Privacy Policy

Last updated: July 2026

This notice describes how GAAP IQ ("we," "us") processes personal information when you use gaapiq.ai and related services. Questions or requests: support@gaapiq.ai. For a plain-language summary of how we protect your content, see Trust & Security.

Information you provide

• Account details. Your name and email — via Google sign-in (name, email, profile photo from Google) or email/password signup. Passwords are stored only as salted hashes, never in plain text.
• Your work product. The research threads, memos, disclosures, policies, and schedules you create; your entity profile; and documents you upload for analysis. This is yours, not ours: we store it so the service works for you and use it for no other purpose — we don't mine it, sell it, or train AI models on it. Uploaded documents are ephemeral: they are processed to support your session and automatically deleted 24 hours after upload, and you can delete them immediately at any time. Work you create persists until you delete it.
• Payment details go directly to Stripe, our payment processor; we never see or store your card number.

Information collected automatically

• Usage records. Which features you use and the AI processing they consume, so plans and allowances work and we can operate the service.
• Technical logs. IP address, browser, and request data collected automatically by our hosting infrastructure for security and reliability.

We do not collect sensitive personal information and do not knowingly collect data from anyone under 18.

How we use it

To provide the service: your content is processed by AI models (via the providers below) to generate answers and drafts, your entity profile tailors results, and usage records enforce plan limits. Also: account administration, support, security and fraud prevention, service improvement based on aggregate usage, and compliance with legal obligations. We don't sell your data, we don't use it for advertising, and we don't train AI models on your private content — nor do our model providers: every AI request is restricted, in our code, to zero-data-retention endpoints that do not store your prompts or content and do not use them for training. Model providers process your content only to generate your output.

Who we share it with

We use a small set of service providers, each only for its function:

• AI model providers — generate output from your queries and content, restricted to zero-data-retention endpoints (no prompt storage, no training); the current provider list is available on request at support@gaapiq.ai;
• Stripe — payments and subscription management;
• Google — sign-in, if you choose it;
• Render — hosting and database (United States);
• Resend — transactional email such as password resets.

Public data sources like SEC EDGAR are queried on your behalf. We may also disclose information if required by law, or transfer it as part of a merger, acquisition, or sale of assets (in which case this notice continues to apply to it).

Cookies

We use essential cookies only: your sign-in session and a security (CSRF) token. No advertising cookies, no third-party trackers, no analytics cookies — which is why there's no cookie banner. Blocking essential cookies in your browser will prevent sign-in from working.

How we protect it

• Encryption. Your data is encrypted at rest (AES-256, including database replicas and backups) and in transit (TLS) — between your browser and us, and between us and every provider listed above.
• Segregation. Your content is isolated to your account: every request is checked for ownership, and no other user can access it.
• No-look operations. Our administrative and operational tools display counts, timestamps, and system health — never your documents, questions, or work product — and your content does not appear in our application logs. No human reviews your content unless you ask us for support help or the law requires it.

A plain-language summary of these protections, including how each is enforced, is on our Trust & Security page.

Where your data lives, and how long

Data is hosted in the United States. Content you create stays until you delete it or your account; documents you upload are automatically deleted 24 hours after upload (or immediately, if you remove them yourself). Deleting anything removes it from the live database, with short-lived encrypted backups expiring on their retention cycle. We keep billing and usage records as needed for legal, tax, and accounting purposes even after account deletion.

Your rights

You can access, correct, export, or delete your personal information. Email support@gaapiq.ai and we'll act on your request in accordance with applicable law. Depending on where you live (including US states such as California, Colorado, Connecticut, Texas, Utah, and Virginia), you may have specific statutory rights to access, deletion, correction, and portability, and the right not to be discriminated against for exercising them. We do not "sell" or "share" personal information as those terms are defined under US state privacy laws, and we do not use it for targeted advertising — so there is nothing to opt out of. If we ever can't resolve a privacy concern, California residents may also contact the Complaint Assistance Unit of the California Department of Consumer Affairs.

Changes to this notice

We'll update this notice as the service evolves, revising the "Last updated" date and, for material changes, making reasonable efforts to notify you.

Contact

GAAP IQ · support@gaapiq.ai