Privacy Policy

• Customers own the documents in their data rooms. We process them only to run the service.
• We collect what we need to run accounts, protect rooms and keep activity records.
• We never sell personal information.
• We use a small set of service providers, listed in section 7.
• We don't use customer documents to train AI models.

DiligensHub is a virtual data room for mergers and acquisitions. It is operated by DiligensHub LLC ("DiligensHub", "we", "us").

This policy covers our website at diligenshub.com, our status page and the DiligensHub service.

Organizations use DiligensHub to run deals. We call them customers. A customer decides what happens to the documents, messages and records in its data rooms. We process that information on the customer's behalf and follow its instructions. For that data, the customer is the controller and we are its processor.

For our website, sales enquiries and the accounts people use to sign in, we decide how data is used. There, we are the controller.

If you were invited to a data room, the organization that invited you controls its contents. Ask them first about data in that room.

• To provide the service: host rooms, show each person what their access allows, and send invitations and notifications.
• To keep rooms secure: sign-in checks, two-step sign-in, session limits, watermarks and records of who did what.
• To give customers activity records and reports about their rooms.
• To run AI review, when a customer leaves it on for a deal.
• To answer sales enquiries and support requests.
• To meet legal obligations and enforce our terms.

Pages viewed in a room carry a watermark with the viewer's name, email address and the time.

We don't sell personal information. We don't use deal content for advertising.

AI review is on for each new deal. Deal owners can switch it off. While it is on, we send document text and page images to our AI provider to produce findings. Questions asked of the AI Assistant, and the content needed to answer them, go to the same provider.

We don't use customer documents to train AI models. Our AI provider's terms don't allow it to train on them either.

We use these service providers to run DiligensHub. Each receives only what its job needs.

Inside a room, other members see your name and email address, as the room's settings allow. The room's administrators see its activity records.

If your organization uses single sign-on, its identity provider tells us you've signed in.

We disclose information when the law requires it, or to protect people's safety or our rights. When asked for a customer's data, we refer the request to the customer where we can. If DiligensHub is sold or merged, information may pass to the new owner under this policy.

• The DiligensHub app uses no advertising or analytics cookies.
• It keeps your sign-in session in your browser's local storage, with preferences such as sort order.
• It sets one short-lived cookie while you sign in with single sign-on.
• Protected offline copies of DRM files are stored on your device, encrypted.

You can block cookies and site storage in your browser. Our website still works without them.

• Every connection to DiligensHub is encrypted.
• Passwords are stored only as one-way hashes.
• Two-step sign-in is available for every account.
• With DRM on for a deal, its files are encrypted at rest, each with its own key.
• Our administrators can't add themselves to a deal, and their actions are recorded.

No system is perfectly secure. If a breach affects your personal information, we will tell you and the customer as the law requires. More detail is on our Security page.

• We keep deal content until the customer asks us to delete it.
• Files deleted in a room stay in its recycle bin for 30 days, then are permanently deleted.
• Activity records are part of the customer's deal record, and are kept with it.
• Sign-in sessions are deleted when they expire, after 24 hours at most.
• Notifications are deleted after 90 days.
• We keep sales enquiries while we may still follow up. Ask, and we will delete yours.

When an account is erased, we remove its sign-in details, sessions and Assistant conversations. Records of what the person did in a deal stay with that deal, as part of the customer's records.

Depending on where you live, you can ask to see, correct, delete or export your personal information. You can also object to some uses, or ask us to limit them.

For information in a data room, contact the organization that runs the room. We will help them respond.

For anything else, email privacy@diligenshub.com. We respond within the time the law allows.

In the EU, the UK and some other places, you can also complain to your data protection authority. California residents: we don't sell or share personal information for targeted advertising.

We and our providers store and process information in the United States. Where the law requires, we protect transfers with safeguards such as standard contractual clauses.

DiligensHub is for business use. It isn't meant for anyone under 18, and we don't knowingly collect their information.

We will post any change on this page and update the date at the top. If a change is significant, we will tell customers before it takes effect.

Email privacy@diligenshub.com, or write to DiligensHub LLC, 32069 Corte Cardoza Temecula, CA, 92592.

For a security issue, email security@diligenshub.com.