Privacy Policy

1. Information we collect

• Account information: Your name, email address, role, and password credentials, and details about your organization such as its name, industry, and number of employees.
• Your Content: The information you enter or upload while using the Service, including business details, asset information, objective responses, evidence files, and the documents, SSP, and POA&M generated from them.
• Billing information: Payments are processed by Stripe. We receive limited billing details, such as subscription status and the last digits of a payment card. We do not receive or store full card numbers.
• Usage and technical data: Log data such as IP address, browser and device type, pages and features used, and timestamps, collected for security, troubleshooting, and service improvement.
• Cookies: We use cookies according to your choices in our cookie banner. See our Cookie Policy for the full list.
• Communications: Messages you send us, such as support requests.

2. How we use information

We use information to:

• Provide, maintain, and secure the Service, including authentication and multi-factor authentication.
• Generate the policies, procedures, documents, SSP, POA&M, and score estimates you request.
• Process payments and manage your subscription.
• Respond to support requests and send service and billing notices.
• Monitor, troubleshoot, and improve the Service.
• Comply with legal obligations and enforce our Terms.

We do not sell your information.

3. AI processing

To draft and personalize content, the Service sends relevant parts of Your Content to a third-party AI provider, OpenAI, through its programming interface (API). OpenAI processes the content on our behalf to return results to us. Under OpenAI's API terms, your content is not used to train its models, and we do not permit it. OpenAI handles data under its own privacy and data policies, which you can review on its website. AI-generated content is a suggestion that you must review before relying on it.

4. Sharing of information

We do not share your information with third parties for their own purposes. We share it only in these cases:

• Service providers that process information on our behalf, namely hosting, payment processing (Stripe), and AI processing (section 3), under obligations to protect it.
• Legal and safety: where required by law, legal process, or to protect the rights, property, or safety of Phebsoft, our users, or others.
• Business transfers: in connection with a merger, acquisition, or sale of assets, with notice where required.

We may in the future list third-party auditors within the Service. We will not share your information with them. Whether to contact an auditor is your decision, and any resulting relationship is between you and that auditor.

5. Where your information is stored

Our servers are located in the Netherlands, and your information is stored and processed there. If you access the Service from outside the Netherlands, including from the United States, your information will be transferred to and processed in the Netherlands.

6. Information you should not upload

The Service is not designed to store Controlled Unclassified Information (CUI), export-controlled data (such as ITAR-controlled technical data), or classified information. Do not enter or upload it, and redact it from evidence files such as screenshots and configuration exports. Evidence you upload may contain sensitive security information about your systems, and you are responsible for deciding what to upload.

7. Security

We use reasonable administrative, technical, and organizational safeguards, including required multi-factor authentication on every account and logical separation of each organization's data from others. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. Please protect your credentials and tell us promptly if you suspect unauthorized access.

8. Retention and deletion

We keep your information while your account is active. If your subscription ends, your data remains in your account but is accessible only as described in our Terms. If you do not log in to your account for one year, we may delete your account and associated data, and we will try to email you before doing so. You may also ask us to delete your account at any time. After deletion we may retain information where required by law, for legitimate business records, or in backups until they are overwritten in the ordinary course.

9. Your rights and choices

Depending on where you live, you may have rights over your personal information, such as rights to access, correct, delete, or obtain a copy of it, and to opt out of certain uses. You can manage cookies through the cookie banner. To exercise your rights, contact us using the details below. We may need to verify your identity, and we will respond within the time required by law.

10. Children

The Service is intended for businesses and is not directed to anyone under 18. We do not knowingly collect information from minors.

11. Changes to this policy

We may update this policy from time to time. We will post the updated version with a new effective date and, for material changes, notify you by email or in the Service.