Privacy Policy

1. Data Controller

Cryptology LLC is the data controller responsible for your personal information. For any privacy-related inquiries, you can contact us at:

Contact: Submit a privacy request

2. Information We Collect

2.1 Information You Provide

• Account Information: Email address, password (stored in hashed form), and optional display name when you create an account.
• Content: Screenshots, text descriptions, and other materials you upload for issue generation.
• Project Data: Project names, settings, and generated issues.
• Communications: Information you provide when contacting us for support.
• Consent Records: Records of your agreement to our Terms of Service and this Privacy Policy, including timestamp, IP address, and document versions.
• Billing Information: If you subscribe to a paid plan, we store an identifier linking your account to your customer record with our payment processor, together with your plan, subscription status and billing period. We do not collect, receive or store your card number or other payment credentials: those are handled entirely by Stripe.

2.2 Information Collected Automatically

• Usage Data: Pages visited, features used, timestamps, and interaction patterns.
• Device Information: Browser type, operating system, device type, and screen resolution.
• Log Data: IP address, access times, referring URLs, and error logs.
• Cookies: We use essential cookies for authentication and session management. See Section 9 for details.

3. Legal Basis for Processing (EEA/UK Users)

If you are in the European Economic Area or United Kingdom, we process your personal data based on the following legal grounds:

• Contract Performance: Processing necessary to provide the Service you requested (Article 6(1)(b) GDPR).
• Legitimate Interests: Processing for our legitimate business interests, such as security, fraud prevention, and service improvement, where these interests are not overridden by your rights (Article 6(1)(f) GDPR).
• Legal Obligations: Processing required to comply with applicable laws (Article 6(1)(c) GDPR).
• Consent: Where you have given explicit consent for specific processing activities (Article 6(1)(a) GDPR).

4. How We Use Your Information

We use your information to:

• Provide, maintain, and improve the Service.
• Process your uploaded content using AI to generate issue tickets.
• Authenticate your identity and manage your account.
• Send essential service communications (account verification, security alerts, important notices).
• Detect, prevent, and address security threats, fraud, and abuse.
• Comply with legal obligations.
• Enforce our Terms of Service.

We do not: Sell your personal information, use your content to train AI models, or share your data for third-party marketing purposes.

5. AI Processing and Third-Party Services

Our Service uses third-party artificial intelligence providers, including OpenAI, to process your content. When you use AI features:

• Your content is transmitted to OpenAI's servers for processing.
• OpenAI processes this data according to their data usage policies (API data is not used to train their models by default).
• We do not use your content to train or improve AI models.
• Generated outputs are returned to our servers and stored in your account.

Other service providers we use:

• Vercel: Hosting, infrastructure, and temporary storage for the files you upload while an issue is being generated (data may be processed in the US).
• Neon: Database hosting (PostgreSQL).
• Resend: Transactional email delivery (verification and security notices).
• Cloudflare: Security and bot protection. Cloudflare receives your IP address and browser information in order to distinguish real users from automated traffic on forms that need bot protection, such as sign-in, sign-up, password reset and contact.
• Stripe: Payment processing and subscription management for paid plans. Stripe receives your email address and the payment details you enter directly into its checkout, and acts as an independent controller of that payment data under its own privacy policy.

Except where stated otherwise above, these providers act as our processors, are bound by data processing agreements, and are required to protect your information in accordance with applicable laws. Stripe determines its own purposes for the payment data you give it and is responsible for that data under its own privacy policy.

6. Data Sharing and Disclosure

We may share your information only in the following circumstances:

• Service Providers: With vendors who assist in providing the Service, subject to confidentiality obligations.
• Legal Requirements: When required by law, subpoena, court order, or government request. We will notify you when legally permitted.
• Protection of Rights: To protect our rights, property, or safety, or that of our users or the public.
• Business Transfers: In connection with a merger, acquisition, bankruptcy, or sale of assets, where your data may be transferred to a successor entity.
• With Your Consent: When you explicitly authorize sharing.

7. International Data Transfers

Your information may be transferred to and processed in countries outside your country of residence, including the United States, where data protection laws may differ from those in your jurisdiction.

For transfers from the EEA/UK, we rely on:

• Standard Contractual Clauses (SCCs) approved by the European Commission.
• Adequacy decisions where applicable.
• Other lawful transfer mechanisms as permitted by applicable law.

By using the Service, you consent to the transfer of your information to the United States and other countries as described in this policy.

8. Data Security

We implement industry-standard security measures to protect your data:

• Encryption in transit (TLS/SSL) and at rest.
• Secure password hashing algorithms.
• Regular security assessments and monitoring.
• Access controls and authentication requirements.
• Rate limiting and abuse prevention.

However, no method of transmission or storage is 100% secure. We cannot guarantee absolute security of your data. You acknowledge that you provide personal information at your own risk.

Limitation of Liability for Data Breaches: To the maximum extent permitted by law, our liability for any data breach shall be limited as set forth in our Terms of Service. We shall not be liable for unauthorized access resulting from your failure to maintain account security, phishing attacks, or other social engineering, or circumstances beyond our reasonable control.

9. Cookies and Tracking

We use cookies only where they are necessary to run the Service. We set no advertising, profiling or cross-site tracking cookies.

• Essential Cookies: Required for authentication, security, and basic functionality. These cannot be disabled.

We use Vercel Speed Insights to measure page performance and Vercel Web Analytics to count page views. Neither sets cookies, and neither builds a profile of you or tracks you across sites. Web Analytics records the page visited, the referring page, and coarse details such as country, browser and device type. It does not record your IP address, and it does not link visits together into a session that identifies you.

We do not use advertising cookies and we do not sell data to advertisers. Because the only cookies we set are the essential ones above, there is nothing to opt out of; blocking them in your browser will sign you out and prevent sign-in.

10. Data Retention

We retain your data as follows:

• Account Data: Retained while your account is active. When you delete your account it is erased, along with your projects, issues, sessions and subscription record.
• User Content: Issues, projects and settings are retained until you delete them or your account is closed.
• Attachments: Screenshots and recordings you upload are deleted from our storage as soon as the issue is generated, whether generation succeeds or fails. A file left behind by an interrupted submission is removed automatically once it is more than 24 hours old. We keep no copy of your attachments once generation has finished: only the generated issue text is stored in your account.
• Usage Records: We keep a timestamp for each issue you generate in order to measure usage against your plan. These timestamps are deliberately kept even if you later delete the issue itself, and are deleted when you delete your account.
• Billing Records: If you have subscribed to a paid plan, your subscription record is deleted with your account. Stripe retains its own record of the transaction for as long as its obligations require, under its own policy.
• Log Data: Operational and security logs are held by our hosting provider under its retention settings and are not kept indefinitely by us. We do not maintain a separate long-term log archive.
• Login Attempts: Records of sign-in attempts support rate limiting and account lockout, and are routinely removed once they are more than 24 hours old.
• Consent Records: Retained for the duration required by applicable law (typically 3-7 years) to demonstrate compliance. If you delete your account, the record is disconnected from your account but still holds a one-way hash of your email address and the IP address the acceptance came from, so that we can show our terms were agreed if that is ever disputed.
• Support and Privacy Requests: Messages you send us through the contact form are retained so that we can handle the request and show how it was handled. They keep the name, email address and message you sent, and are not deleted when you delete your account.

We may retain anonymized or aggregated data indefinitely for analytics purposes.

11. Your Privacy Rights

Depending on your location, you may have the following rights regarding your personal data:

11.1 All Users

• Access: Request a copy of your personal data.
• Correction: Request correction of inaccurate data.
• Deletion: Delete your account and its data from your account settings. Because deletion is irreversible, we ask you to re-enter your password, and your authentication code if you use two-factor authentication, before it proceeds. Your account, profile, projects, issues, sessions and subscription record are erased. Two things are deliberately kept, and neither is fully anonymous: your consent record, unlinked from your account but still holding a one-way hash of your email address and the IP it was accepted from, so we can show our terms were agreed; and any message you sent us through the contact form, which keeps the name, email address and text you supplied. If you want a contact message erased as well, ask us and we will remove it unless we are required to keep it.
• Data Portability: Receive your data in a structured format.

11.2 EEA/UK Users (GDPR)

• Restriction: Request restriction of processing in certain circumstances.
• Objection: Object to processing based on legitimate interests.
• Withdraw Consent: Withdraw consent at any time (where processing is based on consent).
• Complaint: Lodge a complaint with your local data protection authority.

11.3 California Users (CCPA/CPRA)

• Know: Right to know what personal information is collected, used, disclosed, or sold.
• Delete: Right to request deletion of personal information.
• Correct: Right to correct inaccurate personal information.
• Opt-Out: Right to opt-out of the sale or sharing of personal information (we do not sell or share personal information for cross-context behavioral advertising).
• Limit Sensitive Data: Right to limit use and disclosure of sensitive personal information (we do not collect sensitive personal information as defined by CPRA beyond account credentials).
• Non-Discrimination: Right not to be discriminated against for exercising privacy rights.

California "Shine the Light" (Civil Code § 1798.83): California residents may request information regarding disclosure of personal information to third parties for direct marketing purposes. We do not share personal information with third parties for their direct marketing purposes.

11.4 Other U.S. State Privacy Laws

If you are a resident of Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Utah (UCPA), or other states with comprehensive privacy laws, you may have similar rights including: access, correction, deletion, data portability, and the right to opt-out of targeted advertising, sale of personal data, and profiling. Contact us to exercise these rights.

11.5 Exercising Your Rights

To exercise any of these rights, submit a privacy request. We will respond within the timeframe required by applicable law (typically 30 days, or 45 days for CCPA/CPRA).

Identity Verification: To protect your privacy, we will verify your identity before processing requests. Verification may include confirming your email address, providing account information, or other reasonable methods. For requests made by authorized agents, we require written authorization from the account holder.

Appeals: If we deny your request, you may appeal by contacting us within 30 days. We will respond to appeals within the timeframe required by applicable law. If your appeal is denied, you may contact your local data protection authority.

12. Automated Decision-Making

Our Service uses artificial intelligence to generate content based on your inputs. This processing:

• Does not make decisions that produce legal effects or similarly significant effects on you.
• Is based on your explicit request to use AI features.
• Can be reviewed and modified by you before any use.

If you are in the EEA/UK and believe automated processing has significantly affected you, you may contact us to request human review of any decision.

13. Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will:

• Notify relevant supervisory authorities within 72 hours where required by applicable law (e.g., GDPR Article 33).
• Notify affected individuals without undue delay where the breach is likely to result in a high risk to their rights and freedoms.
• Document all breaches and remediation actions taken.

We maintain security incident response procedures and will take appropriate steps to mitigate any harm.

14. Children's Privacy

The Service is not intended for children under 18 years of age (or the age of majority in your jurisdiction). We do not knowingly collect personal information from children. If we learn that we have collected personal information from a child, we will promptly delete it. If you believe a child has provided us with personal information, please contact us.

15. Do Not Track

Some browsers have a "Do Not Track" (DNT) feature. We do not currently respond to DNT signals because there is no industry standard for handling them. We will update this policy if a standard is established.

16. Jurisdiction-Specific Provisions

16.1 United Kingdom (UK GDPR)

If you are in the United Kingdom, your personal data is protected under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. You have the same rights as EEA users described in Section 11.2 above. The relevant supervisory authority is the Information Commissioner's Office (ICO): https://ico.org.uk.

16.2 Brazil (LGPD)

If you are in Brazil, your personal data is protected under the Lei Geral de Proteção de Dados (LGPD). You have rights including: access, correction, deletion, portability, information about sharing, consent withdrawal, and the right to petition the ANPD (Autoridade Nacional de Proteção de Dados).

16.3 Australia (Privacy Act)

If you are in Australia, we handle your personal information in accordance with the Privacy Act 1988 and the Australian Privacy Principles (APPs). You have the right to access and correct your personal information. Complaints can be made to the Office of the Australian Information Commissioner (OAIC).

16.4 Canada (PIPEDA)

If you are in Canada, your personal information is protected under the Personal Information Protection and Electronic Documents Act (PIPEDA) or applicable provincial legislation. You have the right to access and correct your personal information. Complaints can be made to the Office of the Privacy Commissioner of Canada.

16.5 Other Jurisdictions

If you are located in a jurisdiction with specific privacy laws not listed above, we will comply with applicable requirements. Contact us for information about your specific rights.

17. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the version number and "Last updated" date at the top of this page. For significant changes, we may notify you via email or through the Service.

Your continued use of the Service after changes take effect constitutes acceptance of the revised policy. We encourage you to review this policy periodically.

18. Contact Us

For questions, concerns, or requests regarding this Privacy Policy or our data practices, please submit a request through our contact form.

For EEA/UK users: If you are not satisfied with our response, you have the right to lodge a complaint with your local data protection authority.