Privacy Policy

Pontis Inc., doing business as Geopax, is the operator of the service. This policy covers personal information handled by Geopax in connection with geopax.app, app.geopax.app, related services, and communications with us. Personal information means information that identifies a person or can reasonably be linked to a person.

Geopax determines how to use information needed to run its website, manage accounts, communicate with you, and operate its business. When a customer provides personal information through a workspace, Geopax also processes that information to provide the service to that customer under its instructions and applicable agreements. Your employer or other workspace owner may have its own privacy policy and responsibilities.

If your request concerns information controlled by your organization, contact its administrator. You may also contact legal@geopax.app, and we will help route the request as appropriate.

Account and contact information: your name, email address, organization, workspace membership, role, profile details, and information you provide when you contact us or book a demo. Our sign-in provider also processes information needed to authenticate you and protect your account.

Workspace information: records you enter, upload, or import, such as suppliers, contacts, products, purchase orders, invoices, contracts, and other business documents. These records may include names, work contact details, or other personal information. We also process your chats, prompts, attachments, generated responses, saved assessments, and actions within the service.

Connected systems: when an authorized administrator enables an integration, we receive the records permitted by that connection and process the credentials or tokens needed to maintain it. The information depends on the provider, permissions, and records your organization chooses to connect.

Device and usage information: IP addresses, browser and device information, pages visited, timestamps, referring pages, campaign information, interactions, account and organization identifiers, performance data, and diagnostic records. Our analytics and recording tools can also collect page content, text entered into fields, and browser console information as described below.

Business communications: correspondence, meeting details, support requests, and any billing or contract information you provide in dealing with us. Public research and visitor-identification services may also supply business contact or company information associated with your organization or website visit.

We use information to create and manage accounts, authenticate users, apply workspace permissions, import and organize records, answer requests, run analysis, and provide the features your organization uses.

We also use information to respond to questions, arrange demos, administer customer agreements, send service notices, prevent abuse, investigate errors, measure which features people use, and identify where people encounter problems. We may use business contact and website-visit information to understand interest in Geopax and communicate about our services, subject to applicable law and your choices.

To answer a question, extract information from a document, or run an analysis, Geopax sends relevant prompts, file content, business records, and context to AI and infrastructure providers. This can include personal information contained in those materials. Document search also creates numerical representations of document text to help retrieve relevant passages.

Geopax uses Vercel AI Gateway and model providers for AI processing. The provider used can depend on the feature and routing configuration. Provider retention and permitted use depend on the applicable service terms and settings. Contact us for information about the providers and processing arrangements relevant to your use; this policy does not promise that every provider offers zero retention.

Public web research uses Exa and may send relevant company or supplier names, domains, product names, SKUs, and manufacturer part numbers in search queries or page requests. The service is designed to exclude personal contact details, credentials, private prices, internal transaction references, and contract terms from public research requests. These controls cannot guarantee that every sensitive detail will be detected. Do not include unnecessary personal information or secrets in requests.

We record chat prompts, responses, and tool inputs and outputs in diagnostic traces to investigate failures and assess how the service performs. These records can contain information from your conversations, documents, and business records. They may be available to authorized personnel and diagnostic service providers, including Sentry.

Geopax and its providers use cookies, browser storage, scripts, and similar technologies for sign-in, session management, analytics, and website visitor identification. Some are needed to operate the service; others help us understand use and business interest. The current service starts these tools automatically and does not provide an in-product opt-in or cookie-preference control. Reading this policy does not itself provide consent to tracking.

We use PostHog for product analytics and session recordings. A recording can reproduce pages you view, clicks, scrolling, on-screen content, and text you enter. General page text and input fields are not configured to be masked, so recordings may contain personal information or business content visible in the interface. Request headers and bodies are excluded from the replay configuration, but that does not prevent visible page content from appearing in a recording.

We use Sentry for application errors and diagnostics, including error-related session recordings and the AI traces described above. We also use Vercel Web Analytics on both the marketing site and the application. Our marketing site includes a Fuse website visitor-identification script that can receive visit and device information to help identify business interest and support outreach.

You can use browser settings and privacy tools to restrict cookies or scripts and clear stored information. Blocking essential technologies may prevent sign-in or other features from working. These controls may not stop processing that occurs on our servers. Contact legal@geopax.app about analytics, recording, or visitor-identification choices and any rights that apply to you.

Service providers: we use providers for hosting, storage, authentication, AI processing, public research, diagnostics, analytics, meeting scheduling, and business communications. These include Vercel, Supabase, WorkOS, AI model providers, Exa, Sentry, PostHog, Cal.com, and the website visitor-identification service described above. They receive information relevant to their role. For example, booking a demo sends the details you provide to our scheduling service, and running an AI task sends relevant content to the providers that carry out that task.

Your organization and authorized users: workspace owners, administrators, and other members can receive information according to their access rights and your use of shared features. We may share account or support information with your organization when needed to manage its service.

Connected services and your instructions: we share information when you enable a connection, request an action, or otherwise direct us to do so. Third-party services you choose may process information under their own policies.

Legal and business needs: we may disclose information where required by law, to respond to lawful requests, enforce agreements, investigate abuse, or protect rights and safety. Information may also be disclosed to professional advisers or in connection with a merger, financing, acquisition, or transfer of business, subject to applicable safeguards and legal requirements.

We retain information for the purposes described in this policy, taking account of the type of information, whether your account or customer agreement remains active, operational needs, legal requirements, and the need to resolve disputes or protect the service. Account records, workspace files, chats, analytics, diagnostic records, and backups may have different retention periods.

Disconnecting a system does not automatically remove records already imported from it. Closing an account or deleting an item may not immediately remove copies in backups, diagnostics, or provider systems. Some information may remain where required by law or needed for security, disputes, or enforcement of agreements, with use limited to those purposes.

Contact legal@geopax.app to request deletion or ask about retention for a particular category of information. Requests concerning customer-controlled workspace information may require that customer’s instructions. We will explain any applicable limits when handling your request.

We use technical and organizational measures designed to limit unauthorized access, including authentication and workspace access controls. No internet service or storage system can guarantee complete security. Contact us promptly if you believe your account or information is at risk.

Our providers may process information outside the place where you live, including in the United States. Privacy laws and government access rules may differ there. Where applicable law requires safeguards for an international transfer, we use the arrangements required for that transfer. Contact us for details about locations and safeguards relevant to your information.

Depending on where you live and the law that applies, you may have rights to access or receive a copy of your personal information, correct it, delete it, restrict or object to processing, obtain a portable copy, or withdraw consent. Where applicable, you may also have rights to opt out of certain advertising, sale, sharing, or profiling uses. These rights are subject to legal conditions and exceptions.

Send requests to legal@geopax.app. Tell us the request and the account or organization involved, without sending passwords or unnecessary identity documents. We may need to verify your identity and authority before responding. An authorized agent may contact us where the law permits. We will respond within the period required by applicable law and explain any refusal or limit.

You may unsubscribe from marketing messages using the instructions in the message or contact us to stop marketing outreach. We may still send necessary account, security, or service messages. Withdrawing consent does not affect processing that was lawful before withdrawal, and may affect features that need the information.

You may contact us about a privacy concern and, where applicable, complain to your local privacy regulator or appeal a decision as provided by law. We will not unlawfully discriminate against you for exercising your privacy rights.

Geopax is a business service intended for adults aged 18 and over. We do not knowingly collect personal information directly from children. If you believe a child has provided personal information, contact us so we can investigate and take appropriate steps to remove it.

We may update this policy as our service or practices change. We will update the date on this page and provide notice of material changes through the service or another appropriate channel. Where a change requires consent, we will seek it before applying that change.

For privacy questions, requests, or complaints, contact Geopax at legal@geopax.app.