Platform Privacy Notice
This Privacy Notice explains how Ciridae, Ltd. and its subsidiaries and affiliates (collectively, “Ciridae,” “we,” “us,” or “our”) collect, use, disclose, and protect personal information in connection with Crucible and customer applications built and operated through the Ciridae Platform System.
This notice applies to the Platform, its authenticated web applications and APIs, and related support and integration services. Ciridae’s separate website privacy policy applies to the public website at ciridae.com. If a customer agreement, order form, or data processing agreement contains different terms, that agreement controls to the extent of the conflict.
Our role. For customer application content and connected-workspace data, Ciridae generally acts as a service provider or processor on behalf of the customer that makes the Platform available. The customer determines why the data is processed and who is authorized to use the Platform. Ciridae acts as an independent controller or business for information used to administer accounts, provide support, secure and improve the Platform, manage billing, and meet our legal obligations.
Information We Collect
The information we process depends on the features a customer enables and the permissions an administrator or user grants.
| Category | Examples |
|---|---|
| Account and identity data | Name, work email address, company, job title, user and tenant identifiers, profile information, authentication records, access roles, credentials, and session tokens. |
| Customer and application data | Records, workflow information, project data, files, configuration information, instructions, and other content submitted to or generated through a customer application. |
| Connected-service data | Google Workspace and Microsoft 365 data described below, together with authorization records and tokens needed to maintain the connection. |
| AI inputs and outputs | Prompts, instructions, retrieved context, files, model responses, user feedback, and related metadata processed through Ciridae’s LLM Gateway. |
| Operational telemetry | IP address, device and browser information, dates and times of access, usage events, error context, system and application logs, performance data, and session replay information. |
| Support and communications | Messages, support requests, meeting notes, troubleshooting information, and correspondence with Ciridae. |
| Commercial information | Customer relationship information, order forms, subscription and billing status, and transaction information. Payment card data is processed by our payment provider rather than stored directly by Ciridae. |
We receive information directly from users and customer administrators; automatically from use of the Platform; from connected Google, Microsoft, and other services at the direction of a user or customer; and from service providers, partners, and lawful public sources.
How We Use Information
We use information to:
- authenticate users, authorize requests, and administer accounts and integrations;
- provide, configure, operate, support, and troubleshoot the Platform;
- associate authorized correspondence and documents with the correct customer or project workspace;
- provide user-directed AI, search, summarization, analysis, and workflow features;
- monitor performance, reliability, availability, and product usage;
- detect, investigate, prevent, and respond to fraud, misuse, vulnerabilities, and security incidents;
- manage subscriptions, billing, customer relationships, and contractual obligations;
- comply with law, enforce agreements, and establish or defend legal claims; and
- create aggregated or de-identified information that does not reasonably identify an individual.
Where applicable law requires a legal basis, we process personal information as necessary to perform a contract, pursue legitimate interests such as providing and securing the Platform, comply with legal obligations, and, where required, based on consent. A customer is responsible for establishing its own lawful basis and providing required notices for data it directs Ciridae to process.
AI and Automated Processing
The Platform routes AI and language-model features through Ciridae’s LLM Gateway. When a user invokes an AI-enabled feature, relevant prompts, customer content, connected-service data, and retrieved context may be sent to contracted model and infrastructure providers solely to produce the requested result and operate the feature. Access is limited to authorized services and personnel with a documented need.
AI-generated outputs may be incomplete, inaccurate, or inappropriate for a particular use. Users remain responsible for reviewing outputs before relying on them or using them to make decisions. The Platform is not intended to make solely automated decisions that produce legal or similarly significant effects about individuals unless expressly agreed in writing and implemented with appropriate safeguards.
Cookies, Analytics, and Session Replay
The Platform uses cookies and similar technologies for authentication, security, session management, preferences, and functionality. We also use product analytics, session replay, and error-monitoring services. Depending on configuration, these services may process user identifiers, usage events, error context, device information, and recordings of interactions with the Platform.
Where session replay is enabled, Ciridae configures masking controls intended to prevent sensitive fields and content designated as sensitive from appearing in recordings. Access to analytics and replay information is limited to authorized personnel and service providers that need it to operate, secure, troubleshoot, or improve the Platform. We retain this information only for as long as reasonably necessary for those purposes and applicable legal or contractual obligations. We do not use analytics or session replay information for cross-context behavioral advertising.
SMS Messaging
If you opt in to receive text messages from us, we collect your mobile phone number, your opt-in and opt-out records, and the content and metadata of the messages you exchange with us. We use this information to operate the messaging program, respond to you, provide support, and maintain the records required by applicable law and by mobile carriers.
We do not sell or share your SMS opt-in data or personal information with third parties for marketing purposes. Mobile information is shared only with the service providers that help us operate the messaging program, such as our messaging platform provider, and only for that purpose. No mobile information is shared with third parties or affiliates for their own marketing or promotional purposes.
You may opt out at any time by replying STOP to any message. Reply HELP for assistance. Message and data rates may apply. Message frequency varies.
How We Disclose Information
We may disclose information:
- to the customer that provides or administers the relevant Platform account;
- to service providers and subprocessors that host, secure, monitor, support, bill for, or provide AI, communications, and other functionality for the Platform, solely as needed to provide those services;
- to professional advisers, auditors, insurers, and financing sources subject to appropriate duties of confidentiality;
- when required by law, legal process, or a valid request from public authorities;
- to protect the rights, safety, property, and security of Ciridae, customers, users, and others;
- in connection with a merger, financing, acquisition, reorganization, or sale of assets, subject to appropriate protections; and
- with the customer’s or user’s direction or consent.
We do not sell personal information. We do not share personal information for cross-context behavioral advertising, and we do not use sensitive personal information to infer characteristics about individuals.
Security
The Ciridae Platform System is hosted on Google Cloud Platform. Ciridae uses administrative, technical, and physical safeguards designed to protect information, including encrypted HTTPS connections, encryption at rest for managed databases, object storage, and secret storage, private networking for production databases, role-based and least-privilege access controls, separated development and production environments, vulnerability management, monitoring, backups, change controls, and incident-response procedures. No method of storage or transmission is completely secure, and we cannot guarantee absolute security.
Retention and Deletion
We retain information only for as long as reasonably necessary to provide the Platform, satisfy documented business purposes, comply with legal and contractual obligations, resolve disputes, and enforce agreements. Retention depends on the type of information and the customer’s configuration.
| Data | General retention |
|---|---|
| Customer application and connected-service data | For the customer relationship and generally deleted within 60 days after contract termination, unless law or contract requires longer retention. Verified deletion requests are handled within the period required by applicable law and contract. |
| Infrastructure, system-event, and application logs | Generally up to one year. |
| Product analytics and session recordings | Generally up to one year. |
| Error and performance records | Generally up to 90 days. |
| Legal, security, and incident records | As necessary for legal, audit, security, and evidentiary obligations. |
Deletion from encrypted backups occurs through documented backup-expiration schedules. We may retain aggregated or de-identified information that cannot reasonably identify an individual. Legal holds and narrow security obligations may require longer retention.
Your Choices and Rights
Depending on your relationship with Ciridae and applicable law, you may have the right to request access, correction, deletion, portability, restriction, or objection; withdraw consent; or appeal a decision regarding a privacy request. You will not be discriminated against for exercising a legal privacy right.
If your account is provided by a customer organization, submit your request to that organization first. Ciridae will assist the customer as required by contract and law. For information Ciridae controls directly, contact privacy@ciridae.com. We may verify your identity and authority before completing a request.
You may disconnect Google Workspace through the Platform’s integration settings or revoke access from your Google Account. A Microsoft 365 administrator may revoke Crucible’s tenant authorization and remove mailbox or SharePoint assignments through Microsoft Entra, Exchange, and SharePoint administration. Disconnecting or revoking access stops future collection but does not automatically delete information already stored; submit a deletion request if you also want stored data removed.
California Privacy Rights
California residents may have rights to know, access, correct, delete, and obtain a portable copy of personal information, and to opt out of its sale or sharing. Ciridae does not sell personal information or share it for cross-context behavioral advertising. An authorized agent may submit a request where permitted by law. To exercise a right, email privacy@ciridae.com. These rights are subject to exceptions and may not apply when Ciridae processes information solely as a service provider for a customer.
International Transfers
Ciridae is based in the United States, and information may be transferred to and processed in the United States and other countries where Ciridae or its service providers operate. Where required, we use contractual or other recognized safeguards for international data transfers.
Children and Sensitive Information
The Platform is intended for business use and is not directed to children under 18. We do not knowingly collect personal information from children through the Platform. Do not submit protected health information, payment-card data, government identifiers, or other specially regulated data unless its processing is expressly authorized by a written agreement with Ciridae and appropriate safeguards have been implemented.
Changes to This Notice
We may update this notice as the Platform, integrations, or legal requirements change. We will post the updated notice with a revised effective date and provide additional notice or obtain consent when required. If we materially change how we use Google user data, we will update our disclosures and obtain any consent required by Google policy before using the data for the new purpose.
Contact Us
- Privacy
- privacy@ciridae.com
- General
- info@ciridae.com
- Address
- Ciridae, Ltd.
1003A O’Reilly Avenue
San Francisco, CA 94129
United States - Phone
- +1 610 608 9634
This notice is intended to describe Ciridae’s privacy practices. It is not a substitute for a customer-specific data processing agreement or other written agreement where one is required.