Calphant Privacy Policy

Who we are

calphant app LTD is the controller of your personal data. We are a company registered in England and Wales. You can reach us about anything in this policy at hi@calphant.dev.

What we collect

• Your account: your name, email address, country and your company's name. If you sign in with Google, Google sends us your name, email address and profile picture; we use only your name and email address.
• Payment: Stripe handles payment. We never see your card number. We receive a customer reference, your subscription status and whether each payment succeeded.
• What you give Calphant: your conversation with Steve, the instructions you give, the files and pictures you attach, and the work your AI employees produce for you.
• Connected accounts and sign-ins: when you connect a service, we store the key or sign-in it needs, encrypted. When you keep a sign-in to a website for your employees to use, we store that website's sign-in cookies, encrypted, for that one site and only for your company. Your employees and the AI models never see these values.
• The record of actions: every action your AI employees take, what allowed it and what happened, so you and we can check what was done.
• Usage: how much AI work your company uses, to apply your plan's allowance.
• Technical data: your IP address and basic request details, to keep the service secure and prevent abuse.

Why we use it, and our lawful basis

We do not sell your data. We do not show you advertising. We do not make decisions about you that have legal or similarly significant effects based solely on automated processing.

Training AI models on the work done in Calphant

We collect the work done in Calphant and use it to train and improve AI models, including models Calphant builds. This covers your conversation with Steve, the instructions you give, the files and pictures you attach, the work your AI employees produce, and the record of actions. It may include personal data that the work contains.

We never train on your keys, passwords, website sign-ins or payment details, on data we receive through Google APIs, or on data from any other connected service whose terms do not allow it.

You can object to this use at any time by writing to hi@calphant.dev. From then on we stop using your new work for training, unless the law allows us to continue. Work that has already been used to train a model cannot be removed from that model.

Google user data

If you sign in with Google, we receive your name, email address and profile picture from Google. We use your name and email address only to create your account, sign you in and contact you about your account. We store them with our sign-in provider, Supabase, and share them with no one else, except as this policy describes for running Calphant.

If you connect a Google account for your AI employees to use (for example, to send email for your company), we access only what you approve on Google's screen, only to carry out your instructions, and we store the sign-in encrypted. You can disconnect it at any time from Calphant or from your Google account settings.

Calphant's use and transfer of information received from Google APIs follows the Google API Services User Data Policy, including the Limited Use requirements and the Google Workspace API User Data Policy. We do not use Google user data to train AI models and we do not sell it.

Who we share it with

We share personal data only with the providers that run parts of Calphant for us, and only what each one needs. They act on our instructions under contracts that protect your data.

We may also disclose personal data where the law requires it, or to protect people's safety.

International transfers

Your company's data is stored in Singapore. Some providers above process data in the United States, and the model hosts OpenRouter routes to may process it in the United States, China or other countries. When personal data leaves the UK, we protect it with a safeguard UK law recognises: UK adequacy regulations where they exist, the UK Extension to the EU-US Data Privacy Framework for certified US providers, or the UK International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses. You can ask us for a copy of the safeguard that applies by writing to hi@calphant.dev.

How long we keep it

While your company is open, we keep what is needed to run it. When you close your company, work stops and stored keys, sign-ins and website cookies are deleted at once. We keep financial records for six years, as UK tax law requires. Work used for training is kept for as long as it is useful for training, and what a model has already learned from it stays in that model.

The record of actions is tamper-evident: its entries cannot be removed without breaking the proof that nothing was changed. If you ask us to delete your data after closing, we delete your conversations, files and the contents of your employees' work within one month, and keep only the minimal entries that show an action happened, for as long as we need them to meet legal obligations or to establish, exercise or defend legal claims.

Your rights

Under UK data protection law you have the right to:

• ask for a copy of your personal data;
• ask us to correct data that is wrong;
• ask us to delete your data;
• ask us to restrict how we use your data;
• ask for your data in a portable format;
• object to our use of your data where we rely on our legitimate interests, including for training AI models;
• withdraw consent where we rely on it.

To use any of these rights, write to hi@calphant.dev. We will answer within one month. You can also read your company's record and download a copy of it from the product, disconnect any service or forget any website sign-in at any time, and close your company.

If you are unhappy with how we handle your data, please tell us first. You also have the right to complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.

Cookies and browser storage

Calphant uses one cookie, which is strictly necessary to keep you signed in, and stores one preference in your browser that you set yourself (whether the sidebar is shown). We use no advertising, analytics or tracking cookies.

Security

Connections are encrypted, stored keys and sign-ins are encrypted, and each company can reach only its own work, files and connected accounts. No system is perfectly secure. If a personal data breach puts your rights at risk, we will tell you and the Information Commissioner's Office as the law requires.

Children

Calphant is not for anyone under 18.

Changes

We will tell you by email before a change to this policy that affects you.

Contact

calphant app LTD. Email: hi@calphant.dev.