Privacy Policy | GraphnAI

This Privacy Policy explains how GraphnAI, Inc. ("GraphnAI", "we", "us" or "our") collects, uses, shares and keeps personal information when you visit graphnai.com and our other websites (the "Website"), request or use the GraphnAI Public Preview, contact us, or apply for a job. It also explains your choices and rights. Capitalized terms not defined here have the meanings in our Terms of Service.

1. The data in your environment isn't ours

The GraphnAI software (the "Software") runs on infrastructure you control and stores the information it collects from your directories, identity providers and security events in a database you control. We don't receive, host or have access to that information ("Customer Data"), so this policy doesn't cover it: your organization decides how it's used and kept. The only information the Software sends us is described in section 2.3. If you connect the Software to an AI provider, email server or webhook, it sends data to that service under your agreement with it, not to us.

2. Information we collect

2.1 When you request a Preview

What you enter: your name, work email address, company, phone number, the approximate number of identities in your environment and, if you provide it, the hostname of the server you'll install on.
Your agreement: that you accepted the Terms of Service and this policy, the version you accepted and when.
Collected automatically: the IP address the request comes from, and the result of a bot check by Cloudflare Turnstile, which evaluates signals from your browser and device.
What we create: the dates you verified your email and we issued or declined the Preview, and your license. Your license key contains identifiers for your tenant and license, the Preview tier and limits, and the expiry date, but not your name or email address. The download we send you is pre-configured with your email address as the first administrator account and with the hostname you gave us.
Download activity: when you download the Software, our servers record the IP address and time of each download, and count downloads against your link's limit.

2.2 When you contact us or apply for a job

Contact form: your name, email address, company, the type of inquiry and your message.
Careers form: your name, email address, the position you're interested in, your message and, if you provide it, your LinkedIn profile address.
Email and calls: anything you send us when you write to us, reply to our emails or speak with us, including support requests and any diagnostic information you choose to share.

2.3 From the Software

Usage reports: a few minutes after it starts, about once a day after that, and once after its first successful sync, the Software sends us a report with identifiers for your installation, tenant and license; your license state and expiry; the Software's version and platform; and counts, such as how many identities, relationships, domains and users by role you have, the results of syncs, how often features are used, and detections by rule. Usage reports never include account names, domain names, hostnames, IP addresses, directory contents or other free text. Because they carry your license's identifiers, we can associate them with your Preview request. The usage reporting guide lists every field.
Update checks: about once a day, the Software sends us its version number to ask whether a newer version is available. Your administrators can turn this off.
Microsoft Entra ID setup: if your administrators choose automatic setup, the Software sends our sign-in relay your license key, a one-time value and the address of your GraphnAI server, so that Microsoft can return you to it.
Network details: each of these requests shows us the public IP address it comes from.

The Software doesn't include crash reporting or third-party analytics, and it doesn't send us Customer Data. Installing it downloads container images from GitHub's container registry and Docker Hub, which receive your server's IP address under their own privacy policies.

2.4 When you visit the Website

Server logs: the IP address, the pages and files requested, the time, the referring page and your browser's user agent, which our servers and our content delivery network record as part of serving the Website.
Analytics: page views and performance measurements through Cloudflare Web Analytics, which doesn't use cookies, and, only if you accept analytics cookies, Google Analytics. See section 7.

3. How we use information

We use the information we collect to:

review Preview requests, verify email addresses, issue licenses and deliver the Software;
prevent fraud and abuse, for example by limiting requests per IP address, blocking automated signups and issuing one active Preview per email address;
administer licenses and enforce the Preview's terms and limits;
send you messages about your request, your Preview and the Software, such as verification and delivery emails and notices about your Preview;
contact you about GraphnAI products and services, including following up on your Preview. You can opt out of marketing messages at any time;
respond to inquiries and support requests;
evaluate job applications;
understand how the Website and the Software are used, and improve them;
protect the security of our services, people and systems; and
comply with the law, enforce our agreements, and establish, exercise or defend legal claims.

We don't sell personal information, share it for cross-context behavioral advertising, or use it to make decisions that produce legal or similarly significant effects based solely on automated processing.

Legal bases (European Economic Area, United Kingdom and Switzerland)

Where these laws apply, we process personal information to take steps you request before entering into, and to perform, our agreement with you (Preview requests, licenses, delivery and support); for our legitimate interests in operating, securing and improving our services, preventing abuse, and communicating with business contacts about our products, which we balance against your rights; with your consent, for analytics cookies, which you can withdraw at any time; and to comply with legal obligations.

4. How we share information

We share personal information only as described here.

Service providers that process it on our behalf to run our services:
- Cloudflare, which delivers and protects the Website, connects our signup service to the internet, provides the Turnstile bot check and provides Web Analytics;
- Microsoft, which provides our email (including the verification and delivery emails we send you and the messages from our forms) and the sign-in service behind automatic Microsoft Entra ID setup;
- Google, which provides Google Analytics if you accept analytics cookies; and
- Web3Forms, which delivers messages from our contact and careers forms to our inbox.
Legal and safety: when we believe in good faith that the law, legal process or a government request requires it, or that it's needed to protect the rights, property or safety of GraphnAI, our users or others, or to investigate fraud or security issues.
Business transfers: to a successor or acquirer in connection with a merger, acquisition, financing, reorganization or sale of all or part of our business, subject to this policy's protections.
With your consent or at your direction.

5. Where we process information

GraphnAI is based in the United States. We store and process the information we collect on our own servers in the United States, and our service providers may process it in the United States and other countries. If you're outside the United States, your information will be transferred to the United States, where data protection laws may differ from those where you live. We protect it as this policy describes wherever it's processed.

6. How long we keep information

Our public signup service: it holds each Preview request until our internal systems collect it, and deletes its copy 30 days later once the request has a final outcome (Preview issued, request declined or verification expired). A request still under review stays until it's resolved. Usage reports are deleted from it 30 days after collection.
Verification and download links: verification links expire after 72 hours. Download links expire after 7 days or 5 downloads, whichever comes first, and the download file is deleted within 24 hours after the link expires.
Preview, license and usage records: we keep records of Preview requests, our decisions, the licenses we issue and usage reports for as long as we need them to administer licenses, prevent abuse, improve our products and meet legal obligations. These records don't currently have a fixed deletion schedule; you can ask us to delete yours at any time (see section 8).
Messages: we keep form submissions and email for as long as we need them to respond and to maintain our business records.
Job applications: we keep them for as long as needed to consider you for the role and other openings, unless you ask us to delete them sooner.
Logs and backups: server logs are rotated as they grow, and backups are kept for a limited period before they're replaced.

7. Cookies and analytics

Analytics cookies (consent required)

With your consent, we use Google Analytics (GA4) to understand how visitors use the Website. When you accept analytics cookies, the following are set:

_ga: distinguishes unique visitors. Expires after 2 years.
_ga_*: maintains session state. Expires after 2 years.

Google Analytics collects information such as the pages you visit, how long you stay, how you arrived (a search engine, social media or a direct link), your browser and device type and your approximate location, and processes it under Google's terms. We use it only to see aggregate trends, not to identify individual visitors.

Cookieless analytics

We use Cloudflare Web Analytics, which doesn't use cookies or track visitors across sites. It provides page view and performance measurements only.

Bot protection

The Preview request form uses Cloudflare Turnstile to tell people from automated signups. Turnstile evaluates signals from your browser and device when you submit the form, and Cloudflare processes them under its own privacy policy.

Managing your preferences

When you first visit, a banner asks whether you accept analytics cookies. If you decline, no analytics cookies are set and Google Analytics doesn't load. Your choice is saved in your browser's local storage so we don't ask again. You can change it at any time with the Cookie Settings link in our footer, or by clearing this site's data in your browser.

8. Your choices and rights

Depending on where you live, you may have the right to:

know what personal information we hold about you and get a copy, including in a portable format;
correct inaccurate information;
delete your information;
object to or restrict certain processing, including processing based on our legitimate interests;
withdraw consent where we rely on it, without affecting processing that happened before; and
opt out of marketing messages, which you can also do by replying to any marketing email.

To make a request, contact us and select "Privacy Inquiry" as your inquiry type. We'll respond within the time the law requires. To protect your information, we'll confirm your request from the email address we have on file, and we may ask for more information to verify your identity. You may use an authorized agent where the law allows, and we may ask for proof of the agent's authority. If we decline your request, you may appeal by replying to our decision, and we'll explain the outcome. We won't discriminate against you for exercising your rights.

When we delete your Preview request, we remove the request and its contact details. We may keep a minimal record, such as the license we issued and an entry in our audit log, where we need it for security, to prevent abuse of the Preview, or to meet legal obligations. Deleting your records doesn't remove the Software or its data from your servers.

If you're in the European Economic Area, the United Kingdom or Switzerland, you also have the right to lodge a complaint with your local data protection authority. We'd appreciate the chance to address your concern first.

9. Security

We protect personal information with measures appropriate to its sensitivity. The Website and our signup and download services use encrypted HTTPS connections. Access to Preview records is limited to authorized GraphnAI staff who sign in through our company identity provider from our internal network, and every decision on a request is logged. Download files are encrypted with a password we send you, and license keys are digitally signed so they can't be altered. No system is perfectly secure, so we can't guarantee the security of information you send us.

10. Children

Our services are for business use and aren't directed to children. We don't knowingly collect personal information from anyone under 16. If you believe a child has given us personal information, please contact us and we'll delete it.

11. Other websites

The Website links to other sites and services, such as social networks. Their own privacy policies govern the information they collect.

12. Changes to this policy

We may update this policy from time to time. We'll post the new version here with a new version number and effective date and, for material changes, we'll give notice on the Website or by email to Preview participants before the change takes effect.

13. Contact us

If you have questions about this policy or how we handle personal information, please contact us and select "Privacy Inquiry" as your inquiry type. GraphnAI, Inc. is the company responsible for the personal information described in this policy.