Privacy Policy

Scope and controller

This Privacy Policy describes how Recovery AI handles information when an organization or its users use the accounts-receivable automation platform, website and related services.

Recovery AI may act as controller for certain account and usage data and as processor or service provider for business data an organization connects to the platform. Specific responsibilities may also be defined in the applicable agreement, order form or data processing agreement.

Information we process

The information we process depends on how Recovery AI is configured and which integrations an organization enables.

• Account and profile data: name, work email, organization, role and preferences.
• B2B billing data: customers, invoices, amounts, due dates, statuses, payments and payment promises.
• Communications: messages, replies, detected intent and context needed to manage a recovery case.
• Technical and security data: logs, IP address, device, authentication events, audit records and telemetry.
• Integration data: information received from accounting systems, CRM, email or other services authorized by the organization.

How we use information

We process information only to operate, secure, improve and provide the contracted Recovery AI functionality.

• Synchronize and organize accounts receivable.
• Prioritize cases and generate follow-up recommendations.
• Execute authorized actions according to configured autonomy policies.
• Detect replies, promises, disputes and payments.
• Prevent fraud, abuse and unauthorized access.
• Provide support, analytics, auditability and service improvements.

Artificial intelligence and automated decisions

Recovery AI uses models and rules to analyze operational signals, classify communications, prioritize cases and recommend or execute actions within limits defined by the organization.

Autonomy features are subject to controls, audit records and configurable rules. Recovery AI should not be used to make legal, credit or regulated debt-collection decisions without appropriate organizational oversight and configuration.

Vendors, integrations and transfers

We may use infrastructure, authentication, communications, observability, storage and AI service providers to deliver Recovery AI. Access is limited to what is necessary to provide the service and is subject to contractual and security controls.

When an organization connects third-party services, processing performed by those services is also governed by their own terms and policies.

Retention and security

We retain information for as long as necessary to provide the service, meet contractual or legal obligations, resolve disputes and maintain security records. Retention periods may vary by data type and contractual configuration.

We apply technical and organizational measures designed to protect confidentiality, integrity and availability, including access controls, encryption in transit, secrets management and audit logs. No system can guarantee absolute security.

Rights and requests

Depending on jurisdiction, individuals may have rights to access, correction, deletion, objection, restriction, portability or withdrawal of consent. When data is controlled by a customer organization, the request should first be directed to that organization.

Requests relating to a Recovery AI account may be submitted through the support channels available in the platform. We may need to verify identity and authorization before fulfilling a request.

Changes to this policy

We may update this policy as the product, legal requirements or our practices change. We will publish the current version and its effective date on this page.