Privacy Policy

Dodge AI, Inc. is the company responsible for this Policy.

Address: 16192 Coastal Highway, Lewes, Delaware 19958, United States

Contact for privacy questions and requests: support@getdodge.ai

The law treats us differently depending on whose data we handle.

• Controller (business). For information about website visitors, prospects, people who contact us, account administrators and billing contacts, and for our own security and operations, Dodge AI decides why and how personal information is used. This Policy applies to that information in full.
• Processor (service provider). For Customer Content, meaning data our customers submit to the Services or make available through connected enterprise systems, the customer is the controller (or business) and Dodge AI is its processor (or service provider). We process Customer Content only on the customer's documented instructions and under our agreement with the customer, including our Data Processing Agreement ("DPA"). If your organization is our customer and you use the Services through it, please direct privacy requests about Customer Content to your organization. If you send them to us, we will pass them on to the customer where we can.

If this Policy and a signed DPA conflict on the handling of Customer Content, the DPA controls.

We comply with the GDPR and the UK GDPR where they apply to our processing of personal data, both as a controller and as a processor. Our DPA contains the terms required by Article 28 of the GDPR. Where we act as a processor, we assist customers with data subject requests, data protection impact assessments and audits, as the DPA describes.

Information you give us. Name, work email address, phone number, job title, organization details, account credentials, communications with us, information you submit when booking a demo or call, and billing details. Card and bank details are handled by our payment processors, and we do not store full card numbers.

Customer Content. Text, files, prompts, tickets, configuration, logs, code, and outputs that you or your organization submit or generate in the Services, and data the Services read from enterprise systems you connect (for example SAP, Oracle or Microsoft Dynamics environments). This may include personal information about your employees, contractors, suppliers and customers, such as names, business contact details, user IDs, roles, and ticket or transaction records.

Restricted data. The Services are not designed for special categories of personal data (such as health, biometric, or racial or ethnic origin data), payment card numbers, government identification numbers, or data subject to classified-information or defense export controls. Customers should not submit these unless we have expressly agreed in writing.

Usage and device information. IP address, device and browser type, pages viewed, interactions, timestamps, log data, and approximate location derived from IP address.

Cookies and similar technologies. See Section 10.

Information from other sources. Business contact details from public sources or referral partners, and information from integration providers when you choose to connect a third-party service.

Where the GDPR or UK GDPR applies to us as a controller, we rely on the legal bases below.

Where we rely on consent, you can withdraw it at any time. Withdrawal does not affect processing done before it. We do not make decisions that have legal or similarly significant effects on individuals solely by automated means. We do not sell personal information, and we do not share it for cross-context behavioral advertising.

• The Services use AI models to process Customer Content and produce outputs, for example to analyze tickets, propose fixes, or review code.
• We use Customer Content only to provide, secure and support the Services for the customer that submitted it.
• We do not use Customer Content to train or fine-tune AI models that are made available to other customers or to any third party, unless the customer gives us written permission.
• We may use service metrics, error rates and de-identified usage data to improve the Services. That data does not include Customer Content.
• Third-party AI model providers process Customer Content only as our sub-processors, under written terms that prohibit them from using it to train their models and that require confidentiality and appropriate security.
• AI outputs can be inaccurate or incomplete. Customers are responsible for reviewing outputs before acting on them, as set out in our Terms.

We share personal information only as follows:

• Service providers and sub-processors. Companies that help us run the Services, such as cloud hosting, AI model providers, analytics, customer support, scheduling, email and payment providers. They may use information only to provide services to us and are bound by written agreements. Customers can ask for our current sub-processor list at support@getdodge.ai. We give customers at least 30 days' notice before adding a new sub-processor that will process Customer Content, and customers may object as set out in the DPA.
• Integration providers. When you choose to connect a third-party service, we exchange information with it as needed for that connection.
• Legal and safety reasons. Where required by law or legal process, or to protect the rights, property, safety and security of Dodge AI, our customers or others.
• Business transfers. In a merger, acquisition, financing or sale of assets. We will tell you before personal information becomes subject to a different privacy policy.
• With your consent or at your direction.

We may share aggregated or de-identified information that cannot reasonably identify you. We will not try to re-identify it.

Dodge AI is based in the United States. We and our sub-processors may process and store information in the United States and other countries. Those countries may have data protection laws different from those where you live.

When we transfer personal data from the European Economic Area, the United Kingdom or Switzerland to a country without an adequacy decision, we use approved safeguards. These include the EU Standard Contractual Clauses, the UK International Data Transfer Addendum and the Swiss addendum, and, where a recipient is certified, the EU-US Data Privacy Framework. You can ask us for a copy of the relevant safeguards at support@getdodge.ai. Transfers of personal data from India are made as permitted by the Digital Personal Data Protection Act, 2023.

We keep personal information only as long as needed for the purposes in this Policy.

When information is no longer needed, we delete it or anonymize it.

We use administrative, technical and organizational safeguards designed to protect personal information, including encryption of data in transit and at rest, role-based access controls, logging and monitoring, and confidentiality obligations for personnel. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

We maintain SOC 2 Type I and Type II compliance. Our independent auditor's SOC 2 report is available to customers and prospective customers on request, under a confidentiality agreement, and we test our controls on an ongoing basis.

If we become aware of a personal data breach affecting a customer's Customer Content, we will notify that customer without undue delay and in any event within 72 hours, and give the information it needs to meet its own legal obligations. Where we are the controller, we will notify affected individuals and regulators as the law requires.

We use essential cookies that make the Services work, and analytics cookies that help us understand how our websites and Services are used. Where the law requires consent for non-essential cookies, we ask for it before setting them. You can control cookies through your browser settings. We honor the Global Privacy Control signal where the law requires it. If you block cookies, parts of the Services may not work properly. A list of the cookies we use is available on request at support@getdodge.ai.

Depending on where you live, you may have some or all of the following rights over personal information we hold about you as a controller.

• All users. Access, correct or delete your personal information, and object to certain processing.
• EEA, UK and Switzerland. Access, rectification, erasure, restriction of processing, data portability, objection to processing (including direct marketing), and withdrawal of consent. You may also complain to your local data protection authority, such as the UK Information Commissioner's Office.
• California and other US states. Know and access what we collect, delete, correct, opt out of the sale or sharing of personal information, limit the use of sensitive personal information, and not be discriminated against for exercising these rights. We do not sell or share personal information and do not use sensitive personal information beyond what the law permits. In the past 12 months we collected the categories described in Section 3, which correspond to identifiers, commercial information, internet or network activity, professional or employment-related information, and approximate geolocation, and we disclosed them for business purposes to the recipients described in Section 6. You may use an authorized agent to make a request.
• India. Under the Digital Personal Data Protection Act, 2023, you may obtain a summary of your personal data and the entities we share it with, request correction and erasure, nominate another person to exercise your rights, and use our grievance process in Section 15.

How to make a request. Email support@getdodge.ai. We may need to verify your identity first. We respond within one month, or within 45 days where US state law applies, and we will tell you if we need more time. If you appeal a decision, contact us with the word "Appeal" in the subject line.

Customer Content. If your personal information is in Customer Content, contact the customer that controls it. We will help it respond as set out in the DPA.

Marketing. You can opt out of marketing emails using the unsubscribe link. You may still receive non-marketing messages such as billing or security notices.

The Services are business services and are not directed to anyone under 18. We do not knowingly collect personal information from anyone under 18. If you believe a young person has given us personal information, contact us and we will delete it.

The Services may link to or connect with third-party websites and services. We are not responsible for their privacy practices, and we encourage you to read their policies.

We may update this Policy from time to time. We will post the updated version and change the "Last updated" date above. For material changes, we will also notify our customers by email or through the Services before the changes take effect.

Dodge AI, Inc.

16192 Coastal Highway, Lewes, Delaware 19958, United States

Email: support@getdodge.ai

For privacy questions, requests, and data protection inquiries, email us with "Privacy" in the subject line. To raise a grievance under Indian law, email us with "Grievance Officer" in the subject line, and we will acknowledge and respond within 30 days.