Privacy Policy

This Privacy Policy explains what information AutoSAM collects, how we use it, and what choices you have.

AutoSAM is in an early-access, pre-general-availability phase. As of the effective date above, no AutoSAM customer accounts exist and the AutoSAM product has not been deployed to a live production environment. This policy is written in two parts for every section that describes forward-looking product processing: what we collect today, on the marketing website, and what will apply once AutoSAM reaches general availability (“GA”). See our Terms of Service for AutoSAM's current early-access status.

Data controller

For the purposes of the EU General Data Protection Regulation ("GDPR") and UK GDPR, the data controller is GovCertix LLC, a Virginia limited liability company with its principal office at 2461 Eisenhower Ave, Suite 200, Alexandria, VA 22314, United States. You may contact the data controller at privacy@autosam.io. Privacy requests go to privacy@autosam.io; requests for a signed Data Processing Agreement go to legal@autosam.io.

1. Information we collect

Today.

AutoSAM is in an early-access, pre-general-availability phase. The only personal information AutoSAM's marketing site collects today is submitted through the lead form or the contact form: name, email address, company, your area of interest, and your consent to be contacted, plus optional fields (role, business types, entities, and a free-text message). We also collect standard web-server log data (IP address, user agent, referrer, and request timestamps) and, where you consent, analytics events (PostHog) and error-diagnostic data (Sentry).

When AutoSAM reaches general availability.

Once the AutoSAM product is generally available, this section will additionally cover account profile information, usage and event telemetry, and service configuration data needed to provide monitoring, notifications, and billing. As of the effective date of this policy, no AutoSAM customer accounts exist and this forward-looking description does not yet apply. We will update this notice, and provide any legally required notice at collection, before this section becomes operative.

1.5 Data we do not collect or accept

AutoSAM's product architecture does not accept, process, or store Controlled Unclassified Information (CUI), International Traffic in Arms Regulations (ITAR)–controlled technical data, Export Administration Regulations (EAR)–controlled technical data, classified information, or other procurement-sensitive material, on the marketing site or the AutoSAM product. This is an architectural design choice (internally tracked as ADR-UPLOAD-01), not a policy a user must remember to follow. Do not upload, paste, or otherwise transmit CUI, ITAR/EAR‑ controlled data, classified information, or confidential contract terms through any AutoSAM surface, including free-text fields on this website. If you inadvertently submit such information, contact privacy@autosam.io and we will delete it from our records. This design choice is also why DFARS 252.204-7012 (Safeguarding Covered Defense Information) and NIST SP 800-171 do not apply to AutoSAM's own data handling: AutoSAM removes itself from the scope of these controls by design rather than attempting to inherit them.

2. How we use information

Today, we use lead-form information to respond to your inquiry and, where you have consented, to send you product and company updates. Once AutoSAM reaches general availability, we will also use account information to operate and secure the service, provide customer support, process billing, deliver product communications, and improve platform performance and reliability. Under GDPR Article 6, our lawful bases for processing are:

• Lead-form processing (today): Consent (Art. 6(1)(a)), given by the explicit consent checkbox, and/or pre-contractual measures (Art. 6(1)(b)) taken at your request prior to a possible future agreement. You may withdraw consent at any time by emailing privacy@autosam.io, without affecting the lawfulness of processing before withdrawal (GDPR Art. 7(3)).
• Service operation and delivery (at GA): Contract performance (Art. 6(1)(b))
• Security and fraud prevention: Legitimate interest (Art. 6(1)(f))
• Billing and tax compliance (at GA): Contract performance (Art. 6(1)(b)) and legal obligation (Art. 6(1)(c))
• Product communications: Legitimate interest (Art. 6(1)(f)) or consent (Art. 6(1)(a)), depending on the communication type
• Analytics: Consent (Art. 6(1)(a)), collected via our cookie consent mechanism

Marketing communications. We only send marketing email to lead-form submitters who checked the consent box. Every marketing email includes a one-click unsubscribe link; you may also opt out at any time by emailing privacy@autosam.io.

3. Cookies and similar technologies

We use functional cookies for site reliability, analytics technologies to measure product usage, and functional telemetry to diagnose errors. Learn more at our cookie policy.

International data transfers

AutoSAM is operated from the United States. If you are located in the European Economic Area ("EEA"), United Kingdom, or Switzerland, your personal data may be transferred to and processed in the United States by the sub-processors listed in Section 4. These transfers are made pursuant to Standard Contractual Clauses ("SCCs") approved by the European Commission (Commission Implementing Decision (EU) 2021/914). You may request a copy of applicable SCCs by emailing privacy@autosam.io.

4. Data sharing and processors

We use trusted service providers under contractual safeguards. We do not sell your personal data. Our current sub-processors (the ones actually receiving data today, sourced from our single subprocessor registry so this list cannot disagree with our Subprocessors page) are:

• Vercel: Application hosting for the marketing site (U.S.)
• Microsoft: Exchange Online / M365 SMTP for outbound lead-form and contact-form email (U.S.)
• PostHog: Product analytics; loaded per the Analytics Behavior statement above (U.S.)
• Sentry: Functional error monitoring (U.S.)

Planned sub-processors (activated at product general availability): Supabase (Application database, authentication, and storage) and Stripe (Payment processing). We disclose these now so a future customer can see what is coming; once AutoSAM is generally available, paid-plan customers will receive at least 30 days' advance notice before any new sub-processor is engaged.

For a complete and versioned list of our sub-processors, see /legal/subprocessors.

5. Data retention

Today.

• Lead-form submissions and the resulting internal email (Microsoft 365 mailbox): retained for as long as reasonably necessary to respond to your inquiry, and no longer than 3 years absent an ongoing relationship
• Marketing-lead database records (once the marketing_leads persistence path is enabled): retained on the same schedule as the corresponding email record
• PostHog analytics events (with consent): retained per PostHog's standard retention window, currently up to 12 months
• Sentry error diagnostics: retained per Sentry's standard retention window, currently up to 90 days

When AutoSAM reaches general availability.

The retention periods below will apply to product data once the AutoSAM product is live. As of the effective date of this policy, no AutoSAM customer accounts exist and this section does not yet apply:

• Account data: retained while your account is active, deleted upon account deletion
• Billing records: 7 years (statute-of-limitations and audit conservatism; the exact period will be confirmed against applicable tax and financial-reporting law before GA)
• Audit logs: 365 days
• Monitor run history: 30 days
• Notification history: 90 days
• API usage logs: 30 days

6. Security

Today.

• 256-bit TLS encryption for all data in transit, provided by our hosting provider (Vercel)
• Lead-form emails are held in a Microsoft 365 mailbox governed by Microsoft's security controls; AutoSAM does not currently operate any additional data-at-rest storage of its own
• AutoSAM/GovCertix LLC does not currently hold SOC 2 Type II certification. Some infrastructure providers we plan to use (e.g., Vercel) hold their own SOC 2 Type II reports; certification inheritance is not equivalent to AutoSAM holding certification. No FedRAMP authorization exists, and none is required at this stage.

Upon general availability.

AutoSAM intends to implement, and represent contractually once live, additional safeguards including AES-256 encryption for data at rest, row-level security (RLS) enforced at the database layer, and multi-factor authentication (MFA) support for all accounts. These controls are not yet in place because the product has not been deployed to a live production environment.

For full details on our security practices and architecture, see our Trust Center.

7. Your choices and rights

Because there is no AutoSAM product account today, all rights requests are handled by email. Depending on your jurisdiction, you may have the following rights:

• Access: Request a copy of your personal data by emailing privacy@autosam.io
• Rectification: Request correction of inaccurate data
• Erasure: Request deletion of your data
• Portability: Receive your data in a structured, machine-readable format
• Objection: Object to processing based on legitimate interests
• Restrict processing: Request limitation of processing under certain conditions
• Withdraw consent: Withdraw consent for analytics/marketing communications at any time by emailing privacy@autosam.io

Self-service data export and account deletion will be provided in-product once AutoSAM reaches general availability.

For CCPA/CPRA: California residents have the following rights under the California Consumer Privacy Act as amended by the California Privacy Rights Act (effective January 1, 2023):

• Right to know: Request disclosure of the categories and specific pieces of personal information collected
• Right to delete: Request deletion of personal information we hold about you
• Right to correct: Request correction of inaccurate personal information (email privacy@autosam.io)
• Right to opt-out of sale: We do not sell personal data; see our Do Not Sell My Personal Information page
• Right to limit use of sensitive personal information: California residents may request that we limit the use and disclosure of sensitive personal information (contact privacy@autosam.io)
• Right to non-discrimination: We will not discriminate against you for exercising any of these rights

For any privacy request, contact privacy@autosam.io. We will respond to verified requests within the applicable state's statutory maximum, generally 45 days from receipt with one 45-day extension.

Appeal process. If we deny a rights request in whole or in part, we will explain the basis for the denial. You may appeal by replying to our decision or emailing privacy@autosam.io with the subject line “Privacy Appeal.” We will respond to your appeal within 60 days, with reasons if the appeal is denied, and, for California residents, information on how to contact the California Attorney General.

California "Shine the Light": Under California Civil Code §1798.83, California residents may request disclosure of whether a business has shared personal information with third parties for their direct marketing purposes. AutoSAM does not share personal information with third parties for direct marketing purposes. If you have questions, contact privacy@autosam.io.

8. State privacy rights

In addition to CCPA rights for California residents described above, residents of the following states have specific privacy rights under their respective laws. GovCertix LLC extends the rights in this table as a matter of policy to all verified requesters, whether or not a given statute applies to a business-contact dataset of this kind. To exercise any of these rights, contact privacy@autosam.io. We will respond to verified requests within the applicable state's statutory maximum, generally 45 days from receipt with one 45-day extension.

If your state is not listed above but has enacted a consumer privacy law, you may still contact privacy@autosam.io to submit a privacy request.

9. Do not sell statement

AutoSAM does not sell personal data. For additional requests related to this statement, see Do Not Sell My Personal Information.

10. Children's privacy

AutoSAM is a business-to-business service and is not directed at children. Under United States law, we do not knowingly collect personal information from children under 13, consistent with the Children's Online Privacy Protection Act (COPPA). For EU/EEA data subjects, under GDPR Article 8 we treat 16 as our consent-age floor. If you believe that a minor has provided personal data to AutoSAM, please contact us at privacy@autosam.io and we will promptly delete such information.

11. Automated decision-making

AutoSAM does not use personal data to make automated decisions with legal or similarly significant effects on you. Analytics inferences from PostHog (feature usage, engagement measurement) are used for aggregate product improvement, not to make consequential decisions about any individual.

12. Your right to lodge a complaint

If you are a resident of the EU/EEA and believe that AutoSAM has processed your personal data unlawfully, you have the right to lodge a complaint with your national data protection supervisory authority. A list of EU Data Protection Authorities is available at edpb.europa.eu. UK residents may contact the Information Commissioner's Office (ICO) at ico.org.uk.

13. Policy changes

We may update this Privacy Policy over time. Material updates will be reflected on this page with an updated effective date.