Privacy Policy

1. Who This Policy Covers and Our Roles

This Privacy Policy describes how ACROA (“we”, “us”, or “our”), operating the Contract Risk & Obligation Agent platform accessible at acroa.tuiber.com, collects, processes, and protects information when organizations and their authorized users interact with our multi-tenant B2B SaaS service.

ACROA is an enterprise contract intelligence service designed for commercial organizations. Under applicable data protection frameworks:

• Customer Organization as Data Controller: The business organization or tenant that creates an ACROA account and connects document sources acts as the data controller regarding contracts, documents, and corporate records ingested into the platform.
• ACROA as Data Processor: ACROA acts strictly as a data processor (or service provider), processing customer document data exclusively on behalf of and according to the instructions of the customer organization to perform contract extraction, obligation monitoring, and risk analysis.
• Authorized End Users: End users (employees, contractors, and corporate team members) access the platform under the tenancy, authorization, and administrative oversight of their employer or contracting organization.

2. What We Access from Google Drive and Why

To monitor contract deadlines, extraction benchmarks, and financial obligations, ACROA provides an optional integration with Google Drive. Our integration adheres strictly to the Google API Services User Data Policy, including the Limited Use requirements.

When an organization administrator explicitly enables the Google Drive connector:

• Per-Tenant Authorization: OAuth 2.0 authorization is established independently per organization tenant. Credentials (ConnectorCredential) are encrypted at rest using AES-GCM cryptography.
• Tenant-Configured Folders Only: ACROA lists and inspects files located strictly within folders designated and configured by the tenant administrator. ACROA does not scan the user’s entire Google Drive.
• Supported Contract Formats: The connector lists and downloads only Portable Document Format files (application/pdf). All other file types, including Microsoft Word documents and Google Docs, are skipped.
• Size Limit and Trashed Files: Files larger than 25 megabytes (MB) are skipped to prevent resource exhaustion. Files marked as trashed in Google Drive are excluded from discovery.
• Deduplication and Read-Only Operations: ACROA downloads file bytes, computes SHA-256 hashes to prevent duplicate ingestion, and queues documents for analysis. ACROA never writes back, modifies, moves, creates, or deletes files or metadata within your Google Drive.

3. How We Process and Protect Ingested Contract Data

Document bytes retrieved from Google Drive enter our segregated contract ingestion pipeline. Here is how your data is handled:

• Deterministic Text Extraction: Documents are processed via asynchronous Celery workers. Document text is extracted deterministically using local extraction libraries (pypdf).
• AI/LLM Semantic Interpretation: Extracted clause text is analyzed via our large language model adapter (ai/llm/adapter.py) powered by Google Gemini. The LLM is used exclusively for linguistic interpretation, semantic categorization, and natural language clause summaries.
• Deterministic Rule Engine Integrity: In accordance with ACROA’s architectural golden rules, LLMs never produce money amounts, payment dates, numerical quantities, or threshold values. All financial, temporal, and risk thresholds are computed exclusively by ACROA’s deterministic backend rule engine (backend/app/services/rule_engine/). LLM output is an interpretation aid, never the system of record.
• Tenant-Isolated Storage: Extracted obligations, contract clauses, document chunks, and audit logs are stored in PostgreSQL with strict tenant scoping and database-level Row-Level Security (RLS). Every query enforces the tenant identifier (tenant_id). Data from one tenant is completely isolated and inaccessible to any other tenant.

4. Clerk-Mediated Google Sign-In (Authentication Only)

We provide the ability for users to sign into ACROA using Google Sign-In, mediated through our authentication service provider, Clerk (Clerk, Inc.).

Clear Distinction from Google Drive Access: Google Sign-In is completely separate and decoupled from the Google Drive connector:

• Authentication Data Collected: Google Sign-In collects only your basic identity information (name, primary email address, and profile photo URL) provided by Google’s standard OAuth identity profile.
• Sole Purpose: This identity data is used exclusively to authenticate your identity, create or link your user profile within your organization’s tenant, and send administrative transactional notices.
• No Drive Permissions: Signing into ACROA with Google does not grant ACROA access to your Google Drive, files, docs, or sheets. Google Drive access requires an affirmative, distinct authorization performed by an organization administrator inside the Integrations settings.

5. Third-Party Subprocessors

ACROA engages trusted third-party service providers to deliver specialized operational infrastructure. Each provider is bound by strict contractual data protection terms:

6. Data Retention and Deletion

We retain customer data only as long as necessary to provide the ACROA services to your organization:

• Active Retention: While an organization maintains an active subscription and connected integrations, contract metadata, extracted obligations, and audit logs are retained to enable ongoing compliance monitoring and renewal tracking.
• 30-Day Disconnection / Termination Policy: Ingested contract data, extracted obligation records, document chunks, and cached files are automatically and permanently deleted 30 days after a customer organization disconnects Google Drive or terminates its account.
• How to Disconnect Google Drive: An organization administrator can disconnect Google Drive at any time by navigating to Integrations in the application dashboard and clicking “Disconnect” on the Google Drive card. Disconnecting immediately:
  1. Calls Google’s OAuth token revocation endpoint to invalidate all stored access and refresh tokens.
  2. Deactivates background synchronization and file discovery workers.
  3. Initiates the 30-day deletion countdown for all associated ingested document data.
• Expedited Deletion Requests: An authorized administrator may request immediate, expedited purging of all tenant records prior to the standard 30-day window by emailing notifications@acroa.app.

7. Security and Technical Safeguards

We implement industry-standard administrative, physical, and technical safeguards to preserve the confidentiality, integrity, and availability of customer information:

• Encryption at Rest and in Transit: OAuth credentials, connector tokens, and sensitive configurations are encrypted at rest using AES-GCM authenticated encryption. All external communications and web traffic use Transport Layer Security (TLS 1.3 / HTTPS).
• PostgreSQL Row-Level Security (RLS): Multi-tenancy is enforced at the database layer via PostgreSQL RLS policies. Every database session is scoped to the tenant identifier (tenant_id), preventing cross-tenant data leakage.
• Role-Based Access Control (RBAC): Within each tenant, user actions are strictly governed by granular roles (admin, manager, analyst, viewer).
• Human Approval Gates: Autonomous agent actions (such as sending external communications, reconciling financial records, or modifying contract obligations) are deny-by-default and require explicit human-in-the-loop review and approval.
• Untrusted Content Handling: External documents and parsed files are treated as untrusted input with defenses designed to prevent prompt injection and unauthorized execution.

8. Your Rights and Contact Information

Depending on your jurisdiction (such as California under the CCPA/CPRA, or other applicable state and international privacy laws), organizations and authorized users have rights regarding personal information processed by ACROA:

• The right to know what personal information is collected, used, and disclosed.
• The right to request deletion of personal information held by us.
• The right to correct inaccurate personal information.
• The right to non-discrimination for exercising statutory privacy rights.

Because ACROA is a B2B SaaS processor, individual end users seeking to access, correct, or delete data contained within their organization’s contract documents should direct their requests to their organization administrator (the data controller). We will assist customer administrators in responding to verified data subject inquiries.

For privacy inquiries, technical security notices, or data subject requests, please contact our privacy and security team:

9. Changes to This Privacy Policy

We may update this Privacy Policy periodically to reflect changes in our technical practices, security enhancements, integrations, or legal obligations. We will notify customers of material updates by posting the revised policy on this page with an updated “Last reviewed” date and, where appropriate, notifying organization administrators via email or in-app notification.

10. Effective Date and Governing Terms

This Privacy Policy is effective as of September 29, 2026 and was last reviewed on September 29, 2026.

Your organization’s access to and use of ACROA is additionally governed by our Terms of Service.