Privacy Policy

Effective date: October 14, 2026 · Last updated: October 14, 2026

Explico^® is built security-first: tenant boundaries, encryption, and per-request access checks on the secured shared service. We do not use your research prompts, uploaded organization content, or work product to train shared knowledge domains. This policy covers portal identity, website interactions, and billing-related personal data—not the substantive content of your research sessions, which is governed by your agreement and deployment envelope.

[Legal entity name] (“Explico,” “we”) respects your privacy. This policy describes personal information we collect through explico.dev, account registration, scheduling contact flows, and authenticated services.

1. What we collect

• Account data: name, email, organization, verification status, and credentials managed through our identity provider.
• Website data: basic technical logs, anti-abuse signals (including Cloudflare Turnstile on contact scheduling), and cookies strictly necessary for security and session management.
• Scheduling: if you book a meeting via our embedded scheduler, Cal.com processes booking fields under their policy; we receive booking metadata needed to hold the meeting.
• Product usage: for authenticated customers, audit and telemetry as described in your agreement—research query text handled under deployment-specific retention rules, not sold for advertising.

2. Animated demo

The public marketing animation demo does not require an account. It should not collect research queries. If we measure aggregate playback analytics, we will use minimal, non-identifying metrics.

3. How we use data

To provide and secure the service, verify accounts, meet legal obligations, communicate about your account, and improve reliability.

4. We do not train on your research content

Explico does not use your research questions, prompts, uploaded documents, matter content, or generative (RAG) payloads to train foundation models, to build public datasets, or to sell data to third parties for their model training. Third-party generative providers used under your agreement are selected for zero-retention and no-training contractual terms where Explico controls vendor routing; when you supply your own provider keys, your contract with that provider governs.

Vendor knowledge domains and your organization’s corpus remain governed by entitlements and your agreement—not by repurposing your usage to train Explico or outside AI systems.

5. Service improvement: knowledge-gap metadata (not your text)

To prioritize cache expansion, domain coverage, and SME curation, Explico may process limited operational metadata about retrieval and authority-cache behavior—for example: which domain and entitlement applied, whether a cache key hit or missed, coarse subject or authority identifiers, timing, and error classes. This “knowledge gap” signaling helps us decide what reference material to prefetch, which packs to extend, and where service quality needs work.

When you enable remote authority supplements (entitlement-gated), gap signaling may include normalized cache keys only—for example provider record identifiers, classification codes, hit or miss, and timing—and not your user id, matter id, or research query text. The same minimization applies on the shared service when the feature is on.

Gap metadata is designed to avoid storing research query text in routine telemetry; where your deployment retains encrypted query text for audit, that retention is separate from product analytics and follows your agreement. [Counsel: opt-out or aggregation rules for enterprise; disclose in DPA when remote authority add-on is purchased.]

6. Sharing

We share data with subprocessors that help us operate (hosting, email, identity, scheduling, error monitoring). [Counsel: subprocessor list and DPA references.]

7. Your choices

[Counsel: access, deletion, correction, and US state privacy rights processes.]

8. Retention

Retention on the secured shared service depends on your tier and agreement:

• Engine threads and user messages for the account lifetime; export window on closure before crypto-shred of identity-linked content, per agreement;
• Audit and compliance exports per deployment-specific rules;
• Research query text handled under deployment-specific retention rules—not sold for training.

[Counsel: complete schedules for account, audit, gap-metadata aggregates, and marketing contact data.]

9. Contact

[Counsel: privacy contact email and postal address.]