Privacy policy
In short. We keep your account details, what you put into your workspace, and a record of your credits. AI and search providers process your content so the service can work. We do not sell your data, we do not train models on it, and we do not use advertising trackers. You can close your account and delete your content yourself.
1. Who is responsible
Carlos Vitorino, [email protected], Portugal, is the controller of the personal data described here. Privacy questions and requests go to [email protected]. We are subject to the EU General Data Protection Regulation (GDPR).
2. What we collect, why, and on what basis
| Data | Why | Basis (GDPR art. 6) |
|---|---|---|
| Account: name, email address, how you sign in (password, Google or GitHub), a hashed password if you use one, a hashed one-time sign-in token until it is used or expires (20 minutes), the date you joined. | To create and secure your account and to contact you about it. | Contract |
| Sessions: an IP address and browser description for each signed-in device, and when it was last used. | To keep you signed in, show you where you are signed in, and detect abuse. | Contract, legitimate interest in security |
| Your content: hunts, candidates, projects, documents, chat messages, uploaded files (PDF, Word, images, text), and the research the agent gathers for you. | To provide the service. The agent reads it and writes more of it. | Contract |
| Connections: your GitHub login and an encrypted access token if you connect GitHub; the names and last use of any MCP tokens or tool connections, and a log of which tool was called and when (never the arguments or the answers). | To push your brief to your repository, to let your AI tool read your workspace, and to enforce rate limits. | Contract |
| Credits and payments: each credit purchase, grant, charge and refund, with its date and amount. Card details never reach us; Creem takes them. We receive the size and outcome of a payment and the checkout reference. | To keep your balance, give you receipts and history, and keep the accounts the law requires. | Contract, legal obligation |
| Free allowance checks: one-way hashes of your mailbox, of the network a claim came from (kept for 30 days), of the random id in the device cookie, and of your email's domain (the last three kept for 90 days with the outcome). | To give one free allowance per person, and to spot someone creating many accounts for it. Credits are withheld, never the account. | Legitimate interest in preventing abuse |
| Messages from you: what you write to support, and our replies. | To help you. | Contract, legitimate interest |
| Usage statistics: which pages are visited, with record identifiers removed, your browser type, screen size, country and an anonymous daily visitor count. No cookie, and no user identifier. | To see which parts of the product are used so we can improve it. | Legitimate interest |
| Server logs and job logs: request records and the progress lines of the work you run, with secrets removed. | To run, secure and fix the service. | Legitimate interest |
3. AI processing
When you ask for research, the agent sends text to AI model providers and search queries to search providers (see subprocessors). That text can include what you typed, the content of your documents and uploaded files, and pages the agent read. We use the providers' paid API services and have not opted in to any training on your data. We do not train our own models on your content. Models can reproduce what they were given, so do not enter secrets, health data or other special categories of personal data about yourself or others.
The service ranks and grades ideas, products and markets. It does not make decisions about you that have legal or similarly significant effects.
4. Personal data from public sources
The agent and our daily "sparks" feed read public pages: forums, review pages, request boards, freelance postings and similar. Most of what is relevant is about products and needs, not people. When a post is turned into a need, we keep a paraphrase, a short quote and a link to the public page, and not the author's username or the full post. A public page is cached and may be shared between accounts. If you are named in something we hold and want it removed, write to [email protected] with the link.
5. Who we share data with
We share data with the companies on the subprocessors page, only for the purposes listed there. We may disclose data if the law requires it, or to protect our rights or the safety of others. If the business is sold or merged, your data may move to the new owner, who must honour this policy. We do not sell personal data and we do not share it for advertising.
If you push a build brief to GitHub, the files you ticked are published to a public repository under your account. That is your choice and happens only when you confirm it.
6. Transfers outside the EEA
Some of our providers are outside the European Economic Area: in the United States, Singapore and China. We rely on adequacy decisions, including the EU–US Data Privacy Framework for certified providers, and otherwise on standard contractual clauses or the providers' own contract terms, and we limit what we send to what a task needs. Ask [email protected] if you want a copy of the safeguards.
7. How long we keep data
- While your account is open: your account, content and connections, until you delete them or close the account.
- When you close your account: your content and your sign-in identity are deleted straight away. Connections are removed, and we ask GitHub to withdraw our access.
- Kept after closing: the record of credit purchases, grants and charges, without your content, for as long as accounting and tax law requires (up to 10 years). A one-way hash of your mailbox is kept so a closed account cannot collect the free allowance again.
- Backups: a nightly copy of the database is kept for 14 days, so deleted data can remain in a backup for up to that long.
- Connection logs: about a month. Network hashes for the free allowance: 30 days. Device and domain hashes and claim outcomes: 90 days. Support emails: up to three years after the last message.
8. Your rights
You have the right to access your data, to have it corrected or deleted, to restrict or object to its use, to receive it in a portable format, and to withdraw consent where we rely on it. Closing your account deletes your content. For anything else, or for a copy of your data, write to [email protected] from the address on your account. We answer within one month. You can complain to the Comissão Nacional de Proteção de Dados (Portugal) or to the authority where you live.
9. Cookies and local storage
We use only what the app needs to work:
- A session cookie that keeps you signed in. A short-lived cookie used while you connect GitHub. A cookie that remembers your default project. A random device id, kept for a year, that tells us one browser from another when we give out the free allowance (only a hash of it is stored).
- Browser storage that remembers your layout choices, such as the width of panels and whether a list is open.
Our usage statistics set no cookie and identify no one. Every cookie above is needed for the app to work or to keep the free allowance fair, and we use no advertising or tracking cookies, so there is no cookie banner. Creem's checkout, Google and GitHub set their own cookies on their own pages.
10. Security
Data is stored in the European Union, encrypted in transit. Access tokens for connected services are encrypted at rest. Each account's data is isolated at database level. Pages the agent reads are opened in a sandboxed browser, and what the agent reads from the web is treated as untrusted text. No system is perfectly secure. If a breach puts your data at risk we will tell you and the authority as the law requires.
11. Children
The service is for people aged 18 or over. We do not knowingly collect data from anyone younger. If you think a child has an account, write to us and we will delete it.
12. Changes
We may update this policy. We will tell you about a material change by email or in the app before it takes effect. The date at the top shows the last update.