Legal · Privacy Policy

Privacy Policy

This privacy policy describes personal-information handling for visitors and customers of PrivyCDP, a customer data platform (CDP) from iAge Technologies, Inc. Review the sections below and contact the listed privacy team with questions.

Editorial updated: 2026-10-25

1. Introduction & Scope

iAge Technologies, Inc. ("Company," "we," "our," or "us") operates from Arlington, Virginia, and is committed to the highest standards of data protection and privacy. This Privacy Policy governs our AI-native Customer Data Platform and explains how we collect, process, store, and protect personal information in compliance with applicable privacy laws.

Jurisdiction: This Privacy Policy is governed by Virginia state law and the Virginia Consumer Data Protection Act (VCDPA), along with federal regulations where applicable. Confirm hosting locations and support access for the services and customer deployment in scope.

Compliance Framework: Our published architecture describes customer-managed access, data retention and audit controls. These controls must be configured and evaluated for each deployment; this policy does not establish certification or an auditor examination result.

2. AI Technology Disclosure

AI processing notice

Our platform utilizes artificial intelligence and machine learning technologies to enhance marketing automation, customer insights, and data processing. This includes:

Predictive Analytics: AI models analyze customer behavior patterns to predict preferences and optimize marketing campaigns
Natural Language Processing: AI assistant features that help users interact with data and generate insights
Automated Decision Making: AI-driven segmentation, personalization, and campaign optimization
Data Enhancement: AI algorithms that enrich customer profiles and improve data quality

Your Rights Regarding AI: You have the right to know when AI is used in processing your data, request human review of automated decisions, and opt-out of certain AI-powered features where technically feasible.

3. Information We Collect

3.1 Personal Information (Controller Data)

Identity Data: Full name, email address, phone number, job title, company name
Account Data: Username, encrypted passwords, API keys, authentication tokens
Billing Data: Billing address, payment method details (processed via secure third-party processors)
Communication Data: Support tickets, chat logs, email correspondence, preference settings
Professional Data: Company size, industry, use case information, integration requirements

Website service choices: Google Analytics loads only after optional consent. The Calendly calendar on the review page loads only when you click its load button; it then receives connection and booking details. You can send an inquiry through our own form or email instead. If you submit a message to the optional assistant, our API sends conversation content to OpenAI to generate a reply. Do not submit personal, patient, account, contract or secret information. Fonts are hosted on this website. Read the website trust page for these data flows and controls.

3.2 Technical & Usage Data

Device Information: IP address (anonymized after 30 days), browser type, operating system, device identifiers
Usage Analytics: Feature usage, session duration, click patterns, error logs, performance metrics
API Data: API calls, integration usage, webhook delivery status, rate limiting data
Security Data: Login attempts, access logs, security incidents, audit trails
Location Data: Country-level location derived from IP address for compliance and security

Website inquiries may include the first public landing page and a basic source category. These are held in memory during navigation for up to 30 minutes and sent to our own inquiry service only when you submit a form. This feature uses no cookies, browser storage or visitor identifier, excludes URL query values and private/token routes, and is disabled when Global Privacy Control or Do Not Track is enabled. It does not send form contents to third-party analytics.

Separately, if you allow optional analytics through Cookie settings, Google Analytics 4 measures public marketing page visits using cookies. Google receives a browser identifier, basic device/browser information and public page views through your network connection. We exclude URL queries, fragments, referrer URLs, form contents, personalized titles and private/token routes. Analytics stays off before consent and when Global Privacy Control or Do Not Track is enabled. Advertising features and Google Signals are disabled. You can withdraw consent in Cookie settings; see our Cookie Policy and the Google Privacy Policy.

3.3 Customer Data (Processor Role)

Data Processor Relationship: When processing customer data on behalf of our clients, we act as a data processor. This includes:

End-customer personal information uploaded by our clients
Marketing automation data, campaign metrics, and interaction logs
Customer journey data, behavioral analytics, and preference profiles
Third-party integration data (CRM, email platforms, analytics tools)

Client Control: Our clients maintain full control over this data. We process it strictly according to their instructions, applicable Data Processing Agreements (DPAs), and privacy laws.

4. Legal Basis for Processing

GDPR Legal Bases

Contract performance (Art. 6(1)(b))
Legitimate interests (Art. 6(1)(f))
Legal compliance (Art. 6(1)(c))
Consent where required (Art. 6(1)(a))

US Privacy Laws

Business purpose (CCPA/CPRA)
Service provision (VCDPA)
Legal obligation compliance
Security and fraud prevention

5. How We Use Your Information

Service Delivery & Operations

Provide, maintain, and improve our CDP platform and AI features
Process customer data according to client instructions and configurations
Deliver technical support, onboarding, and customer success services
Monitor system performance, uptime, and security incidents

AI & Analytics Enhancement

Train and improve AI models for marketing automation and insights (anonymized data only)
Generate predictive analytics, customer segmentation, and behavioral insights
Provide AI-powered recommendations and automated campaign optimization
Develop new AI features and improve existing machine learning algorithms

Legal & Compliance

Comply with SOC 2, HIPAA, GDPR, CCPA, VCDPA, and other regulatory requirements
Conduct security audits, vulnerability assessments, and compliance monitoring
Respond to legal requests, court orders, and regulatory inquiries
Investigate and respond to security incidents and data breaches

6. Data Sharing & Disclosure

We Never Sell Personal Data

We do not sell, rent, lease, or trade personal information to third parties for monetary consideration or other valuable consideration.

Authorized Sharing

Service Providers: AWS, Supabase, and other infrastructure providers under strict data processing agreements
Client Instructions: Customer data shared according to explicit client configurations and integrations
Legal Compliance: When required by law, court order, or regulatory investigation
Security Protection: To protect our rights, property, safety, or that of our users
Business Transfers: In connection with mergers, acquisitions, or asset sales (with 30-day notice)
Consent: With your explicit, informed consent for specific purposes

Third-Party Integrations

Our platform integrates with various third-party services at client request. Data sharing occurs only:

With explicit client configuration and consent
Under comprehensive data processing agreements
With selected integration partners under the applicable agreements
According to the principle of data minimization

7. Security & Compliance Framework

Deployment controls to verify

Storage encryption and key custody
Transport protection and deployed TLS configuration
Network access boundaries
Multi-factor authentication (MFA)
Role-based access controls (RBAC)
Monitoring and alert ownership
Vulnerability review evidence
API authentication and access controls

Framework evaluation scope

Controls to evaluate against the applicable SOC 2 examination scope
Evaluate HIPAA business associate responsibilities
Evaluate GDPR Article 32 security measures
Review applicable CCPA/CPRA rights workflows
Review applicable Virginia privacy duties
Request evidence for any ISO 27001 claim
Request any relevant third-party assessment and its scope
Confirm security testing scope and evidence

Incident Response

Confirm incident ownership, notification procedures and evidence for the selected service and deployment. Applicable notification duties depend on the facts and law; this page does not establish continuous monitoring or a response-time SLA.

8. Your Privacy Rights

GDPR Rights (EU Residents)

Right of access (Art. 15)
Right to rectification (Art. 16)
Right to erasure (Art. 17)
Right to restrict processing (Art. 18)
Right to data portability (Art. 20)
Right to object (Art. 21)
Right to withdraw consent (Art. 7)
Right to lodge complaints

US Privacy Rights

Right to know (CCPA/VCDPA)
Right to delete personal information
Right to correct inaccurate data
Right to opt-out of data sales
Right to data portability
Right to non-discrimination
Right to appeal denials (VCDPA)
Right to designate authorized agents

Exercise Your Rights

To exercise any of your privacy rights, contact us using the methods below. We will respond within the legally required timeframes:

Applicable response periods and permitted extensions depend on the request and law. See the GDPR text, California Privacy Protection Agency resources and Virginia Consumer Data Protection Act.

9. Data Retention & Deletion

Retention Periods

Retention depends on the processing purpose, applicable agreement, legal holds and the documented schedule for the service. Confirm account, billing, support, log and backup retention with the privacy contact. The previous fixed periods have been removed pending confirmation of actual practice.

Customer Data Retention

Customer data processed on behalf of clients is retained according to:

Individual client Data Processing Agreements (DPAs)
Client-specified retention periods and deletion schedules
Applicable industry regulations (HIPAA, financial services, etc.)
Legal hold requirements and litigation preservation

Secure Deletion Process

Confirm the deletion process, retained exceptions and backup expiry for the actual service. A deletion request or successful API response does not by itself establish removal from every copy.

10. International Data Transfers

Transfer Mechanisms

Primary Processing Location: United States (Virginia)

When personal data is transferred internationally, we ensure adequate protection through:

Standard Contractual Clauses (SCCs): EU Commission-approved clauses for GDPR compliance
Data Processing Agreements: Comprehensive DPAs with all service providers
Adequacy Decisions: Transfers to countries with EU adequacy status where available
Binding Corporate Rules: For intra-group transfers (if applicable)
Derogations: Specific derogations under GDPR Article 49 when applicable

Cross-Border Data Flow

We maintain detailed records of all international data transfers, including legal basis, safeguards implemented, and transfer impact assessments as required by applicable privacy laws.

11. Virginia Law Specific Provisions

Virginia Consumer Data Protection Act (VCDPA) Compliance

As a Virginia-based company, we comply with the Virginia Consumer Data Protection Act effective January 1, 2023:

Virginia Resident Rights: Access, portability, deletion, correction, and opt-out rights
Sensitive Data: Enhanced protections for biometric, health, and other sensitive personal data
Data Protection Assessments: Conducted for high-risk processing activities
Appeal Process: Right to appeal our decisions on consumer requests within 60 days
Non-Discrimination: No adverse treatment for exercising VCDPA rights

Virginia AG Contact: For unresolved VCDPA concerns, contact the Virginia Attorney General at consumer@oag.state.va.us

12. Children's Privacy

Age Restriction

Our services are not intended for individuals under 18 years of age. We do not knowingly collect personal information from children under 18. If we become aware of such collection, we will delete the information immediately and may terminate associated accounts.

13. Updates to This Policy

We may update this Privacy Policy to reflect changes in our practices, services, legal requirements, or business operations. Material changes will be communicated through:

Email notification to registered users (30 days advance notice)
Prominent website notice and in-app notifications
Updated "Last modified" date at the top of this policy
Version history maintained for transparency

Continued use of our services after policy updates constitutes acceptance of the revised terms.

14. Contact Information

Privacy Contacts

Privacy Rights: privacy@privycdp.org
Data Security: security@privycdp.org
Legal/Compliance: legal@privycdp.org
General Inquiries: hello@privycdp.org

Priority Response

For urgent privacy matters, data breaches, or security incidents, please mark your communication as "URGENT - PRIVACY" in the subject line. Confirm the response and escalation arrangements for the service in scope.

The editorial revision date is shown above. It is not a legal review or approval date.

Designed to support SOC 2, ISO 27001, GDPR, HIPAA, PCI DSS and FedRAMP evaluations; deployment evidence required

Discuss your deployment with engineers.

Bring your data flow, operating owners and evaluation questions.

Request an architecture review Review Enterprise TCO Model →Request permissioned references and release-specific evidence during evaluation.