01 Overview
This Privacy Policy explains how Cesteral Intelligence collects, uses, shares, and protects personal data when you use our website, product, support channels, and related services.
It is written to support our obligations under the General Data Protection Regulation (GDPR) and other applicable privacy laws.
02 Who we are
For the personal data covered by this Privacy Policy, Cesteral AB ("Cesteral Intelligence") is the controller when we decide why and how that data is processed, such as for account administration, security, billing, support, and direct communications with you.
If you use Cesteral through a team or organization workspace, that workspace owner may be the controller for content, prompts, files, connected-source data, and workflow outputs submitted by its users. In those cases, Cesteral generally acts as a processor or service provider on that workspace's instructions, as described in our Data Processing Agreement.
If you have questions about this policy or want to exercise your rights, contact contact@cesteral.com.
03 Personal data we collect
3.1 Information you provide directly
- Account details such as name, email address, and organization or workspace details.
- Profile and settings information you choose to add.
- Billing and commercial information required to subscribe, invoice, or manage a paid relationship.
- Messages you send through our contact form, support channels, or other communications with us.
- Content you choose to submit to the product, including prompts, workflow configuration, uploaded files, governance requests, approval records, and connected-service credentials or metadata.
3.2 Information collected automatically
- Log and diagnostic data such as IP address, browser type, device information, timestamps, referring URLs, and error data.
- Product usage data such as pages viewed, features used, actions taken, tool executions, workflow runs, approval activity, audit logs, and security events.
- Cookie and similar technology data used for session management, security, and product operation.
3.3 Information from third parties
- Authentication and organization data from Clerk.
- Billing and subscription data from Stripe when billing is enabled.
- Contact and email-delivery metadata from Resend when we send transactional email.
- Data from third-party services you connect to the platform, such as Slack, cloud storage providers, CRMs, spreadsheets, or advertising platforms.
- Model inputs and outputs generated when you invoke AI or LLM features through the providers configured in your workspace.
04 How we use personal data
We use personal data to:
- provide, operate, secure, and maintain the platform;
- authenticate users and manage workspaces, roles, and permissions;
- execute workflows, tool calls, approvals, change sets, and related governance controls;
- process billing, subscriptions, invoices, and commercial requests;
- respond to support inquiries, product questions, and sales or contact requests;
- monitor performance, investigate incidents, detect abuse, and improve reliability;
- comply with legal obligations, enforce our terms, and protect our rights, users, and systems;
- improve the platform through analytics and operational insight; and
- send service, transactional, or administrative communications.
We do not sell personal data.
We do not use customer content submitted through the platform to train our own general-purpose models.
05 Legal bases for processing
Depending on the context, we process personal data on one or more of the following legal bases:
- Contract: to provide the services you request, maintain your account, and perform our obligations under our Terms, order forms, or other agreements.
- Legitimate interests: to secure the platform, prevent abuse, improve reliability, analyze usage, and operate our business.
- Consent: where we ask for consent, such as for optional marketing-related communications or similar preferences.
- Legal obligation: to meet accounting, tax, fraud-prevention, security, regulatory, or lawful disclosure requirements.
06 How we share personal data
We share personal data only as needed to operate the service, comply with law, or follow your instructions.
Categories of recipients include:
- infrastructure, hosting, database, and security providers, such as Supabase, Vercel, Sentry, and Inngest;
- identity, communications, and billing providers, such as Clerk, Resend, and Stripe when those services are in use;
- AI, integration, and connected-service providers that you or your workspace configure or invoke;
- professional advisers, auditors, insurers, and acquirers in the context of legitimate business operations; and
- law enforcement, regulators, courts, or other third parties when we are legally required to disclose information or when disclosure is necessary to protect rights, safety, or the platform.
If an organization invites you into its workspace, other workspace administrators may be able to access information associated with your use of that workspace.
07 International transfers
Our primary infrastructure is currently hosted in the United States through providers such as Supabase and Vercel. Some of our service providers and connected services may process data in countries outside the EEA or UK. Where required, we use appropriate safeguards for those transfers, including the EU-US Data Privacy Framework (where the provider is certified), Standard Contractual Clauses, supplementary technical measures, and other vendor transfer mechanisms designed to support GDPR compliance.
08 Data retention
We retain personal data for as long as reasonably necessary for the purposes described in this policy, including to provide the service, maintain security and records, resolve disputes, and comply with legal obligations.
Typical retention periods include:
| Data category | Typical retention approach |
|---|---|
| Account, workspace, and subscription records | Kept while the account or commercial relationship is active, then retained as needed for legal, accounting, and backup purposes |
| Support and contact requests | Kept as needed to respond, follow up, and maintain support history |
| Audit, security, and operational logs | Retained for a limited period based on security, troubleshooting, and compliance needs |
| Persisted workflow execution data | Retained only if data persistence is enabled, subject to the workspace retention setting |
| Billing and tax records | Retained as required by applicable accounting and tax laws |
Where a workspace enables optional workflow-data persistence, the retention period is configurable within the product and currently ranges from 7 to 90 days.
09 Security
We use administrative, technical, and organizational measures designed to protect personal data, including:
- encryption in transit and, where supported, at rest;
- access controls, role-based permissions, and least-privilege practices;
- audit logging, monitoring, and incident investigation;
- credential management and secret-handling controls; and
- backups, recovery procedures, and operational safeguards.
No system is completely secure, and we cannot guarantee absolute security.
10 Your rights
Depending on your location and the applicable law, you may have rights to:
- access personal data we hold about you;
- correct inaccurate or incomplete personal data;
- request deletion of personal data;
- restrict or object to certain processing;
- receive a portable copy of certain personal data; and
- withdraw consent where processing is based on consent.
If you use Cesteral through an organization workspace, requests relating to workspace-submitted content may need to be directed to that organization first, because it may control the underlying processing.
You may also have the right to lodge a complaint with your local data protection authority. For users in Sweden, the supervisory authority is IMY (Integritetsskyddsmyndigheten).
To make a privacy request, contact contact@cesteral.com.
11 Cookies and similar technologies
We use cookies and similar technologies for core functionality, security, session management, and platform operation. We may also use limited analytics or performance technologies to understand reliability and product usage. Where required by law, we will seek consent before using non-essential cookies or similar technologies.
The main categories of cookies and similar technologies we use are:
- Essential: session management (Clerk authentication), CSRF protection, and security tokens required for the platform to function.
- Analytics and performance: error tracking and reliability monitoring (Sentry) to help us identify and fix issues.
We do not currently use advertising or third-party tracking cookies.
12 Children's privacy
The platform is intended for business and professional use and is not directed to children. We do not knowingly collect personal data from children. If you believe a child has provided personal data to us, contact contact@cesteral.com.
13 Changes to this policy
We may update this Privacy Policy from time to time. When we do, we will post the updated version here and update the effective date above. If a change is material, we may also notify you through the product or by email.
14 Contact
For privacy questions, legal requests, or general inquiries about this policy, contact: