Platform Privacy Notice

Capitalized terms not defined here have the meaning given in Section Definitions or, where applicable, the executed Master Services Agreement.

This Platform Privacy Notice describes how Section, Inc. ("Section", "we", "us", "our") processes the personal information of End Users in connection with the Services (Section Coach and SectionHQ). For visitors to sectionai.com, the separate Privacy Policy applies.

1. Our role

Your employer or institution (the "Customer") decides what personal information is processed through the Services and for what purposes. Customer is the controller of that personal information. Section processes the personal information on Customer's behalf as a processor. The terms of Section's processing are set out in the Data Processing Addendum.

Because Customer is the controller, your first point of contact for questions about how your personal information is processed, and for requests to exercise your rights, is your employer's administrator. We will assist your employer in responding to your requests.

2. Personal information we process

The Services are scoped to a narrow set of personal information:

1. Account identifiers: first name, last name, business email.
2. Authentication metadata: login times, IP address, session tokens, MFA factors, and similar information (held by Clerk on Section's behalf).
3. Product usage data: coaching sessions, feature interactions, completion records, certification responses, and similar product event metadata.
4. Support content: information you provide when you contact Section support (held by Freshdesk on Section's behalf).
5. Optional HRIS data (SectionHQ tenants only, and only if your employer enables the integration): employee directory metadata such as manager, role, and organizational structure (held by Finch and Section).

3. What we do not process

Section does not collect, store, or process protected health information, government-issued identifiers, financial account or payment card data, biometric data, or sensitive personal data through the Services. Customer is contractually required not to submit such data to the Services. If you receive a request to submit such data through the Services, do not do so; report it to your employer's administrator.

Payment for individual self-serve purchases of Section Coach is handled by our payment processor, Stripe: card details are collected and processed by Stripe directly through Stripe Elements, and Section does not receive or store full payment card numbers. Enterprise access is invoiced and does not involve payment card data.

4. Purposes

We process the personal information in section 2 to:

1. deliver the Services to you and your employer, including coaching, certification, use case discovery, and analytics;
2. authenticate you and protect your account;
3. provide your employer's administrators with the analytics, dashboards, and reporting they have subscribed to;
4. operate, secure, monitor, and improve the Services;
5. respond to your support requests;
6. comply with applicable law and respond to lawful requests.

5. AI Features and Foundation Models

The Services use AI Features that route prompts to Foundation Models through the LLM gateway. The LLM gateway and the Foundation Model providers operate under zero-retention contracts: prompts and responses are processed in real time and are not retained by them and are not used to train any Foundation Model. The full AI-specific terms are set out in the AI Addendum.

6. Sub-processors

Section's current Sub-processors are listed on the Subprocessor List. The list includes the service each Sub-processor provides, the categories of personal information involved, and the safeguards in place.

7. International transfers

The Services are operated from the United States, specifically Render's US-West region in Oregon. Section's workforce is primarily based in the United States, with limited contractor support in South America consistent with applicable OFAC sanctions and export controls. Where personal information is transferred from outside the United States to Section or its Sub-processors, transfers rely on appropriate safeguards including the EU Standard Contractual Clauses, the UK International Data Transfer Addendum, and analogous mechanisms under the Swiss FADP.

8. Retention

Personal information is retained for the duration of your employer's subscription to the Services. On termination, Section deletes Customer Data within thirty (30) days of the termination date or Customer's written deletion request, whichever is later, and purges Customer Data from backups within ninety (90) days. Limited information may be retained longer where required by law or for the establishment, exercise, or defense of legal claims.

9. Security

Section maintains technical and organizational measures appropriate to the risk of the processing, including TLS 1.2 or higher in transit, AES-256 at rest on the Render managed database, multi-factor authentication, least-privilege access, quarterly access reviews, centralized logging and monitoring in Datadog, and a documented Security Incident Response Plan. Section is SOC 2 Type II audited and aligned with ISO/IEC 27001. The full set of controls is described in the DPA, section 9, and the Section Compliance Playbook, available to your employer under NDA.

10. Your rights

Depending on your jurisdiction, you may have rights to access, correct, delete, restrict, or port your personal information, and to object to specific processing. Because your employer is the controller, please direct rights requests to your employer's administrator. We will assist your employer in responding within the timelines required by applicable law. Where you wish to contact Section directly, you may write to legal@sectionai.com; we will route your request to your employer where required and will respond to you to the extent legally permitted.

11. Children

The Services are not directed to children under the age of sixteen, and Section does not knowingly collect personal information from children. If you believe a child has provided personal information through the Services, please contact legal@sectionai.com so we can take appropriate steps.

12. Changes

Section may update this Platform Privacy Notice from time to time. Material changes will be reflected in the Version and Last Updated date above and, where appropriate, communicated to you in product.

13. Contact

Questions about this Platform Privacy Notice may be sent to legal@sectionai.com.

Section, Inc. 228 Park Avenue S, PMB 96268 New York, NY 10003-1502 legal@sectionai.com