Privacy Policy

1. Information We Collect

ACE Regulatory collects information you provide directly (name, email, company, billing details) and usage data (features used, pages visited, API calls) to provide and improve our service. We also collect workspace content that you choose to monitor through the platform (regulatory sources, gap analyses, remediation tasks).

2. How We Use Your Information

We use your information to operate the platform, authenticate users, send service notifications, bill for paid plans, and ensure platform security. We do not sell personal information. We do not use workspace content to train third-party AI models.

3. Data Security

We implement industry-standard safeguards including encryption at rest and in transit, workspace-scoped isolation enforced in the application on every query and verified by an automated check on every build, layered access controls, and continuous security monitoring. Our security program is built on SOC 2-aligned controls and we are actively pursuing SOC 2 Type II attestation. Internal security reviews are run on a recurring cadence, and third-party penetration testing is on our roadmap.

4. Data Retention & Deletion

We retain workspace data for as long as your account is active. On account closure, workspace data is deleted from production systems within 30 days and from backups within 90 days, unless retention is required by law. You can request deletion of your account or specific data at any time via our contact form.

5. International Data Transfers

We process data in the United States. If you access the service from outside the United States, you understand that your data will be transferred to, stored, and processed in the United States. For transfers from the European Economic Area, United Kingdom, or Switzerland, we rely on Standard Contractual Clauses.

6. Your Rights

Depending on your jurisdiction, you may have rights to access, correct, port, delete, or restrict processing of your personal data, and to object to certain processing. To exercise these rights, use our contact form. We respond within 30 days.

EEA / UK residents (GDPR / UK GDPR)

The data controller for personal data of EEA and UK residents is Night Lite USA LLC (doing business as ACE Regulatory). Our EU representative can be reached via our contact form. You also have the right to lodge a complaint with your local data protection authority.

California residents (CCPA / CPRA)

California residents have the right to know what personal information we collect, the right to delete personal information we have collected, the right to correct inaccurate personal information, and the right to limit the use of sensitive personal information. ACE Regulatory does not sell or share personal information for cross-context behavioral advertising.

7. Subprocessors

We engage subprocessors to provide hosting, the application database, authentication, email delivery, payment processing, and — when configured — error monitoring, analytics, and model responses. The current list, including which ones run only when a setting is turned on, is published at /subprocessors. We will notify customers of new subprocessors in advance of any material change.

User-submitted chatbot messages, and regulation text you submit for gap analysis, are sent to the model provider configured for that request so it can generate the response. Depending on configuration, that provider is the Anthropic API, an InsForge-hosted model gateway, or an OpenAI-compatible model endpoint (Ollama) that we configure and that is run by us or by a hosting provider on our behalf. The model endpoint is chosen by us, not by you. Whichever one is configured is listed on the subprocessor page. A local model endpoint is not a third party.

We use Sentry for error tracking when it is configured, and Google Analytics for website measurement only after you allow analytics cookies. Google Tag Manager loads only when a container id is configured. Contact-form submissions are stored in the application database and also forwarded to a workflow-automation service we operate for lead handling. That service is described on the subprocessor list; it is not a separate customer-relationship product.

8. Data Processing Addendum

A Data Processing Addendum (DPA) is available to all customers on request and is incorporated into our Enterprise agreements by default. The DPA includes Standard Contractual Clauses for international transfers. To request the DPA, use our contact form.

9. Breach Notification

In the event of a personal-data breach affecting your workspace, we will notify the primary workspace owner without undue delay and in any case within 72 hours of confirmation, consistent with GDPR Article 33 obligations.

10. Contact

For privacy questions, data-subject requests, or DPA requests, use our contact form.