Privacy Policy

1.1 Information You Provide Directly. When you complete our System Census or other intake forms, we collect: company name, website, and industry; contact name, email address, phone number, and role; employee count and tool stack information; pain points, AI experience, and related business context. When you email us, schedule a call, or otherwise communicate with us, we collect the content of those communications. When you enter into a consulting engagement, we collect information necessary to perform the Services.

1.2 Information Collected Automatically. We may collect standard web analytics data including IP address, browser type, referring URL, pages visited, and time spent on pages. We use this data in aggregate to improve our website and do not use it to identify individual visitors. We use minimal, functional cookies necessary for website operation. We do not use advertising cookies or tracking pixels from third parties.

1.3 Client Data Accessed During Engagements. During consulting engagements, with explicit Client authorization, we may access data within Client business systems including CRMs, billing platforms, accounting software, HR systems, and other SaaS tools. This access is governed by the applicable Statement of Work and is subject to the data processing practices described in Section 3.

2.1 Portal and Contact Information. We use the information you provide through the Portal and communications to: prepare for discovery calls and consulting engagements; customize our approach based on your industry, tool stack, and pain points; communicate with you about our services; and improve our intake process and service delivery.

2.2 Client Data During Engagements. During an active engagement, Client Data is processed solely for the purpose of delivering the Services described in the applicable Statement of Work. This includes analyzing system schemas and data structures, identifying entities, relationships, and semantic conflicts across systems, generating statistical and structural profiles, and building the Semantic Map and related deliverables.

2.3 Metadata for Service Improvement. Anonymized, aggregated Metadata Profiles may be used to improve our methodology and tools, build cross-industry pattern libraries, and develop the Solaris platform. We do not use individually identifiable Client Data for these purposes.

3.1 What We Retain (Metadata Profiles). After processing Client Data, we retain only: schema metadata (field names, data types, table structures, and relationship definitions — not the records themselves); statistical profiles (record counts, null percentages, value distributions, and format patterns — anonymized and aggregated); semantic annotations (entity type classifications, conflict type labels, severity scores, and resolution patterns); and anonymized samples (a small number of structurally representative examples with all identifying information removed).

3.2 What We Do Not Retain. We do not retain: individual customer records, employee records, or transaction records; personally identifiable information (PII) from Client systems; protected health information (PHI); financial account numbers, Social Security numbers, or similar sensitive identifiers; or raw data exports or database dumps.

3.3 Processing Transparency. Every data processing operation is logged in our audit system. During an engagement, Clients can view the status of data processing at any time, including: schema reading (we accessed field names and data types), data profiling (we analyzed statistical distributions), metadata extraction (we extracted semantic patterns and conflict signatures), and raw data purge (all raw data has been deleted from processing environments).

3.4 Data Deletion Receipts. Upon completion of data processing for any Client system, Solaris issues a formal Data Deletion Receipt documenting: which systems were accessed; how many records were read; what metadata was retained (categories, not content); the exact timestamp when raw data was purged; and a confirmation that no raw Client Data persists in any Solaris system. Clients may request these receipts at any time during or after an engagement.

3.5 Processing Environment. Client Data is processed in isolated, temporary environments. These environments are created specifically for each processing task, not shared between clients, destroyed after processing is complete and metadata has been extracted, and subject to encryption in transit and at rest during the processing window.

3.6 Google User Data. Where you connect a Google account to Solaris (Google Analytics, Google Calendar, or Gmail), we access your Google user data only with your explicit OAuth consent, using read-only scopes, solely to provide the features you request. This section states exactly what we access, how it is used, what is shared, how it is protected, and how long it is kept.

3.6.1 What We Access. Google Analytics: report data for the properties you choose (sessions, page views, traffic sources, and similar aggregate metrics), with read-only scope. Google Calendar: your calendar events (titles, times, and attendee names and email addresses), with read-only scope. Gmail: your account profile (email address and message counts) and message headers only — subject, sender, and date. We do not access, fetch, or store the bodies or attachments of your email messages.

3.6.2 How We Use It. Analytics data powers the reports and dashboards you view in your Solaris workspace. Calendar events let your workspace show your meetings and corroborate who attended a meeting you chose to record. Gmail profile information and message headers verify your connection is working and, where you enable it, help your workspace understand who your correspondents are. Google user data is used for these user-facing features only — never for advertising, never for profiling unrelated to the features you requested, and never for any purpose prohibited by Google's Limited Use requirements.

3.6.3 What We Share. We do not sell, rent, or trade Google user data, and we do not transfer it to third parties — including data brokers or advertisers — for any purpose. The only parties that handle it are the infrastructure service providers that operate our hosting and databases (processing it on our behalf under confidentiality and data-protection obligations), and disclosures required by law as described in Section 4.3. We do not allow humans to read your Google user data except with your consent, where necessary for security purposes, or to comply with applicable law.

3.6.4 How It Is Protected. All Google user data moves over encrypted connections (TLS). The OAuth refresh tokens that authorize our access are encrypted at rest with AES-256-GCM using keys held separately from the database. Access is limited to the systems that serve your workspace.

3.6.5 Retention and Deletion. Google user data is fetched live when you use a feature and displayed to you; we do not maintain a stored copy of your Analytics reports, your calendar, or your mailbox. The narrow exception: if you start a meeting recording from a calendar invite, the identity of that event (its title, time, and attendee list) is saved with that recording session so the recording keeps its context. Disconnecting a Google account (from your workspace or from your Google account permissions) revokes our access and deletes the stored token immediately; any event details saved with your recordings are deleted when you delete those recordings, or on request per Section 6.2.

3.6.6 Limited Use and AI/ML. The use of raw or derived user data received from Google Workspace APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data to develop, improve, or train generalized artificial intelligence or machine learning models. Where AI features in your workspace process your Google user data, they do so solely to provide the features you requested, for you; our AI provider (Anthropic) does not use data submitted through its API to train its models, per its terms of service. We do not transfer Google user data to any third-party AI or ML service that would use it for model training.

3.7 Context Auditor Uploads. When you upload documents to the free Context Auditor, we collect your email address (to deliver the report link) and process the uploaded documents in memory only — they are never written to storage, never used to train any model, and are gone when the analysis completes, typically within minutes. Document text is sent to our AI provider (Anthropic) solely to perform the analysis you requested. The resulting report quotes short excerpts from your documents as evidence for its findings; the report is retained for 30 days and then automatically deleted, and every report page carries a delete-now control that removes it immediately. What we retain permanently is anonymous structural statistics only — counts and categories (how many documents, how many conflicts, which confidence bands) — never document content, values, names, or excerpts. Report links are unguessable and never indexed; we do not sell or share uploaded content.

3.8 personalOS Workspaces. personalOS is different from the engagement processing described above, and deliberately so: it is your durable workspace. Content you bring to a personalOS workspace — documents you upload, meeting recordings and their transcripts, notes synced from tools you connect, and the knowledge your workspace derives from them — is stored for as long as your workspace is active, because remembering it is the service. That content is yours: it is visible to you inside your workspace, it is never sold or shared except as described in Section 4, and you can delete individual items from your workspace or request full deletion of your workspace data under Section 6.2. AI features process your workspace content solely to provide your workspace's features to you; our AI provider does not train its models on it.

4.1 We Do Not Sell Data. We do not sell, rent, or trade any personal information or Client Data to third parties.

4.2 Service Providers. We may share information with third-party service providers that help us operate our business, including cloud infrastructure (hosting and database services), communication tools, and analytics. All service providers are bound by confidentiality and data protection obligations.

4.3 Legal Requirements. We may disclose information if required by law, regulation, legal process, or governmental request. We will make reasonable efforts to notify you before such disclosure unless prohibited by law.

4.4 Business Transfers. In the event of a merger, acquisition, or sale of assets, information may be transferred to the successor entity, subject to the same privacy protections described in this policy.

5.1 Technical Safeguards. We implement reasonable technical safeguards to protect information, including encryption in transit (TLS/HTTPS) for all data transmission, encryption at rest for stored data, access controls limiting data access to authorized personnel, and isolated processing environments for Client Data.

5.2 Organizational Safeguards. Personnel with access to Client Data are bound by confidentiality obligations. We maintain audit logs of all data access and processing activities and conduct periodic reviews of our security practices.

5.3 Limitations. No method of transmission or storage is completely secure. While we strive to protect your information, we cannot guarantee absolute security.

6.1 Access and Correction. You may request access to the personal information we hold about you and request corrections to any inaccuracies. Contact us at privacy@getsolaris.ai.

6.2 Deletion. You may request deletion of your personal information from our systems. We will comply within 30 days, except where retention is required by law or necessary to fulfill an active engagement.

6.3 Metadata Profile Deletion. Clients may request deletion of their Metadata Profiles at any time. Upon such request, we will delete all metadata associated with the Client's engagement within 30 days and provide confirmation.

6.4 Data Portability. Upon request, we will provide your personal information and any Metadata Profiles in a standard, machine-readable format.

6.5 Withdrawal of Consent. If we process your information based on consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing conducted before withdrawal.

7.1 Portal and Contact Information. We retain Portal submissions and contact information for as long as necessary to provide our services and maintain our business relationship. If you request deletion, we will comply within 30 days.

7.2 Engagement Records. We retain records of consulting engagements (Statements of Work, invoices, deliverable records) for a period of seven (7) years after the engagement ends, as required for business and tax purposes.

7.3 Metadata Profiles. Metadata Profiles are retained indefinitely unless a Client requests deletion. These profiles contain no personally identifiable information.

7.4 Audit Logs. Data processing audit logs and Data Deletion Receipts are retained for a period of five (5) years.

Our services are not directed to individuals under the age of 16. We do not knowingly collect personal information from children. If we become aware that we have collected information from a child, we will delete it promptly.

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA), including the right to know what personal information we collect and how it is used, the right to request deletion, and the right to opt out of the sale of personal information. As stated in Section 4.1, we do not sell personal information. To exercise your CCPA rights, contact us at privacy@getsolaris.ai.

Our services are operated from the United States. If you access our services from outside the United States, your information may be transferred to, stored, and processed in the United States. By using our services, you consent to such transfer and processing.

We may update this Privacy Policy from time to time. Material changes will be communicated via the website or email. The "Last Updated" date at the top of this policy indicates the most recent revision. Continued use of our services after changes constitutes acceptance of the updated policy.

For questions about this Privacy Policy, data processing practices, or to exercise your rights, contact us at:

Solaris
Privacy inquiries: privacy@getsolaris.ai
General inquiries: hello@getsolaris.ai
Website: getsolaris.ai

For data deletion requests or Data Deletion Receipt inquiries, please include your company name and the approximate dates of your engagement.