We raised $7M to put AI on the governed path. Early access starts now.Read the press release
Last updated: July 29, 2026
Version 1.1
Effective Date: July 29, 2026 | Last Updated: July 29, 2026
ActualyzeAI, Inc. ("Actualyze," "we," "us," or "our") values the privacy of every person who interacts with our products and services. This Privacy Policy ("Policy") explains how we collect, use, disclose, and safeguard information when you visit our website at actualyze.ai or any associated subdomain (collectively, the "Site") and when you use the Actualyze platform and any related services we make available (the "Services").
Actualyze is a platform purpose-built to help organizations govern, secure, operate, and optimize the use of artificial intelligence inference providers. Because Actualyze processes data on behalf of our enterprise customers ("Customers"), this Policy describes both our role as a data controller with respect to our own marketing and operational activities and our role as a data processor when we handle Customer Data on behalf of our Customers.
Actualyze is not responsible for providing notices or obtaining consents for processing Customer Data from any individual to whom that data relates. Our Customers are responsible for providing such notices and obtaining such consent. If we receive a request from an individual regarding their information contained in Customer Data we will direct that request to the Customer for a response.
By accessing or using the Site or Services, you acknowledge that you have read, understood, and agree to be bound by this Policy. If you do not agree with the terms of this Policy, please do not use the Site or Services.
This Policy applies to:
Visitors to the Actualyze Site, including prospective Customers, partners, and job applicants;
Authorized users of the Actualyze platform, including administrators, team leads, engineers, and other personnel granted access by a Customer; and
Customer Data that we process in our capacity as a data processor on behalf of our Customers.
This Policy does not apply to the data practices of third-party AI providers (such as OpenAI, Anthropic, or other large language model providers) that Customers integrate through Actualyze. Those providers have their own privacy policies, and Customers are responsible for reviewing and complying with them.
We collect information that you voluntarily provide when you:
Register for an account or a free trial of Actualyze including your name, work email address, company name, job title, and password;
Contact us through our Site's contact or inquiry forms including your name, email address, phone number, and the substance of your message;
Subscribe to marketing communications, newsletters, or product updates;
Participate in surveys, research studies, webinars, or product feedback sessions;
Purchase a subscription to the Services including billing contact information and, where you pay online, payment information, such as credit card information (which is collected and processed by our third-party payment processors);
Apply for a position at Actualyze, including your name, address, email address, phone number, and educational and work history.
When you access the Site or use the Services, we and our service providers may automatically collect certain technical and behavioral information, including:
Device and browser information — browser type and version, operating system, screen resolution, and device identifiers;
Log and usage data — IP address, pages visited, referring URL, time and date of access, clickstream data, and session duration;
Platform usage data — AI request volumes, team and budget utilization rates, feature adoption patterns, virtual model configurations, and overage metrics (collected in de-identified or aggregated form where possible); and
Cookie and tracking data — as further described in Section 6 below.
"Customer Data" means any data, content, or information submitted to the Services by or on behalf of a Customer or its authorized users. Customer Data may include:
When a Customer routes AI requests through Actualyze, we process the content of those requests and responses — including prompts, completions, and any personal data they contain — solely on the Customer's behalf and instructions, transiently, as necessary to provide the Services, for example to apply routing, governance controls, and any data guardrails the Customer has configured. Actualyze is designed not to retain this payload content beyond that transient processing.
The Customer Data we store consists of:
Request metadata — routing, governance, and attribution records generated when AI requests pass through Actualyze, such as timestamps, model and provider identifiers, token counts, tool invocations, team and budget attribution, guardrail detection events, and request outcomes;
User identity information (such as names and email addresses) imported or created by the Customer within the Actualyze workspace;
Organizational structure data — team configurations, sub-team hierarchies, business unit assignments, and budget allocations;
Cost attribution and spend data surfaced through Actualyze's budget and financial operations functionality; and
Any other data that the Customer or its authorized users upload to or store in the Services, including content stored through features the Customer elects to enable or configure.
We process Customer Data solely as instructed by the Customer, in accordance with our Terms of Service (available at https://actualyze.ai/terms/service) and our Data Processing Addendum ("DPA"). Customers are responsible for ensuring that their collection and submission of Customer Data complies with all applicable laws. Customers are advised against submitting sensitive personal information, including government-issued identification numbers, payment card data, or protected health information to the Services unless required to do so for the Customer's own business purposes.
We use the information we collect for the following purposes:
To create, administer, and maintain customer accounts and workspaces;
To provision, operate, and improve the Actualyze platform, including its governance, cost attribution, and compliance features;
To monitor platform performance, diagnose technical issues, and ensure system reliability;
To develop new features, products, and services based on usage insights; and
To verify usage levels and tier compliance for billing purposes; and
To train, evaluate, and improve the model-selection and routing functionality of the Services using de-identified operational telemetry, as described in our Data Processing Addendum; this does not include the content of requests or responses.
To respond to inquiries, support requests, and other communications;
To send transactional communications, such as account notifications, billing information, and trial expiration reminders; and
To notify Customers of material changes to the Services or this Policy.
To send newsletters, product updates, case studies, and other marketing content to users who have opted in;
To personalize content and outreach based on your organization type, tier, usage patterns, or expressed interests; and
To measure the effectiveness of our marketing campaigns.
You may opt out of marketing communications at any time as described in Section 9 below.
To detect, investigate, and prevent fraudulent, abusive, or unauthorized use of the Services;
To enforce our Terms of Service (https://actualyze.ai/terms/service), Website Terms of Use (https://actualyze.ai/terms/website), and other applicable policies;
To comply with applicable laws, regulations, and legal processes, including responding to lawful requests by governmental authorities; and
To establish, exercise, or defend legal claims.
We may use Customer Data and usage information in de-identified or aggregated form for statistical, security, and operational purposes, to improve our product, to train and improve the model-selection and routing functionality of the Services, and to publish benchmarks, industry reports, and research, in each case as described in and subject to the restrictions of our Data Processing Addendum. Published material will not identify any Customer or individual, or be attributable to any Customer, without prior written consent. We do not use Customer Data, in any form, to train generative AI or foundation models.
We do not sell your personal information. We may disclose your information in the following circumstances:
We engage trusted third-party vendors and subprocessors to help us operate and improve the Services. These include providers of cloud hosting, data storage, analytics, customer support, payment processing, email delivery, and security services. Such vendors are contractually bound to use your information only for the purposes of providing services to us and to maintain appropriate confidentiality and security standards.
A current list of our subprocessors is available at https://trust.actualyze.ai or on request from privacy@actualyze.ai. We provide Customers at least fourteen (14) days' notice before any new subprocessor begins processing personal data on our behalf, as described in our Data Processing Addendum.
To the extent that a Customer instructs Actualyze to share Customer Data with a third party (for example, through integration with an external SIEM, data warehouse, or analytics tool), we will do so in accordance with that instruction. The Customer remains responsible for ensuring such sharing complies with applicable law.
If Actualyze is involved in a merger, acquisition, asset sale, financing, or similar corporate transaction, your information may be transferred as part of that transaction. We will provide notice before your personal information is subject to a materially different privacy policy.
We may disclose your information when required to do so by law, court order, subpoena, or other legal process, or when we believe in good faith that such disclosure is necessary to: (a) comply with applicable law or legal obligations; (b) protect and defend the rights or property of Actualyze; (c) prevent or investigate possible wrongdoing; or (d) protect the safety of our users or the public.
We may share your information with our affiliates and subsidiaries for purposes consistent with this Policy. Any such entity will be bound by terms at least as protective as those described herein.
We may share aggregate or de-identified information that cannot reasonably be used to identify you with third parties for research, marketing, analytics, or other business purposes.
We retain personal information and Customer Data for as long as necessary to provide the Services and fulfill the purposes described in this Policy, unless a longer retention period is required or permitted by law.
Request metadata and related platform records are retained in accordance with the limits applicable to the Customer's subscription tier; request and response payload content is not retained beyond transient processing, except where the Customer has enabled a feature that stores such content, in which case it is retained in accordance with that feature's configuration and the applicable subscription tier. For other personal information, we determine the appropriate retention period based on the amount, nature, and sensitivity of the information, the purposes for which we process it, and applicable legal, accounting, and reporting requirements.
Following cancellation or expiry of a subscription, Customers may request export of their Customer Data by written notice to legal@actualyze.ai within thirty (30) days (fourteen (14) days where we have terminated the subscription). Following termination, we delete or anonymize Customer Data in accordance with our standard retention and deletion schedules, and in any event within twelve (12) months, unless a legal obligation, legal hold, or the establishment, exercise, or defense of legal claims requires longer retention. Account-level personal information (such as billing records) may be retained as required by applicable law.
We and our service providers use cookies, web beacons, pixel tags, and similar technologies to collect information about your use of our Site and Services.
Strictly Necessary Cookies: Required for the basic operation of the Site and Services, including session management and authentication. These cannot be disabled.
Analytics Cookies: Help us understand how visitors use the Site (e.g., Google Analytics) and Services. We use this data in aggregate to improve the Site and Services.
Functional Cookies: Remember your preferences and settings to enhance your experience.
Marketing Cookies: Used to deliver relevant advertising and track campaign performance. We do not enable these cookies without your consent.
When you first visit the Site, our cookie consent banner allows you to accept or decline non-essential cookies, and you may update your choices at any time through the cookie preference settings available on the Site. You may also disable or delete cookies through your browser settings. Most browsers provide instructions in their Help menus. Note that disabling certain cookies may impair the functionality of the Site or Services. We honor browser-level Do Not Track ("DNT") signals to the extent technically feasible; however, because there is no uniform standard for DNT, our response may vary across browsers. Where required by applicable law, we also treat valid opt-out preference signals, such as the Global Privacy Control ("GPC"), as a request to opt out of the sale or sharing of personal information; note that we do not sell personal information or share it for cross-context behavioral advertising without your consent.
We implement and maintain commercially reasonable administrative, technical, and physical safeguards designed to protect the information we hold from unauthorized access, disclosure, alteration, or destruction. Our security program includes:
Encryption of data in transit using TLS and at rest using industry-standard encryption;
Access controls and role-based permissions, including SSO, SAML and RBAC features;
Data guardrails including masking capabilities and request blocking, built into the Actualyze platform for Customers to configure;
Audit trails of administrative and platform activity; and
Controls aligned with the SOC 2 Type II and ISO/IEC 27001 frameworks.
Despite these measures, no method of transmission over the internet or method of electronic storage is 100% secure. We cannot guarantee absolute security of your information. You are responsible for maintaining the confidentiality of your account credentials. Please notify us immediately at security@actualyze.ai if you suspect any unauthorized access to your account. If we become aware of a security incident that compromises personal information, we will notify affected Customers and, where required by applicable law, affected individuals and regulators without undue delay, consistent with our legal and contractual obligations, and will take reasonable steps to mitigate the effects of the incident.
Depending on your jurisdiction, you may have the following rights with respect to your personal information:
Access — the right to request a copy of the personal information we hold about you;
Correction — the right to request correction of inaccurate or incomplete information;
Deletion — the right to request deletion of your personal information, subject to our legal and contractual obligations;
Portability — the right to receive your personal information in a structured, commonly used, machine-readable format;
Objection / Restriction — the right to object to or request restriction of certain processing activities; and
Appeal — the right to appeal any decision we may make in response to a request.
If you are a California resident, Appendix A describes rights that are applicable to you. If you are located in the European Economic Area, the United Kingdom, or Switzerland, Appendix B (EEA, UK, and Swiss Data Subject Rights) describes the rights that apply to you.
We do not sell personal data, and we do not process personal data for targeted advertising without your consent.
To exercise these rights, except as noted in Section 8.2 below, please contact us at privacy@actualyze.ai. We will respond to the extent and within the timeframe required by applicable law. We may request that you provide us information sufficient to verify your identity before responding to a request.
For requests relating to Customer Data processed on behalf of a Customer, we will direct the request to the relevant Customer and will comply with the Customer's lawful instructions. Individuals whose data is processed through Actualyze on behalf of a Customer should contact that Customer directly in the first instance.
If you no longer wish to receive marketing communications from us, you may opt out at any time by: (a) clicking the "unsubscribe" link in any marketing email; (b) adjusting your communication preferences within your Actualyze account settings; or (c) contacting us at privacy@actualyze.ai. Please allow up to ten (10) business days for your opt-out to take effect. Note that even after opting out of marketing communications, you will continue to receive transactional and account-related messages.
Our Site and Services may contain links to third-party websites and integrate with external AI providers, cloud services, and other platforms chosen by the Customer ("Third-Party Services"). This Policy does not govern the data practices of any Third-Party Service. We are not responsible for the privacy practices or content of Third-Party Services. We encourage you to review the privacy policies of any Third-Party Service before providing information to or through them.
ActualyzeAI is based in the United States, and the Site and Services are operated from the United States. Information we collect is stored and processed in the United States. By using the Site or Services, you acknowledge that your information will be transferred to and processed in the United States, which may have data protection rules that differ from those of your jurisdiction.
Where we process personal data on behalf of a Customer and that processing involves a transfer of personal data from the European Economic Area, the United Kingdom, or Switzerland, the transfer is governed by our Data Processing Addendum, which incorporates the European Commission's Standard Contractual Clauses (Module Two, Controller-to-Processor), the UK International Data Transfer Addendum, and equivalent arrangements for Switzerland. The Data Processing Addendum is available at https://trust.actualyze.ai or on request from privacy@actualyze.ai.
Where we act as a controller in respect of individuals in the EEA, the United Kingdom, or Switzerland — principally visitors to the Site, recipients of our communications, event and webinar registrants, and job applicants — Appendix B describes the rights that may apply.
The Services are not directed at, or intended for use by, children under the age of 18. We do not knowingly collect personal information from children under 18. If we become aware that we have inadvertently collected personal information from a child under 18, we will take prompt steps to delete that information. If you believe we have collected information from a child, please contact us at privacy@actualyze.ai.
We may update this Policy from time to time as our Services evolve, as applicable laws change, or for other operational or legal reasons. When we make material changes, we will: (a) update the "Last Updated" date at the top of this Policy; (b) post a notice on our Site; and (c) if you have an active account, send notice to the email address associated with your account at least thirty (30) days before the change takes effect. Your continued use of the Services following the effective date of the updated Policy constitutes your acceptance of the changes.
If you have questions or concerns about this Policy or our privacy practices, or if you wish to exercise any of your privacy rights, please contact us:
ActualyzeAI, Inc.
Attn: Privacy Officer
45 S. Arroyo Parkway, Suite C25
Pasadena, CA 91105
Email: privacy@actualyze.ai
Website: https://actualyze.ai/privacy
This Appendix supplements the Policy and applies to California residents. It is provided in accordance with the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act (the "CCPA"), and applies to the extent the CCPA applies to our processing of your personal information. Actualyze does not currently meet the thresholds that would qualify it as a "business" subject to the CCPA, including the annual gross revenue, consumer-volume, and personal-information sale or sharing thresholds set out in the CCPA, and this Appendix is therefore provided voluntarily and in anticipation of the CCPA's potential future applicability to our operations. This Appendix does not apply to Customer Data that we process as a service provider on behalf of a Customer; requests concerning Customer Data are handled as described in Section 8.2.
In the preceding twelve (12) months, we have collected the categories of personal information described in Section 2, including: identifiers (such as name, email address, phone number, and IP address); professional or employment-related information (such as company name and job title); commercial information (such as subscription and billing records); and internet or other electronic network activity information (such as browsing history, clickstream data, and interactions with our Site and Services). We collect this information from the sources described in Section 2, use it for the purposes described in Section 3, disclose it to the categories of recipients described in Section 4, and retain it as described in Section 5.
We do not sell personal information and have not sold personal information in the preceding twelve (12) months. We do not share personal information for cross-context behavioral advertising without your consent, and we have no actual knowledge of selling or sharing the personal information of consumers under sixteen (16) years of age. We do not collect sensitive personal information for purposes of inferring characteristics.
Subject to applicable exemptions, you may have the right to: (a) know and access the personal information we have collected about you; (b) delete personal information we have collected from you; (c) correct inaccurate personal information; (d) opt out of the sale or sharing of personal information; (e) limit the use of sensitive personal information; and (f) not receive discriminatory treatment for exercising any of these rights.
While we are not obligated at this point to respond to requests under the CCPA, we will consider requests under the CCPA and respond as we deem appropriate in our discretion. To make a request, contact us at privacy@actualyze.ai. We will verify your request as required by the CCPA and respond within forty-five (45) days, which we may extend by an additional forty-five (45) days where reasonably necessary. You may designate an authorized agent to submit a request on your behalf; we may require proof of the agent's authority and verification of your identity. We also honor opt-out preference signals such as the Global Privacy Control, as described in Section 6.2.
Under California Civil Code § 1798.83, California residents may request once per calendar year a list of third parties to whom we have disclosed personal information for direct marketing purposes. We do not disclose personal information to third parties for their direct marketing purposes without your consent.
This Appendix applies to individuals located in the European Economic Area ("EEA"), the United Kingdom ("UK"), or Switzerland whose personal data ActualyzeAI, Inc. processes in its capacity as a data controller — principally visitors to the Site, recipients of our marketing communications, event and webinar registrants, and job applicants.
This Appendix does not apply to Customer Data. Where we process personal data as a processor on behalf of a Customer, requests are handled as described in Section 8.2 and transfer arrangements are addressed in Section 11.
We process your personal data on the following legal bases under the General Data Protection Regulation ("GDPR") and equivalent UK and Swiss law:
Performance of a Contract: Processing necessary to provide the Services you have contracted for, including account creation and billing;
Legitimate Interests: Processing necessary for our legitimate interests, including improving our Services, preventing fraud, maintaining security, and sending business communications — where such interests are not overridden by your rights;
Consent: Where you have given us explicit consent, including for marketing communications and non-essential cookies; and
Legal Obligation: Processing required to comply with applicable legal obligations.
Subject to applicable law, you have the following rights:
Right of access (Article 15 GDPR);
Right to rectification (Article 16 GDPR);
Right to erasure / "right to be forgotten" (Article 17 GDPR);
Right to restriction of processing (Article 18 GDPR);
Right to data portability (Article 20 GDPR);
Right to object to processing (Article 21 GDPR), including for direct marketing; and
Rights related to automated decision-making and profiling (Article 22 GDPR).
To exercise your rights, or if you have any questions about your personal data, contact us at privacy@actualyze.ai. We will respond within one (1) month of receipt. Where your request is complex or where we have received a number of requests, we may extend this period by up to two further months, in which case we will inform you within one month of receipt and explain the reason for the delay. You also have the right to lodge a complaint with the supervisory authority in your jurisdiction of residence. Actualyze does not engage in automated decision-making, including profiling, that produces legal or similarly significant effects concerning you.
Where we process personal data on behalf of a Customer, that processing is governed by our standard Data Processing Addendum, which is incorporated into our Terms of Service and forms part of every Customer's agreement with us. By accepting the Terms of Service, Customer agrees to the Data Processing Addendum; no separate signature is required. The Data Processing Addendum is offered on a standard, non-negotiable basis and is available at https://trust.actualyze.ai or on request from privacy@actualyze.ai.