Privacy Notice

Who We Are

The Tribe AccredAI platform is operated by Tribe Consulting, LLC, trading as Tribe AccredAI. For the personal data described in this notice, Tribe Consulting, LLC acts as the data controller.

Information We Collect

Account Information

• Names
• Email addresses
• User roles
• Organization details
• Authentication credentials

Workspace & Institutional Content

• Uploaded accreditation evidence
• Program documentation
• Narratives, reports, and prompts submitted to AI features
• Workflow activity and reviewer comments
• Organizational structures

Technical & Usage Information

• Device, browser, and IP address
• Authentication and access logs
• Usage analytics and feature interactions
• Performance diagnostics and error logs

Payment Information

Payment data (card details, billing address, tax information) is collected and processed directly by our payment provider, Paddle, as described below. We do not store full payment card numbers on our systems.

How We Use Information & Legal Basis

• Providing the Platform — account creation, access, and core features. Legal basis: performance of a contract.
• AI-assisted workflows — processing your prompts and uploaded materials to generate outputs. Legal basis: performance of a contract.
• Security and fraud prevention — protecting accounts, detecting abuse. Legal basis: legitimate interests; legal obligation.
• Product improvement — aggregated or anonymized analytics. Legal basis: legitimate interests.
• Customer support — responding to inquiries. Legal basis: performance of a contract; legitimate interests.
• Operational communications — service updates, security notices, billing. Legal basis: performance of a contract; legitimate interests.
• Marketing — only where you have opted in. Legal basis: consent.
• Legal and compliance — meeting tax, accounting, and regulatory obligations. Legal basis: legal obligation.

We do not sell personal information.

AI-Assisted Processing

Uploaded materials and prompts may be processed by AI systems (operated by us and our model providers) to support evidence organization, narrative generation, standards alignment, summarization, and workflow assistance. AI outputs should always be reviewed and approved by institutional personnel prior to submission or publication.

Who We Share Information With

We share personal data with the following categories of recipients:

• Paddle (Merchant of Record). Paddle.com Market Limited and its affiliates act as our reseller and Merchant of Record for all sales of the Platform. We share your name, email, billing address, and order details with Paddle so they can process payments, manage subscriptions, handle refunds, calculate and remit taxes, issue invoices, and provide checkout-related customer support. Paddle’s handling of your data is governed by Paddle’s Privacy Notice.
• Hosting and infrastructure providers that store and serve Platform data on our behalf.
• Authentication, email, and analytics providers that support sign-in, transactional email, and usage measurement.
• AI model providers that process prompts and content to generate outputs for the Platform’s AI features.
• Professional advisers (legal, accounting, audit).
• Authorities where required by law, regulation, legal process, or to protect rights, property, or safety.
• Acquirers in connection with a merger, acquisition, financing, or sale of assets.

International Transfers

Where personal data is transferred outside your country (including from the UK or EEA to the United States), we rely on appropriate safeguards such as Standard Contractual Clauses, the UK International Data Transfer Addendum, or adequacy decisions where available.

Data Retention

We retain personal data only for as long as reasonably necessary to provide the Platform, maintain organizational continuity, comply with legal and tax obligations, resolve disputes, and enforce our agreements. When no longer required, data is deleted or anonymized. Organizations may request deletion of accounts or workspaces, subject to applicable contractual or legal requirements.

Your Rights

Depending on your jurisdiction, you may have the right to access, rectify, erase, restrict, or port your personal data, object to processing, withdraw consent (without affecting prior processing), and lodge a complaint with your local supervisory authority. We aim to respond to verified requests within one month. To exercise these rights, contact privacy@accredai.com.

Data Security

We implement reasonable administrative, technical, and organizational safeguards intended to protect information from unauthorized access, disclosure, alteration, or misuse. Measures include encrypted communications, authentication protections, access controls, and infrastructure monitoring. No method of electronic transmission or storage can be guaranteed to be completely secure.

Cookies

We use cookies and similar technologies in three categories: essential cookies required for authentication, security, and core platform functionality; analytics cookies that help us understand how the Platform is used; and marketing cookies used to measure campaign performance. Non-essential categories are off by default and are only set after you accept them. EU/UK visitors are asked for consent on first visit via our cookie banner, and you can change your choices at any time from the “Cookie Preferences” link in the site footer.

Policy Updates

This Privacy Notice may be updated periodically to reflect operational, legal, or Platform changes. Updated versions will be posted on this page with a revised effective date.

FERPA (U.S. higher-education customers)

When an Institution subject to the Family Educational Rights and Privacy Act (“FERPA”) uploads education records to Tribe AccredAI, the Institution remains the controller of those records. Tribe Consulting, LLC processes them as a “school official” with legitimate educational interests under 34 CFR §99.31(a)(1)(i)(B), under the Institution’s direct control.

• Categories. Only what the Institution chooses to upload — e.g. policies, narratives, course materials, and any student records the Institution authorizes.
• Purpose. Solely to provide accreditation evidence management and related services the Institution has contracted for.
• Subprocessors with potential access to education records: our cloud hosting / database provider, our email provider for transactional notifications, and — only when the Institution opts in — AI model providers via the Lovable AI Gateway. Our payments provider (Paddle) does not receive education records. A current list is on the Subprocessors page.
• Retention & deletion. Education records are retained for as long as the Institution’s workspace is active, then exported or deleted in accordance with the DPA on termination.
• Inspection & correction. The Institution may inspect, correct, export, or delete records it has uploaded through the in-product administrative tools or by contacting privacy@accredai.com.

Contact

Tribe Consulting, LLC — privacy@accredai.com