Privacy Policy

1. Information we collect

• Account and profile data, such as email address, workspace name, and company profile details.
• Uploaded source files and the text or metadata extracted from them so the product can ground outputs in your company context.
• Encrypted provider-key records, provider status metadata, billing and subscription metadata, and task or loop history.
• Technical and product-use data required to run the app, maintain sessions, store preferences such as theme or text size, and protect the platform from misuse.

2. How we use information

• To create and secure accounts and workspaces.
• To process uploads, retrieve context, run tasks, save outputs, and show history inside the product.
• To manage subscriptions, enforce plan limits, and provide customer support or operational notices.
• To protect the service, investigate abuse, debug issues, and improve reliability.

3. How BYOK affects processing

When you run tasks, relevant prompts and grounded context are sent to the AI provider connected to your workspace. Those requests are processed under your provider relationship and are subject to that provider's policies and retention practices.

Provider API keys are stored in encrypted form inside CTRON Loop. We do not display the raw value back to clients after it is saved.

3a. CTRON managed AI (optional)

If you turn on CTRON AI in Settings, your task prompts and grounded context are instead sent to the third-party inference provider we use to run open models on your behalf. This is distinct from BYOK: with managed AI the request leaves our systems to our inference provider rather than to a provider you chose, and is subject to that provider's policies.

Managed AI is optional and off by default. Usage is metered against your plan's allowance. You can switch back to your own key at any time.

4. Storage and security

Workspace data is designed around row-level isolation so one user's workspace cannot access another user's data through the application layer. Uploaded source files are stored in workspace-scoped paths.

We use reasonable technical and organizational measures to protect the service, but no system is perfectly secure. You should avoid uploading data that requires guarantees beyond the product's current security posture unless you have independently assessed the risk.

5. Sharing

We share data only with the service providers required to operate the product, such as hosting, database, storage, billing, the AI providers you choose to connect through BYOK, and, only if you turn on CTRON managed AI, our managed inference provider.

We may also disclose information when required by law, to enforce our terms, or to protect the rights, safety, and security of users or the platform.

5a. Cookies

Essential cookies are always set, because the product cannot work without them. They keep you signed in, remember which workspace you are in, and protect the service against abuse. They are not used to build a profile of you or to advertise to you.

Optional cookies cover two things. The first is understanding how the product is used, so we can see which parts work and which do not; this is measured by account identifier, never by name or email address. The second is measuring which adverts bring people to CTRON Loop, which uses the Meta Pixel in your browser and the Meta Conversions API from our servers. Only two things are reported to Meta: viewing our public product pages, and completing account registration. Where you are signed in, your email address and account identifier reach Meta only as an irreversible hash, never in readable form.

Optional cookies are off until you choose to turn them on. Nothing loads and no optional cookie is set before you accept, and declining is a single click in the same place as accepting. If you change your mind we delete the optional cookies already set rather than simply stopping.

You can change your answer at any time using the Cookie settings link in the footer, which appears on the home page, pricing, and this policy.

6. Retention and deletion

We keep data for as long as needed to provide the service, maintain records, resolve disputes, and meet legal or security obligations.

You can delete certain resources from within the product, and account or workspace deletion features may remove associated records. Some operational backups or logs may persist for a limited period where required for resilience or compliance.

7. Your choices

• You can update workspace details, company profile information, provider connections, and certain account settings inside the app.
• You can cancel a paid subscription through the billing portal.
• You can stop using the service at any time, subject to any remaining billing obligations for the current paid period.
• You can accept, decline, or withdraw consent for optional cookies at any time using the Cookie settings link in the site footer.

8. International and legal rights

Depending on where you are located, you may have rights to access, correct, delete, or restrict certain personal data. We will honor mandatory rights that apply to the service under applicable law.

If we materially change this policy, we will update the published version and revise the last-updated date.