Legal
Privacy Policy
Last updated September 23, 2026
This policy explains what information Conviction IC (“Conviction,” “we”) collects when you use the Conviction website and application, how we use it, and the choices you have. It should be read together with our Terms of Service.
Information we collect
- Account information: your email address and password. Passwords are stored as one-way hashes by our authentication provider and are never visible to us. We also record when you accepted our Terms and which version you accepted.
- Your Content: documents you upload, the text we extract from them, deal details you enter, and the committee reports, citations, and diligence questions the Service generates.
- Usage and activity records: for example which deals and committee runs exist in your workspace, which model was used, when runs happened, and an activity log of actions like uploads, runs, and invites. We use these to operate the Service, apply plan limits, and troubleshoot.
- Technical data: our hosting provider keeps standard request logs (such as IP address, browser type, and pages requested) for security and reliability.
- Communications: anything you send to our support address.
Cookies
We use only the cookies needed to keep you signed in. We do not use advertising cookies, third-party analytics, or cross-site tracking.
How we use information
We use information to provide and secure the Service, run the analyses you request, send account emails (such as sign-up confirmation), respond to support requests, enforce our Terms, and meet legal obligations. We do not sell your information, share it for advertising, or use Your Content to train AI models.
AI model providers
When you run a committee on a hosted model, the deal information and extracted document text for that run are sent to the provider you select. Each provider processes that data under its own commercial API terms, which state that API inputs are not used to train their models by default. OpenRouter requests are limited to providers with a zero-data-retention policy. We do not yet have zero-data-retention agreements directly with every provider. Our Security page lists this as work in progress. If your materials cannot leave infrastructure you control, talk with us before uploading them.
Who we share information with
We share information only with service providers (“subprocessors”) that help us run Conviction, and only for that purpose:
| Provider | Purpose | Data involved |
|---|---|---|
| Supabase | Database, authentication, and document storage | All account data and Your Content |
| Vercel | Application hosting | All data in transit through the app; request logs |
| Inngest | Background job orchestration | Job state limited to record IDs and job status; no document content or generated reports. The jobs themselves run on our own servers |
| Amazon Web Services (SES) | Transactional email | Your email address and email content |
| Google Workspace | Support inbox | Anything you send to our support address |
| OpenAI, Anthropic, OpenRouter | AI model inference, only for the provider you select | Deal information and extracted document text for that run |
We also share a deal's committee analysis with people you invite to view it (see our Terms). We may disclose information if required by law or valid legal process, to protect the rights, safety, or security of our users or the Service, or as part of a merger, acquisition, or sale of assets, in which case this policy continues to apply to your information.
How we protect information
Each organization's data is isolated at the database level, documents are kept in private storage scoped to your organization, and data is encrypted in transit. Our Security page covers our controls in more detail, including the ones that are still being built.
Retention and deletion
We keep your information for as long as your account is active. You can ask us to delete your account, or particular deals and documents, by emailing help@convictionic.com. We will delete them from our active systems unless we have a legal obligation to keep them. Copies in our providers' backups are removed when those backups expire on the providers' normal schedules. Records we must keep for legal, security, or fraud-prevention reasons are kept only as long as those reasons apply.
Your rights
Depending on where you live, you may have the right to access, correct, delete, or receive a copy of your personal information, or to object to or restrict certain processing. To make a request, email help@convictionic.com. We may need to verify your identity first. We will not discriminate against you for exercising these rights.
International processing
Conviction is operated from the United States. Your information may be processed in the United States and in other countries where our providers operate.
Children
Conviction is a professional tool and is not directed at anyone under 18. We do not knowingly collect information from children.
Changes to this policy
We may update this policy. If we make material changes, we will notify you by email or in the Service before they take effect. The date at the top of this page shows when it was last updated.
Questions? Email help@convictionic.com.