Privacy
In force from .
chromaticcoherence.ai is run by Chromatic Coherence. Write to support@chromaticcoherence.ai. Not registered for VAT.
1. Who is responsible
chromaticcoherence.ai is run by Chromatic Coherence. Write to support@chromaticcoherence.ai. Not registered for VAT. Chromatic Coherence decides what is kept and why, and is responsible for it, apart from each organisation's index, which the organisation decides.
2. What we keep, why, and for how long
| What | Why, and on what basis | Must you give it? | Kept by | How long |
|---|---|---|---|---|
| Your account: your email and password (stored hashed), or what Google gives when you sign in with it (your name, email and picture link); the name you go by | To run your account: our contract with you | The email and a password, or a Google sign-in, yes; the name, no | Supabase | Until your account is erased |
| Your sign-ins: each session's address and browser, and Supabase's log of sign-ins | To keep accounts safe: our legitimate interest | — | Supabase | A session until you sign out, or a day after it expires; the log as Supabase keeps it |
| The emails that reset a password or confirm a new account | To run your account: our contract with you | — | Sent by Supabase, through Zoho, from support@chromaticcoherence.ai | As Supabase keeps them; a copy in our sent mail until we delete it |
| A seat in an organisation: your email, the name you go by, the organisation and your role; a picture, where you added one on the site's earlier version, public at its address | To run the plan your organisation bought: our contract with its operator, who bought it; for every other member, our legitimate interest in running the organisation's plan, to which you may object | The email, yes; the name, no | Supabase; the picture in Supabase's storage | Until you are erased or the organisation closes; the picture's file deleted within a day of that, and a copy your browser kept until it expires |
| An invitation: the invitee's email and the name the operator typed, given by the operator, not by you | To let you join: our legitimate interest in running the organisation's plan | — | Supabase | 14 days to accept it; deleted when it is accepted, and 30 days after it expires or is revoked |
| A request for a seat: your work email, your organisation's name and the level you asked for | To answer it: our legitimate interest | The email, yes, so we can answer | Supabase | Deleted when your address takes a seat, or 12 months after you asked |
| The keys your assistants use: each stored as a hash, with its scope, the assistant and host it was made for, and when it was last used | To let your assistants reach the index: our contract with the operator, or our legitimate interest for a member | — | Supabase | They do not expire; deleted when you are erased or the organisation closes |
| A request to connect an assistant: the sign-in that opened it | To make sure only the person who opened it can allow it: our legitimate interest in keeping accounts safe | — | Supabase | Ten minutes; deleted when the next request is made after it expires |
| Your use of the index: each call, its units and its time | To meter the plan's units and bill them, on the same basis as your seat | — | Supabase | With the organisation's billing record; once you are erased it names no one |
| A seat blocked for abuse: the reason we gave, and its history | To protect the service: our legitimate interest | — | Supabase | With the organisation's billing record |
| Your choices: joining, and each assistant you connected, each with its time | To show what was chosen and when: our legitimate interest | — | Supabase | With the organisation's billing record |
| A record that an erasure was done: when, what was erased, and the code it was done under, which nothing left in our records ties to your name, email or account | To show the erasure was done: our legal duty to account for it | — | Supabase | With the organisation's billing record |
| A purchase: the plan, its seats and top-ups, the payment and the invoices, the organisation's name typed at the checkout, and the organisation and the plan as Stripe's metadata | To sell and account for the plan: our contract with the buyer, and our legal duty to keep business records | Yes, to buy | Stripe, and the organisation's billing record in Supabase | 7 years after the organisation closes, then erased |
| Emails you send to support, the email telling an organisation its plan has ended, and the export of an organisation's index we send its operator | To answer you and to run the plan: our legitimate interest; the export at the organisation's instruction | No | Zoho | Six years; sent mail until we delete it |
| Requests to the site and to our API: your address, the time, the page and your browser | To run and secure them: our legitimate interest | — | Vercel | As long as Vercel's logs on our plan keep them: one to thirty days |
| Visits to the site's pages: the page's address without anything after ? or #, the page that linked to it, and your country, browser, operating system and device. No cookie is set and nothing is stored in your browser | To see which pages are read, and make them better: our legitimate interest. Say no, free, on the cookies page, or by your browser sending Global Privacy Control | No | Vercel | The figure Vercel makes from your request to tell one visit from another: 24 hours. The counts: 12 months on our plan, and as long after as Vercel keeps them |
3. The organisation's index
What an organisation's members and their assistants file back to its index is the organisation's: after each piece of work, a label for the assistant that observed, what it stated and meant, its findings, its colour and how close what was stated came to what was meant; its sharing with the organisation; and the places asked, with what each held. The labels and what was stated and meant are sealed under a sealing key for each person, which only our API can open. The index adds no name, email or account, and keeps no question typed to it. Erasure and the export run only through our API. We keep it for the organisation, as the terms say; ask the organisation about it, and we help it answer you.
None of an organisation's index is used for our own ends: our own research reads our own organisation's index alone.
4. Your right to object
Where we rely on our legitimate interest, you may object by writing to support@chromaticcoherence.ai. A member's seat runs the organisation's plan, so we weigh an objection with the organisation.
5. What we do not do
No advertising, no profiling and no automated decisions. We do not sell an organisation's index or share it with anyone, and no script from another site runs on the site: the one that counts visits is served from chromaticcoherence.ai itself.
6. Who else handles it, and where
| Who | What | Where | How a transfer is safeguarded |
|---|---|---|---|
| Supabase | Accounts, organisations, seats, each organisation's index, invitations and requests for a seat; the emails that reset a password and the email that confirms a new account | London (AWS eu-west-2); Supabase Pte. Ltd is in Singapore | The UK Addendum to the EU standard contractual clauses, in its data processing agreement |
| Stripe | Payments: it collects your email, billing address and card details at its checkout, and keeps its own records as a controller | Stripe's own locations | The UK addendum to the EU standard contractual clauses and the UK extension to the EU–US Data Privacy Framework, in its privacy policy |
| Vercel | Runs the site and our own API at api.chromaticcoherence.ai, which the site asks for your account; keeps their request logs; counts visits to the site's pages | Served from the United States (US East) | The UK international data transfer addendum with the standard contractual clauses, in its data processing agreement |
| Zoho | Support mail, the emails that reset a password or confirm a new account, the email telling an organisation its plan has ended, and the export of an organisation's index sent to its operator | Zoho's United States data centre | The model contractual clauses its privacy policy names |
| Its own sign-in, where you choose it: a controller of what it holds about you | Its own locations | Its own terms |
7. Closing an account
To close your account, write to support@chromaticcoherence.ai. We erase what we keep about you as a member: your name, your picture, the keys your assistants use and your sign-in. In each organisation's index we delete your sealing key, so your labels and what you stated and meant read as erased; the words of your findings, their colours and how close each came, your sharing and the places asked stay as your organisation's memory, under a code that nothing left in our records ties to your name, email or account. The erasure is whole once the store's backups from before it have aged out, within 7 days of it. An export of the index already sent to the organisation stays with it, and in our sent mail as the table above says. An organisation's operator closes the organisation first.
When an organisation closes, its index is returned to its operator on request and then erased, and its billing record is kept 7 years and then erased. An organisation whose plan lapsed 90 days ago closes, and its operator is told by email when the plan lapses.
8. Your rights
You may ask for a copy of what we keep about you, and to correct it, erase it, restrict it, object to it or take it elsewhere. Write to support@chromaticcoherence.ai; we answer within a month.
9. Complaints
Write to support@chromaticcoherence.ai. We acknowledge a complaint within 30 days and answer it without undue delay. You may also complain to the Information Commission, at ico.org.uk, at any time.
10. Children
The site is for people at work, and a plan is sold to people aged 18 or over.
Changes and earlier versions
This version is in force from . What the keys your assistants use record: the assistant and host each was made for, and when it was last used. A row for the request to connect an assistant, which keeps the sign-in that opened it for ten minutes. The email that confirms a new account is sent by Supabase, through Zoho, from support@chromaticcoherence.ai, and a copy is kept in our sent mail. Each earlier version is kept below, whole.
The version in force from
1. Who is responsible
chromaticcoherence.ai is run by Chromatic Coherence. Write to support@chromaticcoherence.ai. Not registered for VAT. Chromatic Coherence decides what is kept and why, and is responsible for it, apart from each organisation's index, which the organisation decides.
2. What we keep, why, and for how long
| What | Why, and on what basis | Must you give it? | Kept by | How long |
|---|---|---|---|---|
| Your account: your email and password (stored hashed), or what Google gives when you sign in with it (your name, email and picture link); the name you go by | To run your account: our contract with you | The email and a password, or a Google sign-in, yes; the name, no | Supabase | Until your account is erased |
| Your sign-ins: each session's address and browser, and Supabase's log of sign-ins | To keep accounts safe: our legitimate interest | — | Supabase | A session until you sign out, or a day after it expires; the log as Supabase keeps it |
| The email that resets a password | To run your account: our contract with you | — | Sent by Supabase, through Zoho, from support@chromaticcoherence.ai | As Supabase keeps them; a copy in our sent mail until we delete it |
| A seat in an organisation: your email, the name you go by, the organisation and your role; a picture, where you added one on the site's earlier version, public at its address | To run the plan your organisation bought: our contract with its operator, who bought it; for every other member, our legitimate interest in running the organisation's plan, to which you may object | The email, yes; the name, no | Supabase; the picture in Supabase's storage | Until you are erased or the organisation closes; the picture's file deleted within a day of that, and a copy your browser kept until it expires |
| An invitation: the invitee's email and the name the operator typed, given by the operator, not by you | To let you join: our legitimate interest in running the organisation's plan | — | Supabase | 14 days to accept it; deleted when it is accepted, and 30 days after it expires or is revoked |
| A request for a seat: your work email, your organisation's name and the level you asked for | To answer it: our legitimate interest | The email, yes, so we can answer | Supabase | Deleted when your address takes a seat, or 12 months after you asked |
| The keys your assistants use: each stored as a hash, with its scope and the assistant's client id | To let your assistants reach the index: our contract with the operator, or our legitimate interest for a member | — | Supabase | They do not expire; deleted when you are erased or the organisation closes |
| Your use of the index: each call, its units and its time | To meter the plan's units and bill them, on the same basis as your seat | — | Supabase | With the organisation's billing record; once you are erased it names no one |
| A seat blocked for abuse: the reason we gave, and its history | To protect the service: our legitimate interest | — | Supabase | With the organisation's billing record |
| Your choices: joining, and each assistant you connected, each with its time | To show what was chosen and when: our legitimate interest | — | Supabase | With the organisation's billing record |
| A record that an erasure was done: when, what was erased, and the code it was done under, which nothing left in our records ties to your name, email or account | To show the erasure was done: our legal duty to account for it | — | Supabase | With the organisation's billing record |
| A purchase: the plan, its seats and top-ups, the payment and the invoices, the organisation's name typed at the checkout, and the organisation and the plan as Stripe's metadata | To sell and account for the plan: our contract with the buyer, and our legal duty to keep business records | Yes, to buy | Stripe, and the organisation's billing record in Supabase | 7 years after the organisation closes, then erased |
| Emails you send to support, the email telling an organisation its plan has ended, and the export of an organisation's index we send its operator | To answer you and to run the plan: our legitimate interest; the export at the organisation's instruction | No | Zoho | Six years; sent mail until we delete it |
| Requests to the site and to our API: your address, the time, the page and your browser | To run and secure them: our legitimate interest | — | Vercel | As long as Vercel's logs on our plan keep them: one to thirty days |
| Visits to the site's pages: the page's address without anything after ? or #, the page that linked to it, and your country, browser, operating system and device. No cookie is set and nothing is stored in your browser | To see which pages are read, and make them better: our legitimate interest. Say no, free, on the cookies page, or by your browser sending Global Privacy Control | No | Vercel | The figure Vercel makes from your request to tell one visit from another: 24 hours. The counts: 12 months on our plan, and as long after as Vercel keeps them |
3. The organisation's index
What an organisation's members and their assistants file back to its index is the organisation's: after each piece of work, a label for the assistant that observed, what it stated and meant, its findings, its colour and how close what was stated came to what was meant; its sharing with the organisation; and the places asked, with what each held. The labels and what was stated and meant are sealed under a sealing key for each person, which only our API can open. The index adds no name, email or account, and keeps no question typed to it. Erasure and the export run only through our API. We keep it for the organisation, as the terms say; ask the organisation about it, and we help it answer you.
None of an organisation's index is used for our own ends: our own research reads our own organisation's index alone.
4. Your right to object
Where we rely on our legitimate interest, you may object by writing to support@chromaticcoherence.ai. A member's seat runs the organisation's plan, so we weigh an objection with the organisation.
5. What we do not do
No advertising, no profiling and no automated decisions. We do not sell an organisation's index or share it with anyone, and no script from another site runs on the site: the one that counts visits is served from chromaticcoherence.ai itself.
6. Who else handles it, and where
| Who | What | Where | How a transfer is safeguarded |
|---|---|---|---|
| Supabase | Accounts, organisations, seats, each organisation's index, invitations and requests for a seat; the emails that reset a password | London (AWS eu-west-2); Supabase Pte. Ltd is in Singapore | The UK Addendum to the EU standard contractual clauses, in its data processing agreement |
| Stripe | Payments: it collects your email, billing address and card details at its checkout, and keeps its own records as a controller | Stripe's own locations | The UK addendum to the EU standard contractual clauses and the UK extension to the EU–US Data Privacy Framework, in its privacy policy |
| Vercel | Runs the site and our own API at api.chromaticcoherence.ai, which the site asks for your account; keeps their request logs; counts visits to the site's pages | Served from the United States (US East) | The UK international data transfer addendum with the standard contractual clauses, in its data processing agreement |
| Zoho | Support mail, the email that resets a password, the email telling an organisation its plan has ended, and the export of an organisation's index sent to its operator | Zoho's United States data centre | The model contractual clauses its privacy policy names |
| Its own sign-in, where you choose it: a controller of what it holds about you | Its own locations | Its own terms |
7. Closing an account
To close your account, write to support@chromaticcoherence.ai. We erase what we keep about you as a member: your name, your picture, the keys your assistants use and your sign-in. In each organisation's index we delete your sealing key, so your labels and what you stated and meant read as erased; the words of your findings, their colours and how close each came, your sharing and the places asked stay as your organisation's memory, under a code that nothing left in our records ties to your name, email or account. The erasure is whole once the store's backups from before it have aged out, within 7 days of it. An export of the index already sent to the organisation stays with it, and in our sent mail as the table above says. An organisation's operator closes the organisation first.
When an organisation closes, its index is returned to its operator on request and then erased, and its billing record is kept 7 years and then erased. An organisation whose plan lapsed 90 days ago closes, and its operator is told by email when the plan lapses.
8. Your rights
You may ask for a copy of what we keep about you, and to correct it, erase it, restrict it, object to it or take it elsewhere. Write to support@chromaticcoherence.ai; we answer within a month.
9. Complaints
Write to support@chromaticcoherence.ai. We acknowledge a complaint within 30 days and answer it without undue delay. You may also complain to the Information Commission, at ico.org.uk, at any time.
10. Children
The site is for people at work, and a plan is sold to people aged 18 or over.
The version in force from
1. Who is responsible
chromaticcoherence.ai is run by Chromatic Coherence. Write to support@chromaticcoherence.ai. Not registered for VAT. Chromatic Coherence decides what is kept and why, and is responsible for it, apart from each organisation's index, which the organisation decides.
2. What we keep, why, and for how long
| What | Why, and on what basis | Must you give it? | Kept by | How long |
|---|---|---|---|---|
| Your account: your email and password (stored hashed), or what Google gives when you sign in with it (your name, email and picture link); the name you go by | To run your account: our contract with you | The email and a password, or a Google sign-in, yes; the name, no | Supabase | Until your account is erased |
| Your sign-ins: each session's address and browser, and Supabase's log of sign-ins | To keep accounts safe: our legitimate interest | — | Supabase | A session until you sign out, or a day after it expires; the log as Supabase keeps it |
| The email that resets a password | To run your account: our contract with you | — | Sent by Supabase | As Supabase keeps them |
| A seat in an organisation: your email, the name you go by, the organisation and your role; a picture, where you added one on the site's earlier version, public at its address | To run the plan your organisation bought: our contract with its operator, who bought it; for every other member, our legitimate interest in running the organisation's plan, to which you may object | The email, yes; the name, no | Supabase; the picture in Supabase's storage | Until you are erased or the organisation closes; the picture's file deleted within a day of that, and a copy your browser kept until it expires |
| An invitation: the invitee's email and the name the operator typed, given by the operator, not by you | To let you join: our legitimate interest in running the organisation's plan | — | Supabase | 14 days to accept it; deleted when it is accepted, and 30 days after it expires or is revoked |
| A request for a seat: your work email, your organisation's name and the level you asked for | To answer it: our legitimate interest | The email, yes, so we can answer | Supabase | Deleted when your address takes a seat, or 12 months after you asked |
| The keys your assistants use: each stored as a hash, with its scope and the assistant's client id | To let your assistants reach the index: our contract with the operator, or our legitimate interest for a member | — | Supabase | They do not expire; deleted when you are erased or the organisation closes |
| Your use of the index: each call, its units and its time | To meter the plan's units and bill them, on the same basis as your seat | — | Supabase | With the organisation's billing record; once you are erased it names no one |
| A seat blocked for abuse: the reason we gave, and its history | To protect the service: our legitimate interest | — | Supabase | With the organisation's billing record |
| Your choices: joining, and each assistant you connected, each with its time | To show what was chosen and when: our legitimate interest | — | Supabase | With the organisation's billing record |
| A record that an erasure was done: when, what was erased, and the code it was done under, which nothing left in our records ties to your name, email or account | To show the erasure was done: our legal duty to account for it | — | Supabase | With the organisation's billing record |
| A purchase: the plan, its seats and top-ups, the payment and the invoices, the organisation's name typed at the checkout, and the organisation and the plan as Stripe's metadata | To sell and account for the plan: our contract with the buyer, and our legal duty to keep business records | Yes, to buy | Stripe, and the organisation's billing record in Supabase | 7 years after the organisation closes, then erased |
| Emails you send to support, the email telling an organisation its plan has ended, and the export of an organisation's index we send its operator | To answer you and to run the plan: our legitimate interest; the export at the organisation's instruction | No | Zoho | Six years; sent mail until we delete it |
| Requests to the site and to our API: your address, the time, the page and your browser | To run and secure them: our legitimate interest | — | Vercel | As long as Vercel's logs on our plan keep them: one to thirty days |
| Visits to the site's pages: the page's address without anything after ? or #, the page that linked to it, and your country, browser, operating system and device. No cookie is set and nothing is stored in your browser | To see which pages are read, and make them better: our legitimate interest. Say no, free, on the cookies page, or by your browser sending Global Privacy Control | No | Vercel | The figure Vercel makes from your request to tell one visit from another: 24 hours. The counts: 12 months on our plan, and as long after as Vercel keeps them |
3. The organisation's index
What an organisation's members and their assistants file back to its index is the organisation's: after each piece of work, a label for the assistant that observed, what it stated and meant, its findings, its colour and how close what was stated came to what was meant; its sharing with the organisation; and the places asked, with what each held. The labels and what was stated and meant are sealed under a sealing key for each person, which only our API can open. The index adds no name, email or account, and keeps no question typed to it. Erasure and the export run only through our API. We keep it for the organisation, as the terms say; ask the organisation about it, and we help it answer you.
None of an organisation's index is used for our own ends: our own research reads our own organisation's index alone.
4. Your right to object
Where we rely on our legitimate interest, you may object by writing to support@chromaticcoherence.ai. A member's seat runs the organisation's plan, so we weigh an objection with the organisation.
5. What we do not do
No advertising, no profiling and no automated decisions. We do not sell an organisation's index or share it with anyone, and no script from another site runs on the site: the one that counts visits is served from chromaticcoherence.ai itself.
6. Who else handles it, and where
| Who | What | Where | How a transfer is safeguarded |
|---|---|---|---|
| Supabase | Accounts, organisations, seats, each organisation's index, invitations and requests for a seat; the emails that reset a password | London (AWS eu-west-2); Supabase Pte. Ltd is in Singapore | The UK Addendum to the EU standard contractual clauses, in its data processing agreement |
| Stripe | Payments: it collects your email, billing address and card details at its checkout, and keeps its own records as a controller | Stripe's own locations | The UK addendum to the EU standard contractual clauses and the UK extension to the EU–US Data Privacy Framework, in its privacy policy |
| Vercel | Runs the site and our own API at api.chromaticcoherence.ai, which the site asks for your account; keeps their request logs; counts visits to the site's pages | Served from the United States (US East) | The UK international data transfer addendum with the standard contractual clauses, in its data processing agreement |
| Zoho | Support mail, the email telling an organisation its plan has ended, and the export of an organisation's index sent to its operator | Zoho's United States data centre | The model contractual clauses its privacy policy names |
| Its own sign-in, where you choose it: a controller of what it holds about you | Its own locations | Its own terms |
7. Closing an account
To close your account, write to support@chromaticcoherence.ai. We erase what we keep about you as a member: your name, your picture, the keys your assistants use and your sign-in. In each organisation's index we delete your sealing key, so your labels and what you stated and meant read as erased; the words of your findings, their colours and how close each came, your sharing and the places asked stay as your organisation's memory, under a code that nothing left in our records ties to your name, email or account. The erasure is whole once the store's backups from before it have aged out, within 7 days of it. An export of the index already sent to the organisation stays with it, and in our sent mail as the table above says. An organisation's operator closes the organisation first.
When an organisation closes, its index is returned to its operator on request and then erased, and its billing record is kept 7 years and then erased. An organisation whose plan lapsed 90 days ago closes, and its operator is told by email when the plan lapses.
8. Your rights
You may ask for a copy of what we keep about you, and to correct it, erase it, restrict it, object to it or take it elsewhere. Write to support@chromaticcoherence.ai; we answer within a month.
9. Complaints
Write to support@chromaticcoherence.ai. We acknowledge a complaint within 30 days and answer it without undue delay. You may also complain to the Information Commission, at ico.org.uk, at any time.
10. Children
The site is for people at work, and a plan is sold to people aged 18 or over.
The version in force from
1. Who is responsible
chromaticcoherence.ai is run by Chromatic Coherence. Write to support@chromaticcoherence.ai. Not registered for VAT. Chromatic Coherence decides what is kept and why, and is responsible for it, apart from each organisation's index, which the organisation decides.
2. What we keep, why, and for how long
| What | Why, and on what basis | Must you give it? | Kept by | How long |
|---|---|---|---|---|
| Your account: your email and password (stored hashed), or what Google gives when you sign in with it (your name, email and picture link); the name you go by | To run your account: our contract with you | The email and a password, or a Google sign-in, yes; the name, no | Supabase | Until your account is erased |
| Your sign-ins: each session's address and browser, and Supabase's log of sign-ins | To keep accounts safe: our legitimate interest | — | Supabase | A session until you sign out, or a day after it expires; the log as Supabase keeps it |
| The email that resets a password | To run your account: our contract with you | — | Sent by Supabase | As Supabase keeps them |
| A seat in an organisation: your email, the name you go by, the organisation and your role; a picture, where you added one on the site's earlier version, public at its address | To run the plan your organisation bought: our contract with its operator, who bought it; for every other member, our legitimate interest in running the organisation's plan, to which you may object | The email, yes; the name, no | Supabase; the picture in Supabase's storage | Until you are erased or the organisation closes; the picture's file deleted within a day of that, and a copy your browser kept until it expires |
| An invitation: the invitee's email and the name the operator typed, given by the operator, not by you | To let you join: our legitimate interest in running the organisation's plan | — | Supabase | 14 days to accept it; deleted when it is accepted, and 30 days after it expires or is revoked |
| A request for a seat: your work email, your organisation's name and the level you asked for | To answer it: our legitimate interest | The email, yes, so we can answer | Supabase | Deleted when your address takes a seat, or 12 months after you asked |
| The keys your assistants use: each stored as a hash, with its scope and the assistant's client id | To let your assistants reach the index: our contract with the operator, or our legitimate interest for a member | — | Supabase | They do not expire; deleted when you are erased or the organisation closes |
| Your use of the index: each call, its units and its time | To meter the plan's units and bill them, on the same basis as your seat | — | Supabase | With the organisation's billing record; once you are erased it names no one |
| A seat blocked for abuse: the reason we gave, and its history | To protect the service: our legitimate interest | — | Supabase | With the organisation's billing record |
| Your choices: joining, each assistant you connected, and sharing or withholding your spreads, each with its time | To show what was chosen and when: our legitimate interest. The spreads themselves are the organisation's index | — | Supabase | With the organisation's billing record |
| A purchase: the plan, its seats and top-ups, the payment and the invoices, the organisation's name typed at the checkout, and the organisation and the plan as Stripe's metadata | To sell and account for the plan: our contract with the buyer, and our legal duty to keep business records | Yes, to buy | Stripe, and the organisation's billing record in Supabase | 7 years after the organisation closes, then erased |
| Emails you send to support, the email telling an organisation its plan has ended, and the export of an organisation's index we send its operator | To answer you and to run the plan: our legitimate interest; the export at the organisation's instruction | No | Zoho | Six years; sent mail until we delete it |
| Requests to the site and to our API: your address, the time, the page and your browser | To run and secure them: our legitimate interest | — | Vercel | As long as Vercel's logs on our plan keep them: one to thirty days |
| Visits to the site's pages: the page's address without anything after ? or #, the page that linked to it, and your country, browser, operating system and device. No cookie is set and nothing is stored in your browser | To see which pages are read, and make them better: our legitimate interest. Say no, free, on the cookies page, or by your browser sending Global Privacy Control | No | Vercel | The figure Vercel makes from your request to tell one visit from another: 24 hours. The counts: 12 months on our plan, and as long after as Vercel keeps them |
3. The organisation's index
What an organisation's members and their assistants return to its index is the organisation's: observations and their shards, trajectories, spreads and who they are shared with, the questions Ask Hue could not answer, which every member of the organisation reads, and each ask's record of the words asked and the rows reached. We keep it for the organisation, as the terms say; ask the organisation about it, and we help it answer you.
None of an organisation's index is used for our own ends: our own research reads our own organisation's index alone.
4. Your right to object
Where we rely on our legitimate interest, you may object by writing to support@chromaticcoherence.ai. A member's seat runs the organisation's plan, so we weigh an objection with the organisation.
5. What we do not do
No advertising, no profiling and no automated decisions. We do not sell an organisation's index or share it with anyone, and no script from another site runs on the site: the one that counts visits is served from chromaticcoherence.ai itself.
6. Who else handles it, and where
| Who | What | Where | How a transfer is safeguarded |
|---|---|---|---|
| Supabase | Accounts, organisations, seats, each organisation's index, invitations and requests for a seat; the emails that reset a password | London (AWS eu-west-2); Supabase Pte. Ltd is in Singapore | The UK Addendum to the EU standard contractual clauses, in its data processing agreement |
| Stripe | Payments: it collects your email, billing address and card details at its checkout, and keeps its own records as a controller | Stripe's own locations | The UK addendum to the EU standard contractual clauses and the UK extension to the EU–US Data Privacy Framework, in its privacy policy |
| Vercel | Runs the site and our own API at api.chromaticcoherence.ai, which the site asks for your account; keeps their request logs; counts visits to the site's pages | Served from the United States (US East) | The UK international data transfer addendum with the standard contractual clauses, in its data processing agreement |
| Zoho | Support mail, the email telling an organisation its plan has ended, and the export of an organisation's index sent to its operator | Zoho's United States data centre | The model contractual clauses its privacy policy names |
| Its own sign-in, where you choose it: a controller of what it holds about you | Its own locations | Its own terms |
7. Closing an account
To close your account, write to support@chromaticcoherence.ai. We erase what we keep about you as a member: your name, what you stated and meant, your trajectories' lines, your questions and asks, your picture, your keys and your sign-in; the words of your shards stay as your organisation's memory. An organisation's operator closes the organisation first.
When an organisation closes, its index is returned to its operator on request and then erased, and its billing record is kept 7 years and then erased. An organisation whose plan lapsed 90 days ago closes, and its operator is told by email when the plan lapses.
8. Your rights
You may ask for a copy of what we keep about you, and to correct it, erase it, restrict it, object to it or take it elsewhere. Write to support@chromaticcoherence.ai; we answer within a month.
9. Complaints
Write to support@chromaticcoherence.ai. We acknowledge a complaint within 30 days and answer it without undue delay. You may also complain to the Information Commission, at ico.org.uk, at any time.
10. Children
The site is for people at work, and a plan is sold to people aged 18 or over.