Last Updated: March 8, 2026
This Privacy Policy ("Policy") describes how Govantic, Inc., a Delaware corporation ("Govantic," "we," "us," or "our") collects, uses, discloses, and protects information in connection with the Govantic platform and related services (collectively, the "Service"), as well as our marketing website at govantic.com (the "Website").
By accessing or using our Service or Website, you agree to the practices described in this Policy. If you do not agree with this Policy, please do not use the Service or Website.
This Policy applies to:
1.1 Website Visitors. Individuals who visit our Website (govantic.com), including the home page, features page, pricing page, about page, and related marketing pages.
1.2 Customers. Organizations that subscribe to and use the Service, including their designated Authorized Users (Admins, Managers, and Viewers).
1.3 Monitored Individuals. Individuals within a Customer's organization whose communications, activities, or data may be processed by the Service through Supervision Agents. Important: Govantic processes data about Monitored Individuals solely on behalf of and at the direction of our Customers. Customers are responsible for providing notice and obtaining any required consents from Monitored Individuals. If you are a Monitored Individual with questions about how your data is processed, please contact your employer or the organization that deployed Govantic.
(a) Account Registration Information. When you create a Govantic account or Workspace, we collect:
(b) Compliance Knowledge. Customers upload and create compliance-related content within the Service, including:
(c) Contact and Communication Information. When you contact us via email (e.g., hello@govantic.com, legal@govantic.com) or through our Website, we collect the information you provide in your message.
(d) Payment Information. If you subscribe to a paid plan (Professional or Enterprise), we collect billing information such as company name, billing address, and payment method details. Payment card information is processed by our third-party payment processor and is not stored on our servers.
(a) Data Processed by Supervision Agents. When Customers enable Supervision Agents, the Service processes data from connected third-party sources on behalf of the Customer. This may include:
Critical Architecture Note: Data processed by Supervision Agents and the AI reasoning engine is processed within the Customer's own cloud account. This data does not transit Govantic's infrastructure. Govantic's web application and administration plane process only metadata, configuration data, and Workspace management data.
(b) Incident and Evidence Data. The Service generates and stores incident records when potential compliance violations are detected, including:
(c) Review and Approval Data. Records of human review decisions on AI-extracted requirements, including reviewer identity, approval status, and notes.
(a) Usage Data. We automatically collect information about how you interact with the Service and Website, including:
(b) Device and Browser Information. We collect:
(c) Network Information. We collect:
(d) Local Storage. The Service uses browser local storage (not traditional cookies) to maintain your authentication session. Specifically, we store an authentication token under the key govantic-auth in your browser's local storage to keep you logged in between sessions.
(e) Cookies and Similar Technologies. Our Website may use cookies for:
You can control cookie preferences through your browser settings. Disabling essential cookies may affect the functionality of the Website.
We use information to:
We use information to:
We use information to:
We use information to:
We use information to:
Govantic does not sell, rent, or trade personal information to third parties for their own marketing purposes.
We may share information with third-party service providers who assist us in operating the Service, including:
All service providers are contractually obligated to use information only for the purposes of providing services to Govantic and to maintain appropriate security measures.
The Service integrates with third-party platforms at the Customer's direction. When a Customer connects the Service to third-party tools (e.g., Slack, Gmail, AWS), the Service accesses data from those platforms in accordance with the Customer's configuration. The Intervene response mode may cause Govantic to post messages or take actions within those third-party platforms on behalf of the Customer.
We may disclose information if required to do so by law, regulation, legal process, or governmental request, including:
In the event of a merger, acquisition, reorganization, bankruptcy, or sale of all or a portion of our assets, information may be transferred to the acquiring entity. We will notify affected users of any such transfer and any choices they may have regarding their information.
We may share aggregated, anonymized, and de-identified data that does not identify any individual or Customer. This data may be used for industry benchmarks, research, and to improve the Service.
Govantic is designed with a single-tenant deployment model for Enterprise customers:
We implement industry-standard security measures to protect information, including:
You may access, update, or correct your account information at any time through the Settings page in the Service. Workspace Admins can manage users, roles, and workspace settings.
Customers can export their data from the Service at any time during an active subscription.
You may request deletion of your account by contacting us at privacy@govantic.com. Workspace Admins may also delete the entire Workspace, which will remove all associated data.
You may opt out of marketing communications at any time by:
Opting out of marketing communications will not affect transactional communications related to your account.
You can manage your cookie preferences through your browser settings. Most browsers allow you to block or delete cookies. Note that blocking essential cookies may impair the functionality of the Website.
Our Website does not currently respond to "Do Not Track" signals from browsers.
If you are located in the EEA, UK, or Switzerland, you have the following rights under the General Data Protection Regulation (GDPR) or equivalent local law:
(a) Right of Access. You have the right to request a copy of the personal data we hold about you.
(b) Right to Rectification. You have the right to request correction of inaccurate or incomplete personal data.
(c) Right to Erasure ("Right to Be Forgotten"). You have the right to request deletion of your personal data, subject to certain legal exceptions.
(d) Right to Restriction of Processing. You have the right to request that we restrict the processing of your personal data in certain circumstances.
(e) Right to Data Portability. You have the right to receive your personal data in a structured, commonly used, machine-readable format and to transmit it to another controller.
(f) Right to Object. You have the right to object to the processing of your personal data based on our legitimate interests.
(g) Right to Withdraw Consent. Where processing is based on consent, you have the right to withdraw that consent at any time.
Legal Bases for Processing. We process personal data on the following legal bases:
Data Transfers. If you are located in the EEA, UK, or Switzerland, your personal data may be transferred to and processed in the United States, where Govantic is headquartered. We implement appropriate safeguards for such transfers, including Standard Contractual Clauses (SCCs) approved by the European Commission.
Data Processing on Behalf of Customers. Where Govantic processes personal data of Monitored Individuals on behalf of a Customer, the Customer acts as the Data Controller and Govantic acts as the Data Processor. In such cases, the Customer's privacy policy and data processing obligations apply. Govantic will enter into a Data Processing Agreement (DPA) with Customers as required under GDPR.
To exercise any of these rights, contact us at privacy@govantic.com. We will respond within thirty (30) days.
If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA):
(a) Right to Know. You have the right to request that we disclose the categories and specific pieces of personal information we have collected, the sources of collection, the purposes of collection, and the categories of third parties with whom we share personal information.
(b) Right to Delete. You have the right to request deletion of your personal information, subject to certain exceptions.
(c) Right to Correct. You have the right to request correction of inaccurate personal information.
(d) Right to Opt Out of Sale/Sharing. Govantic does not sell or share personal information for cross-context behavioral advertising.
(e) Right to Non-Discrimination. We will not discriminate against you for exercising any of your CCPA/CPRA rights.
To exercise your rights, contact us at privacy@govantic.com. We will verify your identity before processing your request.
If you are located in a jurisdiction with specific privacy laws (e.g., Brazil's LGPD, Canada's PIPEDA), you may have similar rights to access, correct, delete, or restrict the processing of your personal data. Contact us at privacy@govantic.com to exercise these rights.
When Customers deploy Supervision Agents, the Service processes data about individuals within the Customer's organization ("Monitored Individuals"). This may include:
Govantic processes this data solely on behalf of and at the direction of the Customer. The Customer is the Data Controller (or equivalent under applicable law) and is responsible for:
If you are a Monitored Individual and wish to exercise your privacy rights (access, deletion, correction, etc.), please contact the organization that deployed Govantic (your employer or contracting party). Govantic will cooperate with the Customer to fulfill such requests in accordance with applicable law.
If the Govantic Desktop (Endpoint Agent) is installed on your device, it may collect:
This data is collected to enforce your organization's compliance policies. The Endpoint Agent is designed to understand context and distinguish between legitimate business activities and potential policy violations. Contact your organization's IT or compliance team for more information about what is monitored and why.
The Service integrates with the following categories of third-party services at the Customer's direction:
Each third-party integration is governed by that service's own privacy policy and terms of service. Govantic is not responsible for the privacy practices of third-party services. Customers should review the privacy policies of all connected services.
Our Website may use third-party analytics services to help us understand usage patterns. These services may collect information about your use of the Website through cookies and similar technologies.
Our Website may contain links to third-party websites. This Policy does not apply to those websites. We encourage you to review the privacy policies of any third-party websites you visit.
The Service and Website are not intended for individuals under the age of 18. We do not knowingly collect personal information from children under 18. If we become aware that we have inadvertently collected personal information from a child under 18, we will take steps to delete such information promptly. If you believe we have collected information from a child under 18, please contact us at privacy@govantic.com.
Govantic is headquartered in the United States. If you access the Service or Website from outside the United States, your information may be transferred to, stored, and processed in the United States or other countries where our service providers operate.
We implement appropriate safeguards for international data transfers, including:
For Enterprise customers, the single-tenant deployment model ensures that Customer Data processed by Supervision Agents and the AI reasoning engine remains within the Customer's own cloud account and region.
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will:
Your continued use of the Service or Website after the effective date of any changes constitutes your acceptance of the updated Policy.
If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:
Govantic, Inc.
Privacy inquiries: privacy@govantic.com
Legal inquiries: legal@govantic.com
General inquiries: hello@govantic.com
If you are located in the EEA and have concerns about our data processing practices that we have not satisfactorily addressed, you have the right to lodge a complaint with your local Data Protection Authority.
By using the Govantic Service or Website, you acknowledge that you have read and understood this Privacy Policy.