Privacy Policy

1. Who is responsible

Global Vibing LLC, a Delaware limited liability company registered to do business in Florida, operates Govern All A.I. and decides how the personal information described here is used. Contact: [email protected].

2. What we collect

• Account information: your email address, and your name and organization if you give them.
• Sign-in information: session cookies and the one-time sign-in links we email you.
• Billing information: your plan, payment status and the payment references Stripe returns. Stripe collects your card details; we never receive or store your full card number.
• Content you provide: assessment answers, documents you generate or upload, the systems you ask us to check and their results, and requests you route through Iron Suit.
• Technical information: the IP address and browser details of each request, which our firewall checks against lists of known abusive addresses, and server logs kept for security and troubleshooting.

We use only the cookies needed for sign-in and security. We do not use advertising cookies or third-party analytics on the service.

3. How we use it

• to provide the service you signed up for and to support you;
• to bill you through Stripe and keep required financial records;
• to secure the service, prevent abuse and investigate incidents;
• to improve the service using counts and statistics that do not identify you;
• to meet legal obligations.

We do not sell personal information, and we do not share it for advertising based on your activity across other businesses' sites.

4. Artificial intelligence processing

• Our AI features (for example governance document drafts and assessment analysis) run on an AI model we host on our own servers; that content does not leave our servers for those features.
• Iron Suit forwards the AI requests you route through it to the AI provider you connect it to, using your own key, after applying your policies. Your provider key is stored encrypted.

We do not use your content to train AI models.

5. Who processes it for us

We share personal information only with service providers that help us run the service, under their terms and only for that purpose:

• Stripe (payments);
• OVHcloud (the servers the service runs on);
• Cloudflare (domain name service and network protection);
• our email delivery providers (sign-in links and service email);
• the outside AI providers named above, only for the features that use them.

We may also disclose information when the law requires it, to protect people or the service from harm, or as part of a sale or reorganization of the business, in which case this policy continues to apply to it.

6. How long we keep it

We keep your information while your account is open. When you close your account or ask us to delete it, we delete it within 30 days, except records we must keep by law (for example billing records) and copies in backups, which are overwritten on their normal rotation.

7. Your choices and rights

You can ask us to show you, correct, export or delete your personal information, or to stop a particular use of it. Write from your account's email address to [email protected]; we answer within 30 days (45 days where California law allows that time). Residents of California, the European Union, the United Kingdom and other places with privacy laws have these rights under those laws, and we honor them without charging a fee or treating you differently for using them.

8. Security

Connections to the service are encrypted, access to systems is limited to the people who need it, and provider keys you give Iron Suit are encrypted at rest. No system is perfectly secure; if a breach affects your information, we will tell you as the law requires.

9. Where information is processed

The service is run from the United States. Our service providers may process information in the United States and other countries where they operate, under the safeguards their terms provide.

10. Children

The service is for businesses and professionals and is not directed to children under 16. We do not knowingly collect their information; if you believe a child has given us information, write to us and we will delete it.

11. Changes to this policy

We will post changes here with a new effective date, and give at least 30 days' notice by email or on the service before a material change takes effect.