Last Updated: November 25, 2024
Ivo's services are intended for use by business customers, but we may process information about you when providing our services and operating our business. This Privacy Policy (the "Policy") provides a comprehensive description of how Ivo collects, uses, and discloses information about you ("Personal Information"), as well as your rights and choices regarding such Personal Information. For purposes of this Policy, "Ivo", "we", "our", and "us" refers to Ivo AI, Inc. and its affiliates, and "you" or "your" refers to the individual interacting with us.
Some regions provide additional rights by law. For region-specific terms, please see the following sections below:
For our contact details, please visit the "Contact Us" section below.
This Policy applies to (a) our AI contract review and redlining services, including the associated technology we provide for access and use of those services (e.g., app.ivo.ai and our Microsoft Word Add-in application) (the "Services"), (b) privacy@ivo.ai (the "Website"), and (c) our emails, advertisements and any other location, online or offline, where you interact with our business (e.g., conferences or third party social media and networking sites) (collectively, with the Services and Website, the "Business").
Data protection laws distinguish between entities that control the purposes and means of processing information and entities that process information on behalf of other entities. The Ivo SaaS Service Agreement or another written agreement (the "Agreement"), along with our terms and conditions and those of our partners and vendors, governs our provision of Services to a business customer (a "Company"). When Ivo processes Personal Information on behalf of a Company to provide contracted Services, we do so in accordance with the terms of the Agreement and the Customer's instructions, not this Policy. If you wish to exercise your rights regarding Personal Information we are processing on behalf of a Company, you should contact the applicable Company for assistance, and Ivo may forward communications we receive from you to the Company for resolution. We are not responsible for the privacy practices of our business customers, which may differ from those in our Policy.
Moreover, this Policy does not apply to any third-party applications or services that are used in connection with our Services, or any other products, services or accounts provided by other entities under their own terms of service and privacy policy (collectively, "Third-Party Services"). For example, a Company may connect, directly or through another application, messaging systems, e-mail services, e-commerce platforms, and other products and services to its Services account ("Ivo Account").
If you do not agree with this Policy, then do not access or use the Services, Website or any other aspect of our Business.
Ivo will process information continuously through the operation of our Services and Websites, and through other interactions with our Business, as described in the Agreement. If you provide us with information about another individual, by acknowledging or agreeing to this Policy, you represent and warrant that you have the authority to do so and have delivered any required notices and obtained all necessary rights and consents to provide such information to us for processing in accordance with this Policy. If you believe information has been provided to us improperly, please notify us in accordance with the "Contact Us" section below.
A. Information Provided to Ivo
We receive information when you submit it to our Business:
The Services are intended for use by business customers and their employees and other authorized users ("Authorized Users"). If you or someone at your Company begins the process of applying for a Ivo Account, we may receive information about you, your Company, and individuals associated with your Company. We may collect: (1) your Contact Information; (2) Identifying Data of Company owners, control persons and other relevant Company personnel, such as their date of birth, residential address, government-issued identification, and any information captured on such identification or through our identification verification process; and (3) other Company information requested by or provided to us. This information is needed to verify the identity of the customer wishing to use the Services, comply with legal and regulatory obligations applicable to us, determine the availability of Services offerings, and maintain your Ivo Account.
In connection with providing Services, we receive additional information submitted by, on behalf of and relating to a Company and its Authorized Users, such as:
B. Information Generated and Collected by Ivo
We generate, collect and derive information when you use or interact with our Services, Website and other products and services provided or used by our Business:
We use cookies and other technologies to help us process information:
C. Information Collected by Ivo from Other Sources
We also collect and receive information from other sources:
The categories of information we collect and receive from these sources may include all of the categories identified above in "Information Provided to Ivo" and "Information Generated and Collected by Ivo." We treat the information obtained from other sources in accordance with any laws or contractual obligations applicable to us.
We use information for business and commercial purposes in accordance with the practices described in this Policy. In addition, Ivo uses information to operate our Services, Website, and Business as follows:
Notwithstanding the above, we may use information that does not identify you for any purpose permitted by law or contractual obligation applicable to us. For information on your rights and choices regarding how we use your Personal Information, please see the "Your Rights and Choices" section below.
We disclose information we collect in accordance with the practices described in this Privacy Policy. The categories of parties to whom we disclose information are:
Notwithstanding the above, we may disclose information that does not identify you (including information that has been aggregated or de-identified) for any purpose except as prohibited by law or contractual obligation applicable to us. For information on your rights and choices regarding how we share information about you, please see the "Your Rights and Choices" section below.
Where permitted under laws applicable to our Business, we use analytics services to help us understand how users access and use the Website and other aspects of our Business. In addition, we work with agencies, advertisers, ad networks, and other technology services to place advertisements on our behalf on other websites and services. For example, we may place ads through Google, LinkedIn and Facebook that you may view on their platforms as well as on other websites and services.
As part of this process, we may use tracking technologies (including incorporating them into our Website and emails), as well as incorporating into our ads displayed on other websites and services. Some of these tracking technologies may track your activities across time and services for purposes of associating the different devices you use, and delivering relevant ads and/or other content to you ("Interest-based Advertising").
For further information on the types of tracking technologies we use and your rights and choices regarding analytics and Interest-based Advertising, please see the "Your Rights and Choices" section below. You will continue to see advertising, including potentially from us, even if you opt out of personalized advertising.
Our Business is operated from the United States, Canada and other jurisdictions. Any of your Personal Information we collect may be transferred to, processed, used, handled, and stored in the United States and other jurisdictions. Data protection laws in the United States and other jurisdictions may differ from those of your country of residence. We take measures to comply with applicable data protection laws when we transfer Personal Information internationally.
For personal data transferred from the European Economic Area, Switzerland or the United Kingdom, we will provide appropriate safeguards, such as through the use of the relevant standard contractual clauses. For further information on these transfers and the relevant appropriate safeguards, please see the "Additional Disclosures for Data Subjects in the European Economic Area, Switzerland and the United Kingdom" section below.
Security. We use organizational, technical, and administrative measures designed to protect your Personal Information from loss, theft, misuse, and unauthorized access, disclosure, alteration and destruction. However, no information security program or transfer via the internet is entirely secure so we cannot guarantee the security of your Personal Information.
Use by Minors. We do not direct any of our Services or other aspects of our Business to children. We do not knowingly collect personal information (as defined by the U.S. Children's Privacy Protection Act, or "COPPA") from children under 13. We also do not knowingly "share" or "sell," as those terms are defined under the California Privacy Rights Act, the personal information of minors under 16 who are California residents. If you are a parent or guardian and believe we have violated this provision, contact us at privacy@ivo.ai.
Retention. Ivo collects and stores Personal Information for the purposes outlined in this Policy. We retain Personal Information for as long as we continue to have a business or operational purpose to retain it, and may continue to retain and use Personal Information as necessary to comply with (or demonstrate compliance with) our legal or regulatory obligations, resolve disputes, prevent fraud, and enforce our rights. Please note that our retention obligations may require us to retain your Personal Information after you are no longer an Authorized User or your Company’s Ivo Account has closed. These retention obligations may also prohibit us in some cases from deleting Personal Information after you have asked us to delete your Personal Information. When the applicable retention period elapses, we will delete or de-identify your Personal Information in accordance with our policies and procedures.
Changes to this Privacy Policy. We reserve the right to change and reissue this Policy at any time by posting an updated version. If we have an existing relationship with you, you represent a Company, or if you are an Authorized User, we may provide you notice through our Website or your Company's Ivo Account or directly using the Contact Information provided to us. If we do not have an existing relationship with you---for instance, if you only visit our Website---any notice we provide will be posted to our Website. Any privacy notice is effective upon posting or when it is provided to you. We encourage you regularly to review this Policy to ensure that you are always aware of what Personal Information we collect, how we use and otherwise process it and under what circumstances we will disclose it to third parties.
Region-Specific Rights. In addition to these rights and choices, you may have additional rights based on your region. For region-specific terms, please see the bottom of this Policy.
Ivo Account. Ivo Services are intended for use by business customers, and you may only use an Ivo Account if you are an employee or other Authorized User of a Company that has opened an Ivo Account. The information in a Company's Ivo Account is governed by our Agreement with the business customer. You should direct questions about Personal Information we are processing on behalf of a Company to that Company's administrators. If you are an Authorized User, you may also be able to access, update, or delete certain information within your Company's Ivo Account through the Services, provided that the Company and its administrators are responsible for determining how that data is processed.
Tracking Technology Choices.
Please be aware that if you disable or remove tracking technologies some parts of our Services, Website and Business may not function correctly.
The companies we work with to provide you with targeted ads in connection with our Business are required to give you the choice to opt out of receiving targeted ads. Most of these companies are participants of the Digital Advertising Alliance ("DAA") and/or the Network Advertising Initiative ("NAI"). To learn more about the targeted ads provided by these companies, and how to opt out of receiving certain targeted ads from them, please visit: (i) for website targeted ads from DAA participants, https://www.aboutads.info/choices↗; and (ii) for targeted ads from NAI participants, https://www.networkadvertising.org/choices↗. Opting out only means that the selected participants should no longer deliver certain targeted ads to you, but does not mean you will no longer receive any targeted content and/or ads (e.g., in connection with the participants' other customers or from other technology services). Any such targeted advertising will only be carried out to the extent that it is permitted by applicable law.
Please note that if you opt out using any of these methods, the opt out will only apply to the specific browser or device from which you opt out. Except as required by applicable law, we are not responsible for the effectiveness of, or compliance with, any opt-out options or programs, or the accuracy of any other entities' statements regarding their opt-out options or programs.
Communications.
Please note that your opt out is limited to the email address or phone number used and will not affect subsequent subscriptions.
Where applicable, to exercise your rights regarding your Personal Information, please contact us at privacy@ivo.ai. If you have any more general questions about this Policy, our data practices, or our compliance with applicable law, please contact us:
By email: privacy@ivo.ai
By mail: Ivo AI, Inc. Attn: Privacy 200 Pine St, Floor 2 San Francisco, CA 94104
If you experience any difficulties accessing the information in this Privacy Policy, please contact us at privacy@ivo.ai.
Nevada law (NRS 603A.340) requires each business to establish a designated request address where Nevada consumers may submit requests directing the business not to sell certain kinds of personal information that the business has collected or will collect about the consumer. A sale under Nevada law is the exchange of personal information for monetary consideration by the business to a third party for the third party to license or sell the personal information to other third parties. If you are a Nevada consumer and wish to submit a request relating to our compliance with Nevada law, please refer to the "Contact Us" section above.
These additional disclosures apply only to California residents and only to the extent applicable.
Notice of Collection.
The California Consumer Privacy Act as amended by the California Privacy Rights Act ("CPRA") provides additional rights and requires businesses collecting or disclosing personal information to provide notices and means to exercise rights. In the past 12 months, we have collected the following categories of personal information enumerated in the CPRA:
For further details on personal information we collect, including the sources from which we receive information, review the "Information that Ivo Collects" section above. We collect and use these categories of personal information for the business purposes described in the "How We Use Information" section above. We disclose the personal information to the categories of persons set out in the "Disclosure of Information" section above. Please visit those sections for further details.
Right to Know, Correct and Delete.
You have the right to know certain details about our data practices. In particular, you may request the following from us:
In addition, subject to exceptions, you have the right to correct or delete the personal information we have collected from you.
To exercise any of your rights, please submit a request to us at privacy@ivo.ai. We will confirm receipt of your request and respond to your request within the time limits prescribed by law. We may require specific information from you to help us verify your identity and process your request. If we are unable to verify your identity, we may deny your requests.
If personal information about you has been processed by us as a service provider on behalf of a business customer, please inquire with the business customer directly to exercise your rights. If you wish to make your request directly to us, please provide the name of our business customer on whose behalf we processed your personal information. We will refer your request to that business customer, and will support them to the extent required by applicable law in responding to your request.
Additional Notice and Opt-Out
Our business model is providing subscriptions-as-a-service for contract review, analysis and redlining to business customers, not selling personal information. However, under the CPRA, some marketing practices, like the disclosure of Website visitor data to obtain targeted ads and analytics to advertise our products on third party sites, may be considered a "share" or "sale" even if no money is exchanged. A "share" is broadly defined under the CPRA to include a disclosure for cross-context behavioral advertising, and a "sale" is broadly defined under the CPRA to include a disclosure for something of value. Under these definitions, we may collect, share, or sell the following categories of personal information for commercial purposes: identifiers, characteristics, commercial or transaction information, internet activity, non-precise geolocation data, and inferences drawn. The categories of third parties to whom we "share" or "sell" personal information include, where applicable, vendors and other parties involved in cross-context targeted advertising. To the extent our marketing practices constitute a "share" or "sale" of your personal information, you have the right to opt out. You can exercise this right by modifying your cookie preferences on your browser or extension. These settings enable you to communicate an opt out that is specific to your browser or device, as applicable, so you will need to instruct each separately.
Retention
We retain each category of personal information for the length of time that is reasonably necessary for the purpose for which it was collected, and as necessary to comply with our legal obligations, resolve disputes, prevent fraud, and enforce our agreements.
Authorized Agent.
You can designate an authorized agent to submit requests on your behalf. However, we may require signed proof of the agent's permission to do so and verify your identity directly. Requests must be submitted through the designated methods listed above.
Right to Non-Discrimination.
You have the right not to receive discriminatory treatment by us for the exercise of any of your rights.
Shine the Light.
Customers who are residents of California may request (i) a list of the categories of personal information disclosed by us to third parties during the immediately preceding calendar year for those third parties' own direct marketing purposes; and (ii) a list of the categories of third parties to whom we disclosed such information. To exercise a request, please write us at privacy@ivo.ai or the postal address set out in "Contact Us" above and specify that you are making a "California Shine the Light Request." We may require additional information from you to allow us to verify your identity and are only required to respond to requests once during any calendar year.
Virginia provides additional rights to Virginia residents through the Virginia Consumer Data Protection Act ("VCDPA"). This section addresses those rights and applies only to Virginia residents acting in an individual or household context.
You have the following rights under the VCDPA:
To exercise any of these rights, please submit a request to us at privacy@ivo.ai. We will respond to your request within the time limits prescribed by law. We may require specific information from you to help us confirm your identity and process your request. If personal data about you has been processed by us as a processor on behalf of a business customer and you wish to exercise any rights you have with such personal data, please inquire with the business customer directly. If you wish to make your request directly to us, please provide the name of the business customer on whose behalf we processed your personal data. We will refer your request to that business customer, and will support them to the extent required by applicable law in responding to your request.
Roles.
Ivo may process personal data in accordance with the instructions of or on behalf of a business customer, including when providing Services to a Company under an Agreement. In this context, Ivo acts as a processor and the business customer acts as a controller. Ivo may also act as a controller when directly determining the processing of personal data in other Business contexts set out in this Policy, like complying with regulatory obligations applicable to our Business.
Lawful Basis for Processing.
Data protection laws in Europe require a "lawful basis" for processing personal data. Our lawful bases include where: (a) you have given consent to the processing for one or more specific purposes, either to us or to our service providers, partners, or business customers; (b) processing is necessary for the performance of a contract; (c) processing is necessary for compliance with a legal obligation; or (d) processing is necessary for the purposes of the legitimate interests pursued by us or a third party, and your interests and fundamental rights and freedoms do not override those interests.
International Transfers.
We may transfer your personal data to our operations in the United States or to our service providers or other third parties in the United States or in other countries - this may involve the transfer of your personal data to countries which have different data protection standards to those which apply in the European Economic Area, Switzerland or the United Kingdom.
Some of these countries are subject to a European Commission and/or UK government adequacy decision. For other countries, Ivo has put in place the relevant European Commission or UK government-approved standard contractual clauses with the relevant third parties to ensure that your personal data is protected with appropriate safeguards. We may also rely on other permitted data transfer mechanisms.
Your Data Subject Rights.
You may have certain statutory rights relating to your personal data. Subject to applicable law, you may have the right to access and rectify your personal data, to require us to erase your personal data or to transfer it to other organizations, and to object to the processing of your personal data. Where we process your personal data because we have a legitimate interest in doing so (as explained above), you may have a right to object to this. You may also have the right to restrict processing of your personal data in certain circumstances. These rights may be limited in some situations, for example, where we can demonstrate that we have legitimate grounds to process your personal data. In addition, you have the right to ask us not to process your personal data (or provide it to third parties to process) for marketing purposes or purposes materially different from those for which it was originally collected or subsequently authorized by you. You may withdraw your consent at any time for any processing of your personal data which we do based on consent you have provided to us.
To exercise any of these rights, please contact us at privacy@ivo.ai. We will respond to your request within the time limits prescribed by law. We may require specific information from you to help us confirm your identity and process your request. If your personal data has been processed by us as a processor on behalf of a business customer and you wish to exercise any rights you have with such personal data, please inquire with our business customer directly. If you wish to make your request directly to us, please provide the name of our business customer on whose behalf we processed your personal data. We will refer your request to that business customer, and will support them to the extent required by applicable law in responding to your request.
Retention of your Personal Data.
Please note that we retain personal data for as long as necessary to fulfill the purposes for which it was collected from you and/or our business customers, and may continue to retain and use your personal data for purposes of our legitimate interests and/or as necessary to comply (or demonstrate compliance with) with our legal/regulatory obligations, resolve disputes, prevent fraud, and enforce our rights.
We hope that we can satisfy any queries that you may have about the way we process your personal data. However, if you have any issues with our compliance, you may contact us at privacy@ivo.ai. You also have the right to lodge a complaint with the data protection regulator in your jurisdiction if you have any unresolved concerns. You can lodge the complaint in the country where you reside, where you work or where any alleged infringement of data protection law occurred.
Your Rights and Choices.
Subject to limited exceptions under applicable Canadian law, you may have the right to access, update, correct inaccuracies in, and withdraw consent (subject to reasonable prior notice and applicable legal and contractual restrictions) to the collection, use and disclosure of your personal information. If you withdraw your consent, we may not be able to provide our Website, Services or other aspects of our Business. To exercise any of these or other rights applicable to you under Canadian privacy laws, please contact us as set out in the "Contact Information" section below. We may require specific information from you to help us confirm your identity and process your request. If personal information about you has been processed by us on behalf of a business customer and you wish to exercise any rights you have with respect to such personal information, we encourage you to inquire with our business customer directly. If you are a resident of the province of Quebec, please note that we transfer and store personal information outside of the province. If you wish to make your request directly to us, please provide the name of our business customer on whose behalf we process your personal information, and we may refer your request to that business customer. We will assist our business customer in responding to your request.
Governance Policies and Practices
We are committed to protecting personal information and have implemented policies and practices that govern our treatment of personal information, including:
Contact Information
If you have any questions or comments about this Privacy Policy or the manner in which we or our service providers (including our service providers outside Canada) treat your personal information, to withdraw your consent, or to request access to or correction of your personal information, please contact us at privacy@ivo.ai.