Privacy Policy

Picari ("we", "us", or "our") operates an evaluation platform that helps security teams evaluate and select cybersecurity tools. This Privacy Policy explains how we collect, use, share, and protect your personal information when you use our services.

By using Picari, you agree to the collection and use of information in accordance with this policy. If you do not agree with our practices, please do not use our services.

The data controller for picari.ai is Picari Limited, 77 Camden Street Lower, Dublin 2, D02 XE80, registered in Ireland under number 794246. Contact hello@picari.ai for anything in this policy.

We collect information that you provide directly to us, as well as information generated through your use of our platform:

Information You Provide:

• Account information (name, email address, password)
• Professional information (job title, company name, team size, industry)
• Briefing conversations (requirements, preferences, evaluation criteria)
• Evaluation communications with vendors (messages, documents, evaluations, notes)
• Feedback and survey responses

Information Collected Automatically:

We collect some information automatically. Two kinds, usage analytics and Google Analytics, are collected only while analytics is on in Cookie settings; the rest is collected whenever you use the site. In the EEA, the UK and Switzerland analytics is off until you turn it on; elsewhere it runs until you opt out, and the Cookie Policy explains how we tell.

• Usage analytics, only while analytics is on: pages visited, features used, interactions with recommendations, the campaign link you arrived on, a random visitor id that is linked to your account if you sign in, and your browser's User-Agent string. See the Cookie Policy for every key and its lifetime.
• Google Analytics, only while analytics is on: Google's own page and event measurement, with advertising features permanently off.
• Log data, always: IP address, access times, requested URLs and referring URLs, kept by our hosting provider and API for security and troubleshooting.
• Error reports, when error monitoring is switched on (it is off today): when a page fails, the error, the page and your browser type are sent to our own error service; nothing is stored on your device for this.

We process your personal data based on the following legal grounds under GDPR, UK GDPR, and similar data protection laws:

• Contractual Necessity: Processing necessary to provide our services to you, including account creation, AI-powered recommendations, evaluation workspaces, and vendor matching.
• Legitimate Interests: Processing for our legitimate business interests: security measures, fraud and abuse prevention, service logs and error reports, and the aggregate insight described under Community features, provided these interests are not overridden by your rights. Outside the EEA, the UK and Switzerland, usage analytics and Google Analytics also run on this basis, with a right to object that you exercise with one click in Cookie settings; inside those regions they run only on your consent.
• Consent: In the EEA, the UK and Switzerland we rely on your consent for usage analytics and Google Analytics (given or refused in Cookie settings, never assumed), and everywhere for marketing communications. You may withdraw consent at any time; for analytics, the switch in Cookie settings does it immediately.
• Legal Obligations: Processing necessary to comply with legal requirements, such as tax, accounting, or regulatory obligations.

We use the information we collect for the following purposes:

• Provide AI-powered recommendations tailored to your business needs
• Match you with relevant software solutions and vendors
• Facilitate secure communications in evaluation rooms
• Improve our AI models and recommendation engine (see AI Transparency section below)
• Send you transactional updates about your evaluations, matches, and account
• Send marketing communications (with your consent)
• Ensure the security and integrity of our platform
• Detect, prevent, and address fraud or abuse
• Measure how the site is used, to improve it, when you have turned analytics on
• Comply with legal obligations

A key differentiator of Picari is the ability to evaluate vendors anonymously, giving you control over your evaluation process:

• In evaluations, you remain anonymous to vendors until you explicitly choose to reveal your identity
• Vendors see only your requirements, criteria, and messages, not your personal information
• You control when and if you share your identity with each vendor individually
• Your private briefing conversations are never shared with vendors
• Private notes within evaluations are visible only to you and your invited colleagues

This anonymity protection is central to our platform and helps ensure you can evaluate solutions without sales pressure or unsolicited outreach.

Signed-in members can react to a vendor, save it to their own list, and post comments on a vendor's page. This section explains what we record about those actions and how we use it. These features are only available to signed-in members: we do not record a reaction, a save or a comment from a signed-out visitor.

What we record:

• Your reaction to a vendor (Recommend or Blame) and a history of changes to it
• The vendors you save
• Comments you post, whether posted under your name or anonymously
• Reports you make about a comment
• The source and campaign of the page link you used for each of these actions while signed in (for example, a booth QR code), recorded against the action itself

Lawful basis:

• Contract: to provide the reaction, save and comment features you use
• Legitimate interests: for moderation, for aggregate insight such as the public Recommend count and Picari's own internal analysis, and for handling legal complaints about content. You have the right to object to processing on this basis

What is public:

The total number of Recommends a vendor has received is shown publicly on the vendor's page, never who gave them. Comments are shown publicly. Blame and your saved list are never shown publicly, to the vendor, or to any other member.

Anonymity limits:

An anonymous comment is anonymous to other members and to the vendor, but Picari always knows who posted it. We may disclose an author's identity if required by a court order or another legal obligation, or with the author's consent as part of resolving a defamation complaint.

Moderation and legal disclosure:

An automatic filter screens comments for profanity, email addresses and phone numbers. A comment reported by three different members is held from public view until an admin reviews it, and we tell the author why. Anyone can report a concern about a comment without a Picari account, by emailing hello@picari.ai.

Retention:

• Your reaction and save history is kept for as long as your account exists, and is deleted when your account is deleted
• Comments are kept until you or a moderator deletes them
• On account deletion, your reactions, saves and comments are deleted. If a comment is the subject of an open report or legal complaint at the time, an admin-only copy is kept until the matter is resolved, then deleted

Our platform uses artificial intelligence to provide personalized recommendations and insights. Here's how we handle AI-related data:

• Service Improvement: Briefing conversations and interaction patterns may be used to improve Picari's recommendation systems and overall service quality.
• Data sales: We do not sell your personal data, including for AI training. The one exception is yours to choose: if you turn on Visitor insights, details of your visit are shared with our partner RB2B, which California law may treat as a sale or share. See Visitor insights below.
• Vendor Separation: Vendors participating in evaluations do not have access to your private briefing conversations or your interactions with other vendors.
• Third-Party AI Providers: We use third-party AI infrastructure to power certain features. Data shared with these providers is used solely to operate our service and is subject to contractual data protection obligations. Your data is not used to train third-party models beyond what is necessary to provide the service.
• Aggregated Insights: We may use aggregated, de-identified data to generate market insights and improve our matching algorithms.

Picari stores cookies and browser storage in three categories: strictly necessary (sign-in, abuse protection, your consent choice, your drafts), preferences you set, and analytics (Google Analytics and Picari's own usage analytics). In the EEA, the UK and Switzerland analytics is off until you turn it on; elsewhere it runs until you opt out. The Cookie Policy at /cookies lists every key, who sets it, why, and for how long, and explains how we tell where you are. A fourth category, Visitor insights, is off unless you turn it on; it is described in Visitor insights (RB2B) below.

Change your choice at any time with Cookie settings in the footer, your account menu or the top bar of every page; a change takes effect at once. A Global Privacy Control signal from your browser is honored as a refusal. Your browser's own settings can block or delete storage as well, but they are not the only control and blocking strictly necessary storage signs you out.

The cookie choice you are shown depends on the country of the connection your request arrives from, read by our content delivery network when the choice is first made. Only the two-letter country code is kept, on the consent record; the network address is not kept with your choice or your analytics events, and the Cookie Policy explains both rules.

We share your information only in the following limited circumstances:

• The Public: Comments you post, and each vendor's total Recommend count, are visible to anyone visiting the vendor's page.
• With Vendors (in Evaluation Rooms): Only the requirements, context, and messages you provide in evaluation rooms, your identity remains hidden until you choose to reveal it.
• With Your Invited Colleagues: Team members you invite to evaluation projects or evaluation rooms can see shared information within those contexts.
• Service Providers (Subprocessors): Companies that help us run the platform, named in the Subprocessors section below. Each is bound by a data processing agreement limiting it to the service it provides to us.
• Legal Requirements: When required by law, regulation, legal process, or government request, or to protect the rights, property, or safety of Picari, our users, or others.
• Business Transfers: In connection with a merger, acquisition, or sale of assets, your information may be transferred to the acquiring entity.

Apart from Visitor insights, which runs only if you turn it on, we do not sell or share your personal information.

When you visit or log in to our website, cookies and similar technologies may be used by our online data partners or vendors to associate these activities with other personal information they or others have about you, including by association with your email. We (or service providers on our behalf) may then send communications and marketing to these email addresses. You may opt out of receiving this advertising by visiting https://app.retention.com/optout. You also have the option to opt out of the collection of your personal data in compliance with GDPR by visiting https://www.rb2b.com/rb2b-gdpr-opt-out.

RB2B uses its data partner LiveIntent (liadm.com) to match visits; LiveIntent's own choices, including an opt-out, are at https://privacy.liveintent.com.

On Picari this runs only if you turn on Visitor insights (Accept all on the cookie banner, or the switch in Cookie settings), and never when your browser sends Global Privacy Control. In the US our partner RB2B may identify you by name, work email, job title and LinkedIn profile; elsewhere it identifies your company only. Turn it off at any time in Cookie settings: it stops at once and its cookies are deleted.

We use the following service providers ("subprocessors"):

• Amazon Web Services: hosting, database, storage and email queues, in the eu-west-1 region (Ireland).
• Google (Google Ireland Limited, Ireland): Google Analytics 4, only after you turn analytics on, and Google sign-in when you choose it.
• Google: the Gemini API that powers the briefing conversation and written summaries.
• Stripe: card payments on the checkout page.
• Resend: transactional email delivery.
• Slack: internal alerts to Picari's team, which with your consent carry your analytics visitor id.
• YouTube (Google Ireland Limited) and Vimeo (Vimeo.com, Inc., United States): video players on vendor pages, loaded only when you click play.

All subprocessors are bound by data processing agreements that require them to protect your data and limit their use to the services they provide to us. A current list of subprocessors is available upon request by contacting hello@picari.ai.

Your account, briefing and evaluation data is stored in Ireland (AWS eu-west-1). Some providers above process data in the United States: Resend for email delivery, Vimeo when you play a video, and Stripe and Google under their own transfer terms.

When we transfer personal data from the European Economic Area (EEA), United Kingdom, or Switzerland to countries that have not been deemed to provide an adequate level of data protection, we implement appropriate safeguards, including:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• UK International Data Transfer Agreement or Addendum where applicable
• Other legally recognized transfer mechanisms

You may request a copy of the safeguards we use by contacting us at hello@picari.ai.

We implement industry-standard security measures to protect your information, including:

• Encryption of data in transit (TLS) and at rest
• Secure authentication with password hashing and optional multi-factor authentication
• Regular security assessments and audits
• Access controls limiting employee access to personal data
• Secure infrastructure hosted on enterprise-grade cloud platforms

Evaluation room communications are stored securely with strict access controls. While we take reasonable measures to protect your data, no method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

We retain your personal data only for as long as necessary to fulfill the purposes described in this policy:

• Account Data: Retained while your account is active and for up to 2 years after account deletion for legal, security, and audit purposes.
• Evaluation Communications: Retained for the duration of the evaluation and for up to 3 years after closure for support, dispute resolution, and security purposes.
• Briefing Conversations: Retained while your account is active. You may delete individual conversations at any time.
• Analytics Data: Raw usage events are deleted 12 months after the month they were recorded; the monthly totals shown to vendors are kept.
• AI Traces: The record of each AI request made for you (prompt, response and timing) is deleted after 3 months.
• Consent Records: Kept for 6 years, then deleted.
• Log Data: Retained for up to 12 months for security and troubleshooting purposes.

You can request deletion of your account and associated data by contacting us at hello@picari.ai. Certain data may be retained longer if required by law or for legitimate business purposes (e.g., fraud prevention, legal claims).

Depending on your location, you may have the following rights regarding your personal data:

• Right of Access: Request a copy of the personal data we hold about you.
• Right to Rectification: Request correction of inaccurate or incomplete data.
• Right to Erasure: Request deletion of your personal data (subject to legal exceptions).
• Right to Data Portability: Receive your data in a structured, machine-readable format.
• Right to Object: Object to processing based on legitimate interests, including profiling and direct marketing.
• Right to Restrict Processing: Request limitation of processing in certain circumstances.
• Right to Withdraw Consent: Where processing is based on consent, you may withdraw it at any time. For analytics, open Cookie settings in the footer, your account menu or the top bar and turn the switch off; the withdrawal takes effect immediately and is recorded.
• Right to Lodge a Complaint: You have the right to lodge a complaint with your local data protection authority (e.g., the ICO in the UK, or your national DPA in the EU).

How to Exercise Your Rights: To exercise any of these rights, contact us at hello@picari.ai. We may need to verify your identity before processing your request. We will respond within 30 days (or as required by applicable law).

If you have questions about this Privacy Policy, our data practices, or wish to exercise your rights, please contact us at hello@picari.ai.

We aim to respond to all privacy-related inquiries within 30 days.