Privacy Policy

1.Information We Collect

The information we collect depends on how you interact with us.

Website and Contact Information

When you contact us, request a demonstration, or submit a form through an Allogy website, we may collect information such as:

• your name;
• work email address;
• company or organization;
• phone number, if provided;
• the contents of your message or inquiry; and
• other information you choose to provide.

For example, the “Schedule a Meeting” form on allogy.com asks for your name, work email address, and a message. We use this information to respond to your inquiry, schedule requested meetings, communicate about our products and services, and maintain appropriate business records.

Account Information

When you have an account for the Services, we may process information such as:

• name and contact information;
• Organization and organizational role;
• username, account identifiers, and authentication information;
• roles, permissions, and access settings;
• account preferences; and
• information supplied by your Organization to provision or administer your account.

Customer Content

Organizations and authorized users may provide information to Capillary in connection with training, knowledge management, workflow automation, and other uses of the Services. Depending on the deployment, this may include:

• documents, policies, procedures, training materials, and other files;
• training, enrollment, competency, credential, or completion records;
• prompts, questions, queries, and instructions;
• workflow inputs and records;
• AI-generated responses and other outputs;
• review and approval activity; and
• other information submitted or generated through the Services.

We refer to this information collectively as “Customer Content.”

Customer Content may contain personal information or sensitive or regulated information when an Organization is authorized to use the Services for those purposes.

Technical, Usage, and Security Information

We may automatically collect technical information associated with use of our websites or Services, such as:

• IP address;
• device and browser information;
• operating system;
• session and authentication information;
• login and access history;
• timestamps;
• application and system events;
• audit records;
• diagnostic information; and
• approximate location inferred from an IP address where applicable.

We use this information to operate, secure, troubleshoot, maintain, and improve the Services and to detect unauthorized or fraudulent activity.

2.How We Use Information

We may use personal information to:

• provide, operate, maintain, and secure the Services;
• authenticate users and administer accounts, roles, and permissions;
• process Customer Content as instructed by an Organization or authorized user;
• provide training, knowledge retrieval, AI-assisted workflows, reporting, and other requested functionality;
• maintain audit, security, and compliance records;
• respond to support requests and technical issues;
• respond to website inquiries and schedule demonstrations or meetings;
• communicate about our Services and our relationship with you or your Organization;
• develop and improve product functionality, reliability, performance, and security without using Customer Content to train general-purpose AI models;
• comply with contractual and legal obligations;
• prevent fraud, misuse, security incidents, or other harmful activity; and
• establish, exercise, or defend legal rights.

Where we process information on behalf of an Organization, our use of that information is also governed by our agreement with the Organization.

3.Customer Data and Artificial Intelligence

Capillary is designed so that an Organization's data remains segregated from other customers and is not used to train AI models.

Customer Content, including documents, prompts, queries, workflow inputs, and outputs:

• remains within the Organization's tenant and is logically separated from other customer tenants;
• is not used by Allogy to train general-purpose AI models;
• is not permitted to be used by AI model providers to train their models; and
• is not disclosed to third parties for their independent use.

AI processing performed as part of Capillary is provided within the controlled architecture used to deliver the Services and subject to the applicable security and contractual controls.

Where Capillary functionality permits an Organization to connect external systems, APIs, or approved web resources, information transmitted through those integrations may also be processed by the systems selected or authorized by the Organization.

4.Security and Hosting of Capillary

Allogy maintains administrative, technical, and organizational safeguards designed to protect Customer Content and personal information against unauthorized access, acquisition, disclosure, alteration, loss, or destruction.

The Capillary platform's production architecture includes:

• hosting in AWS GovCloud;
• logical tenant isolation;
• AES-256 encryption for data at rest;
• TLS 1.2 or higher for data in transit;
• role-based access controls;
• support for single sign-on;
• audit logging of AI interactions and other relevant system activity; and
• security architecture aligned to the FBI Criminal Justice Information Services (“CJIS”) Security Policy for law-enforcement use cases.

AWS GovCloud provides isolated U.S. cloud regions designed for regulated workloads and operated in accordance with AWS GovCloud requirements.

References to “CJIS-aligned” describe the architecture and controls used by the platform. They do not constitute a blanket certification of every customer deployment; applicable CJIS requirements also depend on the Organization, configuration, use case, contractual requirements, and agency policies.

Capillary is also designed to support healthcare and other regulated use cases. Where an Organization's use requires specific contractual safeguards, including a Business Associate Agreement or other data-processing terms, those requirements are addressed through the applicable agreement with the Organization.

No information system can eliminate all security risk. We maintain security and incident-response procedures designed to identify, contain, investigate, and address security incidents, and we provide notifications when required by applicable law or contract.

5.Cookies and Similar Technologies

On allogy.com, we use Google Analytics only after you choose “Accept analytics.” Google Analytics helps us understand information such as which pages are viewed, how visitors reached the website, and whether visitors use key calls to action or successfully submit a walkthrough request.

We do not send Google Analytics the name, email address, organization, message, or other values entered into the walkthrough form. This website analytics deployment does not use advertising personalization, Google Signals, Facebook Pixel, LinkedIn Insight, Hotjar, or Intercom.

If you decline analytics, Google Tag Manager and Google Analytics do not load and the website remains fully functional. You can review or change your choice at any time by selecting “Privacy settings” in the website footer. Your browser settings may also let you remove stored website data.

6.Service Providers

We use service providers to help us operate our business and provide the Services. Depending on the service involved, these providers may support functions such as:

• cloud infrastructure and hosting;
• security and system administration;
• communications and email;
• customer support;
• analytics and website operations;
• payment or billing services, where applicable;
• professional, legal, accounting, and auditing services; and
• other technical or operational functions.

Service providers are permitted to process information only as necessary to perform services for Allogy and are subject to appropriate confidentiality, security, and contractual obligations.

Customer Content is not provided to third parties for their own advertising, model-training, data-brokering, or other independent purposes.

7.When We May Disclose Information

We may disclose personal information:

• to an Organization that administers your Capillary account;
• to service providers acting on our behalf as described above;
• when you or your Organization directs or authorizes us to do so;
• as required by applicable law, regulation, legal process, subpoena, court order, or valid governmental request;
• when reasonably necessary to protect the rights, security, safety, or property of Allogy, our customers, users, or others;
• in connection with investigating fraud, abuse, or security threats;
• to auditors, assessors, or professional advisors subject to appropriate confidentiality obligations; or
• in connection with a merger, acquisition, financing, reorganization, bankruptcy, sale of assets, or similar corporate transaction, subject to applicable legal requirements.

We do not sell personal information.

8.Data Retention

We retain personal information only for as long as reasonably necessary for the purposes for which it was collected, including providing the Services, maintaining security and audit records, complying with contractual or legal requirements, resolving disputes, and enforcing agreements.

For Capillary accounts provided by an Organization, retention and deletion of Customer Content may be determined by the Organization's instructions and its agreement with Allogy.

When information is no longer required, we delete, anonymize, or otherwise dispose of it in accordance with applicable legal, contractual, and operational requirements.

9.Your Organization's Role

If your Capillary account is provided by an Organization, the Organization may have the ability to:

• create, manage, suspend, or terminate your account;
• establish roles and permissions;
• access information associated with your use of the Services;
• review training, workflow, audit, or activity records;
• establish retention requirements; and
• request access to, correction of, export of, or deletion of information.

Questions about decisions made by your Organization concerning your information should generally be directed to that Organization.

10.Privacy Rights

Depending on where you live and the laws that apply, you may have rights concerning your personal information, which may include the right to:

• confirm whether we process your personal information;
• access or obtain a copy of personal information;
• correct inaccurate personal information;
• request deletion of personal information;
• obtain certain information in a portable format;
• object to or restrict certain processing;
• withdraw consent where processing is based on consent; and
• opt out of certain uses of personal information where provided by applicable law.

We will not discriminate against you for exercising privacy rights provided by applicable law.

To submit a privacy request, contact support@allogy.com. We may take reasonable steps to verify your identity and authority to make the request.

Where Allogy processes information on behalf of an Organization, we may refer your request to the Organization or assist the Organization in responding to it, as required by our agreement and applicable law.

11.California and Other U.S. State Privacy Rights

Residents of California, Colorado, and other states with applicable comprehensive privacy laws may have additional rights concerning their personal information.

These rights may include access, correction, deletion, portability, and certain rights to opt out of the sale of personal information, targeted advertising, sharing for cross-context behavioral advertising, or certain forms of profiling, depending on the applicable law.

Allogy does not sell personal information.

Where applicable law requires additional notices or opt-out mechanisms based on a particular use of personal information, we will provide them.

12.International Users

Allogy is based in the United States, and personal information may be processed in the United States.

Capillary Customer Content is hosted in the United States as described in the security and hosting section above, except where a separate written agreement expressly provides otherwise.

Where the European Economic Area, United Kingdom, or another jurisdiction requires particular safeguards for an international transfer of personal information, transfers are handled in accordance with the applicable agreement with the Organization and legally required transfer mechanisms.

13.Children

Allogy's public websites are not directed to children under 13, and we do not knowingly collect personal information directly from children under 13 through our public websites.

Capillary may in some circumstances be made available to users by an Organization. If an Organization authorizes use of the Services by minors, the Organization and Allogy will handle such information in accordance with the applicable agreement and applicable law, including the Children's Online Privacy Protection Act (“COPPA”) where it applies.

We do not use children's personal information for targeted advertising or AI model training.

14.Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes in our Services, business practices, technology, legal requirements, or contractual obligations.

When we make material changes, we will update the “Last Updated” date above and provide additional notice where required by applicable law or where otherwise appropriate.

15.Contact Us

Questions about this Privacy Policy or our privacy practices may be directed to:

Privacy requests: support@allogy.com
General questions: info@allogy.com