Privacy Policy

I. Introduction

Welcome to IT Folder (“IT Folder,” “we,” “us,” or “our”). This Privacy Policy explains how we collect, use, disclose, and safeguard information when you use our websites, applications, and related services (collectively, the “Services”). By using the Services, you agree to this Policy.

II. Information We Collect

• Account & Contact: name, email, organization, role.
• Usage, Device & Logs: app interactions; device information including browser type (e.g., "Chrome", "Firefox"), platform (e.g., "macOS", "Windows"), timezone, language, and mobile/desktop detection; full IP addresses in sessions and security records for sign-in validation, fraud detection, auditing, and incident investigation, including display in authorized security and log views; user agent strings (truncated to 200 characters); and event logs (e.g., sign-in/out, password view, session creation/termination).
• Session Management: Organizations configure concurrent-session limits (default: 10 per user). Session idle timeout is configurable per organization, or 30 days for "remember me" sessions. Session data includes device information, creation/access timestamps, and full IP addresses for security validation.
• Support: messages and attachments you send to us.
• Network Information: IP addresses used for network and ISP lookups are sent to ipapi.co to obtain ISP/organization, ASN, country, and approximate network-location information. This enrichment supports network documentation and investigation; it is separate from storing IP addresses in security logs.
• Cookies & Similar Tech: essential cookies for authentication and security; analytics cookies where permitted (see "Cookies" below).

CCPA Categories of Personal Information

Under the California Consumer Privacy Act (CCPA), the categories of personal information we may collect include:

• Identifiers: name, email address, IP address, account credentials.
• Commercial information: subscription and billing records, service usage history.
• Internet or other electronic network activity: browsing and interaction data within the Services, device information, event logs.
• Professional or employment-related information: job title, organization, role (as provided during account creation).
• Inferences drawn from personal information: AI-generated embeddings, search results, and documentation suggestions derived from your content.
• Sensitive personal information: account login credentials (username and password combinations) stored within your IT documentation. IT documentation may also contain network configurations, IP addresses, and other technical data that could constitute sensitive personal information under applicable law.

III. How We Use Information

• Provide, secure, and improve the Services (including debugging, monitoring, and fraud prevention).
• Operate features like search, documentation, and AI-assisted tools.
• Send transactional communications (e.g., security alerts, changes to terms).
• Comply with law, enforce agreements, and protect our customers.

Under CCPA, the business purposes for our processing include: performing services on behalf of the business (providing the AI-assisted documentation, search, and workflow features your organization uses); detecting security incidents and protecting against malicious or illegal activity; debugging and repairing errors; and short-term transient use of personal information that is not disclosed to third parties and is not used to build a profile about a consumer. We do not use personal information for purposes that are incompatible with the context in which it was collected.

IV. AI Data Privacy

IT Folder includes AI-powered features to assist with documentation, search, and workflow automation. For new organizations, AI is on by default so the AI assistant (BIP) works immediately: TypeSafe AI's Jev API classifies questions and Google Gemini, on IT Folder's key, turns them into read-only database queries. Documentation assistance, Q&A and OpenAI embeddings stay off until an administrator turns them on. An administrator can turn AI off for the organization at any time; when AI is off, neither Jev nor Gemini is used. Your organization retains full ownership of its data at all times. IT Folder acts solely as a data processor.

What Data Is Used

When AI features are enabled, the following data may be processed:

• User inputs (e.g., questions, prompts, document titles)
• Selected document content or snippets (for search and summarization)
• Metadata (e.g., database schema context for query generation)
• Limited conversation history (for continuity in AI responses)

How AI Processing Works

Some AI features require sending data to third-party AI providers for real-time processing.

• Data is transmitted securely over HTTPS
• Processing is performed only to generate a response
• Results are returned immediately to IT Folder

IT Folder also uses local machine learning models (e.g., embeddings, summarization) that run entirely within its infrastructure and do not send data externally.

AI Providers

Depending on configuration, IT Folder may use:

• OpenAI
• Google
• Anthropic
• TypeSafe AI (Jev), for classifying AI query agent questions, whenever the organization's AI is on

Some providers use organization-supplied API keys, while others may use IT Folder-managed access.

Data Usage Boundaries

• Data is used only for real-time AI inference
• IT Folder does not use customer data to train its own AI models
• IT Folder does not sell or reuse customer data
• Data is not shared across organizations (tenants)

Third-party providers process data according to their own API policies, which may include temporary processing or short-term caching.

AI Data Storage

Within IT Folder:

• AI-generated outputs may be temporarily cached (e.g., to reduce duplicate requests)
• Embeddings (vector data) are stored within your tenant database
• AI activity (e.g., queries, outputs) may be logged for audit and troubleshooting

All data remains isolated to your organization.

AI Security Controls

• Tenant-level data isolation
• Encrypted API keys (when customer-provided)
• Secure transmission (HTTPS)
• Input validation, prompt sanitization, and automated PII redaction (Presidio)
• Feature-level controls (AI can be enabled or disabled per organization)

What to Be Aware Of

• Data sent to AI providers is visible to those providers during processing
• IT Folder does not control external provider retention or transient logging
• AI is on by default for new organizations and is controlled at the organization level (not per-user consent)
• IT Folder automatically detects and redacts common sensitive data patterns (SSNs, credit cards, API keys, credentials) before sending to AI providers, but detection is not guaranteed for all formats

Your Responsibilities

We recommend that users:

• Avoid including highly sensitive data (e.g., passwords, private keys, regulated personal data) in AI prompts unless necessary
• Review internal policies before enabling AI features
• Use organization-level controls to manage AI access

AI Control & Transparency

• AI features can be disabled at any time
• API keys for supported providers can be managed by your organization
• Only configured integrations are activated—no hidden data sharing occurs

Limiting Use of Sensitive Personal Information in AI Features

IT documentation may contain sensitive personal information as defined under CPRA (Cal. Civ. Code §1798.121), including account login credentials, precise location details supplied in uploaded documentation, and potentially financial account information. Ordinary IP-based network lookups provide approximate location; we do not characterize every IP address or network map as precise geolocation. Under CPRA, California consumers have the right to limit the use and disclosure of sensitive personal information to uses that are necessary to perform the services you have requested.

To exercise this right in the context of AI features, you or your organization administrator may:

• Disable AI features entirely at the organization level, preventing any data from being transmitted to AI providers.
• Avoid including sensitive personal information in AI prompts and interactions where possible.
• Contact us at support@itfolder.com to request that we limit the use of your sensitive personal information to what is necessary to provide the Services.

IT Folder uses automated PII detection (powered by Microsoft Presidio) to scan and redact common sensitive personal information patterns — including Social Security numbers, credit card numbers, API keys, and credentials — before data is transmitted to third-party AI providers. This scanning is applied to all AI prompts, document chunks, and search queries. For more details on our AI safeguards, see our AI Transparency page.

V. Cookies & Similar Technologies

We use essential cookies to operate and secure the Services. Our authentication system uses opaque access tokens and signed refresh tokens over HTTPS with CSRF protection and automatic session management.

• __Host-access_token: Opaque access token (15-minute expiration, automatically refreshed during activity) with Secure, HttpOnly, and SameSite=Lax attributes.
• __Host-refresh_token: Signed JWT refresh token (7 days, or 30 days for "remember me") for automatic session renewal across browser restarts, with the same security attributes.
• csrf_token: Anti-forgery token paired with X-CSRF-Token header for state-changing requests. Set with Secure and SameSite=Lax but readable by JavaScript to send the matching header.
• Session Limits: Configurable per organization, with a default of 10 concurrent sessions per user. Oldest sessions are automatically removed when the limit is exceeded.
• Idle Timeout: Sessions expire based on your organization's configured idle timeout, or after 30 days for "remember me" sessions.
• Analytics: We use Google Analytics on marketing pages to measure engagement where permitted. You can control analytics via cookie settings where presented.
• Consent choice: The cookie banner stores your choice in itf_cookie_consent (all or essential) for 365 days, on .itfolder.com so one choice covers the marketing site and the app. It contains no personal data.
• Embedded videos: Some marketing pages embed YouTube videos in privacy-enhanced mode (youtube-nocookie.com). Loading such a page sends your IP address and browser information to Google to display the player; playing the video also shares your playback interactions and may set cookies in its player. See our Cookie Policy for details.

VI. Service Providers & Sub-Processors

We share information with the following categories of service providers who assist us in delivering the Services. These providers process data only on our behalf and under our instructions:

• Amazon Web Services (AWS) – Cloud hosting, database, storage, and infrastructure services. Primary application stores are in US West (Oregon); CloudFront content delivery uses a separate edge network.
• Stripe – Payment processing. Stripe receives only payment-related information (name, email, billing address, payment method) necessary to process your subscription.
• ipapi.co (Kloudend, Inc.) – Network and ISP enrichment. IT Folder sends the queried IP address over HTTPS to obtain network-provider and approximate location information. Processing locations and provider log retention are described in ipapi.co's privacy policy.
• Google Analytics – Website analytics on marketing pages only (not the application). Google receives usage data about how the marketing pages are used. We use Google Analytics 4, which does not log or store IP addresses.
• YouTube (Google LLC) – Embedded product videos on marketing pages only (not the application), displayed in privacy-enhanced mode. YouTube receives your IP address, browser information, and playback interactions.
• Google LLC (Gemini API) – AI query agent: turns natural-language questions into read-only database queries, on by default for new organizations; an administrator can turn AI off at any time. Google receives PII-redacted questions, database schema metadata, and database error messages from a failed query; no query results or database rows.
• TypeSafe AI (Jev API) – Question classification for the AI query agent, always used when the organization's AI is on (on by default for new organizations). TypeSafe AI processes the PII-redacted question inputs on our behalf under its agreement with IT Folder, in the United States, and returns a structured label; it receives no database rows or document content. If Jev's monthly allowance is reached or Jev is unavailable, IT Folder uses its built-in routing instead.
• OpenAI and Anthropic – Only under your organization's own API key, when an administrator supplies one: documentation assistance, Q&A, and opt-in embeddings, and, with an Anthropic key, the AI query agent. Content is PII-redacted before it is sent.

We do not sell, rent, or share your personal information with third parties for their own marketing purposes. Our Sub-Processors page (itfolder.com/sub-processors) is the authoritative, current list of sub-processors, including what data each receives and where it is processed. We will notify customers at least 30 days before engaging a new sub-processor.

VII. Data Breach Notification

In the event of a confirmed security breach that results in unauthorized access to, or disclosure of, your personal data or customer data:

• We will notify affected customers within 72 hours of confirming the breach, consistent with GDPR Article 33 requirements.
• Our notification will include: (a) the nature of the breach; (b) the categories and approximate number of records affected; (c) the likely consequences; (d) the measures taken or proposed to address the breach; and (e) a point of contact for further information.
• We will cooperate with your reasonable requests for additional information and will assist with your obligations to notify supervisory authorities or affected individuals as required by applicable law.
• We will notify the relevant supervisory authority where required by law.

VIII. Security

Security is built into our architecture and supports our privacy commitments. The details below describe our current controls at a high level; we may refine implementation without reducing protections.

• Network & Infrastructure: Hosted on Amazon Web Services (AWS). Traffic is filtered by an AWS Web Application Firewall (WAF) in front of our load balancer. Application services and databases run inside a VPC on private subnets that are not publicly routable; databases are not exposed to the public internet.
• Encryption: TLS protects data in transit. At rest we use AES‑256 with AWS Key Management Service (KMS) using envelope encryption. Each tenant is assigned its own KMS key, and sensitive fields (e.g., license keys and API secrets) are encrypted with dedicated data‑encryption keys (DEKs) protected by that tenant’s KMS key. KMS key material rotates annually; this does not replace existing field DEKs. Amazon S3 storage uses SSE‑KMS, Aurora databases and backups are encrypted, and Redis session storage is encrypted at rest. Public HTTPS, database and Redis connections, and the connection from our load balancer to the application use TLS.
• Tenant Isolation: Logical isolation of customer data at the application and data layers.
• Sessions & Cookies: opaque server‑side session IDs with expirations; Secure, HttpOnly, SameSite cookies over HTTPS; CSRF protection on state‑changing requests (separate CSRF cookie paired with an X‑CSRF‑Token header); per‑user session limits; revocation endpoints.
• Logging & Monitoring: we maintain audit and security logs for product actions and service operations. Logs may include timestamp, user/account, IP address, and browser/user‑agent. Logs are retained for a limited period consistent with security and compliance needs.
• Access Controls & Audit: Role‑based access and least‑privilege IAM. Event logging for sensitive actions (e.g., password viewing is re‑masked within 60–120 seconds), along with monitoring and alerting.
• Password & Breach Checks: we never store plain passwords. For breach checks we hash your password locally (SHA‑1 for compatibility with Have I Been Pwned’s k‑anonymity API) and send only the first 5 characters of that hash to HIBP. We never send your raw password or the full hash.

IX. Session Data Retention

Session-specific data is automatically deleted when:

• You explicitly log out from the application
• Your session expires due to inactivity (based on organization settings or 30 days for "remember me")
• Your refresh token expires (7 days, or 30 days for "remember me")

Security and audit records may be retained separately from sessions for fraud detection, security monitoring, and incident investigation. Central application logs have a 90-day retention policy; the 90-day limit does not apply universally to every audit record. Session records include browser, platform, and full IP address and expire with the server-side session. Standard sessions use the organization's configured idle timeout (7 days by default); "remember me" sessions use a 30-day inactivity window. Active sessions can be renewed, so these windows are not fixed limits from the first sign-in.

X. Data Retention

We retain information while your organization uses the Services. Admins can delete data within the product. Upon cancellation or termination, you will have a 30-day data export window during which you may download your data through the Service's export functionality. After the 30-day export window, your data will be permanently deleted and cannot be recovered. Deletion of uploaded data will be completed within 7 days after the export window closes, subject to limited backups retained for a short period for security and legal compliance. See Section 9 of our Terms of Service.

XI. Your Rights & Choices

Depending on where you live, you may have rights to access, correct, delete, or receive a copy of your information, and to opt out of certain processing.

• California (CPRA): rights to know, delete, correct, portability, and to opt out of “sharing” for cross‑context behavioral advertising (we do not sell personal information). You may also limit the use of sensitive personal information.
• Global Privacy Control: we honor the Global Privacy Control (GPC) browser signal. When your browser sends it, we treat it as a request to opt out of sale or sharing and of optional analytics: Google Analytics is not loaded on our marketing pages and no cookie banner asks you to choose. The application itself uses no advertising or analytics trackers.
• EEA/UK (GDPR): rights to access, rectification, erasure, restriction/objection to processing, and portability; processing bases include performance of contract, legitimate interests (security, product improvement), compliance with legal obligations, and consent where required.

To exercise rights, contact us at support@itfolder.com. We may verify your request and, where applicable, act on behalf of your organization’s administrator.

XII. International Transfers

Primary application databases, session storage, and tenant file buckets are in AWS US West (Oregon). CDN caches and external service providers have separate processing locations, as described in our sub-processor list. Where personal data is transferred from the European Economic Area (EEA), the United Kingdom, or Switzerland to the United States, we rely on the following safeguards:

• Standard Contractual Clauses (SCCs): We use the European Commission's Standard Contractual Clauses (June 2021 version), specifically Module 2 (Controller to Processor) for transfers of personal data from our customers to IT Folder, and Module 3 (Processor to Processor) for onward transfers to sub-processors.
• UK International Data Transfer Addendum: For transfers from the UK, we supplement the SCCs with the UK Information Commissioner's International Data Transfer Addendum.
• Supplementary Measures: We implement technical measures including encryption in transit and at rest (AES-256), tenant isolation, and access controls as described in our Security section above.

Pre-signed SCCs are included in our Data Processing Addendum (DPA), available upon request at support@itfolder.com. See also our Sub-Processor List.

XIII. Children's Privacy

The Services are not directed to children under 13 (or the relevant age of consent in your jurisdiction), and we do not knowingly collect such information.

XIV. Changes to this Policy

We may update this Policy periodically. We will update the “Last updated” date at the top and, if changes are material, provide additional notice.

XV. Contact Us

Questions about this Policy or our privacy practices? Contact support@itfolder.com.