Privacy Policy

Our Commitment to Your Privacy

At Plurit Inc., a Delaware corporation (“Plurit,” “we,” “us,” or “our”), protecting your privacy is fundamental to how we operate. This Privacy Policy explains what information we collect, how we use it, and the choices you have regarding your personal data when using our AI-grounded IT market analysis platform at plurit.com and related services. Questions? Contact us at privacy@plurit.com.

What This Policy Covers

This Privacy Policy applies to all interactions you have with Plurit, including:

• Using our website and platform services
• Accessing Plurit through third-party platforms
• Creating and managing your account
• Participating in vendor comparisons, competitive analyses, and product evaluations
• Receiving communications from us
• Accessing our web-based platform (mobile applications are not currently offered)

This Privacy Policy does not apply to personal data that Plurit processes on behalf of enterprise customers in its capacity as a Data Processor; such processing is governed by the applicable Data Processing Agreement and Subscription Agreement.

Information We Gather

Information You Provide Directly

When you use Plurit, you may choose to share various types of information with us, including:

• Account Details: Your name, email address, and login credentials when you register for an individual or enterprise account.
• Third-Party Sign-In: If you register or log in via a third-party identity provider (such as Google or Microsoft SSO), we receive your name and email address as permitted by your account settings on that provider.
• Requirements Information: Your software and IT procurement needs, project details, and evaluation criteria that help us generate relevant analyses and recommendations.
• Evaluation Data: Your interactions during the analysis process, vendor selections, and decisions made through our platform.
• Communication Content: Support requests and any direct communications with our team.
• Payment Details: If you're a vendor using our platform, we collect billing information and payment method details for platform access, lead generation, premium features, and research services.

Information We Collect Automatically

Our platform automatically gathers certain technical information to provide and improve our services:

• Usage Analytics: Page views, user sessions, click patterns, and other standard web analytics that help us understand how you interact with our platform.
• Device Information: Your IP address, browser type, operating system, and basic device characteristics.
• Performance Data: Loading times, errors encountered, and other technical metrics that help us optimize the platform.

Information from External Sources

We may receive information about you from other sources:

• Employers or Team Administrators: Your employer may provide your information to allow you to establish access to company-level account features.
• Public Business Information: We may supplement profiles with publicly available company information to enhance our matching and analysis services.
• Integration Partners: When you choose to connect third-party tools such as calendar systems, communication platforms, procurement systems, or CRM platforms, we may receive relevant data to enhance our services.
• Data Enrichment Providers: We may use third-party data enrichment services (such as LinkedIn-based company and contact intelligence) to supplement business profile information with publicly available professional data.

Information Collected Through Third-Party Platform Access

When you access Plurit through third-party platforms (such as conversational AI platforms), we collect the following information:

• Anonymized User Identifier: The third-party platform provides an anonymized user identifier that allows us to track your usage across sessions without requiring you to create an account.
• Location Information: The third-party platform automatically provides coarse location data (city, region, country, timezone) which we use to improve vendor matching and recommendations.
• Device and Browser Information: User agent, locale settings, and timezone offset to help us provide a better experience.
• Tool Usage Data: Information about which Plurit tools you use within the third-party platform.
• Optional Email Linking: If you choose to provide your email address when creating a software request through a third-party platform, we may link that email to your anonymized identifier.

Data We Do Not Collect

Regardless of context, Plurit does not collect, solicit, or process the following categories of restricted data:

• Payment Card Information (PCI DSS): Payment processing is handled by secure third-party payment processors; we do not store card data.
• Protected Health Information (PHI): We do not collect health information subject to HIPAA or equivalent regulations.
• Government Identifiers: We do not collect social security numbers, passport numbers, driver's license numbers, or similar government-issued identifiers.
• Authentication Credentials: We do not collect passwords, API keys, MFA/OTP codes, or other authentication secrets.

Our Role as Data Processor

Plurit and Enterprise Customers

When enterprise customers use Plurit's platform to conduct IT market analysis, evaluate vendors, or manage procurement workflows, the following roles apply under applicable data protection law:

• You (the enterprise customer) are the Data Controller: You determine the purposes and means of processing any personal data you input, upload, or configure within the platform.
• Plurit is the Data Processor: We process personal data on your behalf, in accordance with your instructions and our contractual commitments, to deliver the services you have subscribed to.

Data Processing Agreement (DPA)

Enterprise customers who require a Data Processing Agreement (DPA) — as required under GDPR Article 28 or similar applicable law — may request one by contacting privacy@plurit.com.

How We Use Your Information

We use the information we collect to operate and enhance our IT market analysis platform. Where applicable under the General Data Protection Regulation (GDPR), we identify the legal basis for each processing activity below.

Core Platform Services

• Generating Analysis and Recommendations: We use your requirements and preferences to produce vendor comparisons, competitive analyses, and buying recommendations tailored to your organization.
• Managing Vendor Connections: We share your requirements and company characteristics with software vendors in an anonymized format. Your identity and contact information are only revealed when you explicitly click to connect with a specific vendor.
• Evaluation and History: We maintain your evaluation history and decisions to provide continuity throughout your procurement process.
• Account Management: We maintain your individual or enterprise account and preferences.

Platform Improvement

• Product Development: We analyze usage patterns to identify opportunities for new features and improvements.
• Quality Assurance: We monitor platform performance and user experience to ensure our services meet your expectations.
• Research and Insights: We create aggregated, anonymized market research and industry reports that benefit the IT procurement community.

Legal Basis Summary

Automated Analysis and AI-Generated Insights

Plurit uses domain-specific artificial intelligence models to generate vendor comparisons, competitive analyses, product evaluations, and purchasing recommendations. We want to be transparent about how this works and your rights in relation to it.

How Our AI Works

• Grounded AI: Our AI models are grounded on curated, current, and validated domain-specific datasets rather than general-purpose internet data.
• Assisted Decision-Making: AI-generated outputs are intended to assist human decision-makers. They are analytical tools, not binding determinations.
• No Fully Automated Decisions: Plurit does not make decisions that produce legal or similarly significant effects about you through solely automated means without human review.

Your Rights Regarding Automated Analysis

• You may request information about the data sources and logic underlying a specific recommendation.
• You may request that a recommendation be reviewed or supplemented with additional context.
• If you are an EU/EEA resident, you have the right under GDPR Article 22 not to be subject to decisions based solely on automated processing that produce legal or significant effects.

How We Share Information

Vendor Introductions

Our primary service involves connecting IT buyers with relevant vendors. Here's how we handle your information in this process:

• Anonymized Sharing: We share your IT requirements, company characteristics, and browsing signals with relevant vendors without revealing your identity or company name.
• Explicit Consent Required: We only share your name, contact information, and company details with vendors after you explicitly initiate and confirm a connection with that specific vendor.

No Sale of Personal Information

We do not sell or rent your Personal Information. We do not currently engage in cross-context behavioral advertising or share personal information with third parties for their own marketing, advertising, or profiling purposes.

Cookies and Tracking Technologies

Types of Cookies We Use

• Essential Cookies: Required for basic platform functionality, including maintaining your login session and security features.
• Analytics Cookies: Help us understand how you use our platform so we can improve it. We use Google Analytics for this purpose.
• Preference Cookies: Remember your settings and choices to provide a more personalized experience.

Managing Cookies

You can manage cookie preferences through your browser settings. Most browsers allow you to block, delete, or disable cookies. Please note that disabling certain cookies may limit some platform functionality.

Data Retention

We retain your information for as long as necessary to fulfill the purposes described in this Privacy Policy and to meet our legal, accounting, or regulatory obligations.

• Active Accounts: Information is retained for the duration of your active use of the platform.
• Inactive / Closed Accounts: We retain account records for up to three (3) years following account closure, after which personal information is deleted or anonymized.
• Anonymized Data: Anonymized usage data and market insights may be retained indefinitely for research and platform improvement purposes.

Data Security and Protection

Protecting your information is a top priority for us. We implement multiple layers of security:

• Technical Safeguards: We use encryption for data transmission and storage, secure authentication systems, and regular security monitoring.
• Access Controls: We limit access to your information to employees and contractors who need it to provide our services.
• Regular Audits: We regularly review our security practices and update them as needed to address emerging threats.
• Incident Response: In the event of a data breach, we have procedures in place to respond quickly and notify affected users as required by law.

Your Privacy Choices

Account Management

• Profile Updates: You can modify your account information, preferences, and evaluation criteria at any time.
• Data Export: You can request a copy of the personal information we have about you in a portable format.
• Account Deletion: You can request deletion of your account and associated data.
• Vendor Visibility: You decide when and with which vendors to share your contact information.

International Data Transfers

Your information may be stored and processed in the United States or other countries where we or our service providers operate. When we transfer personal information from the European Economic Area (EEA), United Kingdom, or Switzerland to countries that have not received an adequacy decision, we rely on appropriate safeguards including EU Standard Contractual Clauses (SCCs) and UK International Transfer Agreements (IDTA).

Privacy Rights by Jurisdiction

California Residents — CCPA/CPRA

If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA):

• Right to Know: Request disclosure of the categories and specific pieces of personal information we have collected about you.
• Right to Delete: Request deletion of your personal information, subject to certain exceptions.
• Right to Correct: Request correction of inaccurate personal information.
• Right to Opt Out of Sale or Sharing: We do not sell or share personal information.
• Right to Non-Discrimination: We will not discriminate against you for exercising any of your CCPA/CPRA rights.

EU, EEA, and UK Residents — GDPR

If you are located in the European Union, European Economic Area, or United Kingdom, you have the following rights under the GDPR:

• Right of Access (Art. 15)
• Right to Rectification (Art. 16)
• Right to Erasure (Art. 17)
• Right to Restrict Processing (Art. 18)
• Right to Data Portability (Art. 20)
• Right to Object (Art. 21)
• Right Not to Be Subject to Automated Decision-Making (Art. 22)

To exercise these rights, contact us at privacy@plurit.com. We will respond within 30 days.

Nevada Residents

Pursuant to Nevada Senate Bill 220, Nevada residents have the right to opt out of the sale of covered information. Plurit does not sell covered information as defined under Nevada law.

Children's Privacy

Plurit's platform and services are directed solely at individuals aged 18 years or older. We do not knowingly collect, use, or disclose personal information from children under the age of 18. If we become aware that we have inadvertently collected personal information from a child under 18, we will take prompt steps to delete that information from our systems.

Third-Party Websites and Services

Our platform may contain links to third-party websites, vendor profiles, partner integrations, and external services. This Privacy Policy does not apply to those third-party services. We encourage you to review the privacy policies of any third-party services before submitting personal information to them.

Changes to This Policy

We may update this Privacy Policy periodically to reflect changes in our practices or applicable laws. When we make significant changes, we will notify you through your account or by email. The "Effective Date" at the top of this policy indicates when it was last updated. Your continued use of our platform after such changes indicates your acceptance of the updated policy.

Questions and Contact Information

If you have questions about this Privacy Policy, wish to exercise your privacy rights, or have concerns about our privacy practices, please contact us: