Legal
Privacy Policy
How Socratics.ai collects, uses, and protects information across our website and platform, written for the confidentiality that diligence work demands.
01
Overview
This Privacy Policy explains how Socratics.ai ("Socratics.ai", "we", "us", or "our") collects, uses, and protects information when you visit our website, communicate with us, or use our platform for financial due diligence and Quality of Earnings work.
Socratics.ai is based in California and offers its services in the United States. We built our platform around the confidentiality that accounting firms, transaction advisors, and deal teams expect, and this policy reflects that. Please read it alongside any agreement your organization has entered into with us.
02
Our role with your data
Our role depends on the data in question:
- For your account and the information you give us directly, we decide how that information is used (a "business" under California law).
- For the engagement content your firm uploads, such as data rooms, financial records, and related documents, we act as a service provider that processes it only to perform the services, on your firm's behalf and under our agreement (including any Data Processing Addendum). Your firm remains responsible for that content.
03
Information we collect
- Account and profile data: name, work email, company, role, and authentication credentials.
- Engagement content ("Customer Content"): the data room files, financial statements, spreadsheets, and documents your team uploads or connects, together with the analyses, workbooks, and databooks generated from them.
- Usage and device data: log data, IP address, browser and device information, pages viewed, feature usage, and timestamps.
- Communications: messages you send us for sales, support, or other inquiries, and their contents.
- Cookies and similar technologies: see the Cookies section below.
04
How we use information
We use information to:
- Provide, operate, and maintain the platform;
- Run the analyses and generate the deliverables you request;
- Authenticate users and secure accounts;
- Provide support and respond to your inquiries;
- Improve, troubleshoot, and develop new features;
- Communicate with you about the service; and
- Comply with legal obligations and prevent fraud or abuse.
05
AI processing and your content
Our platform uses frontier AI models to execute the analytical steps you initiate. Customer Content is processed to produce the outputs you ask for, and every calculation and step is recorded to an audit trail so results can be traced back to their source.
We do not use Customer Content to train, fine-tune, or improve foundation models, and we contractually require the model providers we use not to train their models on data we send through their APIs. Where providers offer zero-retention processing, we use it.
Model choice is a routing decision made per step. Customer Content is sent to a provider only to complete the work you have requested, and only for as long as needed to return the result.
07
Sub-processors
We use a limited set of vetted sub-processors to run the platform, including cloud hosting and infrastructure, large language model providers, product analytics, and email delivery. We require each to meet confidentiality and security obligations consistent with this policy and our customer agreements.
A current list of sub-processors is available at [sub-processor list URL] or on request to the address below.
08
Data retention
We retain account information while your account is active and as needed to provide the service. Customer Content is retained according to your firm's agreement and configuration; on termination or on request, we delete or return Customer Content within [30] days, subject to any legal retention requirements. Logs and usage data are retained for a limited period consistent with security and operational needs.
09
Security
We protect information with encryption in transit and at rest, role-based access controls on a least-privilege basis, audit logging, network isolation, and regular review. Our SOC 2 Type II examination is [in progress].
No method of transmission or storage is completely secure, but we work to protect your information and will notify you of incidents as required by law and by our agreements with you.
10
Where we process data
Socratics.ai is based in California, and we operate and provide our services in the United States. We process and store information on infrastructure located in the United States, and our services are not directed to individuals outside the United States.
11
Your privacy rights
Our services are offered in the United States, and this section describes the rights available to US users.
California residents have rights under the California Consumer Privacy Act, as amended by the CPRA: to know and access the personal information we collect, to correct inaccurate information, to delete personal information, and to opt out of the sale or sharing of personal information. As noted above, we do not sell or share personal information. We will not discriminate against you for exercising your rights.
Residents of other US states with comprehensive privacy laws may have similar rights. Because much engagement content is processed on behalf of your firm, requests relating to that content should be directed to your firm, and we will assist as a service provider. To exercise rights in personal information we control, contact us at the address below.
12
Cookies and analytics
Our website uses essential cookies to function and a limited set of analytics cookies to understand usage. You can control non-essential cookies through the consent banner and your browser settings. We honor recognized opt-out preference signals such as Global Privacy Control, as required under California law.
13
Children
Our services are intended for business use and are not directed to children under 16. We do not knowingly collect personal data from children.
14
Changes to this policy
We may update this policy from time to time. Material changes will be posted on this page with an updated effective date and, where appropriate, communicated to you directly.
15
Contact us
If you have questions about this policy or our data practices, contact us at support@socratics.ai.
[Legal entity name], [street address], California, United States.