Suger is now Fours. Read the announcement
Customers
Pricing
Insulin
Sign in Get a demo

Privacy Policy

Last updated: October 8, 2026

This Privacy Policy explains how Suger, Inc., doing business as Fours ("Fours", "we", "us"), collects, uses, discloses and protects personal information, and the choices and rights you have. It covers personal information we handle for our own purposes in connection with:

  • our websites: www.fours.com, doc.fours.com and www.insulin.dev, and the older www.suger.io and doc.suger.io addresses, which now redirect to them;
  • the Fours platform, including the Fours console and APIs, when we set up and administer accounts, sign people in, bill, support and secure the service;
  • sales, marketing, events and other business communications; and
  • recruiting, when you apply for a job with us.

It does not cover personal information that our customers put into or connect to the Fours platform. We process that on our customers' behalf, as explained under Customer data.

You can print this policy or save it as a PDF from your browser.

Contents

Notice at collection

This section is our notice at collection under the California Consumer Privacy Act (CCPA). In the preceding 12 months we collected, and we continue to collect, the categories of personal information below. For each it says why we collect it, whether we sell or share it, and how long we keep it. The sections after it give more detail.

We sell or share personal information only through the website tags and the business contact information described under Sale and sharing of personal information. You can opt out on Your Privacy Choices, and a browser that sends Global Privacy Control is opted out automatically.

Identifiers

  • Examples: name, email address, phone number, business postal address, account username and ID, IP address, and cookie and device identifiers.
  • Why: to respond to you, provide and secure accounts, send service and marketing communications, measure our websites and, if you allow it, advertise.
  • Sold or shared: cookie and device identifiers, IP addresses and encoded email addresses, through website analytics, advertising and visitor-identification tags, only if you allow advertising cookies. Business contact details obtained from data providers, as described in Sale and sharing.
  • Kept: for as long as your account is open or we have an active business relationship with you or your organization, and afterward only for as long as we need it for the purposes in this policy, such as security, legal and accounting records, or until you ask us to delete it.

Personal information described in California Civil Code section 1798.80(e)

  • Examples: name, business address, phone number and employer, billing contact details and, if you connect a bank account to reconcile your marketplace payouts, the bank's name, the account's name and its last digits. Card numbers are handled by our payment processor, Stripe, and are not stored by us.
  • Why: to provide accounts and services, bill for them and keep business records.
  • Sold or shared: the business addresses, phone numbers and employers in business contact information from data providers. Otherwise no.
  • Kept: for as long as the account or business relationship lasts, and billing records for as long as tax and accounting rules require.

Commercial information

  • Examples: the products and plans you or your organization use or ask about, purchases of usage credits, and orders and invoices.
  • Why: to provide and bill for the services and to understand which products interest you.
  • Sold or shared: no.
  • Kept: for as long as the business relationship lasts, and as long as tax and accounting rules require.

Internet or other electronic network activity

  • Examples: pages you visit on our websites, the page that referred you, links you click, how you interact with our emails, how you use the Fours platform, and log data such as your browser type and the times of your requests.
  • Why: to operate, secure and improve our websites and platform, to understand which content is useful, and, if you allow it, to measure and target advertising.
  • Sold or shared: browsing activity and what you enter in forms on www.fours.com, through analytics, advertising and visitor-identification tags, only if you allow advertising cookies.
  • Kept: Google Analytics data for up to 14 months after your last visit, and its aggregated reports, which identify no one, after that; product analytics in PostHog for 12 months and its session recordings for up to 30 days; and server logs for 12 months.

Geolocation data (approximate only)

  • Examples: city, region and country derived from your IP address, or included in business contact information. We do not collect precise geolocation.
  • Why: security, fraud prevention and understanding where our visitors are.
  • Sold or shared: as part of IP addresses through website tags if you allow advertising cookies, and the city, region or country in business contact information from data providers.
  • Kept: as for internet activity, or, in business contact information from data providers, as for that information.
  • Examples: job title, employer, work email and phone, LinkedIn profile, and, if you apply for a job, your résumé, work history and references.
  • Why: to understand who we are talking to, provide our services, market them to businesses, and run our recruiting.
  • Sold or shared: business contact information obtained from data providers, as described in Sale and sharing. Otherwise no.
  • Kept: sales and marketing records as for identifiers. Business contact information from data providers until 12 months after a provider last confirmed it. Applicant records for four years after the hiring decision, the minimum California law requires, and longer while a legal claim about them is open.

Education information

  • Examples: education history you include in a job application.
  • Why: recruiting.
  • Sold or shared: no.
  • Kept: as for applicant records.

Inferences drawn from other personal information

  • Examples: your likely interest in our products, drawn from the pages you view and the content you engage with, and, if you allow advertising cookies, the company a website visit came from.
  • Why: to tailor our sales and marketing conversations.
  • Sold or shared: only through the advertising and visitor-identification tags, and only if you allow them.
  • Kept: as for identifiers.

Sensitive personal information: account log-in credentials and financial account access

  • Examples: the username and password or single sign-on credentials you use to sign in to a Fours account and, if you connect a bank account, the access that lets Fours read its transactions, through a bank-data provider such as Plaid.
  • Why: only to sign you in, keep your account secure and reconcile the payouts you asked us to.
  • Sold or shared: no.
  • Kept: for as long as the account exists, until it is deleted at your request.

Our privacy policy is at www.fours.com/privacy/, and you can opt out of the sale and sharing of your personal information on Your Privacy Choices.

Where we get personal information

  • From you, when you fill in a form, book a demo, contact us, sign up for or use an account, attend an event or apply for a job.
  • From your browser or device, through cookies, similar technologies and server logs when you use our websites and platform. See Cookies, analytics and advertising.
  • From your organization, for example when an administrator of a Fours account invites you to it.
  • From service providers and partners, such as event co-hosts, consulting and resale partners who introduce you to us, and cloud marketplace programs.
  • From data providers, such as Apollo.io and People Data Labs, which supply business contact information, sometimes including personal email addresses, and, if you allow advertising cookies, RB2B, which identifies the business and business contact behind a website visit.
  • From public sources, such as company websites and public professional profiles.

How we use personal information

We use personal information to:

  • provide, operate and maintain our websites and the Fours platform, and create and administer accounts;
  • sign people in and keep accounts secure;
  • respond to your questions, demo requests and support requests;
  • bill for our services and keep business records;
  • understand how our websites and platform are used so we can improve them;
  • send you information about our products, events and services, which you can stop at any time;
  • measure and target advertising, only if you allow advertising cookies;
  • detect, prevent and investigate security incidents, fraud and abuse, and debug problems;
  • comply with law, respond to lawful requests, and establish, exercise or defend legal claims;
  • run our recruiting; and
  • carry out a merger, financing, acquisition or similar transaction.

How we disclose personal information

We disclose personal information for business purposes to service providers and contractors that process it on our behalf under written contracts that restrict how they use it. In the preceding 12 months we disclosed identifiers, personal information described in Civil Code section 1798.80(e), commercial information, internet or other electronic network activity, geolocation data, professional or employment-related information, education information, inferences and sensitive personal information to the following categories of service providers, for the purposes above:

  • cloud hosting and infrastructure providers, such as Amazon Web Services and Cloudflare;
  • sign-in and identity providers, such as Auth0;
  • email delivery providers, such as Amazon SES and Resend;
  • customer relationship management and marketing tools, such as HubSpot and Salesforce;
  • website and product analytics providers, such as Google Analytics and PostHog;
  • scheduling tools, such as Cal.com and Google Calendar;
  • payment processors, such as Stripe, and bank-data providers, such as Plaid, when you connect a bank account;
  • support, collaboration and development tools, such as Slack, ClickUp and GitHub;
  • monitoring and logging providers, such as Datadog;
  • bot-protection providers, such as Cloudflare Turnstile;
  • AI model providers, when you use AI features (see AI features);
  • data enrichment providers, such as Apollo.io;
  • applicant tracking providers, such as Lever; and
  • professional advisers, such as lawyers, accountants and auditors.

We also disclose personal information:

  • to your organization, when you use a Fours account it administers — its administrators can see your account details and activity in that account;
  • to partners at your request, for example when you ask on our website to work with one of our consulting partners;
  • to comply with law, to respond to lawful requests from public authorities, and to protect our rights, our users and the public;
  • in a corporate transaction, such as a merger, acquisition, financing or sale of assets; and
  • with your consent or at your direction.

Sale and sharing of personal information

The CCPA defines "sale" and "sharing" broadly. In the preceding 12 months we sold or shared personal information in these two ways:

  • Website analytics, advertising and visitor-identification tags. On www.fours.com, if you allow advertising cookies, the Google tag (Google Analytics, with Google signals and user-provided data collection turned on), the LinkedIn Insight Tag, HubSpot's tracking code and RB2B's visitor identification can collect identifiers (such as cookie and device IDs, IP addresses and an encoded form of an email address you enter), internet activity (such as the pages you visit), approximate location from your IP address, what you enter in forms on our website (HubSpot records form entries), and inferences from them. Google and LinkedIn use this to measure and target advertising, and RB2B to identify the businesses, and sometimes the business contacts, behind visits. Until October 2026 the LinkedIn, HubSpot and RB2B tags could run before a visitor made a choice. They now run only if you allow advertising cookies, and never while your browser sends Global Privacy Control, and Google's tags are told not to use your information for advertising unless you allow it. Categories of third parties: advertising networks and social networks, analytics and marketing technology providers, and visitor-identification services.
  • Business contact information from data providers. To help our customers find and work with business partners, paid features of the Fours platform show them business contact information that we obtain from commercial data providers, including Apollo.io and People Data Labs: name, job title, employer, work or personal email address, phone number, city, region or country, and LinkedIn profile. Categories of third parties: our customers.

You can opt out of the sale and sharing of your personal information at any time on Your Privacy Choices, by sending a Global Privacy Control signal, by submitting an opt-out request, or by emailing privacy@suger.io. An opt-out request does not need an account or proof of identity.

We do not have actual knowledge that we sell or share the personal information of consumers under 16 years of age.

We do not use or disclose sensitive personal information for purposes other than those the CCPA permits without offering a right to limit, so that right does not apply to us.

Cookies, analytics and advertising

Our websites use cookies and similar technologies. On www.fours.com and www.insulin.dev, only necessary cookies run until you make a choice in the cookie banner, which you can change at any time through Cookie Settings in the footer.

  • Necessary: remember your privacy choices and protect our forms from bots with Cloudflare Turnstile. They cannot be switched off.
  • Analytics: Google Analytics measures visits and traffic sources on our marketing websites. It sets cookies only if you allow analytics. When you have not allowed it, Google Analytics still receives basic, cookieless signals about page views, used to produce aggregated, modeled reports. doc.fours.com has no cookie banner: Google Analytics sets analytics cookies there to measure use of the documentation, with its advertising features turned off, so it does not use advertising cookies or share information for advertising.
  • Advertising and visitor identification: the tags described under Sale and sharing. Off unless you turn them on, and never on while your browser sends Global Privacy Control.

Some pages embed content from other services, such as booking calendars from Cal.com and Google Calendar, videos from YouTube and HubSpot, and our status page. Those services receive information about your visit, such as your IP address, when the embedded content loads. We load YouTube videos in its privacy-enhanced mode.

In the Fours platform, we use PostHog to understand how the product is used and to fix problems. It records the pages and features you use and the errors you run into, linked to your account, and records your sessions: what appears on the screen, including text on the page, where you click, and the messages the platform logs in your browser. What you type into form fields is hidden. This is part of providing and improving the service, not advertising. If your browser sends Global Privacy Control, the platform does not load PostHog at all.

Global Privacy Control and Do Not Track

Global Privacy Control (GPC) is a signal your browser can send to tell websites not to sell or share your personal information. We treat it as a valid request to opt out of sale and sharing:

  • On our websites, for the browser that sends it: advertising and visitor-identification tags do not load, Google's tags are told not to use your information for advertising, and the footer shows "Opt-Out Request Honored". This applies whatever you choose in the cookie banner, and the opt-out stays in place for that browser after you turn the signal off, until you opt back in on Your Privacy Choices.
  • For you as a person, when we know who you are: if your browser sends GPC when you send our contact or partner-inquiry form or a privacy request, we log an opt-out request for your email address and apply it to the contact records we keep about you, including advertising audiences and any other offline sharing.

To use GPC, turn it on in a browser or extension that supports it. The Global Privacy Control website lists them.

Do Not Track (DNT) is a different, older browser setting. There is no common standard for what it means, and our websites do not respond to it. They do respond to Global Privacy Control as described above.

Customer data

Our customers, mostly software companies that sell through cloud marketplaces, use the Fours platform to run their marketplace, co-sell, partner, revenue and AI workflows. In doing so they may put in or connect personal information about their own buyers, partners, employees and contacts. Examples include contact details synced from their CRM or a cloud marketplace, partner applications and deal registrations submitted through forms they publish, email processed by the Insulin Inbox app, and conversations with AI agents.

We process this customer data as a service provider (processor) on our customer's behalf and under our agreement with them, which limits what we may do with it. The customer's own privacy policy describes how they use it. If your personal information is in one of our customers' accounts and you want to exercise your privacy rights, please contact that customer. If you contact us instead, we will tell you which customer to contact or pass your request to them where we can identify them, and we will not disclose their data to you directly.

AI features

When you use AI features in the Fours platform, what you enter and the content those features work on are processed to produce results, including by AI model providers that process it on our behalf or, if your organization connects its own model provider account, under that provider's terms with your organization. Fours does not use customer data to train AI models. The model providers that process it — DeepInfra, OpenAI, Anthropic and Google for the models Fours provides, or the provider your organization connects — do so under their own terms and our or your organization's agreements with them. Fours makes its own requests to OpenAI with OpenAI's response storage turned off.

How long we keep personal information

We keep personal information only for as long as we need it for the purposes in this policy. How long that is depends on the information and why we hold it:

  • Accounts: for as long as the account is open, and afterward only for as long as we need it for security, legal, tax, accounting or dispute purposes, or until you ask us to delete it.
  • Sales and marketing records: for as long as we have an active business relationship or you have shown interest in our services, or until you ask us to delete them. If you unsubscribe or ask us to delete your information, we keep the minimum needed to make sure we don't contact you again.
  • Billing records: as long as tax and accounting rules require.
  • Website and product analytics, and logs: Google Analytics data for up to 14 months after your last visit, then only its aggregated reports, which identify no one; PostHog data for 12 months (session recordings for up to 30 days); and server logs for 12 months.
  • Business contact information from data providers: until 12 months after a provider last confirmed it. We then delete it, with the provider's original record and any photo.
  • Your cookie choices: 12 months in your browser, or until you clear them.
  • Privacy requests: for at least 24 months, a record of each request and our response — the date and type of the request, how it was made, the date and nature of our response, and the reason for any denial. We use these records only to comply with the law.
  • Job applications: for four years after the hiring decision, the minimum California law requires, and longer while a legal claim about them is open.

Deleted information may remain in backups for up to 35 days until those backups expire. If we ever restore a backup, we delete again what was deleted after it was taken before the restored data is used.

Your California privacy rights

If you are a California resident, you have the right to:

  • Know and access: ask what personal information we have collected about you, the categories of sources, why we collected, sold or shared it, the categories of third parties we disclosed it to, and the specific pieces of personal information we hold, in a portable format.
  • Delete: ask us to delete personal information we collected from you, subject to exceptions the law allows, such as completing a transaction, security, or a legal obligation.
  • Correct: ask us to correct inaccurate personal information about you.
  • Opt out of sale and sharing: see Your Privacy Choices and Global Privacy Control.
  • Limit the use of sensitive personal information: this right does not apply, because we use sensitive personal information only for the purposes the CCPA permits.
  • Not be retaliated against for exercising these rights, including as a job applicant or employee. We will not deny you services, charge you a different price or give you a different quality of service because you exercised them.

We do not use automated decision-making technology to make significant decisions about consumers.

Shine the Light. California Civil Code section 1798.83 lets California residents ask, once a year and free of charge, for information about the personal information we disclosed to third parties for their own direct marketing in the preceding calendar year. To make that request, email privacy@suger.io.

How to make a request

What happens next. For a request to know, delete or correct, we confirm we received it within 10 business days and tell you how we will handle it, and we respond within 45 calendar days. If we need more time, up to another 45 days, we tell you why before the first 45 days are up. A request to opt out of sale and sharing takes effect on a browser at once, and everywhere else as soon as we can, and no later than 15 business days. If we cannot fulfill all or part of a request, we tell you why.

Verification. For requests to know, delete or correct, we verify your identity by matching the information you give us with information we already hold, and we may email you to confirm. If you have a Fours account, we may ask you to confirm through it. We do not ask for a government ID unless there is no other reasonable way to verify a request, and we use the information you provide only to verify and respond to it. How much we ask for depends on the sensitivity of the information and the risk of harm if someone else made the request.

Authorized agents. You can ask someone else to make a request for you. For a request to know, delete or correct, we will ask the agent for your signed permission and may ask you to verify your identity with us directly. For an opt-out we may ask for your signed permission, but we will not ask you to verify your identity, and an opt-out sent through Global Privacy Control needs no permission at all.

Requests about customer data. If your request concerns personal information one of our customers holds in the Fours platform, see Customer data.

Other privacy rights

Depending on where you live, you may have other privacy rights, such as rights to access, correct, delete, restrict or object to the processing of your personal information, to data portability, and to withdraw consent. You can use the same methods to exercise them. If we decline your request, you can appeal by replying to our decision, and we will review it and tell you the outcome.

European Economic Area, United Kingdom and Switzerland. Fours is the controller of the personal information described in this policy. We rely on these legal bases: performing our contract with you or your organization; our legitimate interests in running, securing, improving and marketing our services, which we balance against your rights; your consent, for example to optional cookies, which you can withdraw at any time; and compliance with legal obligations. You also have the right to complain to your local data protection authority. For customer data, Fours is a processor; see our GDPR page.

Children

Our websites and services are for businesses and are not directed to children. We do not knowingly collect personal information from anyone under 16. If you believe a child has given us personal information, email privacy@suger.io and we will delete it.

Security

We use administrative, technical and physical safeguards designed to protect personal information, including encryption in transit, access controls and monitoring. No system is completely secure, so we cannot guarantee the security of information you send us. For more, see our security page.

International transfers

Fours is based in the United States, and we store personal information mainly in the United States. Our team members and service providers may access it from other countries. When we transfer personal information from the European Economic Area, the United Kingdom or Switzerland, we use safeguards the law recognizes, such as the European Commission's Standard Contractual Clauses.

Changes to this policy

We review this policy at least once a year and update it when our practices change. The date at the top shows when it last changed. If we make material changes, we will post a notice on our website or tell you directly before they take effect.

Contact us

If you have questions about this policy or our privacy practices, contact us at privacy@suger.io or write to:

Suger, Inc. (doing business as Fours)
Attn: Privacy
637 Howard St
San Francisco, CA 94105
United States