Privacy Policy

Information about visitors to screenata.com, people who fill in our forms, book meetings, subscribe to our updates, or administer a Screenata account. For this information we are the controller — we decide why and how it is processed — and this Privacy Policy governs it in full.

Evidence, screenshots, documents, policies, personnel records, and other content that a customer uploads to or generates within the Screenata platform (“Customer Data”). For Customer Data we act as a processor on the customer’s instructions. Our handling of it is governed by our agreement with that customer and by our Data Processing Addendum, not by this Privacy Policy. If you are an employee or contractor of a Screenata customer and want to exercise rights over your own data, contact your employer — we will refer your request to them.

• Contact data. Your name, work email address, company name, job title, and phone number, including when you request a demo, book a meeting, or contact support.
• Account data. The username, password, and profile details you set when establishing a Screenata account, along with your role and permissions within your organization’s workspace.
• Assessment and tool data. Answers you enter into our free tools, such as the SOC 2 readiness assessment, together with the name, email, and company you supply to receive the resulting report.
• Communications data. The content of your exchanges with us by email, support form, chat, or scheduled call, and the metadata that accompanies them.
• Billing data. For paid plans, the billing contact and payment details needed to complete a transaction. Card details are collected and processed by our payment processor; we do not store full card numbers.
• Marketing data. Your preferences for receiving communications from us and your engagement with them.

• Device data. Browser type and version, operating system, screen resolution, device type, language settings, IP address, and approximate location derived from it (city or region level, not precise geolocation).
• Online activity data. Pages viewed, time spent, referring site, navigation paths, access times, and whether you opened our emails or clicked links in them.

Most of this is collected through cookies and similar technologies. See our Cookie Notice for the specific tools involved and how to control them.

We may combine what you give us with information from business data providers, public sources such as company registries and professional networks, our partners and event co-sponsors, and parties involved in a prospective corporate transaction.

Please do not send us government-issued identification numbers, financial account numbers, health information, biometric or genetic data, or information revealing racial or ethnic origin, political opinions, religious beliefs, or trade union membership, except where the Service specifically asks for it. If you submit sensitive personal information to us anyway, you consent to our processing it as described here.

When you use an AI-powered feature, the content you submit to that feature — including chat messages, prompts, and the evidence, screenshots, and documents the feature needs in order to respond — is transmitted to third-party model providers that we engage as subprocessors, for the sole purpose of generating a response back to you. Those providers are OpenAI, Anthropic, Fireworks AI, and Google (Gemini), and they are named in full, alongside every other subprocessor, in Annex 2 of our Data Processing Addendum.

We contractually prohibit our model providers from using your content, or any Customer Data, to train or improve their generalized AI models. We do not sell your content, and we do not use Customer Data to train our own models.

We may create aggregated, de-identified, or anonymized data from information we hold, by removing what makes it identifiable to you or your organization, and we will not attempt to re-identify it. We may use and share that data for lawful business purposes such as analyzing and improving the Service and reporting on industry benchmarks.

We do not use your personal information to make automated decisions that produce legal or similarly significant effects about you. Screenata produces drafts, findings, and recommendations; a person on your team reviews and approves them.

These third parties process personal information on our behalf and under contract. The following receive information collected through screenata.com:

Subprocessors that handle Customer Data within the Screenata platform, including our cloud infrastructure and AI model providers, are listed in our Data Processing Addendum. Customers are notified before we add a new one.

• Professional advisors. Lawyers, accountants, auditors, bankers, and insurers, where reasonably necessary.
• Authorities. Law enforcement, courts, regulators, and other public authorities where required by law or where we believe disclosure is necessary to protect rights, safety, or property.
• Business transaction partners. A counterparty, acquirer, successor, or assignee in connection with a merger, financing, acquisition, sale of assets, insolvency, or similar transaction. We will seek to ensure any recipient honors this Privacy Policy.
• Parties you direct. Anyone you instruct us to share with, including when you connect a third-party integration to your workspace.

We collect these categories for the purposes described in How we use your personal information, and retain them as described in Retention.

• Know and access. Request the categories and specific pieces of personal information we have collected about you, the sources, the purposes, and the categories of third parties we disclose it to.
• Correct. Ask us to correct inaccurate personal information.
• Delete. Ask us to delete personal information we collected from you.
• Portability. Receive a copy in a portable, machine-readable format.
• Opt out. We do not sell personal information, do not share it for cross-context behavioral advertising, and do not use it for targeted advertising or for profiling that produces legally significant effects — so there is nothing to opt out of. If that ever changes, we will update this notice and provide a mechanism before doing so.
• Appeal. If we deny your request, you may appeal by replying to our decision. We will respond in writing with our reasoning within the period the applicable law allows, and tell you how to complain to your state attorney general.
• Non-discrimination. We will not discriminate against you for exercising any of these rights.

Email support@screenata.com with the subject line “Privacy Request.” So that we do not disclose your information to someone else, we will verify your identity by matching the details you provide against our records and, for account holders, by confirming control of the registered email address. An authorized agent may submit a request on your behalf with written proof of authorization. We cannot process a request that lacks enough detail for us to confirm your identity or understand what you are asking for.

WOX LLC is the controller of the personal information covered by this Privacy Policy for the purposes of the EU and UK GDPR. Our contact details are in How to contact us.

European data protection law gives you the right to ask us to: give you access to your personal information and information about how we process it; correct inaccuracies; delete it where there is no good reason for us to keep processing it; transfer a machine-readable copy to you or a third party; restrict processing, for example while accuracy is being established; object to processing based on our legitimate interests, and to direct marketing at any time; and withdraw consent where we rely on it, without affecting processing carried out before the withdrawal.

Submit a request by email to support@screenata.com or by post to the address below. We may ask for information to confirm your identity. If we reject a request in whole or in part, we will explain why, subject to legal restrictions.

If you are not satisfied with how we have handled your information or your request, you can complain to the data protection regulator where you live or work. In the UK that is the Information Commissioner’s Office, Water Lane, Wycliffe House, Wilmslow, Cheshire SK9 5AF, +44 303 123 1113, ico.org.uk. In the EEA, contact details for each national authority are published by the European Data Protection Board.

We are a U.S.-based company, and many of our service providers are based in the U.S. too, so using the Service means your personal information will be accessed and processed in the U.S. The U.S. is not the subject of a general adequacy decision, which means European authorities do not treat its legal regime as providing protection equivalent to European law.

Where we transfer personal information out of Europe to a country without an adequacy decision, we rely on appropriate safeguards — principally the European Commission’s Standard Contractual Clauses, together with the UK International Data Transfer Addendum where the UK GDPR applies — or, in limited cases, on a permitted derogation such as your explicit consent. You can ask us for further information on the mechanism used, and for a copy of the relevant safeguards, at support@screenata.com.