Privacy notice — Cernavo

What we collect

Account data

Identity managed by your sign-in provider — email, display name, role assignments, and tenant membership. Authentication state and session tokens are managed by the sign-in provider, not by Cernavo.

Workflow data

Conversation messages, proposal history, run command audit entries, retention choices, and artifact metadata generated as you use the workspace.

Uploaded datasets

Tabular data you upload through the conversation workspace, scoped to your tenant. Acceptable contents are restricted by the acceptable-data policy.

Support contact

Any email you send to beta support and any context you share with the founder about an incident.

Operational telemetry

Minimal server logs and audit events needed to operate the beta — timestamps, request paths, error codes. These do not contain raw dataset rows.

What we use it for

To run the workflows you request against your own data — profiling, planning, and execution.
To operate and support the private beta: investigate failures, apply security updates, and reach out to invited users.
To preserve enough audit metadata for operator accountability — who did what, when, with which run.

What we do not do

We do not sell, share, or train on your data

Your uploaded datasets are used to run the workflow you request — nothing else.

We do not sell your data, and we do not share your uploaded datasets with brokers, advertisers, or unrelated third parties.
We do not use uploaded datasets to train foundation models. A model provider may receive limited operational context to execute a run step; raw upload payloads are not embedded in conversation messages, events, or checkpoints.
We do not claim SOC 2, HIPAA, PCI, GDPR enterprise data-residency, or similar formal certifications for the beta.

Retention and deletion

Run-scoped artifacts and the run row are retained for 14 days after the run reaches DONE by default. You can choose Keep (retain until expiry) or Delete now — which tombstones references, revokes application access, and crypto-erases run-scoped keys; physical garbage collection runs asynchronously. See the data-handling page for the deletion semantics in full. Audit metadata for the deletion action itself is retained for operator accountability.

Operator and support access

The founder/operator has administrative access to the single-host beta in order to operate it and provide support. That access is not used to mine or repackage your data. If we need to examine a specific dataset to help you, we will say so.

Where data lives

The beta is a single-node, founder-hosted deployment. There is no multi-region replication, no enterprise data-residency program, and no customer self-hosted option in this release.

Your choices

You can request Delete now on any DONE run from the conversation workspace.
You can ask beta support to remove your account and tenant data, subject to the deletion limits described above.
If you do not want a dataset processed under these terms, do not upload it.

Contact

Questions about this notice or a privacy concern with a specific run go to beta support at [email protected]. Because the beta is small and founder-operated, expect a human reply rather than a ticket queue.

Changes

This notice may change as the beta evolves. Material changes will be communicated to invited users. Continued use of the beta after a change means you accept the updated notice. Cernavo, Inc. will publish a more formal commercial privacy policy if and when the product moves beyond private beta.

Last updated: June 2026