Data Protection Policy
Effective October 22, 2026
Last updated: 22 October 2026
This is the short form of how we protect personal data. The full detail is in our Privacy Policy and on the Data Processing page.
What we hold
Account data (name, email and sign-in credentials handled by our authentication provider), the business data you choose to connect, the content you create, and usage telemetry. Details are in the Privacy Policy.
How we use it
- To provide the service you asked for, to measure attributed revenue, to improve the product and to run the business.
- We do not sell personal data and we do not share it for third-party advertising.
- Your content and connected business data are not used to train third-party foundation models.
How we protect it
- Row-level security in the database, so each account can read only its own rows. Your browser never queries the database; every read runs through our API, scoped to the signed-in account.
- TLS encryption for data in transit between your browser, our application and our API.
- AES-256-GCM encryption on the connection keys we store for the services you connect (for example Stripe), so a stored key is not readable as plain text.
- An audit log of privileged actions by our staff. Each privileged admin action records one row (who, what and when), and the owner reads the log behind a permission. The write is best effort: it never blocks a request.
Who processes it
A small set of processors, each for one job: Stripe, Supabase, Anthropic, Resend, Vercel, Render and, only if you accept analytics cookies, PostHog. The roles are explained on the Data Processing page. If we add a processor that touches your data we update both pages first.
How long we keep it
While your account is active. When you delete your account we delete your account data and connected business data within 30 days, and it ages out of encrypted backups within 90 days. Where the law requires us to keep specific records, such as billing records for tax, we keep only those, only as long as required.
Your rights
You can ask for access, correction, deletion, export, and to object to or restrict processing, and you can complain to your data protection authority. Write to privacy@cerqular.ai. We verify it is you and then act within the time the law allows.
Privacy program
- Collection: we collect only the data the service needs, and we say why.
- Storage: data is stored in the United States, encrypted in transit and at rest, with row-level security.
- Sharing: data is shared only with the sub-processors listed on this page.
- Deletion: account data is deleted within 30 days of a verified request.
- Owner: Co-Founder and Co-CEO.
- Review: reviewed at least once a year. Last reviewed 22 October 2026. Next review 22 October 2027.
Not yet in place
- A Data Protection Officer: not yet in place.
- Formal third-party security certifications (for example SOC 2 or ISO 27001): not yet in place. We hold none.
- Until a Data Protection Officer is appointed, privacy@cerqular.ai reaches the founders.
Status of this text
Counsel review of this policy has not been completed. It states what the code and the infrastructure do today, and where a control is not yet in place it says so.