Privacy Policy

1. Introduction

Muverity LLC ("we," "us," or "our") operates ReadyGDPR, a comprehensive privacy compliance platform. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our service. We are committed to protecting your privacy and ensuring transparency in our data practices.

By accessing or using ReadyGDPR, you agree to this Privacy Policy. If you do not agree with our practices, please do not use our service.

2. Information We Collect

2.1 Information You Provide

• Account Information: Name, email address, company name, phone number
• Organization Data: Business information, industry sector, employee count
• Payment Information: Billing details processed securely through Stripe
• Compliance Data: Information you input for compliance assessments and documentation
• Communications: Messages sent through our DPO chat, contact forms, and support tickets

2.2 Automatically Collected Information

• Usage Data: Pages visited, features used, time spent on platform
• Device Information: Browser type, operating system, IP address
• Cookies and Tracking: Session management, preferences (see our Cookie Policy)
• Log Data: Access times, error logs, performance metrics

3. How We Use Your Information

We use the collected information for:

• Service Provision: Operating and maintaining ReadyGDPR platform
• Virtual DPO Services: Providing AI-powered compliance guidance
• Compliance Management: Processing your compliance assessments and documentation
• Communication: Sending service updates, security alerts, and support responses
• Payment Processing: Managing subscriptions and billing
• Improvement: Analyzing usage patterns to enhance our service
• Legal Compliance: Meeting regulatory requirements and enforcing our terms
• Security: Detecting and preventing fraud, abuse, and security incidents

4. Legal Basis for Processing (GDPR)

Under the GDPR, we process your data based on:

• Contract Performance (Art. 6(1)(b)): Processing necessary to provide our services
• Legitimate Interests (Art. 6(1)(f)): Service improvement, fraud prevention, analytics
• Legal Obligation (Art. 6(1)(c)): Compliance with applicable laws and regulations
• Consent (Art. 6(1)(a)): Marketing communications and optional features (where applicable)

5. Data Sharing and Disclosure

We may share your information with:

5.1 Service Providers

• Supabase: Database hosting and authentication services
• Stripe: Payment processing (subject to Stripe's privacy policy)
• Cloud Infrastructure: Hosting and content delivery services
• Anthropic: Provides the AI model behind every AI feature, including the Virtual DPO, document generation, breach notification drafting and data-mapping suggestions

For the list of who processes data on our behalf, see our sub-processors page.

5.2 Legal Requirements

We may disclose information when required by law, court order, or government regulation, or when necessary to protect our rights, safety, or property.

5.3 Business Transfers

In the event of a merger, acquisition, or sale of assets, your information may be transferred to the acquiring entity.

6. International Data Transfers

Your data may be transferred to and processed in countries outside your jurisdiction. We ensure appropriate safeguards are in place, including:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• Data Processing Agreements with all service providers
• Compliance with applicable cross-border data transfer regulations

7. Data Retention

We retain your information for:

• Active Accounts: Duration of your account plus 90 days
• Financial Records: 7 years (legal requirement)
• Marketing Data: Until consent is withdrawn
• Legal Claims: As required by applicable statutes of limitations
• Security Logs: Up to 12 months for security purposes

8. Your Privacy Rights

8.1 GDPR Rights (EU/EEA/UK)

You have the right to:

• Access: Request a copy of your personal data
• Rectification: Correct inaccurate or incomplete data
• Erasure: Request deletion of your data ("right to be forgotten")
• Restriction: Limit how we process your data
• Data Portability: Receive your data in a structured format
• Object: Object to processing based on legitimate interests
• Withdraw Consent: Withdraw consent at any time (where applicable)
• Lodge a Complaint: File a complaint with your supervisory authority

8.2 CCPA/CPRA Rights (California)

California residents have the right to:

• Know: What personal information we collect and how it's used
• Delete: Request deletion of your personal information
• Opt-Out: Opt out of the sale or sharing of personal information (we do not sell data)
• Correct: Request correction of inaccurate information
• Limit: Limit use of sensitive personal information
• Non-Discrimination: Not be discriminated against for exercising your rights

8.3 DPDP Act Rights (India)

Indian users have the right to:

• Access personal data held by us
• Correct or complete inaccurate data
• Erase personal data when no longer necessary
• Nominate another individual to exercise rights in case of death or incapacity

8.4 PDPL Rights (Saudi Arabia)

Saudi Arabian users have the right to:

• Access and obtain copies of personal data
• Request rectification of inaccurate data
• Request deletion or restriction of processing
• Object to processing in certain circumstances
• Withdraw consent where processing is based on consent

To exercise any of these rights, please contact us at [email protected]

9. Security Measures

We implement appropriate technical and organizational measures to protect your data:

• Encryption in transit (TLS/SSL) and at rest
• Regular security audits and penetration testing
• Access controls and authentication mechanisms
• Employee training on data protection
• Incident response procedures
• Regular backups and disaster recovery plans

While we strive to protect your data, no method of transmission over the internet is 100% secure. We encourage you to use strong passwords and enable two-factor authentication.

10. Children's Privacy

ReadyGDPR is not intended for individuals under 16 years of age (or 13 in the US). We do not knowingly collect personal information from children. If you believe we have collected information from a child, please contact us immediately at [email protected].

11. Third-Party Links

Our platform may contain links to third-party websites. We are not responsible for the privacy practices of these sites. We encourage you to review their privacy policies before providing any personal information.

12. Updates to This Privacy Policy

We may update this Privacy Policy periodically to reflect changes in our practices or legal requirements. We will notify you of material changes by:

• Posting the updated policy on this page
• Updating the "Last Updated" date
• Sending email notification for significant changes
• Displaying a prominent notice on our platform

Your continued use of ReadyGDPR after changes constitutes acceptance of the updated policy.

13. Contact Information

For questions, concerns, or to exercise your privacy rights, please contact:

14. Supervisory Authorities

If you are located in the EU/EEA/UK and believe we have not adequately addressed your concerns, you have the right to lodge a complaint with your local data protection authority:

• EU: Find your authority at edpb.europa.eu
• UK: Information Commissioner's Office (ICO) at ico.org.uk