How we holdyour documents,and what never leaves your device.

To provide the service, we collect minimal account details:

• Email address
• Username or display name
• Password (securely hashed and salted; never visible to us)

STET is sold under a software license, primarily on a sales-led Enterprise model. For Enterprise customers, billing runs under a license agreement between your institution and Stet AI Inc. InsForge handles accounts and billing only. We store the subscription tier and status, and a trial start date derived from your account-creation timestamp. STET does not collect, process, or store credit card numbers or payment credentials.

As a software product, STET collects in-app product usage and telemetry to operate, secure, support, and improve the application. This is distinct from the consent-gated web analytics below, and never includes the content of your documents. It may include:

• Feature usage and navigation within the app (which screens and features are used)
• Audit and run counts and aggregate run statistics (for example file counts and total bytes processed). No file names, paths, or document content are included.
• Performance and reliability metrics (load times, processing duration, resource usage)
• Error and crash diagnostics (error type, stack context, app and OS version), scrubbed of document content

In-app product telemetry is processed through our infrastructure provider (InsForge). We do not send in-app product telemetry to a third-party consumer-analytics vendor.

Because the desktop app uses hardware-bound licensing, we collect the information needed to issue, activate, and enforce your license:

• License key and entitlement (tier, seats, validity period)
• A hardware fingerprint used to bind the license to authorized devices
• App version, operating system, and platform
• Activation and update-check status

This data is used only to validate licensing, deliver updates, and prevent unauthorized use.

When you contact us for support, we collect what you choose to share so we can help and keep a record of the request: your messages, email address, the subject of your request, and any diagnostics, screenshots, or logs you voluntarily attach. Please do not include document content or non-public deal data in support requests. We do not ask for it.

We collect limited server-side metadata needed to operate accounts, billing, and support surfaces and to enforce plan limits: for signed-in users, usage metering in InsForge (for example daily audit reservations and, when an audit finishes, aggregate fields such as file count and total bytes processed). No file names, paths, or document content are stored in these rows. Infrastructure and hosting providers may log request metadata for reliability and abuse protection under their own retention policies, as described in our subprocessors list.

If you accept analytics cookies on this website, we use PostHog to collect anonymous web analytics:

• Pages visited and navigation paths (pathname only, no query strings)
• Session duration and bounce rate
• Browser type, operating system, and general geographic region (country or city; IP is not stored)
• Referrer source (how you arrived at the site)

This data is fully anonymous. We have disabled user profiling, session recording, form capture, and IP address storage. You can decline or withdraw consent at any time via the cookie banner.

The full text of documents you process is never written to STET servers or cloud buckets. Content extraction, semantic search, and ledger reconciliation run on-device in the desktop app, entirely within memory. The deterministic engine keeps document content on your device. When your firm enables the optional AI agent stack, a bounded set of LLM reasoning calls carry document-derived excerpts to a contracted Zero-Data-Retention model gateway in flight (detailed below), never whole files, and never persisted off-device.

Checklist data is stored locally on your device (stet_checklists) and never transmitted to STET servers: checklist names, due-diligence item statuses, matched document file names, match confidence scores, and any free-text notes. It is available only on the device where it was created and is cleared when you use “Delete Account” or remove local STET data.

Because document text never touches our backend, no STET engineer, employee, or contractor can view or access your financial records or document contents.

We do not train or fine-tune any model on your Customer Data, including our local semantic matching engine. When the agent stack is enabled, the InsForge Model Gateway contractually enforces Zero Data Retention on prompt content: no storing, no caching, and no training, with OpenRouter as the sole upstream router. We do not control downstream behavior beyond what these contractual terms commit to, and we will update this notice if those terms change.

When you connect a cloud virtual data room, file listing and downloads occur under your account with that provider, subject to their terms and privacy notice. STET does not upload your document content to STET servers for reconciliation; processing runs on-device in the desktop app.

STET ships an optional AI agent stack (workstream specialists, banker, QoE, generation, chat, and IC brief). When the agent stack is enabled by your firm, document-derived excerpts (claim text, finding summaries, ledger row excerpts, and the messages you type into chat) are sent over TLS 1.2+ to the InsForge Model Gateway, which routes them solely through OpenRouter to the configured large-language-model provider for inference. Under a signed Data Processing Agreement between InsForge AI Inc. and Stet AI Inc., the gateway enforces Zero Data Retention: prompt content is not stored, cached, or used to train any model, and OpenRouter is the sole upstream router. The agent stack is the only path that egresses document-derived content to third parties; deterministic-only flows (L0 to L4 matching, ledger reconciliation, on-device extraction, semantic search) do not send any document content off-device. Your firm's partner can disable the agent stack via the partner toggle, in which case STET reverts to deterministic-only behavior.

Every LLM-generated finding, claim, or memo paragraph is marked “unverified” until a human reviewer explicitly approves it. Approved outputs become part of your firm's record; unapproved outputs may be reviewed, rejected, or edited at any time. STET does not auto-execute deal decisions on your behalf. This is intended to align with EU AI Act Art. 13 transparency expectations for AI-assisted outputs.

When enabled by your firm's partner, STET indexes the title, summary, severity, and workstream of approved findings on your device to surface similar findings on future deals within the same firm. This feature is firm-scoped, default-off, and every cross-mandate read is logged in the audit trail. The data does not leave your firm's boundary; it is not shared across firms or with STET.

Session authentication tokens (via InsForge) stored in a secure, HttpOnly cookie. These are required for account login to function. They expire when your session ends or you log out.

If you accept analytics cookies, PostHog stores an anonymous session identifier in localStorageto measure session continuity. Anonymous page-view and page-leave events (used for session-duration signals) are captured. No personal data is stored. This is only activated after you click “Accept” on the cookie banner. You can withdraw consent at any time by clearing local website data.

We store a small number of preference items in local STET storage on your device so the software remembers your choices. None are tracking cookies, and none are transmitted to advertisers or to our servers:

• stet_analytics_consent: records whether you accepted or declined analytics cookies.
• stet_privacy_accepted: records that you acknowledged this Privacy Policy and the Terms.
• stet.updateChannel: desktop app update channel preference (stable, beta, internal). Stored locally only.

The desktop app additionally stores audit findings, document extractions, checklist data, semantic indices, and other working data on your device using IndexedDB and localStorage. All of that storage is local-only and never synced to STET servers; a complete enumeration is available in the app under Account, Settings, Danger Zone, which lists and clears every known store.

Your email, username, and subscription status are retained for as long as your account or license is active. On account deletion, personal data is purged within 30 days from our live systems and within 90 days from encrypted backups.

In-app product usage, telemetry, and error diagnostics are retained for up to 12 months to operate, secure, and improve the software, then deleted or aggregated into non-identifying statistics.

License, device-fingerprint, and activation data are retained for the life of the license to enforce hardware-bound licensing and validate activation, and are purged within 90 days after the license ends.

Support messages and any attachments you provide are retained for up to 24 months to provide and document support, then deleted.

Checklist data is stored locally in on-device app storage (stet_checklists) and is not retained on STET servers. It persists until you delete individual checklists, use the “Delete Account” flow, or clear local STET data. There is nothing for us to delete server-side; this data never reaches our servers.

Never retained server-side. File processing is on-device and in-memory only. Document text never reaches our servers; there is nothing for us to delete.

When the agent stack is enabled, the document-derived excerpts carried in the bounded reasoning calls are subject to Zero Data Retention under our Data Processing Agreement with InsForge: not stored, cached, or used to train any model, by InsForge or by OpenRouter. There is no retained copy off-device to purge.

Anonymous PostHog analytics (if consented) are retained for 12 months, after which they are automatically deleted by PostHog.

In the event of a personal data breach affecting your account or billing data, we will notify affected users and, where required by law, the relevant supervisory authority within 72 hours of becoming aware of the breach, in accordance with GDPR Art. 33. Document content and checklist data are stored on your device and are outside the scope of a server-side breach.