Legal

Data Use

What happens to your operational data, what leaves your network, and what is never used for training. This is the page that has to match how the product actually behaves.

Last updated · Draft
Draft · not legal advice

This document is a structural scaffold. Each section describes what belongs in it; none of it is operative legal language, and it has not been reviewed by a lawyer. Replace the body text with counsel-approved wording before relying on this page.

The commitment

Plain-language statement: customer data stays on customer infrastructure, and is never used to train models for other customers.

Everything below should make that concrete rather than repeat it.

Where data lives

On-prem, edge, and private-cloud deployments, and precisely what differs between them. For air-gapped installs, state that Apture has no access at all.

What leaves the boundary

The routing harness: everyday work runs on local models with real data attached; only escalated requests leave, and only after the scrubber removes names, coordinates, and volumes.

Document what the scrubber removes, what it cannot guarantee, and the audit log the customer can inspect.

Frontier model providers

Which providers receive escalated requests, what they receive, their retention terms, and whether zero-retention arrangements are in place.

Training and finetuning

Customer data trains only that customer’s models. Corrections and approvals feed that customer’s alignment loop. The resulting weights belong to the customer.

State explicitly whether anything aggregated or de-identified is used more broadly — and if not, say so.

Signal and desktop capture

What Signal observes, the per-person FULL versus SUMMARY ONLY setting, who can change it, and what is recorded in either mode. Be specific — this is the most sensitive surface in the product.

Telemetry

What product telemetry is collected, whether it can be disabled, and what it contains. If a deployment is fully offline, say so.

Retention and deletion

Retention windows for anything Apture holds, and how deletion is requested and confirmed.

Sub-processors

A current list, with notice of changes.