Privacy Policy

1. Data we collect

Account data: your email address, display name, avatar, authentication identifiers, and, if you sign in with a provider such as Google, the basic profile that provider returns.

Content data: the prompts, files, images and other Input you submit, the projects, code and Output generated for you, your chat history, project settings, published site content, and any data your published site stores in Cerceal-managed storage.

Usage and technical data: build credit usage, log records, error reports, IP address, device and browser information, timestamps, and pages viewed on published sites (aggregate view counts).

Billing data: plan, transaction records and billing status. Card details are handled by our payment processor and are not stored by us.

2. Why we use it

To provide the Service: authenticate you, run builds, generate and host sites, sync project data and show your history.

To operate and improve: monitor reliability, debug failures, measure usage, prevent abuse and fraud, and enforce limits.

To communicate: service, security and billing notices, and product updates you can opt out of.

To comply with law and to establish, exercise or defend legal claims.

Where the law requires a legal basis, we rely on performance of our contract with you, our legitimate interests in operating and securing the Service, your consent where asked, and compliance with legal obligations.

3. AI processing

To generate a site, your prompts, attached files and relevant project context are sent to third-party AI model providers acting as our processors. We instruct them to process this material only to return a response to us. Do not submit personal data, credentials or confidential material that you would not want processed by a model provider.

We do not sell your content, and we do not use your private project content to train our own models.

4. Who we share it with

Service providers who help us run Cerceal, under contract and only for that purpose: cloud hosting and databases, AI model providers, authentication, email delivery, error monitoring, analytics and payment processing.

Legal and safety recipients: authorities or others where disclosure is required by law, or reasonably necessary to investigate abuse, enforce our Terms, or protect the rights, property or safety of Cerceal, our users or the public.

Corporate transactions: an acquirer or successor in a merger, financing or sale of assets, subject to this policy.

We do not sell personal data and we do not share it for cross-context behavioural advertising.

5. International transfers

Our providers operate in several countries, so your data may be processed outside your own. Where required, we rely on appropriate safeguards such as standard contractual clauses.

6. Retention

We keep account and project data for as long as your account is active. After you delete a project or your account, we remove it from active systems within a reasonable period and from backups on our normal backup cycle. We keep limited records longer where needed for security, billing, accounting or legal obligations.

7. Security

We use encryption in transit, access controls, row-level authorisation on stored project data, hashed credentials for accounts created inside published sites, and least-privilege access for our team. No service can promise perfect security, so please use strong, unique passwords and tell us at legal@cerceal.cloud if you find a vulnerability or suspect a breach.

8. Your rights

Depending on where you live, you may have the right to access, correct, delete, port, restrict or object to the processing of your personal data, and to withdraw consent. You can edit or delete much of your data directly in the product, and you can request the rest at legal@cerceal.cloud. We will verify your identity before acting and will respond within the time the law allows. You may also complain to your local data protection authority.

9. Cookies and similar technologies

We use cookies and browser storage that are necessary to sign you in, keep your session, remember preferences such as your active workspace, and keep the Service secure. We do not use advertising cookies. Blocking essential cookies will break sign-in.

10. Children

Cerceal is not directed at children under 13, and we do not knowingly collect their personal data. If you believe a child has given us data, contact us and we will delete it.

11. Sites built by our users

When you visit a site built and published with Cerceal, the person or organisation that built it decides what data that site collects and is responsible for its own privacy notice. We host that site on their behalf. Direct questions about such a site to its operator.

12. Changes and contact

We may update this policy; the date above shows the current version, and material changes will be signalled in the product where appropriate.

Contact: Cerceal Labs, legal@cerceal.cloud.