Privacy Policy

1. Three roles we play

We are the controller of the personal data this website and the waitlist form collect, such as your name and your work email. We decide why that data is collected and how long we keep it.

If you become a customer, the prompts and content you send through the Gateway are a different matter. There, you are the controller and we are the processor, acting only on your instructions under your Gateway agreement and its data processing addendum. We do not decide what your prompts contain or why you send them, and we do not use that content beyond providing the service to you, except that once it has been redacted and then de-identified we may use the result as Section 7 describes.

For Fully Redacted Data, as Section 7 defines it, we act on our own account. That data has been redacted and then de-identified, so it is no longer your customers' personal data or yours, and we determine the purposes for which we use it. Section 7 states those purposes and the limits on them. Your data processing addendum must name them as permitted purposes before we rely on this role.

2. What we collect, and why

2.1 Waitlist form

When you submit the form at /partners we collect your name, your work email, and your company. If you choose to give them, we also collect a description of your workload and a free-text message.

• Purpose: to evaluate your fit for the waitlist and to email you about your place in line.
• Lawful basis (GDPR Art. 6): legitimate interest in responding to a business inquiry you started.
• Source: directly from you, when you fill in the form.

2.2 Server logs

Like any website, our server records each request it receives. A log entry can include your IP address, your browser's user agent, the page you asked for, and the time. When you join the waitlist, the server log also notes your email address and company, so we can see that a request arrived.

• Purpose: to run, secure, and debug the site.
• Lawful basis (GDPR Art. 6): legitimate interest in keeping the site working and safe.
• Source: your browser, automatically, when it requests a page.

2.3 Session cookie

We set one cookie, used only to protect the form submission from cross-site request forgery. It carries no profile and no advertising identifier.

• Purpose: security, to confirm a form submission came from our own page.
• Lawful basis (GDPR Art. 6): legitimate interest in keeping the form secure. The cookie is strictly necessary, so EU and UK cookie law requires no consent banner for it.
• Source: set by our server when you load a page.

2.4 Local storage: theme

We store one value in your browser's local storage, under the key theme. It records whether you chose light or dark mode.

• Purpose: to remember your display preference between visits.
• Lawful basis: the value never leaves your browser, so we receive no personal data from it. It is strictly necessary for the feature you asked for, so no consent banner is required.
• Source: set by your browser when you use the theme toggle.

2.5 What we do not do

We run no analytics, no ad pixels, and no third-party trackers on this site. We do not sell the personal information this website and the waitlist collect, and we do not share it for cross-context behavioral advertising. Sections 6 and 7 state separately how we treat customer content and the de-identified data derived from it.

3. Cookies and local storage, at a glance

Name	Kind	Purpose	Lasts
roda.session	Cookie	Form security (CSRF)	Up to 30 days
theme	Local storage	Light or dark preference	Until you clear it

Both are strictly necessary, so neither needs consent.

4. Email, and how to stop it

We reply to waitlist requests by email. We plan to add a confirmation email and a short series of follow-up emails about the product. Before we send any follow-up email, this policy will describe it, and every one will carry an unsubscribe link. You can ask us to stop emailing you at any time by writing to compliance@corporatesafety.io.

5. Who we share data with

We do not sell or share the personal information this website and the waitlist collect. We share it only with the service providers below, each of which acts on our instructions.

Provider	Role	Data it sees	Location
Fly.io	Hosting, database	Waitlist records, server logs	US
Postmark	Email delivery	Name, email, messages we send	US
Fastmail	Our mailboxes	Email you send us	US
Infisical	Secrets storage	No visitor personal data	US

Fly.io hosts the site and its database in a single United States region, Dallas. Postmark sees your data only once we send waitlist email through it.

If you become a customer, your own account with your chosen inference provider is not our subprocessor. You choose and contract with that provider directly. Your inference is billed and governed under your own agreement with that provider, not ours. We store your provider credential encrypted, and use it only to forward the requests you send through the Gateway.

6. Customer content, and our commitment on personal data

In plain language: if you are a customer, we do not log the personal data your users send through the Gateway, we do not keep it in a form that identifies anyone, and we do not sell it or disclose it. The one exception is a retention class you configure yourself, and that content is held for you alone.

This section uses the definitions in Section 7 of our Terms of Service, and those definitions carry the same meaning here. In short, Customer Content is what you send through the Gateway and what comes back, and Personal Data is the part of it that identifies a person or an organization. Personal Data covers personal identifiers, payment card data, health identifiers, credentials and secrets, and every custom detection class your organization defines.

6.1 We do not log it

Our logs and traces contain no prompt, no completion, no payload, and no credential. A value shaped like a secret is suppressed at the logging surface by the same detector the screening stage uses. User identity appears in our logs only as an opaque identifier.

6.2 We do not retain it in identifiable form

By default, the redaction engine screens every request, unless you choose by policy to send traffic without screening. It replaces each detected value with a generic placeholder that names a category and a position, such as [Name 1], and carries no part of the original value. The table mapping a placeholder back to its value lives only in the short-lived state of its own conversation, encrypted under your retention class's data key, and it expires with that state. It never enters a request record, a capture, or an export, so a recorded or exported placeholder names a category and an order and nothing more. Once that state has expired, no operator, process, or record of ours can reverse it.

We do not retain Personal Data in identifiable form, except where you configure a retention class that does, and then solely for you and encrypted under that class's key. The choice is yours: a class may capture no payload, a screened payload, or a full payload, the default retention period is 30 days, and a full payload is refused outright for payment card data. You may also choose by policy to send traffic without screening. Content stored under a class you chose is your data, held on your instruction, and governed by your agreement and its data processing addendum rather than by Section 7 of this policy.

6.3 We do not sell or disclose it

We do not sell, license, rent, trade, or otherwise disclose Personal Data to any third party, and we do not share it for cross-context behavioral advertising. We disclose it to no one but the inference provider you chose and instructed us to call, and to no one else except where a binding legal process compels it, in which case we will notify you unless the law forbids it.

7. How we use fully redacted and aggregated data

In plain language: after data has been redacted and then de-identified, so that it points to no person and to no company, we reserve the right to study it, to improve and secure the service with it, to train our own models on it, and, in the future, to license or sell it. We will tell you before we first license or sell it, and an enterprise customer can switch the last two uses off.

This section is separate from Section 6 on purpose. Nothing here applies to Customer Content or to Personal Data, which Section 6 governs without qualification.

7.1 What Fully Redacted Data is

Fully Redacted Data is data derived from Customer Content after two steps, in sequence: the redaction engine has replaced every detected value with a generic placeholder, and we have then de-identified the result so that all three of the following hold.

1. We have taken reasonable technical and organizational measures to ensure the data cannot reasonably be linked, directly or indirectly, to any individual, household, device, or customer organization.
2. We commit publicly, in Section 7.3, to maintain and use it only in de-identified form, and never to attempt to re-identify it.
3. We contractually obligate every recipient to those same conditions.

That test follows Cal. Civ. Code 1798.140(m) and the three-part de-identification test in the FTC's privacy report. Data that remains reasonably linkable to a person or to your organization is not Fully Redacted Data, and nothing in this section applies to it.

Aggregated Data is statistics and other measures describing a group or category rather than any single request, person, or customer. Service Data is operational metadata, such as latency, token counts, selected provider, and counts of findings by category, and it excludes Customer Content and Personal Data.

7.2 What we use it for

We use Fully Redacted Data and Aggregated Data for these purposes, and for no others:

(a) building and refining routing tables, task-class taxonomies, and evidence of quality and cost

(b) operating, improving, securing, troubleshooting, and developing the service

(c) training, fine-tuning, and evaluating models that we or our licensors own

(d) licensing, sharing, or selling it to third parties, a right we reserve for the future and have not exercised as of the last updated date of this policy

Background sampling runs masked requests to calibrate cost and quality estimates, and our routing classifier trains on sampled, masked traffic. Both operate under paragraphs (a) and (b).

7.3 We will not re-identify it

We commit, publicly and as a term of your agreement, to maintain and use Fully Redacted Data only in de-identified form, and never to attempt to re-identify it or to link it to any individual, household, device, or organization. We retain no key or mapping that would permit re-identification, and we do not reconstruct one.

Fully Redacted Data never includes your organization's name, your users' names, any credential or secret, or any confidential identifier of yours. Anything we use is stripped of your organization's identity as well as of every individual's, so no use under this section discloses that you are a customer or what your traffic contains.

7.4 Anyone we give it to is bound by the same rules

We will not license, share, or sell this data to a third party unless that recipient first agrees in writing not to attempt re-identification, not to transfer it onward except under terms at least as protective, and to permit our audit and to delete the data on our written request. A recipient's breach entitles us to terminate its license and require deletion.

7.5 Notice, opt-out, and prospective effect only

Before the first time we license or sell this data to a third party under paragraph (d), we will give you advance written notice. An enterprise customer may opt out of paragraphs (c) and (d) by order form or by its master services agreement, at no change in price, and any administrator your organization authorizes may exercise that opt-out.

These uses apply only to Customer Content processed after you accept the terms that introduce them. We never apply a looser policy retroactively to data received under a stricter one.

7.6 Health data

We use data derived from protected health information only where it has been de-identified in accordance with 45 CFR 164.514(b), and only where any business associate agreement between us expressly permits that de-identification and the resulting use. Where either condition fails, the data is excluded from this section.

7.7 Who owns what

You own Customer Content. We own Fully Redacted Data, Aggregated Data, and Service Data, along with the models, routing tables, and taxonomies we derive from them. Sections 7.3 and 7.4 survive termination of your agreement, and our rights under Section 7.2 survive it only for data already de-identified before termination took effect.

Note for counsel: the CCPA's de-identification carve-out at 1798.145(a)(5) runs to a "business," and we are a service provider for Customer Content. Confirm whether we may invoke it, or whether the customer must grant the right in the data processing addendum.

Note for counsel: confirm the business associate agreement position before any health-derived data is used, and whether Cal. Civ. Code 1798.148 applies to a license of de-identified patient information.

Note for counsel: under GDPR Recital 26 and EDPS v SRB (C-413/23 P), confirm that the decision ledger's pseudonymous subject id and the expiring placeholder table leave us no linking means, and settle the EU anonymisation threshold this section asserts.

8. Do Not Sell, Do Not Share, and Global Privacy Control

We do not sell or share personal information as those terms are defined under US state privacy laws. That holds for the personal information this website and the waitlist collect, and for the Personal Data in customer content under Section 6. Since you have nothing to opt out of, we take no separate action on Global Privacy Control or Do Not Track signals. If that ever changes, we will update this policy and honor those signals before the change takes effect.

The rights reserved in Section 7 concern data that has been de-identified, which US state privacy laws exclude from the definition of personal information. We treat that exclusion as conditional on the test in Section 7.1 actually being met.

9. How long we keep it

We keep waitlist form data until you ask us to delete it, or for 24 months after our last contact with you, whichever comes first. Server logs are kept only as long as our hosting provider's log retention allows, and are used only to run and secure the site. Email delivery records are kept for as long as Postmark's own retention applies, and are used only to diagnose delivery problems.

If you become a customer, the retention of your production content is a separate matter. It is governed by the retention class your organization configures under your agreement, and its data processing addendum, not by this website policy.

10. Your rights

Depending on where you live, you may have rights over the personal data we hold about you. They can include the right to access, correct, delete, or export it. You may also have the right to object to or restrict our processing, and to lodge a complaint with a supervisory authority.

• EU and UK residents (GDPR and UK GDPR): you have the rights above, plus the right to data portability. Where we rely on legitimate interest, you can object, and we will stop unless we have a compelling reason to continue. You can complain to your local data protection authority, or to the UK Information Commissioner's Office.
• California and other US state residents: you have the right to know what we collect, to delete it, to correct it, and to opt out of sale or sharing, which we do not do. California residents can also ask which categories of personal information we have disclosed, for a business purpose, which is limited to the providers listed in Section 5. We will not discriminate against you for exercising any of these rights.

To exercise any of these rights, write to compliance@corporatesafety.io. We will respond within the time your law requires.

11. International transfers

We are based in, and host data in, the United States. If you contact us from the EU, the UK, or elsewhere outside the US, your personal data is transferred to the United States for processing. We rely on the EU Standard Contractual Clauses, and the UK International Data Transfer Addendum, as our transfer mechanism. Counsel will confirm the current adequacy framework before this policy is finalized.

12. Security

We apply reasonable technical and organizational measures to protect the data this site collects. These include encryption in transit and access controls on our hosting and database provider. No system is perfectly secure, and we do not claim a certification we do not hold. Our compliance documentation, available on request, describes which controls the product supports for customer data.

13. Children

This site and the waitlist are directed at businesses, not at children. We do not knowingly collect personal data from anyone under 16, and if we learn we have, we will delete it.

14. Changes to this policy

We will post the new effective date at the top of this page whenever we change it. For a material change we will also email you if you are on the waitlist, consistent with California's Online Privacy Protection Act. We never apply a looser policy retroactively to data you gave us under a stricter one. That applies to the rights reserved in Section 7 as much as to anything else in this policy: they reach only data processed after the terms introducing them are accepted, and for a paying customer only on that customer's affirmative acceptance.

15. Contact and complaints

For any question about this policy, or to exercise a right described in Section 10, write to compliance@corporatesafety.io. For anything about our terms, write to compliance@corporatesafety.io. EU and UK residents can also complain to their local data protection authority, or to the UK Information Commissioner's Office, at any time.