks. Supporting a framework in generated documents does not mean the Service’s own infrastructure carries a corresponding certification. If your use involves protected health information, government records subject to special handling, or other regulated personal data, contact us before submitting that data so we can discuss whether appropriate contractual protections are in place.

We ask that you not enter sensitive personal data about identifiable individuals into free-text fields. Note the tension this creates with the Data Management module: a privacy request record inherently identifies the requester. Where you use that feature, record only what you need.

We apply administrative and technical safeguards designed to protect information, including:

• Encryption of data in transit between your browser and the Service
• Encryption at rest, as provided by our hosting provider’s managed database platform
• Per-tenant data isolation enforced at the database level through a least-privileged database account that cannot bypass it, verified to fail closed
• Role-based access to administrative functions
• An append-only audit log that cannot be altered through the application, enforced by the database itself
• Two-step sign-in, available on every account, which your organization can require
• Optional enterprise single sign-on (SAML/OIDC) for organizations on our Agency plan
• Error monitoring configured to exclude personally identifiable information; our backend explicitly disables the collection of such data in error reports
• Responses from our application programming interface are marked as non-cacheable so that one organization’s data cannot be served from a shared cache to another
• Automated daily backups with continuous transaction-log archiving

No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

Our infrastructure and service providers process data in the United States. Where we transfer personal data out of the European Economic Area, UK, or Switzerland, we intend to rely on appropriate safeguards such as Standard Contractual Clauses.

The Service is intended for business use by organizational personnel and is not directed to children. We do not knowingly collect personal information from individuals under 16.

We may update this policy from time to time. If we make material changes, we will notify account Owners by email or through an in-app notice before the changes take effect. The “Last updated” date at the top reflects the most recent revision.

Gradient Descent LLC
GOVERNBOX.ai
8609 Westwood Center Drive
Suite 110 PMB 1035
Tysons Corner, VA 22182
United States
Email: info@governbox.ai
Phone: +1 703 594 7096
Web: gradientdescent.biz

For access, correction, or deletion requests, email info@governbox.ai with the subject line “Privacy Request,” or use our Contact page.