Privacy Policy

Picari ("we", "us", or "our") operates a bake-off platform that helps security teams evaluate and select the right cybersecurity tools. This Privacy Policy explains how we collect, use, share, and protect your personal information when you use our services.

By using Picari, you agree to the collection and use of information in accordance with this policy. If you do not agree with our practices, please do not use our services.

We collect information that you provide directly to us, as well as information generated through your use of our platform:

Information You Provide:

• Account information (name, email address, password)
• Professional information (job title, company name, team size, industry)
• Briefing conversations (requirements, preferences, evaluation criteria)
• Bake-off communications with vendors (messages, documents, evaluations, notes)
• Feedback and survey responses

Information Collected Automatically:

• Usage data (features used, pages visited, interactions with recommendations)
• Device information (browser type, operating system, device identifiers)
• Log data (IP address, access times, referring URLs)
• Analytics data (aggregated usage patterns, feature engagement)

We process your personal data based on the following legal grounds under GDPR, UK GDPR, and similar data protection laws:

• Contractual Necessity: Processing necessary to provide our services to you, including account creation, AI-powered recommendations, bake-off workspaces, and vendor matching.
• Legitimate Interests: Processing for our legitimate business interests, including platform improvement, security measures, fraud prevention, analytics, and ensuring service quality, provided these interests are not overridden by your rights.
• Consent: Where required, we obtain your consent for specific processing activities, such as marketing communications and non-essential cookies. You may withdraw consent at any time.
• Legal Obligations: Processing necessary to comply with legal requirements, such as tax, accounting, or regulatory obligations.

We use the information we collect for the following purposes:

• Provide AI-powered recommendations tailored to your business needs
• Match you with relevant software solutions and vendors
• Facilitate secure communications in evaluation rooms
• Improve our AI models and recommendation engine (see AI Transparency section below)
• Send you transactional updates about your evaluations, matches, and account
• Send marketing communications (with your consent)
• Ensure the security and integrity of our platform
• Detect, prevent, and address fraud or abuse
• Conduct analytics to understand and improve our services
• Comply with legal obligations

A key differentiator of Picari is the ability to evaluate vendors anonymously, giving you control over your evaluation process:

• In bake-offs, you remain anonymous to vendors until you explicitly choose to reveal your identity
• Vendors see only your requirements, criteria, and messages, not your personal information
• You control when and if you share your identity with each vendor individually
• Your private briefing conversations are never shared with vendors
• Private notes within bake-offs are visible only to you and your invited colleagues

This anonymity protection is central to our platform and helps ensure you can evaluate solutions without sales pressure or unsolicited outreach.

Our platform uses artificial intelligence to provide personalized recommendations and insights. Here's how we handle AI-related data:

• Service Improvement: Briefing conversations and interaction patterns may be used to improve Picari's recommendation systems and overall service quality.
• No Data Sales: We do not sell your personal data to third parties, including for AI training purposes.
• Vendor Separation: Vendors participating in bake-offs do not have access to your private briefing conversations or your interactions with other vendors.
• Third-Party AI Providers: We use third-party AI infrastructure to power certain features. Data shared with these providers is used solely to operate our service and is subject to contractual data protection obligations. Your data is not used to train third-party models beyond what is necessary to provide the service.
• Aggregated Insights: We may use aggregated, de-identified data to generate market insights and improve our matching algorithms.

We use cookies and similar tracking technologies to operate and improve our platform:

• Essential Cookies: Required for basic functionality, such as authentication, security, and session management. These cannot be disabled.
• Analytics Cookies: Help us understand how users interact with our platform, which features are most valuable, and where we can improve.
• Functional Cookies: Remember your preferences and settings to enhance your experience.

You can control cookies through your browser settings. Most browsers allow you to block or delete cookies. However, blocking essential cookies may affect your ability to use our services. Where required by law, we obtain consent before placing non-essential cookies.

We share your information only in the following limited circumstances:

• With Vendors (in Evaluation Rooms): Only the requirements, context, and messages you provide in evaluation rooms, your identity remains hidden until you choose to reveal it.
• With Your Invited Colleagues: Team members you invite to evaluation projects or evaluation rooms can see shared information within those contexts.
• Service Providers (Subprocessors): Trusted companies that help us operate our platform, including cloud hosting, analytics, email delivery, AI infrastructure, and customer support tools. These providers are contractually obligated to protect your data.
• Legal Requirements: When required by law, regulation, legal process, or government request, or to protect the rights, property, or safety of Picari, our users, or others.
• Business Transfers: In connection with a merger, acquisition, or sale of assets, your information may be transferred to the acquiring entity.

We do not sell your personal information to third parties.

We use third-party service providers ("subprocessors") to help operate our platform. These include providers of:

• Cloud hosting and infrastructure
• Database and storage services
• Email delivery and communications
• Analytics and monitoring
• AI and machine learning infrastructure
• Payment processing
• Customer support tools

All subprocessors are bound by data processing agreements that require them to protect your data and limit their use to the services they provide to us. A current list of subprocessors is available upon request by contacting hello@picari.ai.

Picari operates globally, and your personal data may be transferred to and processed in countries outside your country of residence, including the United States and other jurisdictions where our service providers operate.

When we transfer personal data from the European Economic Area (EEA), United Kingdom, or Switzerland to countries that have not been deemed to provide an adequate level of data protection, we implement appropriate safeguards, including:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• UK International Data Transfer Agreement or Addendum where applicable
• Other legally recognized transfer mechanisms

You may request a copy of the safeguards we use by contacting us at hello@picari.ai.

We implement industry-standard security measures to protect your information, including:

• Encryption of data in transit (TLS) and at rest
• Secure authentication with password hashing and optional multi-factor authentication
• Regular security assessments and audits
• Access controls limiting employee access to personal data
• Secure infrastructure hosted on enterprise-grade cloud platforms

Evaluation room communications are stored securely with strict access controls. While we take reasonable measures to protect your data, no method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

We retain your personal data only for as long as necessary to fulfill the purposes described in this policy:

• Account Data: Retained while your account is active and for up to 2 years after account deletion for legal, security, and audit purposes.
• Bake-off Communications: Retained for the duration of the bake-off activity and for up to 3 years after closure for support, dispute resolution, and security purposes.
• Briefing Conversations: Retained while your account is active. You may delete individual conversations at any time.
• Analytics Data: Aggregated and anonymized after 24 months.
• Log Data: Retained for up to 12 months for security and troubleshooting purposes.

You can request deletion of your account and associated data by contacting us at hello@picari.ai. Certain data may be retained longer if required by law or for legitimate business purposes (e.g., fraud prevention, legal claims).

Depending on your location, you may have the following rights regarding your personal data:

• Right of Access: Request a copy of the personal data we hold about you.
• Right to Rectification: Request correction of inaccurate or incomplete data.
• Right to Erasure: Request deletion of your personal data (subject to legal exceptions).
• Right to Data Portability: Receive your data in a structured, machine-readable format.
• Right to Object: Object to processing based on legitimate interests, including profiling and direct marketing.
• Right to Restrict Processing: Request limitation of processing in certain circumstances.
• Right to Withdraw Consent: Where processing is based on consent, you may withdraw it at any time.
• Right to Lodge a Complaint: You have the right to lodge a complaint with your local data protection authority (e.g., the ICO in the UK, or your national DPA in the EU).

How to Exercise Your Rights: To exercise any of these rights, contact us at hello@picari.ai. We may need to verify your identity before processing your request. We will respond within 30 days (or as required by applicable law).

If you have questions about this Privacy Policy, our data practices, or wish to exercise your rights, please contact us at hello@picari.ai.

We aim to respond to all privacy-related inquiries within 30 days.