Privacy Policy
Originally effective July 5, 2026; this version effective November 2, 2026.
Last Updated: November 2, 2026
PreShiftIQ™ ("PreShiftIQ," "we," "us," or "our") respects your privacy. PreShiftIQ, Inc., a Delaware corporation, operates the Site, the Platform and the assistant-tool server, and is responsible for the personal information this policy describes. This Privacy Policy describes the personal information we collect through our website at preshiftiq.com and www.preshiftiq.com (the "Site"); through our application at app.preshiftiq.com, the application interface that serves it at api.preshiftiq.com, our assistant-tool server at mcp.preshiftiq.com, any partner-branded web address through which we serve the application, and the provider-assigned addresses at which those services also answer (together, the "Platform"); through the sign-in pages at accounts.preshiftiq.com, which our authentication provider operates for us; and through our advisory engagements. It also describes how we use that information, with whom we share it, and the rights available to you. If you do not agree with this Privacy Policy, please do not use the Site or Platform or submit information to us.
In this policy, a buyer is the client: the company evaluating technology.
1. Who We Are
PreShiftIQ™ is an independent buyer-side intelligence platform for supply chain technology. Buyers across the supply chain ecosystem (shippers, brokers, carriers, and 3PLs) use the Platform to complete structured assessments and receive matches against interview-validated vendor scorecards. Technology vendors participate in scorecard interviews and receive matched buyer leads. We also provide advisory services, including vendor evaluations and buyer assessments, as engagements alongside the Platform.
Our matching is fiduciary to the buyer: vendors pay for outcomes, never for placement, ranking, or influence over scores.
Contact: info@preshiftiq.com. Web: preshiftiq.com.
2. Information We Collect
2.1 Platform Account Information. When you create an account, we collect your name, business email, company, role, and authentication credentials, which are managed by our authentication provider. Vendors accessing leads by secure email link provide their email address for verification. If you are a buyer, we also store your time zone, which your browser reports when you first use the Platform and which you can change on your Account page. We use it only to compute business-day deadlines for vendors' follow-through on your matches (Section 5), including which country's public holidays apply, and to show those deadlines labeled with your time zone, to you and to a vendor that has accepted your match.
2.2 Buyer Assessment Information. Buyers completing a Platform assessment provide business information about their organization and requirements: company profile, operational details, technology stack, budget ranges, timelines, priorities, and stated non-negotiable requirements. This information exists to produce your match and, as described in Section 5, to be shared with a vendor who accepts your match. Facts about your company that do not change from one assessment to the next, such as its revenue band, where it operates, the size of its fleet and the systems it runs, make up your company profile: we ask for each once, on your company profile page or inside an assessment, keep the profile with your account, and every assessment you start takes those answers from it, except where an assessment's own question cannot hold an answer exactly, in which case that assessment asks it. When you change the profile, the assessments you have not yet submitted are updated to match; an assessment you have already submitted keeps the answers it was submitted with, and shows you that the profile has changed since. If your company has divisions, portfolio companies or facilities that operate differently, you may add them to the profile as units: a unit uses the company's answer unless you give it its own, and you may start an assessment for a single unit. Answers may also come from a conversation with an AI assistant, where you chose to keep them (Section 5B).
2.3 Vendor Scorecard Information. Vendors participating in an evaluation provide company, product, and capability information through structured questionnaires and validation interviews. Scorecard information exists to be measured against buyer requirements and, as described in Section 5, to be shared in scoped form with a matched buyer. Scorecard information is also used, only in aggregate, to produce the data described in Section 5A.
If a vendor claims that a match is excluded from our fee because of a prior relationship with the buyer (as our vendor terms allow), the vendor gives us, through the Platform, the kind of relationship and, for each supporting document, its kind, date, reference or identifier, and description, and the file's name, size, and a SHA-256 fingerprint computed in the vendor's own browser. The document itself is never uploaded to the Platform, and the Platform holds none of its contents. When we rule on the claim, the vendor sends us the documents by email to info@preshiftiq.com; we check each against its fingerprint, keep them for one year from our ruling, and then delete them. The fingerprints stay on the claim record permanently, so a later copy of a document can be checked against them. The claim and our ruling are kept with the match's history and are seen by PreShiftIQ staff and the vendor, not by the buyer.
2.4 Transaction Information. Accepting a match costs a vendor nothing, and we collect no payment information at that step. When the matched buyer pays the vendor, the vendor owes our published success fee, which we invoice and which is settled outside the Platform; for that invoice we collect the vendor's billing contact and keep the payment records needed to reconcile it. We do not store full payment card numbers on our systems.
2.5 Advisory Engagement Information. Information you provide during advisory engagements, including organizational details, contractual context, and responses to assessment workbooks.
2.6 Contact, Subscription, and Correspondence Information. Contact form submissions, email correspondence, event registrations, and resource downloads, including the information needed to respond or fulfill the request.
2.7 Information Collected Automatically. Technical and device data (IP address, browser, operating system, device type), usage data (pages viewed, session duration, referring URLs, approximate location derived from IP address), cookies as described in our Cookie Policy, and server, security, and error logs maintained to operate, secure, and improve the Site and Platform. The providers that host the Platform keep request logs that record, for each request, the IP address it came from, the browser or software user-agent string it sent, the address requested, the response status, and timing. In the records our own systems keep for security, abuse prevention, and account sign-up, an IP address or user-agent string is stored only as a keyed hash: a code computed with a secret key that only we hold, which lets us recognize repeat activity without keeping the address or string in readable form. Because we hold the key, these hashes are pseudonymous personal data. There are two exceptions. When a vendor accepts our vendor terms, we keep the browser user-agent string (up to 200 characters) as evidence of the acceptance. Our rate limiting holds a requesting IP address in readable form for the length of its counting window, at most one hour, and then deletes it.
2.8 Information From Third Parties. In vendor evaluations we may collect information about vendors and their offerings from public sources, customer references, regulatory registries (for example, the FMCSA device registry for ELD verification), and the vendors themselves. We may receive contact information from professional networks or referrers.
2.9 Pre-Launch Interest Registrations. Some pages on preshiftiq.com describe product verticals that have not yet launched and offer a form to register your interest. If you submit that form, we collect your name, work email, and the vertical you registered for, and, if you choose to provide them, your company, role, organization size, current system, and evaluation timeframe, together with the page you submitted from and the time of submission. No account is created, and this information is collected before and outside any Platform account. We use it to record pre-launch interest in that vertical, to understand demand for it, and to contact you about that vertical when it launches, on the legitimate-interest basis described in Section 4 (communicating with prospective customers). We retain interest registrations until the vertical launches and a reasonable follow-up period ends, or until you ask us to remove yours, whichever comes first. To request removal, contact info@preshiftiq.com from the registered email address; consistent with how removal works across our systems, the record is deactivated and excluded from all use rather than physically destroyed immediately (a soft delete), and registering again afterward creates a new registration. A request to delete your personal information also removes your contact details from any registration made with your email address, as described in Section 10.1.
2.10 Experience Follow-Ups. After a match between a buyer and a vendor goes live, we ask each of them short follow-up questions about the engagement, about 30, 90 and 365 days after it went live, gathered into at most one email a week, with no reminders. We do not ask about a match that was lost, ended or withdrawn, or on a demonstration account. Every answer is a choice from a list; there is no free text. Each link works once and expires after 30 days, and we keep only a one-way hash of it. Your answers are never shown to the other party, are never used in matching or scoring, and are used only in aggregate, under the same minimum as decline reasons (Section 5). We keep them with the match's record (Section 8).
2.11 Comparing Vendors. A buyer may compare vendors on the Platform, alone or with the team invited to the assessment. For that comparison we collect what the buyer's team enters: the criteria and their weights (from our catalog, or criteria the team writes), each team member's scores from 1 to 5 with an optional evidence note and its source, the scores the team agrees on with their reason, the stages of the buyer's process with their target dates and the dates each vendor reaches them, notes and links (we keep a link's text only and never open it), the quotes the team enters for each vendor (a five-year cost by category, in US dollars), the questions the team sends to vendors and the vendors' answers, and the buyer's decision: the vendor chosen, or that a vendor was not selected, with a reason chosen from a list. A buyer may also name a vendor we do not cover; we keep the name and any website given as a research candidate, and we may invite that vendor to join PreShiftIQ by an email from info@preshiftiq.com that never names the buyer. A buyer may compare vendors after a shorter assessment, bringing their own shortlist, instead of being matched. Each team member's scores stay private until that member submits them; then the members who have submitted see each other's. Scores, notes, links, quotes and reasons are seen only by the buyer's team and PreShiftIQ staff, never by a vendor, and are never used in matching or scoring. We email the team a reminder before each target date, which each member can turn off under Email preferences in their account. A summary of the comparison is built when the buyer downloads it, as a PDF or a spreadsheet; we keep no copy.
3. How We Use Your Information
We use the information we collect to: operate the Platform, including computing matches between buyer assessments and vendor scorecards and running a buyer's comparison of vendors, its reminders and its questions to vendors (Section 2.11); disclose match information between matched parties as described in Section 5; invoice and reconcile success fees; deliver advisory services and related deliverables; respond to inquiries and communicate with you, including service communications and, where permitted, marketing you can opt out of at any time; maintain, secure, and improve the Site, the Platform, and our internal systems, including error monitoring; create aggregated and de-identified data as described in Section 5A; comply with legal, regulatory, accounting, and contractual obligations; and protect our rights, our customers' rights, and the integrity of our services, including maintaining audit records of data disclosures and preventing fraud or misuse. To limit abuse, we count requests by the IP address they come from (Section 2.7); when we refuse a request for going over a limit, our record of it holds a keyed hash of the address, never the address itself.
4. Legal Bases for Processing
Where the EU General Data Protection Regulation, the UK GDPR, or similar law applies, we process personal information on these bases: performance of a contract (delivering the Platform and services you or your organization engaged); legitimate interests (operating and securing the Platform, communicating with prospective customers, developing our services in ways that do not override your rights); consent (non-essential cookies, marketing, keeping answers you gave in a conversation with an AI assistant (Section 5B), and other activities where consent is required); and legal obligation. Invoicing and reconciling a success fee is performance of the vendor's contract with us. The records of our assistant-tool server (Section 5B) rest on our legitimate interests in operating and securing it, and a signed-in tool call is also performance of a contract: it is you using your own account.
5. Platform Data Sharing Between Buyers and Vendors
The Platform's purpose is to connect matched buyers and vendors, and that requires a defined, limited exchange of information between them. This section describes exactly what is shared and when.
Before a vendor accepts a match, buyers appear to vendors anonymously: vendors see the match profile (persona, operational scale, requirements summary) without the buyer's identity or contact details.
When a vendor accepts a match, both sides receive the information relevant to that specific match and nothing more; no fee is charged for accepting. The buyer receives the vendor's identity, contact details, and scorecard as it was measured for their unique use case: their persona, their evaluated criteria, their stated priorities. The vendor receives the buyer's identity, contact details, and completed questionnaire and company profile for that match, including stated non-negotiable requirements. Information outside the match is never shared: no other personas, no other buyers, no other vendors, no scoring mechanics. What was measured for you is what is shared with you.
A vendor that declines a match must give a reason, chosen from a list we maintain, with a written explanation if it chooses "Other." The reason is kept in the match's history. It is seen by PreShiftIQ staff and by the vendor itself: it is never shown to the buyer, and it is never used in matching, scoring, or deciding what is disclosed. We report on decline reasons only in aggregate, and no figure is reported for a group of fewer than five vendors or fewer than five buyers. This minimum applies to every figure we report or publish; PreShiftIQ staff can see each vendor's own figures, as they can see the records themselves.
After a vendor accepts a match, the vendor is expected to make first contact with the buyer by the deadline shown on the match, counted in business days in the buyer's time zone, excluding weekends and the national public holidays of the buyer's country where we hold that country's calendar (today the United States, Canada, and Mexico; otherwise the United States calendar, and a stated default time zone where none is set, each shown with the deadline). The vendor records its first contact on the Platform, and the buyer can confirm it or, once the vendor has been reminded, report that no contact was made. We remind the vendor before the deadline. If the deadline passes with no contact recorded, or the buyer reports no contact and none was recorded, the acceptance is recorded as not pursued, PreShiftIQ staff are alerted, and the buyer may be offered their next match. If the vendor recorded contact and the buyer reports none, the acceptance is recorded as disputed, and PreShiftIQ staff decide it and record their reason. The buyer sees the status and deadline of each vendor that accepted their match, and the vendor sees its own. Any note the vendor adds and any reason staff record are seen only by PreShiftIQ staff. If an advisor invited you (Section 5C), the advisor's administrators can see these statuses, but not the notes or reasons. None of this is used in matching or scoring, and we report on it only in aggregate, under the same minimum as decline reasons.
After accepting a match, a vendor may state on the Platform that the engagement reached a contract or went live, with the date and, for a contract, its first-year value or that the value is unknown. The buyer is notified and can confirm or dispute the stage and date, and never sees the contract value. If the buyer disputes it, PreShiftIQ staff decide and record a reason. The vendor sees only whether the buyer confirmed or disputed it. These statements are not used in matching, scoring, or our aggregated data, and do not by themselves change our record of the match's outcome.
A buyer comparing vendors (Section 2.11) may add a vendor we cover. We check that vendor against the buyer's stated requirements and tell the buyer which of them it falls short of, if any, never a score; with the buyer's acknowledgment where it falls short, the vendor receives the buyer's request as a match, under this section's rules. A vendor that has accepted a buyer's match or request may receive the buyer team's questions and answer them on the Platform; each vendor sees only its own questions and answers. When the buyer records a decision, PreShiftIQ confirms the contract with the buyer, and a vendor that was not chosen sees only that it was not selected, never the reason.
Every disclosure is recorded in an audit log. Vendors never pay for placement, ranking, or score influence, and disclosure occurs only through the acceptance mechanism described here, never by sale of personal information.
5A. Aggregated and De-Identified Data
We create aggregated and de-identified data from Platform activity, including assessment responses, scorecard data, match outcomes, vendors' answers to buyers' questions and when they answered, and buyers' comparisons of vendors, from our own catalog's criteria and stages only: the weights, scores, stages reached, decisions with their listed reasons, and quotes, never a criterion, stage, note, link, question, answer or reason a buyer writes. This includes information about technology vendors and their products that we gather in vendor evaluations, from public sources, interviews, customer references and the vendors themselves (Sections 2.3 and 2.8), whether or not the vendor has accepted our vendor terms. We use that information in aggregated data only under the same protections: no aggregate identifies a vendor or reveals its responses, every figure is subject to the minimum group size we apply, and no vendor's responses are compared with another vendor's. This data is stripped of identifying information and combined across participants so that it does not identify, and cannot reasonably be used to identify, any individual, buyer organization, or vendor's confidential responses. We use this data to operate and improve the matching engine, to produce market intelligence, and we may license or sell it to vendors, partners, and other third parties, including as market intelligence and data syndication services, which describe buyer demand and the vendor market in aggregate and never compare one vendor's confidential responses with another's. Answers kept from a conversation with an AI assistant are included only while you keep them (Section 5B). We commit to maintaining this data in de-identified form and do not attempt to re-identify it. Aggregated and de-identified data is not personal information, and nothing in this section permits the sale of personal information, which we do not sell.
5B. Assistant Tool Access (MCP Server)
PreShiftIQ operates a Model Context Protocol (MCP) server at mcp.preshiftiq.com that lets AI assistants query the Platform on a user's behalf. Public tools, which work without signing in, return only information already published on preshiftiq.com: the platform description, the covered technology categories with live vendor counts, the per-category vendor roster, how matching works, how we are paid, a search of our published documents and the text of one of them, a link to start an assessment, and answering some of the assessment's questions in the conversation (described below). Apart from those questions and their answer choices, public tool results contain only information already published on preshiftiq.com, which may include a business name.
Which assistants can use signed-in tools. Public tools answer any assistant that follows the protocol. Signed-in tools answer only assistant products we have reviewed and admitted: Claude, Claude Code and ChatGPT, which any account holder can connect to their own account. An organization that runs Gemini Enterprise or Microsoft Copilot Studio for its own people can ask us to set up a connection for it (described below), and signed-in tools answer that product for that organization only once its connection is set up. A signed-in request from any other assistant product, or from an organization's assistant platform without a connection, is refused.
Signed-in tools let a buyer or vendor with a PreShiftIQ account read their own account information through their assistant. A buyer can see the status of their latest assessment and their notified matches, including a vendor's contact details once that vendor has accepted the match. A vendor can see their scorecard status and lead counts and, for a lead they have accepted, the buyer contact details already released to them as described in Section 5; this means a vendor's assistant can read the contact details of a buyer whose match that vendor accepted. To connect, you sign in on the sign-in pages at accounts.preshiftiq.com, which our authentication provider operates; your assistant then presents an access token with each signed-in request. We check that token on every protocol request that carries it. We never store the token itself: when we first accept it, we keep a session record holding only a one-way hash of it (described below), and signed-in tools read your records through that session record. What a signed-in tool returns is delivered to your assistant, at your direction, and from then on it is held by your assistant's provider under that provider's terms. Accounts in a PreShiftIQ demonstration environment receive no answers from signed-in tools through any assistant.
What ChatGPT receives when you connect it. When you connect PreShiftIQ to ChatGPT and sign in, and the sign-in screen lists your email address, our sign-in service gives OpenAI your PreShiftIQ account email address, an identifier for your account, and when you signed in. This happens only if you choose to connect and agree on that screen. A ChatGPT connection whose sign-in screen does not list your email address receives none of these. Other assistants do not receive your email address.
Answering assessment questions in a conversation. A buyer, signed in or not, can answer some of an assessment's questions in a conversation with an assistant; vendor and advisor accounts cannot. While you do, we keep nothing about you: the answers travel in a sealed, encrypted token your assistant holds, which stops working after 15 minutes without use or 24 hours after it was first issued, and the only record we write is a daily count of how often each question was asked and answered, which holds no person, conversation, or address. When you follow the assessment link, a token carries the answers to app.preshiftiq.com; it works once and for 15 minutes, and we record only a random identifier of the conversation and when the token was used. Your answers are kept on the Platform only if you sign in and choose "Keep these answers and use them in my assessment." on our page. We then record that choice, the exact set of answers you were shown, and the version of this policy in force, and fill those answers into the questions of your open assessment that you have not answered yourself. If the conversation was signed in, only that account can keep its answers. PreShiftIQ staff acting in your account cannot make this choice for you, and a demonstration account cannot keep answers. If you decline, nothing is kept. You can later withdraw the choice from your Account page: the answers then leave our aggregated data from that time on; the record of what you kept is not deleted, but its content and your identity are sealed, encrypted, under the same rules as a deletion request (Section 8), destroyed after seven years unless a legal hold applies, and masked in our everyday records. Answers already filled into your assessment stay there as your answers, which you can change or clear like any other.
Advisors. If you were invited to PreShiftIQ by a consulting firm or private equity firm acting for you (your "Advisor"), and you have accepted the advisor disclosure shown to you before your assessment, a person at that firm who holds a PreShiftIQ account can use a signed-in tool to see, through their own assistant, the assessments of the buyers the firm represents: each assessment's technology category, status, submission time and completion, its matches as you see them, including a vendor's contact details once that vendor has accepted, and how many matches await release. The tool does not show your name. A buyer who has not accepted the disclosure is not shown. Each such call records which buyers it showed and which it withheld.
Organization connections. For Gemini Enterprise and Microsoft Copilot Studio, we set up one connection for each customer organization with our authentication provider, and the organization's administrator enters its details into the organization's assistant. Each connection has its own identifier and a secret. We deliver the secret once, encrypted, to the organization's administrator, and our records of the connection never contain it. Each person in the organization still signs in with their own PreShiftIQ account, and a signed-in tool returns only that person's own records, exactly as it would through any other assistant. A connection may request buyer tools, and for a vendor organization vendor tools; advisor tools are never available through an organization connection. For each step we take on a connection (setting it up, adding a callback address, replacing its secret, and removing it), we record the organization's name, the assistant product, the identifiers our authentication provider assigned to the connection, the permissions it may request, its callback addresses, any note we add, and the PreShiftIQ staff member who acted; we record the step before we make it and its result after. What the organization's assistant platform does with tool results is governed by the organization's own agreement with that platform's provider, not by us.
For every request that reaches our service at mcp.preshiftiq.com, whatever address or method it uses, we record a request event: a timestamp, the HTTP method, a label naming which of the server's known addresses was requested (such as the protocol endpoint, the health check, or one of its published discovery documents), the response status, whether the request was cut short, its duration, the calling software's product family (such as claude or chatgpt), any error code, and keyed hashes of the requesting IP address and of the calling software's user-agent string, computed as described in Section 2.7. For a request to an address the server does not publish, we record a keyed hash of the requested path and its length instead of the path itself. We never record a request's query string or body. For a protocol request (an HTTP POST to the server's /mcp address), the event also records: the protocol method and any tool or resource it named; the name and protocol version the calling software declares for itself where it provides them (for example, claude-ai); the protocol version it sent in its request header; whether it carried the two standard protocol headers that name its method and its target (whether each was present, never its value); and, for a request that fails, the response formats it declared. When a request presents an access token, or asks for a signed-in tool without one, the event also records the outcome of our check (accepted; refused, with a code naming the reason, such as an expired token or an application we have not admitted; sign-in required; or insufficient permission for the tool), and, when a token is refused because it was issued to an application we have not admitted, that application's public identifier, never the identity of the person. When a request presents an access token, we also record a keyed hash of the identifier of the assistant application that presented it, and when a token is refused, the address it was issued for. Each request event also records whether our rate-limit service answered and the kind of site the request came from. Each response carries the identifier of its request event, so our own automated checks can find the events their test requests produced.
If our database refuses to store a request event, for example because a value in it is malformed, we keep that event exactly as it was written, together with the database's error code and the rule it broke, in a separate record used to find and fix the fault. It holds the same information as a request event and nothing more.
Request events are written in batches. If requests arrive faster than a batch can be written, the excess requests are not recorded individually; instead, for each short interval, we record how many requests went unrecorded, grouped by the label of the address requested and by the server instance that received them. These counts contain no IP address, user-agent string, or path.
For each tool call we also record a tool-call event: the tool name, a timestamp, the calling assistant's product family, the self-declared software name and protocol version where provided, a keyed hash of the calling software's user-agent string, a keyed hash of the call's arguments, kept to group identical calls (except the tool that records an answer in a conversation, whose arguments are neither recorded nor hashed and whose events record no result count), a reference linking it to its request event, a fingerprint of the published tool definitions in force, the result count, status, and latency. We do not record the raw arguments of any tool call. Public tool calls are not associated with any account. A signed-in tool call is recorded against the PreShiftIQ account the access token belongs to, including a call we refused because the account belongs to a demonstration environment.
Session records. The first time we accept an access token for a signed-in tool, our own sign-in verification service checks the token again, in the same way as the assistant-tool server, and creates a session record: the PreShiftIQ account the token belongs to, the identifier of the assistant application that presented it, the permissions it grants, when the record expires, and a one-way hash of the token, used only to recognize the same token when it is presented again. The token itself is never stored. A session record expires when its token does, and never more than one hour after it is created; after that, no signed-in tool reads anything through it. If the token belongs to no PreShiftIQ account, or grants none of our permissions, no session record is created and signed-in tools return no account information. The assistant-tool server cannot read the Platform's tables directly: it reads them only through a fixed set of database functions and views, and for a signed-in tool each function returns only what the account named in the session record may see as described in this Section and Section 5.
To protect the server, we keep a block list of hashed IP addresses we have refused to serve, with the reason and a history of every change to it. Rate limiting counts requests per IP address, or for signed-in requests per keyed hash of the account's sign-in identifier, and deletes each count within minutes after its counting window ends. Requests to addresses other than the protocol endpoint are also checked against the block list and are rate limited by each server instance, using a count per requesting IP address that is held only in that instance's memory for the length of its counting window; a request over the limit is refused. The one exception is the server's health-check address, /health, which answers any caller and is neither checked against the block list nor rate limited; its requests are recorded like any other. The request logs our hosting provider keeps for the server record each request's IP address and user-agent string, as described in Section 2.7.
Request events, the records of refused request events, tool-call events, session records, and the block-list history are kept for 13 months; after that, the keyed hashes in them (of the IP address, the user-agent string, and the requested path) and the hash of the token in each session record are removed, and the rest of each record is kept for aggregate measurement. A hashed address stays on the block list itself for as long as the block is in force. Overflow counts, the records of organization connections, and the records of which buyers an advisor's call showed or withheld contain no such hash and are kept indefinitely. All of these are append-only records, used for reliability, security, abuse prevention, and aggregate usage measurement, and session records also to decide what a signed-in tool may read. Apart from the removal just described, we do not edit or delete them; if you ask us to delete your personal information, your account is pseudonymised as described in Section 10.1, and these records remain linked only to that pseudonymised account. The daily question counts and the records of when a conversation's token was used hold no hash or personal information and are kept indefinitely.
Your conversation with an AI assistant belongs to that assistant's provider, not to us. What an assistant sends to our server, and how long the provider retains your conversation, is governed by the provider's own privacy policy, or, for an organization connection, by the organization's agreement with that provider. If you follow an assessment link produced by a tool call, the sign-up carries an arrival marker (such as mcp-claude) through the first-party attribution path described in our Cookie Policy. A link from a conversation in which you answered questions also carries the single-use token described above, which app.preshiftiq.com exchanges for a short-lived cookie described in our Cookie Policy, Section 2.1.
5C. Buyers Invited by an Advisor
If you joined PreShiftIQ through a consulting firm or private equity firm that works with you (your "Advisor"), your assessments belong to your Advisor's account on the Platform, and so do your company profile and its units (Section 2.2). People at your Advisor who hold administrator access can see your assessment answers and your matches, can edit your answers, reopen your assessment, and re-run your matching on your behalf, and can see the audit trail of actions in your account, including the follow-through statuses described in Section 5 and whether a vendor's prior-relationship claim on your match was filed and how it was ruled. They do not see decline reasons, vendors' notes, or our staff's reasons. Every action your Advisor takes in your account is recorded in our audit log with who acted and when. Your Advisor does not represent any vendor.
6. How We Share Information With Others
We do not sell personal information. We do license aggregated and de-identified data as described in Section 5A. Beyond the matched-party sharing in Section 5, we share information only with parties who help us run our business, at your direction, or as required by law.
Service providers. We use the following categories of providers, each permitted to use your information only to provide services to us: website hosting (Squarespace), application hosting and infrastructure (Vercel, Railway), authentication (Clerk), payment processing (Stripe, for future subscription and consultant fees; no payment is processed on the Platform today), transactional email (SendGrid), error monitoring (Sentry), encrypted database backups (Cloudflare, in its R2 storage service), alerts to our own team (Slack; these carry record identifiers only, never names, email addresses or company names), source control and development infrastructure (GitHub), AI-assisted analysis tooling (Anthropic), CRM and scheduling (HubSpot, Calendly), advertising and website analytics (LinkedIn), and email, documents, and storage (Google Workspace). These providers process your information for us under their standard data processing terms, accepted at signup.
Shared at your direction. When you connect an AI assistant to your PreShiftIQ account, what a signed-in tool returns is delivered to that assistant's provider because you asked for it (Section 5B). That provider is not our service provider; its own terms govern what it does with the results.
Professional advisors. Auditors, accountants, attorneys, and insurers, where appropriate.
Advisory engagement participants. During an advisory engagement, information may be shared between buyer and vendor parties only as authorized by the engagement's scope and applicable confidentiality terms.
Legal and safety. Authorities, courts, or other parties when we believe disclosure is required by law, necessary to enforce our rights, or necessary to protect any person's safety.
Business transfers. In a merger, acquisition, financing, or asset sale, information may be transferred subject to standard confidentiality protections.
7. International Transfers
PreShiftIQ™ is based in the United States. Information is transferred to, stored, and processed in the United States and in our service providers' locations. Where required, we rely on appropriate safeguards, such as Standard Contractual Clauses, for cross-border transfers.
8. Data Retention
We keep the records of what happens on the Platform: accounts, assessments and their answers, company profiles, matches and scores, disclosures and acceptances, follow-through, contracts and outcomes, follow-up answers (Section 2.10), comparisons of vendors (Section 2.11), payments, the history of changes to them, and our audit trail. We do not delete them, because they are the factual record of decisions made by buyers, vendors and PreShiftIQ. The history of changes records, for each change to an assessment, a vendor record, a match and its follow-through, a company, an organization account, a membership, and the questions, catalog and settings we maintain, the new value, when the change was made, and who made it (a person's account, an automated process of ours, or a PreShiftIQ staff member acting for a customer). For a person's account it records only whether the account is active, its role, and whether it is one of our own test accounts or has been deleted, never a name, email address or phone number. Notifications we send you, on the Platform and by email, are deleted 90 days after they were delivered, except the notice that a vendor accepted your match, which we keep; a notification that was never delivered is kept. Each deletion is recorded in our audit trail by count, without the notifications' contents, and our record of each email's delivery is kept. When you ask us to delete your personal information, we remove you from everyday view instead: your name is reduced to initials, your email address and phone number are removed, and the records stay linked to a pseudonym. Your full identity is kept in a sealed, encrypted record that only PreShiftIQ staff can open, each time for a stated reason that is recorded; it is destroyed seven years after it is sealed, unless a legal hold applies. Our encrypted backups of the Platform's database are kept for up to 36 days, so a backup taken before a deletion request still holds that person's information until the backup ages out; if we ever restore from a backup, we carry out every deletion request served since that backup before the restored data is used. In our audit trail, the information identifying a person is removed from each entry 24 months after it was written. That step applies to the audit trail, not to the history of changes, which stays linked to your pseudonym after a deletion request. Records of our assistant-tool server are kept as Section 5B describes. Request logs kept by the providers that host the Site and Platform are kept for the periods those providers apply.
9. Security
We use administrative, technical, and physical safeguards designed to protect personal information, including encryption in transit, role-based access controls on the Platform, and audit logging of data disclosures. PreShiftIQ staff may act inside your account to support you; each such action that our audit log records is recorded under the staff member's name as well as yours. No method of transmission or storage is fully secure, and we cannot guarantee absolute security. If we confirm a breach of security that affects your personal information, we notify you within 72 hours of confirming it, and we notify the authorities where the law requires.
10. Your Rights and Additional Information
10.1 Your Rights
Depending on where you are located, you may have rights with respect to your personal information, including:
- Access: the right to know what personal information we hold about you.
- Correction: the right to request that inaccurate or incomplete information be updated.
- Deletion: the right to request deletion of your personal information, subject to legal and contractual exceptions. How we carry out a deletion request is described below.
- Portability: the right to receive a copy of your information in a portable format.
- Objection or restriction: the right to object to or restrict certain processing.
- Withdraw consent: where processing is based on consent, the right to withdraw consent at any time.
- Non-discrimination: the right not to be discriminated against for exercising these rights.
What a deletion request does. We keep business and transactional records, because other people and organizations rely on them: assessments and answers, matches, lead and outcome history, contracts, receipts, vendor records, and our audit trail. We do not claim to erase them. A deletion request instead removes your personal information from them: your email addresses and phone numbers are removed from our everyday records, including the audit trail; your name is reduced to your initials; where your full name appears as whole words in a company name we hold for you (your own company field, a vendor record you own, or an organization or company on the Platform of which you are the only active member), that occurrence is reduced to your initials too, in the record and in its history of changes, while a first or last name alone is not changed and a vendor's public brand name in our catalog is not changed; your memberships in organizations and companies on the Platform end; your sign-in account with our authentication provider is closed; and every record you are part of stays linked to a single pseudonym. Free text written inside business records, such as a note someone entered, is kept as written, with two exceptions: where your full name or email address appears in a reason we record, or in a comparison of vendors (Section 2.11: its criteria, stages, notes, links, the reasons for agreed scores, questions and answers), your full name is reduced to your initials and your email address is replaced by your pseudonym. Your full identity is kept in a sealed, encrypted record that only PreShiftIQ staff can open, each time for a stated reason that is recorded; it is destroyed seven years after it is sealed unless a legal hold applies. If we restore our systems from a backup, we carry out again every deletion request served since that backup, before the restored data is used.
To exercise any of these rights, contact us at info@preshiftiq.com. We may need to verify your identity before fulfilling certain requests. We will respond within the timeframes required by applicable law.
10.2 California Residents
If you are a California resident, you may have additional rights under the California Consumer Privacy Act (as amended by the CPRA), including the right to know, delete, correct, and limit certain uses of personal information, and the right not to be discriminated against for exercising these rights. PreShiftIQ™ does not sell personal information and does not share personal information for cross-context behavioral advertising.
10.3 Children's Privacy
The Site and our services are intended for business users and are not directed to children under 16. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us so we can delete it.
10.4 Third-Party Links
The Site may contain links to third-party websites or services. This Privacy Policy does not apply to those third parties, and we are not responsible for their privacy practices. We encourage you to read the privacy policies of any third party before sharing information.
10.5 Changes to This Policy
We may update this Privacy Policy from time to time. The "Last Updated" date at the top indicates when it was most recently revised, and each revision carries a dated line at the top describing what changed. Material changes will be communicated through the Site or by other appropriate means. Continued use of the Site after changes take effect constitutes acceptance of the updated policy. Where you accepted this policy when creating an account or starting an assessment, our record of that acceptance names the version then in force, and it remains our evidence of what you accepted.
10.6 Contact
Questions, requests, or complaints about this Privacy Policy or our handling of personal information can be directed to:
PreShiftIQ™
Email: info@preshiftiq.com
Web: preshiftiq.com