Know how data moves through the vendor file.

DueFiles processes the information required to run vendor insurance compliance: account and organization details, vendor and broker contacts, insurance documents, requirement results, review activity, communications, and service security data.

• Customers control the vendor records, documents, requirements, and decisions in their workspaces.
• DueFiles uses workspace data to provide, secure, support, and maintain the service.
• Document extraction prepares structured evidence; authorized customer users control approvals, rejections, and exceptions.
• DueFiles does not sell personal information or use customer documents for behavioral advertising.
• Privacy requests about DueFiles-controlled information go to privacy@duefiles.com.

The sections that follow define the scope, categories, purposes, disclosures, retention factors, security, rights, and contact paths in detail.

This notice covers the DueFiles website, accounts, vendor submission pages, product communications, support, and sales interactions. It does not cover a customer's own privacy practices or third-party services that operate under separate notices.

DueFiles controls personal information used to run its website, administer accounts, secure the service, and manage direct business relationships. For documents, vendor records, requirements, and other workspace content, the customer determines why the information is processed and DueFiles processes it to provide the service.

The service handles the information needed to operate a vendor compliance workflow:

• Account and organization data: name, work email, organization, role, and workspace settings.
• Vendor and insurance data: vendor contacts, broker contacts, requirements, certificates, endorsements, policy details, and submitted document text.
• Review and activity data: extraction results, confidence indicators, decisions, exceptions, reminders, and event history.
• Sales and contact requests: name, work email, organization, vendor roster range, primary outcome, current workflow, connected systems, and the substance of sales, security, privacy, accessibility, legal, and support correspondence.
• Technical data: session identifiers, request time, browser and device details, IP address, route, and error information.
• Applicant data: information supplied in response to a published role, when DueFiles is hiring.

Information comes directly from account users, vendors, brokers, job candidates, and people who contact DueFiles. Customers also provide vendor records and invite others to submit documents. The service creates technical, extraction, review, and activity data as people use the product.

DueFiles uses information to provide and administer the service, authenticate users, collect documents, extract fields, compare evidence with customer-configured requirements, support human review, deliver reminders, respond to requests, secure and troubleshoot the platform, enforce agreements, and comply with law.

Where a law requires a legal basis, processing rests on performance of a contract, steps requested before a contract, legitimate interests in operating and protecting a business service, compliance with legal obligations, or consent for a specific optional activity. A person has the right to withdraw consent for future processing at any time without changing processing that was already lawful.

DueFiles uses rules and, for provider-backed extraction, an AI service to extract document fields and map them to requirements. Extraction is fallible, so confidence and source evidence remain visible for review. DueFiles does not make solely automated decisions that produce legal or similarly significant effects. The customer's authorized users control approvals, rejections, and exceptions.

Information is disclosed only for defined business and legal purposes:

• to the customer and authorized workspace users that govern the assigned vendor program;
• to infrastructure, hosting, authentication, communications, extraction, monitoring, and support providers that perform services for DueFiles;
• to professional advisers, auditors, insurers, and transaction counterparties under confidentiality duties;
• when required by law or needed to protect rights, safety, service integrity, or users; and
• at a person's direction or with their consent.

Service providers receive the information needed for their function and must process it under binding contractual restrictions.

DueFiles does not sell personal information. DueFiles does not share personal information for cross-context behavioral advertising and does not use customer documents to advertise to vendors, brokers, or account users.

DueFiles uses essential session technology to keep users signed in and protect workspace navigation. DueFiles does not set advertising or behavioral analytics cookies. DueFiles updates this notice and collects legally required consent before using optional tracking.

DueFiles keeps personal information for the account term and as needed to provide the service, maintain security and audit records, resolve disputes, enforce agreements, and meet legal obligations. Record type, customer instructions, workspace configuration, backup cycle, and legal requirements determine the retention period. When retention ends, DueFiles deletes or de-identifies the information.

DueFiles applies transport protection, authenticated workspace boundaries, scoped submission links, server-side input validation, and attributable activity records to the workflows that handle customer information. Security also depends on customers controlling accounts, recipients, requirements, and exported data. Read the security overview and send Enterprise security questions to the security team.

Local law and the person's relationship with DueFiles determine which privacy rights apply. Those rights include access, correction, deletion, restriction, objection, data copies, appeals of denied requests, and complaints to a regulator. DueFiles does not discriminate against a person for exercising a privacy right.

The customer controls workspace data. Vendor contacts and account users direct workspace-data requests to the organization that requested or entered the information. Send requests about information DueFiles controls to privacy@duefiles.com. DueFiles verifies identity and authority before acting on a request and honors authorized agents where law requires it.

DueFiles and its service providers process information in their operating locations. Cross-border transfers use the legal safeguard required for the service and jurisdiction. Enterprise customers obtain deployment-specific contractual data terms through privacy@duefiles.com.

DueFiles is a business service and is not directed to children under 18. The service does not knowingly collect personal information from a child for the child's own use. Send a deletion request to the privacy team if information was submitted contrary to this restriction.

Material changes will appear on this page with a revised effective date. When a change requires additional notice or consent, DueFiles provides it through the service or the assigned contact channel.

Send privacy questions and rights requests to privacy@duefiles.com. Send security reports to security@duefiles.com. Contractual notices must follow the notice method in the signed customer agreement.