Privacy Policy

What we collect

Your account details (name, email), the business data you put in (contacts, projects, documents, messages), and basic usage logs (what happened when — the same audit trail you can see in the product).

Your clients' information reaches us because YOU add it. For that data we act as a processor on your behalf: you decide what's stored and when it's deleted.

What we never do

We don't sell your data or your clients' data. We don't use your business data to advertise to anyone. We don't train AI models on your data.

AI features

AI features run only when you (or your workspace) connect an AI key, and only on the text needed for the task you asked for — a note you want organized, a thread you want drafted, a contract you want reviewed. Requests go to the AI provider you configured (via OpenRouter); results are shown to you and not used for anything else.

Who else touches data

A short list of processors run the service: Vercel (hosting), Neon (database), Stripe (payments — money goes directly between you and your clients), Resend (email delivery), Inngest (background jobs), Sentry (error monitoring). Each sees only what's needed for its job.

Security

Data is encrypted in transit (TLS) and at rest. Especially sensitive values — connected-account tokens, API credentials — are additionally encrypted at the application level. Sign-in links and portal links are signed and time-limited. Staff access to customer workspaces is time-boxed, banner-visible, and logged.

Your controls

Export your contacts anytime; download any document. Close your account and we delete your data within 30 days (excluding records we must keep by law). Email hello@cygnetree.com for any privacy request and a human will handle it.