Privacy Policy

1. Introduction

Corpussage, Inc. ("the Company," "we," "us," or "our") operates corpussage.com (the "Service"). Corpussage is an AI knowledge synthesis platform for teams: it indexes a team's internal knowledge sources -- Confluence pages, Jira tickets, Slack threads, GitHub repositories, and similar systems -- and returns cited answers to questions, so that engineers and knowledge workers can find institutional context without interrupting colleagues or manually searching multiple tools.

This Privacy Policy explains what information we collect through the Service and through direct communications with you, how we use it, and the choices you have. We are based at 530 Lytton Avenue, Suite 200, Palo Alto, CA 94301 and can be reached at [email protected].

2. Information We Collect

2.1 Information You Provide

We collect information you submit directly, including:

• Contact details (name, work email, phone) when you fill out a form, request a demo, start a free trial, or subscribe to updates;
• Company information you choose to share (employer, team size, role, product context);
• The content of messages you send us through the contact form or email.

When you connect a knowledge source (such as a Confluence workspace, Jira project, or Slack channel) to the Service, we process the indexed content from those sources on your behalf in order to generate answers. That content belongs to your organization and is processed solely to provide the synthesis functionality you have requested. We do not use the content of your connected knowledge sources to train our models without explicit written consent.

2.2 Information Collected Automatically

When you visit corpussage.com, we automatically collect limited technical information:

• IP address and approximate location (city or region level);
• Browser type, operating system, and device class;
• Pages visited, referring URLs, and time on page;
• Cookie and similar identifiers (see Section 5 and our Cookie Policy).

2.3 We Do Not Knowingly Collect Children's Data

corpussage.com is not directed to children under 13. We do not knowingly collect personal information from children. If you believe a child has provided us information, contact [email protected] and we will delete it.

3. How We Use Information

We use the information we collect to:

• Respond to inquiries, provide requested information, and operate the trial and subscription onboarding process;
• Index connected knowledge sources and generate cited answers, which is the core function of the Service;
• Operate, maintain, and improve the Service, including diagnosing indexing quality issues and improving answer accuracy;
• Send service updates and, with your consent where required, relevant product announcements;
• Detect, investigate, and prevent unauthorized access, fraud, or abuse;
• Comply with legal obligations.

We do not sell personal information for monetary value. Where applicable state law treats certain advertising arrangements as a "sale" or "share," see your state's section below.

4. Sharing of Information

We share personal information only with:

• Service providers acting on our behalf (for example, cloud hosting, transactional email, analytics) under contractual confidentiality terms that prohibit them from using your data for their own purposes;
• Authorities, when required by law or to protect rights, safety, or property;
• A successor entity in the event of a merger, acquisition, or asset sale, subject to this Policy.

We do not sell personal information to third parties. Content indexed from your connected knowledge sources is not shared with any third party except as necessary to operate the infrastructure that hosts the indexing and retrieval pipeline.

5. Cookies and Tracking

We use cookies and similar technologies to operate the site, remember preferences, and measure usage patterns in aggregate. For details and choices, see our Cookie Policy.

6. Data Retention

We retain personal information only as long as needed for the purposes described above, to comply with legal or accounting obligations, and to resolve disputes. Marketing-list contacts who have not engaged with communications are purged after 24 months. Server access logs are retained for 90 days and then aggregated. Data indexed from connected knowledge sources is retained while your account is active and deleted within 30 days of account termination or source disconnection on request.

7. Security

We use administrative, technical, and physical safeguards designed to protect personal information, including TLS encryption in transit, restricted-access databases, and least-privilege access controls for our team. No system is perfectly secure; we cannot guarantee absolute security. In the event of a data breach that requires notification under applicable law, we will provide notice in accordance with those requirements.

8. Your General Rights

Depending on your jurisdiction, you may have rights including access, correction, deletion, and the ability to limit certain processing. To make a request, email [email protected]. We will respond within the timeframe required by applicable law.

9. California Residents (CCPA / CPRA)

Under the California Consumer Privacy Act ("CCPA") and the California Privacy Rights Act ("CPRA"), California residents have specific rights regarding personal information collected about them. This section supplements the rest of the Policy.

9.1 Categories We Collect

In the past 12 months, we have collected the following categories of personal information defined under Cal. Civ. Code §1798.140: identifiers (name, work email, IP address); commercial information (service inquiries and subscription records); internet activity (browsing on corpussage.com); and inferences drawn from the above for service-improvement purposes. For workspace accounts, we also process professional and employment information (role, employer, team) that you provide during onboarding. We do not collect sensitive personal information as defined under Cal. Civ. Code §1798.140(ae) (such as precise geolocation, government ID, financial account numbers, health data, or biometric identifiers) through the Service.

9.2 Sources, Purposes, Disclosure

We obtain this information from you directly and through automatic site instrumentation. We use it to operate and improve the Service, communicate with you, and meet legal obligations. We disclose it only to service providers under written contract and to legal authorities where required.

9.3 Your CCPA / CPRA Rights

• Right to Know: request the categories and specific pieces of personal information we have collected about you in the past 12 months.
• Right to Delete: request deletion of personal information we collected from you, subject to legal exceptions.
• Right to Correct: request correction of inaccurate personal information.
• Right to Opt Out of Sale or Sharing: we do not sell personal information; we do not "share" it for cross-context behavioral advertising as defined under CPRA.
• Right to Limit Use of Sensitive PI: we do not collect sensitive personal information as described in 9.1, so this right does not have a practical application to our current data practices. If our practices change, we will update this Policy and provide an appropriate opt-out mechanism.
• Right to Non-Discrimination: we will not deny services, charge different prices, or provide a different level of service because you exercised a right.

9.4 How to Exercise

Submit a verifiable request by emailing [email protected] with the subject line "California Privacy Request." Include enough detail for us to verify you are the person whose information is the subject of the request. We respond within 45 days, with a possible 45-day extension for which we will notify you.

9.5 Authorized Agents

You may designate an authorized agent to make a request on your behalf. The agent must provide proof of authorization; we may also require you to verify your identity directly.

9.6 "Shine the Light"

California Civil Code §1798.83 entitles California residents to request information regarding our disclosure of personal information to third parties for direct marketing. We do not disclose personal information for third-party direct marketing.

9.7 Do Not Track and Global Privacy Control

Under the California Online Privacy Protection Act (Cal. Bus. & Prof. Code §22575), we disclose how we respond to "Do Not Track" (DNT) browser signals. Because there is no common industry standard for interpreting DNT signals, we do not currently respond differently to them. We do not authorize third parties to collect personally identifiable information about your activity across different websites when you use the Service. We honor an opt-out preference signal sent by a platform or browser that complies with the CPRA, such as the Global Privacy Control (GPC); when we detect a GPC signal, we treat it as a valid request to opt out of the sale or sharing of personal information for that browser or device.

10. Changes to This Policy

We may update this Policy from time to time. Material changes will be reflected by a new "Last updated" date and, where appropriate, a notice on the Service. We encourage you to review this Policy periodically.

11. Contact

Questions, requests, or complaints about this Policy can be sent to: