Privacy Policy

This Privacy Policy applies to personal information processed by PolicyGen when you:

• visit our website;
• create or use a PolicyGen account;
• purchase or use a subscription;
• complete questionnaires or forms;
• generate privacy policies, terms of service, cookie policies, disclaimers, or other documents;
• upload information or content;
• communicate with PolicyGen;
• subscribe to marketing communications;
• participate in promotions or surveys;
• interact with our emails, advertisements, or online services; or
• otherwise use the Service.

This Privacy Policy does not necessarily apply to information that PolicyGen processes solely on behalf of a customer where that customer determines the purposes and means of processing.

In those circumstances, PolicyGen may act as a data processor or service provider, while the customer may act as the relevant controller or business under applicable law.

Depending on how you use PolicyGen, we may collect the following categories of information.

2.1 Account Information

When you create an account, we may collect:

• full name;
• email address;
• password or authentication credentials;
• account ID;
• company or business name;
• country;
• language;
• account preferences;
• subscription information; and
• other information you choose to provide.

We seek to collect only information reasonably necessary to provide the Service.

When you purchase a subscription or other paid service, payment information may be processed by our third-party payment provider.

Depending on the payment method and provider, this may include:

• billing name;
• billing address;
• payment method;
• transaction identifier;
• subscription status;
• purchase history; and
• invoice information.

Unless expressly stated otherwise, PolicyGen does not intentionally store complete payment-card numbers or security codes.

Payment information may be processed directly by third-party payment providers in accordance with their own privacy policies and applicable contractual and legal obligations.

PolicyGen allows users to provide information about their business, website, application, products, services, data practices, technologies, customers, and other business activities in order to generate documents.

Depending on the document being generated, this information may include:

• business name;
• business type;
• business location;
• website address;
• contact information;
• countries in which the business operates;
• categories of personal information collected by the business;
• purposes for which information is collected;
• analytics and advertising technologies;
• cookies and tracking technologies;
• payment providers;
• communication providers;
• CRM providers;
• hosting providers;
• third-party applications;
• AI tools;
• information concerning users or customers of the business;
• data-retention practices;
• international data transfers;
• legal or regulatory information provided by the user; and
• other information necessary to generate the requested document.

Users should not submit unnecessary sensitive personal information, passwords, authentication credentials, payment-card numbers, government identification numbers, health information, or other highly sensitive information into PolicyGen's document-generation forms unless the Service specifically requests and supports such information.

Where possible, users should provide business-level descriptions rather than identifiable information about individual customers or other individuals.

When you access or use the Service, we may automatically collect technical and usage information, including:

• IP address;
• approximate location derived from IP address;
• browser type;
• operating system;
• device type;
• device identifiers;
• language settings;
• time zone;
• referring URL;
• pages viewed;
• links clicked;
• session information;
• date and time of access;
• error logs;
• performance information;
• authentication events;
• security logs; and
• information about how you interact with the Service.

We may use this information for security, analytics, troubleshooting, performance, fraud prevention, and service improvement.

PolicyGen may use cookies, pixels, local storage, SDKs, and similar technologies.

These technologies may be used for:

• essential website functionality;
• authentication;
• security;
• remembering preferences;
• analytics;
• performance monitoring;
• advertising;
• measuring campaigns; and
• understanding how users interact with the Service.

Where required by applicable law, non-essential cookies and similar technologies will only be activated after obtaining the appropriate consent.

You may also control cookies through your browser settings and, where available, our cookie-preference mechanism.

For additional information, please see our Cookie Policy.

We may process personal information for the following purposes:

Providing the Service

To:

• create and maintain accounts;
• authenticate users;
• generate documents;
• save and retrieve generated documents;
• provide subscriptions;
• process payments;
• provide customer support;
• communicate with users; and
• otherwise provide the Service.

Security

To:

• prevent fraud;
• detect abuse;
• investigate suspicious activity;
• protect accounts;
• maintain system security;
• prevent unauthorized access; and
• protect PolicyGen, users, and third parties.

Service Improvement

To:

• understand Service usage;
• identify technical problems;
• improve features;
• improve user experience;
• test new functionality; and
• develop and maintain our systems.

Communications

To send:

• transactional emails;
• account notifications;
• security notifications;
• service announcements;
• billing communications;
• support communications; and
• where legally permitted, marketing communications.

Legal and Compliance Purposes

To:

• comply with applicable law;
• respond to lawful requests;
• establish or defend legal claims;
• enforce our agreements;
• protect our legal rights; and
• cooperate with competent authorities where legally required.

Where GDPR or UK GDPR applies, we process personal information using one or more lawful bases permitted by applicable law.

These may include:

Contract

Where processing is necessary to provide the Service, process a subscription, maintain your account, or perform an agreement with you.

Legal Obligation

Where processing is necessary to comply with applicable legal obligations.

Legitimate Interests

Where processing is necessary for legitimate interests pursued by PolicyGen or a third party, provided those interests are not overridden by applicable privacy rights.

Examples may include maintaining information security, preventing fraud, improving the Service, operating the business, enforcing agreements, and defending legal claims.

Consent

Where applicable law requires consent, we will request consent before processing the relevant information.

You may withdraw consent where applicable. Withdrawal does not affect the lawfulness of processing performed before withdrawal.

PolicyGen uses artificial intelligence and automated technologies to assist in generating documents and providing certain features.

Depending on the Service configuration, information submitted by users may be processed by third-party AI or technology providers acting on our behalf.

AI-generated content may contain errors, omissions, inaccuracies, or outdated information.

PolicyGen's AI functionality is primarily intended to transform information supplied by the user into business and legal-document templates.

Where applicable privacy law provides rights concerning solely automated decision-making or profiling, PolicyGen will respect those rights.

To operate PolicyGen, we may use third-party technology providers, including providers of:

• artificial intelligence;
• cloud hosting;
• databases;
• authentication;
• analytics;
• email delivery;
• payment processing;
• customer support;
• security;
• error monitoring;
• document generation; and
• infrastructure services.

Third-party providers may process personal information on our behalf where necessary to provide the Service.

We seek to require applicable service providers that process personal information on our behalf to maintain appropriate contractual, confidentiality, security, and data-protection safeguards.

PolicyGen does not use customer-submitted content to train general-purpose AI models unless this is expressly disclosed to the customer and permitted under applicable law and the relevant contractual terms.

Where third-party AI providers are used, PolicyGen will configure and contract with those providers according to the applicable Service configuration and our data-protection requirements.

We may disclose personal information to:

• employees and authorized personnel;
• affiliated companies, where applicable;
• cloud and hosting providers;
• AI providers;
• payment processors;
• analytics providers;
• customer-support providers;
• email providers;
• security providers;
• professional advisers;
• auditors;
• insurers;
• legal authorities where legally required;
• prospective purchasers or investors in connection with a corporate transaction; and
• other service providers necessary to operate the Service.

We do not sell personal information for money in the ordinary operation of PolicyGen unless expressly disclosed and permitted by applicable law.

Where applicable law defines certain forms of advertising-related disclosure as a "sale" or "sharing," PolicyGen will comply with the relevant requirements.

If PolicyGen is involved in a merger, acquisition, financing, restructuring, sale of assets, bankruptcy, or similar transaction, personal information may be transferred as part of that transaction.

Where required by applicable law, we will provide appropriate notice and protections concerning such transfers.

PolicyGen is operated from Israel and may use service providers located in Israel, the European Economic Area, the United Kingdom, the United States, or other countries.

As a result, personal information may be transferred to, stored in, or accessed from countries other than the country in which you reside.

Different countries may provide different levels of data protection.

Where Israeli law applies, PolicyGen will implement applicable requirements governing transfers of personal information outside Israel and relevant contractual and security requirements.

Where GDPR applies, PolicyGen will use an applicable lawful transfer mechanism where required, which may include:

• an adequacy decision;
• Standard Contractual Clauses;
• Binding Corporate Rules;
• another legally recognized transfer mechanism; or
• an applicable statutory derogation.

Where UK GDPR applies, PolicyGen will use an applicable UK transfer mechanism where required.

We retain personal information only for as long as reasonably necessary for the purposes described in this Privacy Policy, unless a longer period is required or permitted by applicable law.

Retention periods may depend on:

• the type of information;
• the purpose for which it was collected;
• whether the information is necessary to provide the Service;
• contractual requirements;
• legal obligations;
• accounting and tax requirements;
• dispute resolution;
• security requirements; and
• applicable limitation periods.

Deleting an account does not necessarily result in immediate deletion of all information.

Certain information may be retained where necessary to:

• comply with legal obligations;
• resolve disputes;
• enforce agreements;
• prevent fraud or abuse;
• maintain security; or
• establish, exercise, or defend legal claims.

Depending on available Service functionality, users may be able to delete their accounts or generated documents through their account.

Deletion requests remain subject to applicable legal requirements and legitimate retention needs.

We may retain limited information necessary for legal compliance, accounting, tax, fraud prevention, security, dispute resolution, or legal claims.

PolicyGen implements reasonable technical and organizational measures designed to protect personal information against unauthorized access, disclosure, alteration, loss, destruction, or other unlawful processing.

Depending on the nature and risk of processing, these measures may include:

• encryption in transit;
• encryption at rest where supported;
• access controls;
• authentication controls;
• least-privilege access;
• logging and monitoring;
• backups;
• vulnerability management;
• security testing;
• employee confidentiality obligations;
• service-provider controls; and
• incident-response procedures.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

If PolicyGen becomes aware of a security incident involving personal information, we will assess and respond to the incident in accordance with applicable law.

Where applicable law requires notification to individuals, regulators, customers, or other parties, PolicyGen will provide such notification within the legally required timeframe and through an appropriate method.

Depending on where you live and which laws apply, you may have rights concerning your personal information.

These may include:

• the right to know whether we process your personal information;
• the right to access your personal information;
• the right to receive information about our processing;
• the right to correct inaccurate information;
• the right to request deletion;
• the right to restrict processing;
• the right to object to certain processing;
• the right to data portability;
• the right to withdraw consent;
• the right to object to direct marketing;
• rights concerning automated decision-making, where applicable; and
• the right to lodge a complaint with a competent privacy regulator.

The availability and scope of these rights depend on applicable law.

Where applicable law provides a privacy right, you may submit a request through the privacy request mechanism made available through the PolicyGen website or Service.

We may request information reasonably necessary to verify your identity and protect against unauthorized disclosure.

Where Israeli law applies, individuals may have rights under the Protection of Privacy Law, 5741-1981 and applicable regulations, including rights concerning access to personal information and correction of inaccurate information, subject to the conditions and limitations established by law.

Israeli privacy law has undergone significant changes under Amendment No. 13, which entered into force on August 14, 2025.

PolicyGen will process personal information in accordance with applicable Israeli privacy requirements.

Where GDPR applies, individuals may have rights including:

• access;
• rectification;
• erasure;
• restriction of processing;
• objection;
• data portability;
• withdrawal of consent; and
• rights concerning automated decision-making where applicable.

You may also have the right to lodge a complaint with the data-protection authority in the EU/EEA country where you live, work, or where you believe an infringement occurred.

Where UK GDPR applies, individuals may have rights including:

• access;
• rectification;
• erasure;
• restriction;
• objection;
• data portability;
• withdrawal of consent; and
• rights relating to automated decision-making and profiling where applicable.

These rights are subject to the conditions and limitations established by applicable UK law.

Privacy rights in the United States vary by state.

Depending on where you live and whether applicable legal thresholds are met, you may have rights under applicable state privacy laws, which may include rights to:

• access;
• correct;
• delete;
• obtain a copy of personal information;
• opt out of certain targeted advertising or data sharing;
• opt out of certain sales of personal information;
• limit certain uses of sensitive personal information; and
• appeal a denied privacy request.

PolicyGen will apply rights required by applicable U.S. privacy laws based on the user's jurisdiction and the applicability of those laws.

The Service is intended for businesses and users who are legally capable of entering into contracts under applicable law.

PolicyGen does not knowingly target children with the Service.

If you believe that a child has provided personal information to us in circumstances where collection was not permitted, you may submit a request through the privacy request mechanism available through the PolicyGen website or Service.

Where laws such as the U.S. Children's Online Privacy Protection Act ("COPPA") apply, PolicyGen will comply with applicable requirements.

Where permitted by applicable law, we may send marketing communications about PolicyGen, new features, products, services, educational content, or promotions.

You may unsubscribe from marketing communications using the unsubscribe mechanism included in the relevant communication or through available account settings.

You may continue to receive essential transactional or service-related communications after opting out of marketing.

We may use analytics technologies to understand how visitors use the Service.

Analytics may collect information such as:

• device information;
• IP address;
• browser information;
• pages visited;
• interactions;
• approximate geographic information;
• referral information; and
• usage statistics.

Where applicable law requires consent for non-essential analytics, we will obtain the required consent before activating those technologies.

If PolicyGen uses advertising technologies, pixels, remarketing tools, or similar technologies, these may collect information regarding interactions with our website or advertisements.

Where applicable law requires consent or provides an opt-out right, PolicyGen will provide the applicable mechanism.

Our Cookie Policy provides additional information.

The Service may contain links to third-party websites, applications, or services.

PolicyGen is not responsible for the privacy practices of third parties that we do not control.

We recommend reviewing the privacy policies of third-party services before providing personal information to them.

PolicyGen may modify, update, replace, or otherwise change this Privacy Policy from time to time.

Changes may be made to reflect:

• changes to the Service;
• new features or functionality;
• changes to our data-processing practices;
• changes to technology;
• changes to our service providers;
• changes in applicable laws or regulations;
• changes to our business operations; or
• other legal, security, or operational requirements.

The owner or operator of PolicyGen reserves the right to make such changes at any time.

Where required by applicable law, material changes will be communicated through an appropriate notice, which may include a notice on the website, within the Service, by email, or through another legally appropriate method.

Your continued use of the Service after a revised Privacy Policy becomes effective constitutes acknowledgment of the revised policy to the extent permitted by applicable law.

Nothing in an updated Privacy Policy will remove or restrict mandatory privacy, consumer, or other legal rights that cannot lawfully be removed or restricted.

PolicyGen is operated from Israel, and Israeli law may apply to certain aspects of the processing of personal information.

However, where mandatory privacy or data-protection laws of another jurisdiction apply to a particular user or processing activity, those mandatory rights and protections are not intended to be excluded by this Privacy Policy.

Nothing in this Privacy Policy is intended to waive, exclude, or restrict any privacy right or protection that cannot lawfully be waived, excluded, or restricted.

This Privacy Policy describes the principal privacy practices applicable to the PolicyGen Service.

Additional notices, consent mechanisms, cookie notices, contractual terms, or product-specific privacy disclosures may apply where required by law or appropriate for a particular feature or processing activity.

Where there is a conflict between this Privacy Policy and a mandatory legal requirement, the mandatory legal requirement will prevail.