Legal

Privacy Policy

Effective Date: November 6, 2026

The Promise Alignment Company, LLC (“we,” “us,” or “our”) operates promisealignment.com and the Promise Alignment platform (the “Services”). This Privacy Policy describes how we collect, use, process, and protect personal and organizational data when you use our platform, website, and AI-powered diagnostic tools.

For the purposes of applicable data protection laws (such as GDPR and CCPA), when we process diagnostic data provided by a customer organization, our customer acts as the Data Controller (or Business), and The Promise Alignment Company, LLC acts as a Data Processor (or Service Provider).

1. Information We Collect

  • Account & Contact Data: When you register for an account, claim an organizational domain, or subscribe to a plan, we collect your name, business email address, company name, job title, and authentication credentials via our identity provider, Clerk.
  • Diagnostic Inputs & Customer Data: When you use the platform and Ask AI, we collect the diagnostic inputs, company context, operational promises, and messages you provide. We use this information to generate your Promise Audit, Cost of Drift analysis, and related platform insights.
  • Records From Tools You Connect: If you connect HubSpot or send us a file of records, we read the records described in section 4.
  • Public Information About Your Company: We read public web pages, customer reviews, news, and public filings about your company and its competitors to build your analysis.
  • Payment & Billing Information: Subscription payments are processed directly by our third-party billing provider, Stripe. We collect billing contact details, plan tier, and transaction history, but we do not collect or store full payment card numbers on our servers.
  • Usage & Telemetry Data: We collect standard technical information regarding your interactions with the platform, including access times, features utilized, report view counts, and device details.
  • Cookies & Tracking:
    • Essential Cookies: Strictly necessary cookies required for session management, user authentication (Clerk), and security. These cannot be disabled.
    • Analytics Cookies: Optional cookies set by Google Analytics (site performance and navigation) and Microsoft Clarity (session replay and heatmaps, with sensitive content masked). These load only after you grant consent via our cookie preferences banner. You may opt out or update your choices at any time via the “Cookie Preferences” link in our site footer.

2. How We Use Your Information

We process collected data to:

  • Operate, maintain, and deliver the Services, including generating Promise Audit and Cost of Drift reports.
  • Process payments, manage subscriptions, and send billing updates.
  • Communicate administrative notices, security alerts, and system updates.
  • Monitor system performance, protect against unauthorized access or impersonation, and secure our infrastructure.
  • Create anonymized, aggregated, and non-identifiable industry benchmarks as permitted under our Terms of Service. Records from a tool you connect are never used for benchmarks.

3. AI Processing & Third-Party AI Models

Our platform utilizes advanced AI models, including Claude developed by Anthropic, Inc., to power Ask AI and generate platform outputs.

  • Commercial API Processing: Diagnostic data processed by our AI subprocessors is transmitted securely via enterprise commercial API endpoints.
  • No AI Model Training on Customer Data: Inputs and customer data provided to our platform are not used by third-party AI providers (such as Anthropic) to train, fine-tune, or improve their foundation models.
  • Records From Connected Tools: Anthropic models check each record from a tool you connect for personal details and compare the records with your published promises, as section 4 describes.
  • Data Minimization: We pass only the data necessary to generate your analysis. Personal account credentials (e.g., passwords) are never transmitted to AI processing engines.

4. Tools You Connect

You can connect HubSpot to add your own records to your report. This section describes what we read, what we keep, and when we delete it.

  • What We Read: Your recently closed deals. For a lost deal, its lost reason. For a won deal, its won reason and deal type. For every deal, its amount, close date, and stage. The notes your team writes on those deals. If you allow it, the emails on those deals, and whether your team or your customer sent each one. For an email, only the newest reply. We also read cancelled subscriptions with their status, recurring amount, and end date. We read the type, amount, and close date of earlier won renewals, up to 3 years back, and your account’s currency to compare a renewal with the one before it. From these records we work out your yearly revenue and churn rate for Cost of Drift. If you allow it, your HubSpot conversations: each chat, help desk and inbox message, and whether your team or your customer sent it. If you allow it, your support tickets: each ticket’s subject and description, every email reply on it if you allow emails, whether your team or your customer wrote each one, and the ticket’s status. For an email, only the newest reply. We leave out a ticket’s internal notes. If you haven’t allowed support tickets, a note your team attached to both a deal and a ticket may be read as a deal note. Your product list: each product’s name, description, price, and billing terms. For each deal, and each cancelled subscription, the products it sold and the amount for each.
  • Who Each Record Belongs To: When you connect a tool, we read which company or contact each record belongs to, and that company’s web domain or that contact’s email address. We use them only to recognize the same customer in every tool you connect. We turn the domain or email address into a scrambled customer number, made with a secret key that only our servers hold. We never store the domain, the email address, or the tool’s own ID for the customer. A record with neither is left out, and we count it as unmatched. We never treat everyone at a public email provider, such as gmail.com, as one company.
  • Files You Send Us: You can send us a file of customer records from a tool we don’t connect to, and our team uploads it for you. From each row we read the customer’s email address or company web domain, the outcome (won, lost, cancelled or renewed), the amount, the date, the reason, and whether your team or your customer wrote it. We turn the email address or domain into the scrambled customer number described above, so a row about a customer from a tool you connect joins that customer. On the free import, a row about a customer outside those your first import brought in is left out, and we count it. On a paid plan, it comes in as a new customer. When a file isn’t laid out like our template, an AI model reads its column names and a few example values, with email addresses and phone numbers removed, to find these fields. We delete the file as soon as it’s read. Its records follow every rule in this section.
  • HubSpot: HubSpot asks you to let us read contacts and companies for this. We also use the products on a renewal and a cancellation to tell whether they are the same loss.
  • What We Never Request: Deal names, contact names, phone numbers, email subjects other than a support ticket’s, and calls. We remove names, email addresses, and phone numbers from email, note, conversation, and ticket text before we store it.
  • Permissions: HubSpot also asks you to let us read the list of fields on your deals. We do not use it. For tasks, HubSpot asks you to let us change contacts, because it has no narrower permission for tasks. We never create, change, or delete a contact.
  • What We Write: Only if you allow it, we write to your HubSpot in two ways. When someone on your team clicks Create in HubSpot on an action item, we create a task with the action item’s details, its due date and a link back, assigned to the HubSpot user you choose, and linked to your company’s record when your HubSpot has one. We keep the task’s ID to keep the two in step. After each import, we write a Promise alignment field onto each matching customer company: Drifting or Aligned, the promises behind it with the kind of record and its date, one summary sentence, the date we set it, and a link to your report. We never write a customer’s words, and we change nothing else in your HubSpot.
  • Personal Details: Before a record is stored, an AI model finds any person’s name, email address, or phone number in its text, and we replace each one with a placeholder. A record we cannot check is not stored.
  • Fingerprints: We keep a fingerprint of each record, made with a secret key that only our servers hold, to recognize a record we have already read. A fingerprint holds no text.
  • How Records Are Used: AI models compare your records with your published promises. The answers are kept apart from public evidence and never change the scores built from it. Your revenue, your churn rate, and the share of lost renewals tied to a drifting promise can price your Cost of Drift.
  • Your Products: We keep your product list and the products each deal sold, with their amounts. An AI model sorts each product as something you sell or as a fee, and links each one you sell to a promise on your Promise Stack, or to none. We keep each answer and reuse it until the product or your Promise Stack changes. When a deal sold more than one product, its amount is split across the promises by the amount of each product.
  • How Long We Keep Them: We keep your records while the tool is connected and your plan allows the import. We keep the records from a file while your plan allows the import.
  • When the Import Stops: If you disconnect the tool in Promise Alignment, we stop importing at once. If you stop paying, we stop within an hour. Your report goes back to public evidence. Reconnect or pay again within 90 days and your records are kept.
  • Deletion After 90 Days: 90 days after the import stops, we delete every record from the tool and everything made from it: the records, your product list and its links, the matching answers, the figures, and the drift counts built from them. This applies to free and paid accounts alike. Backup copies expire within 7 days of the deletion. Anthropic keeps what we send it for a limited period under its own terms. Tasks and Promise alignment fields we wrote stay in your HubSpot, and you can delete them there. We stop updating them when the import stops.
  • Your Own AI Tool: We send your report, including figures from a tool you connect, to an AI tool you connect through our MCP server. That tool’s own terms then apply.
  • What Stays After Deletion: A receipt for each record we read, which holds no text, only a fingerprint made with our secret key. The connection record: which HubSpot account or which file, who approved it, and when the import stopped. Counts of each import and its cost to us, and usage counts. Whether you have used your free import. For billing, a scrambled number for each customer a paid import evaluated, with the date. Your Ask AI conversations stay with your account and can repeat a figure from a connected tool.

5. Third-Party Subprocessors

To deliver our SaaS platform, we share limited data with trusted third-party service providers acting as our subprocessors:

  • Clerk: Identity management, authentication, and user security. Receives your name, business email address, and organization.
  • Supabase: Cloud database, data storage, and encrypted data hosting. Holds the data we store.
  • Anthropic: AI processing for Ask AI, the reports, and records from tools you connect. Receives your company context, public information about your company, your Ask AI messages, and records from a tool you connect or a file you send, before personal details are removed.
  • Vercel: Application hosting and web infrastructure. Receives every request to the Services.
  • Resend: Transactional email and billing notification delivery. Receives your email address and the emails we send you.
  • Stripe: Payments, billing, and tax. Receives your billing name, email address, and address, and the payment details you enter on Stripe’s own page.
  • Firecrawl: Public web research. Receives the web addresses of your company, its competitors and review pages about them, and search queries naming them.
  • SerpAPI: Public search results. Receives search queries naming your company and its competitors.
  • Google Analytics: Voluntary website analytics and usage metrics, loaded only with your analytics consent.
  • Microsoft Clarity: Voluntary session replay and heatmaps, loaded only with your analytics consent.

HubSpot is not our subprocessor. It is the tool you choose to connect, and section 4 describes what we read from it.

All subprocessors are vetted for security compliance and are contractually bound to process data solely on our instructions and in compliance with applicable privacy laws.

6. Data Ownership & Retention

  • Customer Control: As detailed in our Terms of Service, you retain ownership of your raw diagnostic inputs and Customer Data.
  • Retention Period: We retain your account information and diagnostic outputs for as long as your account remains active or as needed to provide you with the Services. Records from a tool you connect follow the schedule in section 4.
  • Data Deletion: Upon written request to hi@promisealignment.com, we will delete or anonymize your personal account data, diagnostic inputs, and records from tools you connect within thirty (30) days, except where retention is required by law or necessary for tax and accounting purposes.

7. Security Standards

We implement administrative, technical, and physical safeguards designed to protect your data against unauthorized access, loss, or disclosure. These measures include SSL/TLS encryption for data in transit, AES-256 encryption at rest (via Supabase), and role-based access controls. The keys that let us read a tool you connect are stored encrypted (AES-256-GCM) and removed when you disconnect.

8. Your Data Rights & Regional Compliance

Depending on your jurisdiction (including the EU/UK GDPR and US state privacy laws like the CCPA/CPRA), you have the following rights regarding your personal information:

  • Access & Portability: Request a copy of the personal data we hold about you.
  • Correction: Request updates or corrections to inaccurate profile details.
  • Deletion: Request the erasure of your personal data.
  • Data Processing Agreements (DPA): B2B customers requiring a signed DPA may request our standard DPA by contacting us.

To exercise any of these rights, email us at hi@promisealignment.com. We will verify and respond to your request within 30 days.

9. Changes to This Policy

We may update this Privacy Policy from time to time to reflect platform updates, regulatory changes, or operational shifts. Material changes will be communicated via email or a prominent notification within the platform dashboard prior to the change taking effect.

10. Contact

The Promise Alignment Company, LLC
Email: hi@promisealignment.com
Website: promisealignment.com