We'll be at The AI Conference in San Francisco, Sept 29 – Oct 1 — meet the team and see a live demo at Booth 131.
Last updated: September 15, 2026
Version 1.2
Effective Date: July 29, 2026 | Last Updated: September 15, 2026
ActualyzeAI, Inc. ("Actualyze," "we," "us," or "our") values the privacy of every person who interacts with our products and services. This Privacy Policy ("Policy") explains how we collect, use, disclose, and safeguard information when you visit our website at actualyze.ai or any associated subdomain (collectively, the "Site") and when you use the Actualyze platform and any related services we make available (the "Services").
Actualyze is a platform purpose-built to help organizations govern, secure, operate, and optimize the use of artificial intelligence inference providers. Because Actualyze processes data on behalf of our enterprise customers ("Customers"), this Policy describes both our role as a data controller with respect to our own marketing and operational activities and Service Data, and our role as a data processor when we handle Customer Data on behalf of our Customers.
Actualyze is not responsible for providing notices or obtaining consents for processing Customer Data from any individual to whom that data relates. Our Customers are responsible for providing such notices and obtaining such consent. If we receive a request from an individual regarding their information contained in Customer Data we will direct that request to the Customer for a response.
By accessing or using the Site or Services, you acknowledge that you have read, understood, and agree to be bound by this Policy. If you do not agree with the terms of this Policy, please do not use the Site or Services.
This Policy applies to:
Visitors to the Actualyze Site, including prospective Customers, partners, and job applicants;
Authorized users of the Actualyze platform, including administrators, team leads, engineers, and other personnel granted access by a Customer; and
Customer Data that we process in our capacity as a data processor on behalf of our Customers; and
Service Data that we generate or collect about the operation, performance, security, support, and billing of the Services, which we process in our capacity as a data controller.
This Policy does not apply to the data practices of third-party AI providers (such as OpenAI, Anthropic, or other large language model providers) that Customers integrate through Actualyze. Those providers have their own privacy policies, and Customers are responsible for reviewing and complying with them.
We collect information that you voluntarily provide when you:
Register for an account or a free trial of Actualyze including your name, work email address, company name, job title, and password;
Contact us through our Site's contact or inquiry forms including your name, email address, phone number, and the substance of your message;
Subscribe to marketing communications, newsletters, or product updates;
Participate in surveys, research studies, webinars, or product feedback sessions;
Purchase a subscription to the Services including billing contact information and, where you pay online, payment information, such as credit card information (which is collected and processed by our third-party payment processors);
Apply for a position at Actualyze, including your name, address, email address, phone number, and educational and work history.
When you access the Site or use the Services, we and our service providers may automatically collect certain technical and behavioral information, including:
Device and browser information — browser type and version, operating system, screen resolution, and device identifiers;
Log and usage data — IP address, pages visited, referring URL, time and date of access, clickstream data, and session duration;
Platform usage data — AI request volumes, team and budget utilization rates, feature adoption patterns, virtual model configurations, and overage metrics (collected in de-identified or aggregated form where possible); and
Cookie and tracking data — as further described in Section 6 below.
"Customer Data" means any data, content, or information submitted to the Services by or on behalf of a Customer or its authorized users. Customer Data excludes Service Data (as described in Section 2.4).
When a Customer routes AI requests through Actualyze, we process the content of those requests and responses — including prompts, completions, and any personal data they contain — solely on the Customer's behalf and instructions, transiently, as necessary to provide the Services, for example to apply routing, governance controls, and any data guardrails the Customer has configured. Actualyze is designed not to retain this payload content beyond that transient processing.
The Customer Data we store consists of: (a) User identity information (such as names and email addresses) imported or created by the Customer within the Actualyze workspace; (b) Organizational structure data — team configurations, sub-team hierarchies, business unit assignments, and budget allocations; and (c) any other data that the Customer or its authorized users upload to or store in the Services, including content stored through features the Customer elects to enable or configure.
We process Customer Data solely as instructed by the Customer, in accordance with our Terms of Service (available at https://actualyze.ai/terms/service) and our Data Processing Agreement ("DPA"). Customers are responsible for ensuring that their collection and submission of Customer Data complies with all applicable laws. Customers are advised against submitting sensitive personal information, including government-issued identification numbers, payment card data, or protected health information to the Services unless required to do so for the Customer's own business purposes.
"Service Data" means data that Actualyze generates or collects about the operation, performance, security, support, and billing of the Services, and aggregates and statistics derived from such data, as further described in Actualyze's then-current documentation. Service Data describes how the Services are used and operated; it does not include the content of any request or response, and it excludes Customer Data. Service Data includes, for example, request metadata generated when AI requests pass through Actualyze such as timestamps, model and provider identifiers, token counts, tool invocations, team and budget attribution, guardrail detection events, request outcomes, and cost attribution and spend data surfaced through Actualyze's budget and financial operations functionality.
Actualyze processes Service Data as a data controller, solely to: (a) operate, maintain, secure, support, and bill for the Services; (b) plan and manage capacity; (c) detect, investigate, and prevent abuse, fraud, security incidents, and violations of our Terms of Service; (d) comply with applicable law; and (e) create and use aggregated, anonymized data as described in Section 3.5. We do not sell Service Data or disclose it to third parties, except to subprocessors and service providers acting on our behalf for the purposes described in this Section 2.4, or as required by law. We do not use Service Data to train or develop artificial intelligence or machine learning models except as expressly permitted by the Data Processing Agreement. To the extent Service Data includes personal data, we process it in accordance with this Policy, the Data Processing Agreement, and applicable data protection law.
We use the information we collect for the following purposes:
To create, administer, and maintain customer accounts and workspaces;
To provision, operate, and improve the Actualyze platform, including its governance, cost attribution, and compliance features;
To monitor platform performance, diagnose technical issues, and ensure system reliability;
To develop new features, products, and services based on usage insights; and
To verify usage levels and tier compliance for billing purposes; and
To train, evaluate, and improve the model-selection and routing functionality of the Services using de-identified operational telemetry that constitutes Service Data, as described in our Data Processing Agreement; this does not include the content of requests or responses.
To respond to inquiries, support requests, and other communications;
To send transactional communications, such as account notifications, billing information, and trial expiration reminders; and
To notify Customers of material changes to the Services or this Policy.
To send newsletters, product updates, case studies, and other marketing content to users who have opted in;
To personalize content and outreach based on your organization type, tier, usage patterns, or expressed interests; and
To measure the effectiveness of our marketing campaigns.
You may opt out of marketing communications at any time as described in Section 9 below.
To detect, investigate, and prevent fraudulent, abusive, or unauthorized use of the Services;
To enforce our Terms of Service (https://actualyze.ai/terms/service), Website Terms of Use (https://actualyze.ai/terms/website), and other applicable policies;
To comply with applicable laws, regulations, and legal processes, including responding to lawful requests by governmental authorities; and
To establish, exercise, or defend legal claims.
We may use Customer Data, Service Data, and usage information in de-identified or aggregated form for statistical, security, and operational purposes, to improve our product, to train and improve the model-selection and routing functionality of the Services, and to publish benchmarks, industry reports, and research, in each case as described in and subject to the restrictions of our Data Processing Agreement. Published material will not identify any Customer or individual, or be attributable to any Customer, without prior written consent. We do not use Customer Data or Service Data, in any form, to train generative AI or foundation models, and we do not otherwise use such data to train or develop AI or machine learning models except as expressly permitted by the Data Processing Agreement.
We do not sell your personal information. We may disclose your information in the following circumstances:
We engage trusted third-party vendors and subprocessors to help us operate and improve the Services. These include providers of cloud hosting, data storage, analytics, customer support, payment processing, email delivery, and security services. Such vendors are contractually bound to use your information only for the purposes of providing services to us and to maintain appropriate confidentiality and security standards.
A current list of our subprocessors is available at https://trust.actualyze.ai or on request from privacy@actualyze.ai. We provide Customers at least fourteen (14) days' notice before any new subprocessor begins processing personal data on our behalf, as described in our Data Processing Agreement.
To the extent that a Customer instructs Actualyze to share Customer Data with a third party (for example, through integration with an external SIEM, data warehouse, or analytics tool), we will do so in accordance with that instruction. The Customer remains responsible for ensuring such sharing complies with applicable law.
If Actualyze is involved in a merger, acquisition, asset sale, financing, or similar corporate transaction, your information may be transferred as part of that transaction. We will provide notice before your personal information is subject to a materially different privacy policy.
We may disclose your information when required to do so by law, court order, subpoena, or other legal process, or when we believe in good faith that such disclosure is necessary to: (a) comply with applicable law or legal obligations; (b) protect and defend the rights or property of Actualyze; (c) prevent or investigate possible wrongdoing; or (d) protect the safety of our users or the public.
We may share your information with our affiliates and subsidiaries for purposes consistent with this Policy. Any such entity will be bound by terms at least as protective as those described herein.
We may share aggregate or de-identified information that cannot reasonably be used to identify you with third parties for research, marketing, analytics, or other business purposes.
We retain personal information and Customer Data for as long as necessary to provide the Services and fulfill the purposes described in this Policy, unless a longer retention period is required or permitted by law.
Request metadata and related platform records are retained in accordance with the limits applicable to the Customer's subscription tier; request and response payload content is not retained beyond transient processing, except where the Customer has enabled a feature that stores such content, in which case it is retained in accordance with that feature's configuration and the applicable subscription tier. For other personal information, we determine the appropriate retention period based on the amount, nature, and sensitivity of the information, the purposes for which we process it, and applicable legal, accounting, and reporting requirements.
Following cancellation or expiry of a subscription, Customers may request export of their Customer Data by written notice to legal@actualyze.ai within thirty (30) days (fourteen (14) days where we have terminated the subscription). Following termination, we delete or anonymize Customer Data in accordance with our standard retention and deletion schedules, and in any event within twelve (12) months, unless a legal obligation, legal hold, or the establishment, exercise, or defense of legal claims requires longer retention. Account-level personal information (such as billing records) may be retained as required by applicable law.
We retain Service Data for the same periods that apply to Customer Data under this Section 5: following termination of a Customer's subscription, Service Data relating to that subscription is deleted or anonymized in accordance with our standard retention and deletion schedules, and in any event within twelve (12) months, unless a legal obligation, legal hold, or the establishment, exercise, or defense of legal claims requires longer retention.
We and our service providers use cookies, web beacons, pixel tags, and similar technologies to collect information about your use of our Site and Services.
Strictly Necessary Cookies: Required for the basic operation of the Site and Services, including session management and authentication. These cannot be disabled.
Analytics and Session Replay Cookies: Help us understand how visitors use the Site, including, where enabled, session replay. Whether these run by default or only with your consent depends on your region, as described in Section 6.2. We use this data to improve the Site and Services.
Functional Cookies: Remember your preferences and settings to enhance your experience.
Marketing Cookies: Used to deliver relevant advertising and track campaign performance. We do not enable these cookies without your consent.
We use a third-party product analytics service, hosted in the United States, to understand how visitors use the Site. Our use of that service is governed by a data processing agreement that incorporates the European Commission's Standard Contractual Clauses for transfers of personal data from the European Economic Area, the United Kingdom, and Switzerland. A current list of our analytics providers is available at https://trust.actualyze.ai.
Region-dependent defaults: What happens before you make a consent choice depends on your region, which we determine from your approximate location (country and, within the United States, state) each time you visit. In regions where the law requires opt-in consent, and wherever we have not enabled default measurement (including whenever your country cannot be determined), the conservative default applies: site measurement runs in an anonymous, cookieless mode until you accept. In that mode, analytics state is held only in the browser's memory for the duration of the visit, no analytics cookies are set, nothing is written to your device, and visits are not linked across sessions.
In regions where we have enabled default measurement (currently the United States, Australia, Japan, New Zealand, Singapore, and Mexico), analytics measurement with cookies may run by default, as disclosed in this policy, and you can turn it off at any time through the "Cookie preferences" link in the Site footer. In that mode, session replay (described below) is also enabled by default, except in California and Pennsylvania: in those two states, and in every opt-in region, session replay never runs unless you explicitly accept it through the consent banner. (Within the United States, if we can determine your country but not your state, session replay stays off; the default cookie-based measurement still applies.)
If you accept cookies (or the default measurement applies): Our analytics service stores an identifier on your device so that repeat visits can be recognized, and where permitted as described above we enable session replay, which records an anonymized reconstruction of your interactions with the Site (pages, scrolling, and clicks). Text you type into form fields is masked in replays and is not captured. One analytics cookie is set in this state; it stores a pseudonymous visitor identifier and session state so visits can be measured across sessions, and lasts one (1) year.
Aggregate web measurement: Where analytics runs (by acceptance or by default), we also load a web analytics service for aggregate site measurement, which sets its own cookies. Advertising signals and ad-personalization are disabled in our configuration, and we do not use that service's advertising features.
If you choose "Essential Only": Behavioral analytics is turned off: no analytics events are collected, no analytics cookies are set, and session replay never runs. Anonymous, cookie-free usage measurement (described below) continues, as it involves no cookies, no identifiers, and no cross-visit tracking. Your explicit choice always overrides any regional default.
Consent and preference storage: To operate the consent mechanics themselves, we store small functional records in your browser's local storage: your consent choice, the most recent region classification (which expires after seven days and is revalidated at the start of each visit before any regional default is applied), and a marker that the consent banner has already been shown to you. These records hold a choice or a display state, not anything about you as a person, and are not used for tracking.
Anonymous usage measurement: Independently of your consent choice, our hosting provider collects anonymous usage measurements for the Site: page views and interaction events such as button clicks, scroll depth, and form submissions. These measurements record that an interaction happened, not who performed it. They set no cookies, store nothing on your device, are not linked to your identity, and do not track individual visitors across visits.
Identification when you submit a form: When you submit a contact, demo, newsletter, or similar form on the Site, we associate your current visit with the contact details you submit, using a hashed version of your email address as the analytics identifier. Your raw email address is never used as the identifier. This lets us understand which content led to an inquiry. A notice to this effect appears next to each such form. This association does not occur if you have chosen "Essential Only" or your browser sends a Global Privacy Control signal.
If you visit the Site from a region where the law requires opt-in consent (or where we have not enabled default measurement), you will see our cookie consent banner, which allows you to accept or decline non-essential cookies before any are set. In the regions described in Section 6.2 where default measurement applies, no consent prompt normally appears; measurement is disclosed in this policy, and the "Cookie preferences" link in the Site footer is how you make a choice. Either way, you may update your choices at any time through that footer link, which opens the consent banner. Declining or opting out after analytics has run stops analytics collection and session replay, deletes the analytics identifier from your device, and disables all behavioral analytics services; any analytics cookies already set are no longer used and expire on their own. You may also disable or delete cookies through your browser settings. Most browsers provide instructions in their Help menus. Note that disabling certain cookies may impair the functionality of the Site or Services. We honor browser-level Do Not Track ("DNT") signals to the extent technically feasible; however, because there is no uniform standard for DNT, our response may vary across browsers. Where required by applicable law, we also treat valid opt-out preference signals, such as the Global Privacy Control ("GPC"), as a request to opt out of the sale or sharing of personal information; note that we do not sell personal information or share it for cross-context behavioral advertising without your consent.
We implement and maintain commercially reasonable administrative, technical, and physical safeguards designed to protect the information we hold from unauthorized access, disclosure, alteration, or destruction. Our security program includes:
Encryption of data in transit using TLS and at rest using industry-standard encryption;
Access controls and role-based permissions, including SSO, SAML and RBAC features;
Data guardrails including masking capabilities and request blocking, built into the Actualyze platform for Customers to configure;
Audit trails of administrative and platform activity; and
Controls aligned with the SOC 2 Type II and ISO/IEC 27001 frameworks.
Despite these measures, no method of transmission over the internet or method of electronic storage is 100% secure. We cannot guarantee absolute security of your information. You are responsible for maintaining the confidentiality of your account credentials. Please notify us immediately at security@actualyze.ai if you suspect any unauthorized access to your account. If we become aware of a security incident that compromises personal information, we will notify affected Customers and, where required by applicable law, affected individuals and regulators without undue delay, consistent with our legal and contractual obligations, and will take reasonable steps to mitigate the effects of the incident.
Depending on your jurisdiction, you may have the following rights with respect to your personal information:
Access — the right to request a copy of the personal information we hold about you;
Correction — the right to request correction of inaccurate or incomplete information;
Deletion — the right to request deletion of your personal information, subject to our legal and contractual obligations;
Portability — the right to receive your personal information in a structured, commonly used, machine-readable format;
Objection / Restriction — the right to object to or request restriction of certain processing activities; and
Appeal — the right to appeal any decision we may make in response to a request.
If you are a California resident, Appendix A describes rights that are applicable to you. If you are located in the European Economic Area, the United Kingdom, or Switzerland, Appendix B (EEA, UK, and Swiss Data Subject Rights) describes the rights that apply to you.
We do not sell personal data, and we do not process personal data for targeted advertising without your consent.
To exercise these rights, except as noted in Section 8.2 below, please contact us at privacy@actualyze.ai. We will respond to the extent and within the timeframe required by applicable law. We may request that you provide us information sufficient to verify your identity before responding to a request.
For requests relating to Customer Data processed on behalf of a Customer, we will direct the request to the relevant Customer and will comply with the Customer's lawful instructions. Individuals whose data is processed through Actualyze on behalf of a Customer should contact that Customer directly in the first instance.
If you no longer wish to receive marketing communications from us, you may opt out at any time by: (a) clicking the "unsubscribe" link in any marketing email; (b) adjusting your communication preferences within your Actualyze account settings; or (c) contacting us at privacy@actualyze.ai. Please allow up to ten (10) business days for your opt-out to take effect. Note that even after opting out of marketing communications, you will continue to receive transactional and account-related messages.
Our Site and Services may contain links to third-party websites and integrate with external AI providers, cloud services, and other platforms chosen by the Customer ("Third-Party Services"). This Policy does not govern the data practices of any Third-Party Service. We are not responsible for the privacy practices or content of Third-Party Services. We encourage you to review the privacy policies of any Third-Party Service before providing information to or through them.
Actualyze is based in the United States, and the Site and Services are operated from the United States. Information we collect is stored and processed in the United States, and certain of our subprocessors store data in the United Kingdom. By using the Site or Services, you acknowledge that your information will be transferred to and processed in the United States and the United Kingdom, which may have data protection rules that differ from those of your jurisdiction.
Where we process personal data on behalf of a Customer and that processing involves a transfer of personal data from the European Economic Area, the United Kingdom, or Switzerland, the transfer is governed by our Data Processing Agreement, which incorporates the European Commission's Standard Contractual Clauses (Module Two, Controller-to-Processor), the UK International Data Transfer Addendum, and equivalent arrangements for Switzerland. The Data Processing Agreement is available at https://trust.actualyze.ai or on request from privacy@actualyze.ai.
Where we act as a controller in respect of individuals in the EEA, the United Kingdom, or Switzerland — principally visitors to the Site, recipients of our communications, event and webinar registrants, and job applicants — Appendix B describes the rights that may apply.
The Services are not directed at, or intended for use by, children under the age of 18. We do not knowingly collect personal information from children under 18. If we become aware that we have inadvertently collected personal information from a child under 18, we will take prompt steps to delete that information. If you believe we have collected information from a child, please contact us at privacy@actualyze.ai.
We may update this Policy from time to time as our Services evolve, as applicable laws change, or for other operational or legal reasons. When we make material changes, we will: (a) update the "Last Updated" date at the top of this Policy; (b) post a notice on our Site; and (c) if you have an active account, send notice to the email address associated with your account at least thirty (30) days before the change takes effect. Your continued use of the Services following the effective date of the updated Policy constitutes your acceptance of the changes.
If you have questions or concerns about this Policy or our privacy practices, or if you wish to exercise any of your privacy rights, please contact us:
ActualyzeAI, Inc.
Attn: Privacy Officer
45 S. Arroyo Parkway, Suite C25
Pasadena, CA 91105
Email: privacy@actualyze.ai
Website: https://actualyze.ai/privacy
This Appendix supplements the Policy and applies to California residents. It is provided in accordance with the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act (the "CCPA"), and applies to the extent the CCPA applies to our processing of your personal information. Actualyze does not currently meet the thresholds that would qualify it as a "business" subject to the CCPA, including the annual gross revenue, consumer-volume, and personal-information sale or sharing thresholds set out in the CCPA, and this Appendix is therefore provided voluntarily and in anticipation of the CCPA's potential future applicability to our operations. This Appendix does not apply to Customer Data that we process as a service provider on behalf of a Customer; requests concerning Customer Data are handled as described in Section 8.2.
In the preceding twelve (12) months, we have collected the categories of personal information described in Section 2, including: identifiers (such as name, email address, phone number, and IP address); professional or employment-related information (such as company name and job title); commercial information (such as subscription and billing records); and internet or other electronic network activity information (such as browsing history, clickstream data, and interactions with our Site and Services). We collect this information from the sources described in Section 2, use it for the purposes described in Section 3, disclose it to the categories of recipients described in Section 4, and retain it as described in Section 5.
We do not sell personal information and have not sold personal information in the preceding twelve (12) months. We do not share personal information for cross-context behavioral advertising without your consent, and we have no actual knowledge of selling or sharing the personal information of consumers under sixteen (16) years of age. We do not collect sensitive personal information for purposes of inferring characteristics.
Subject to applicable exemptions, you may have the right to: (a) know and access the personal information we have collected about you; (b) delete personal information we have collected from you; (c) correct inaccurate personal information; (d) opt out of the sale or sharing of personal information; (e) limit the use of sensitive personal information; and (f) not receive discriminatory treatment for exercising any of these rights.
While we are not obligated at this point to respond to requests under the CCPA, we will consider requests under the CCPA and respond as we deem appropriate in our discretion. To make a request, contact us at privacy@actualyze.ai. We will verify your request as required by the CCPA and respond within forty-five (45) days, which we may extend by an additional forty-five (45) days where reasonably necessary. You may designate an authorized agent to submit a request on your behalf; we may require proof of the agent's authority and verification of your identity. We also honor opt-out preference signals such as the Global Privacy Control, as described in Section 6.3.
Under California Civil Code § 1798.83, California residents may request once per calendar year a list of third parties to whom we have disclosed personal information for direct marketing purposes. We do not disclose personal information to third parties for their direct marketing purposes without your consent.
This Appendix applies to individuals located in the European Economic Area ("EEA"), the United Kingdom ("UK"), or Switzerland whose personal data ActualyzeAI, Inc. processes in its capacity as a data controller — principally visitors to the Site, recipients of our marketing communications, event and webinar registrants, and job applicants — as well as individuals whose personal data is included in Service Data that we process as a controller (see Section 2.4).
This Appendix does not apply to Customer Data. Where we process personal data as a processor on behalf of a Customer, requests are handled as described in Section 8.2 and transfer arrangements are addressed in Section 11.
We process your personal data on the following legal bases under the General Data Protection Regulation ("GDPR") and equivalent UK and Swiss law:
Performance of a Contract: Processing necessary to provide the Services you have contracted for, including account creation, billing, and customer support, and processing Service Data as necessary to bill for and support the Services;
Legitimate Interests: Processing necessary for our legitimate interests, including improving our Services, preventing fraud and abuse, maintaining security, capacity planning, processing Service Data for these purposes, and sending business communications — where such interests are not overridden by your rights;
Consent: Where you have given us explicit consent, including for marketing communications and non-essential cookies; and
Legal Obligation: Processing required to comply with applicable legal obligations.
Subject to applicable law, you have the following rights:
Right of access (Article 15 GDPR);
Right to rectification (Article 16 GDPR);
Right to erasure / "right to be forgotten" (Article 17 GDPR);
Right to restriction of processing (Article 18 GDPR);
Right to data portability (Article 20 GDPR);
Right to object to processing (Article 21 GDPR), including for direct marketing; and
Rights related to automated decision-making and profiling (Article 22 GDPR).
To exercise your rights, or if you have any questions about your personal data, contact us at privacy@actualyze.ai. We will respond within one (1) month of receipt. Where your request is complex or where we have received a number of requests, we may extend this period by up to two further months, in which case we will inform you within one month of receipt and explain the reason for the delay. You also have the right to lodge a complaint with the supervisory authority in your jurisdiction of residence. Actualyze does not engage in automated decision-making, including profiling, that produces legal or similarly significant effects concerning you.
Where we process personal data on behalf of a Customer, that processing is governed by our standard Data Processing Agreement, which is incorporated into our Terms of Service by reference and applies where the Customer submits personal data to the Services. By accepting the Terms of Service, Customer agrees to the Data Processing Agreement; no separate signature is required. The Data Processing Agreement is available at https://trust.actualyze.ai or on request from privacy@actualyze.ai.