Privacy Policy

1. Introduction

This Privacy Policy ("Policy") describes how Circa Technologies, Inc. ("Circa," "we," "our," or "us") collects, uses, stores, discloses, and protects information in connection with the Circa platform, including the Library, Alia, Gesserit, and all related web-based tools and services (collectively, the "Service"). Capitalized terms not defined herein have the meanings given in the Circa Terms of Use.

By accessing or using the Service, You acknowledge that You have read and understood this Policy. If You do not agree to this Policy, You must discontinue use of the Service.

Our two core commitments. Two things in this Policy matter more than the rest, so we state them plainly here:

1. Data You upload privately stays private. Files and datasets You upload for Your own use are used to provide the Service to You. We do not use them to train AI models made available to other Users, and we do not make them available to other Users. Section 9 sets out the full commitment, including its narrow exceptions.
2. We do not sell Your personal information. We do not sell, rent, or trade personal information, and we do not share it for cross-context behavioral advertising or targeted advertising.

2. Information we collect

2.1 Account and registration information. When You create an account, we collect: full name; email address; Team Name (used to attribute published content); organization or company name, where provided; and authentication credentials, which are managed by our authentication provider. Circa does not store account passwords in plaintext.

2.2 Billing and payment information. Payment transactions are processed by Stripe, Inc. Circa does not directly collect, store, or process credit card numbers, bank account numbers, or other sensitive financial account information. Stripe may collect Your name, billing address, and payment instrument details under its own privacy policy. We receive transaction confirmations, amounts paid, and associated account identifiers. Where You publish data and receive revenue-sharing payments, we or Stripe may additionally collect the payout and tax information necessary to make those payments and meet our reporting obligations.

2.3 User-uploaded data and content. We collect and process data You upload, including: files uploaded to Alia for AI-assisted analysis and LCA model creation; datapoints and datasets created or published by You within the Library; and LCA models, reports, and associated data created within Gesserit.

Data uploaded for private use remains accessible only to You and to Users You authorize within Your organization, subject only to the narrow access exceptions in Section 9.4. Data You affirmatively elect to publish within the Library may be made available to other Users for licensing in accordance with the Terms of Use.

Uploaded files are LCA and engineering source material, such as bills of materials, BIM exports, process data, and supplier records. They are not intended to contain personal information. Where Your uploads do contain personal information, Circa processes it as a processor on Your organization's behalf, as described in Section 8.2.

2.4 Usage data and metadata. We automatically collect: IP address and approximate geolocation; browser type, operating system, device identifiers, and screen resolution; pages and features accessed, search queries entered, Data Pulls executed, and clickstream data; session duration, timestamps, and frequency of use; and referring and exit URLs.

2.5 Chat and interaction data. We collect and retain chat interactions, prompts, queries, and responses generated within the Service, including interactions with Alia. Our use of this data is governed by Section 9.

2.6 Communications. If You contact us, we collect the content of Your communications, including attachments, and associated metadata.

2.7 What we do not collect. We do not collect government identification numbers, biometric data, precise geolocation, health information, or information about Your race, ethnicity, religion, political opinions, sexual orientation, or trade union membership. We do not ask for these. Please do not submit them to the Service.

2.8 Our websites. When You use a form on circa.ai or support.circa.ai, for example to contact us, request a demo, or subscribe to updates, we collect what You enter, typically Your name, email address, organization, and message, and use it to respond to You. On circa.ai we use Google Analytics and Google Ads to understand how visitors use the site and whether our advertising works, as described in Section 5.3. support.circa.ai does not use analytics or advertising cookies.

3. How we use your information

3.1 Providing and operating the Service: to create and manage Your account; to process transactions, including Credit purchases, Data Pulls, and revenue-sharing payments to publishers; to index, store, and make available user-uploaded data and User-Generated Content; to provide AI-assisted analysis and LCA model creation within Alia; to facilitate data access and modeling within Gesserit; and to attribute published content to the appropriate Team Name.

3.2 Improving and developing the Service: to analyze usage patterns and trends; to improve our AI features, subject to the limits in Section 9; to conduct internal research and analytics, using aggregated or de-identified data wherever practicable; and to develop new features.

3.3 Security and compliance: to detect, prevent, and respond to fraud, abuse, security incidents, and technical issues; to enforce the Terms of Use, including licensing and redistribution restrictions; and to comply with legal obligations and lawful requests.

3.4 Communications: to send service-related notices, including account confirmations, billing receipts, technical alerts, and updates to the Terms of Use or this Policy. We may also send information about new features, from which You may opt out at any time.

4. How we share your information

Circa does not sell, rent, or trade Your personal information. We do not share personal information for cross-context behavioral advertising or targeted advertising, and we do not use the Service to build advertising profiles. We share information only as follows.

4.1 Service providers and subprocessors. These providers receive access only to the extent necessary to perform their function, are bound by written contracts restricting their use of the information to that purpose, and are obligated to protect its confidentiality and security.

This table is our current list of subprocessors, and we update it when it changes. Organizational customers with a Data Processing Agreement in place will receive at least thirty (30) days' notice before we add a new subprocessor that processes personal data on their behalf, and may object as provided in that agreement.

4.2 Published User-Generated Content. If You elect to publish datapoints within the Library, the published content and Your associated Team Name will be visible to other Users who license that data. This disclosure is initiated by Your affirmative act of publishing, and its scope is governed by the Terms of Use.

Because published content is subject to a perpetual license and may be retained after account deletion, we recommend using an organizational Team Name rather than an individual's name. You may change Your Team Name at any time in Your account settings, and we will apply the change to future attribution displays.

4.3 Legal requirements. We may disclose Your information where we believe in good faith it is necessary to comply with applicable law, regulation, legal process, or governmental request; to enforce the Terms of Use or this Policy; to detect, prevent, or address fraud, security, or technical issues; or to protect the rights, property, or safety of Circa, our Users, or the public.

We will evaluate each request for validity and scope, will disclose no more than the request requires, and will notify You of a legal demand for Your information unless legally prohibited from doing so or the request relates to an emergency involving a risk of serious harm.

4.4 Business transfers. In a merger, acquisition, reorganization, bankruptcy, or similar transaction, Your information may be transferred to the successor entity. Any successor will remain bound by the commitments in this Policy with respect to information transferred, unless and until You are given notice of and an opportunity to respond to a change.

4.5 With your consent. We may share Your information with third parties where You have given express consent.

5. Cookies and tracking technologies

5.1 Strictly necessary cookies. Required for session management, authentication, and security. They cannot be disabled without impairing core functionality.

5.2 Analytics and performance cookies. Within the Circa application we use third-party analytics and monitoring tools (Google Analytics, PostHog, New Relic, and Sentry) that may set cookies and record how Users interact with the Service, including session recordings. We use this information to understand and improve the Service and to diagnose errors. We do not use these tools for advertising: Google signals is switched off, and our Google Analytics properties are not linked to any advertising account. You can block or delete these cookies in Your browser settings at any time, and the Service will continue to work.

5.3 Our website. On circa.ai, Google Analytics and Google Ads set cookies to measure visits and whether our ads lead to sign-ups or inquiries. Ad personalization (remarketing) and Google signals are switched off. Visitors in the European Economic Area, the United Kingdom, and Switzerland are asked before these cookies are set. Elsewhere they are set unless You decline, which You can do at any time under "Cookie settings" in the website footer. If Your browser sends a Global Privacy Control signal, we do not set advertising cookies unless You accept them.

5.4 Managing cookies and opt-out signals. Most browsers allow You to manage cookie preferences. Disabling certain cookies may affect functionality. On circa.ai we honor the Global Privacy Control (GPC) signal as described in Section 5.3. Videos embedded on our websites use YouTube's privacy-enhanced mode, which does not set YouTube cookies until You play a video.

6. Data storage and security

6.1 Storage location. Platform data is hosted and stored in the United States, on infrastructure operated by Railway and Amazon Web Services. Product analytics event data is additionally processed and stored by Google (Analytics 4 and BigQuery) in the United States. If You access the Service from outside the United States, Your information will be transferred to, stored, and processed in the United States, where data protection laws may differ from those of Your jurisdiction. Section 8.3 describes the safeguards applied to transfers out of the EEA, the UK, and Switzerland.

For organizational customers with data-residency requirements, Circa offers a customer-hosted database option as a paid add-on, under which platform data resides in infrastructure the customer hosts and controls, subject to that customer's own residency, governance, and access policies. Contact privacy@circa.ai or contact@circa.ai to discuss scope.

6.2 Security measures. We implement administrative, technical, and physical safeguards designed to protect the confidentiality, integrity, and availability of Your information. These currently include:

1. Separate database per team. When a team is created, Circa provisions a separate PostgreSQL database for that team's data, and requests are routed to the correct database based on team identity, so isolation is enforced at the database level rather than only in application code. Account, team membership, and billing records are kept in a separate system database.
2. Encryption in transit. Connections to the Service, and between the application and its databases, are encrypted with TLS.
3. Encryption at rest. Databases run on managed, encrypted storage.
4. Managed authentication. Circa does not store or manage user passwords. Sign-in is handled by Stytch, Inc., a dedicated authentication provider that maintains SOC 2 compliance, using single sign-on and magic links. Credentials remain outside Circa's databases.
5. Network and infrastructure controls, including web application firewalling, managed threat detection, and audit logging of infrastructure and administrative activity.
6. Application error and performance monitoring, configured not to collect default personal information, with email addresses, IP addresses, cookies, and authentication headers removed from error reports in the web application.
7. Automated daily backups of each customer database.
8. Restricted internal access. Access to user-uploaded data is limited to authorized personnel and logged, as described in Section 9.4.

Optional additional safeguards, including application-level field encryption and a customer-hosted database, are available as paid add-ons for customers with specific compliance requirements.

No method of electronic transmission or storage is completely secure, and we cannot guarantee the absolute security of Your information.

6.3 Data breach notification. In the event of a breach affecting the security, confidentiality, or integrity of personal information, we will notify affected Users and, where applicable, regulators, in accordance with applicable law. Where Circa processes personal data on behalf of an organizational customer, we will notify that customer without undue delay and in any event within seventy-two (72) hours of becoming aware of a personal data breach affecting their data, and will provide the information reasonably necessary for them to meet their own notification obligations.

7. Data retention

We retain information for as long as reasonably necessary to fulfill the purposes for which it was collected, to provide the Service, to comply with legal obligations, to resolve disputes, and to enforce our agreements.

Data retained beyond the periods above will be aggregated or de-identified such that it can no longer reasonably be linked to You.

8. Your privacy rights

8.1 Rights we extend to all Users, regardless of location. Whatever Your jurisdiction, You may: access the personal information we hold about You; correct information that is inaccurate or incomplete; delete Your account and associated personal information; export Your personal information in a commonly used, machine-readable format; opt out of non-essential communications; withdraw consent where our processing is based on consent; and object to processing based on our legitimate interests.

To exercise any of these rights, contact privacy@circa.ai. We will acknowledge Your request within ten (10) business days and respond substantively within thirty (30) days, or within forty-five (45) days where the request is complex, in which case we will tell You why. We may need to verify Your identity before acting, and we will not discriminate against You for exercising these rights.

8.2 Roles: controller and processor. For account, billing, usage, and interaction data, Circa acts as a controller (or "business"), and this Policy governs that processing. For personal data contained within files and datasets uploaded by an organizational customer, Circa acts as a processor (or "service provider") on that customer's instructions; the customer's own privacy notice governs, and we process the data only as they instruct and as our Data Processing Agreement permits. If You are an employee or contact of an organizational customer and wish to exercise rights over data they uploaded, please contact them; we will assist them in responding.

8.3 European Economic Area, United Kingdom, and Switzerland. Where the EU GDPR, the UK GDPR, or the Swiss FADP applies to our processing, the following additional terms apply.

Legal bases.

Where we rely on legitimate interests, we have assessed those interests against Your rights and freedoms, and will provide a summary of that assessment on request.

Your rights. In addition to Section 8.1, You have the right to restrict processing, the right to data portability, the right to object to processing based on legitimate interests, and the right not to be subject to a decision based solely on automated processing producing legal effects concerning You or similarly significantly affecting You. Circa does not make such decisions; Alia's outputs are analytical aids that You review and control.

Complaints. You have the right to lodge a complaint with Your local supervisory authority. We would appreciate the chance to address Your concern first, at privacy@circa.ai.

International transfers. Personal data is transferred to and stored in the United States. Our service providers listed in Section 4.1 process personal data under data processing terms that include the European Commission's Standard Contractual Clauses or another transfer mechanism recognized under the EU GDPR, the UK GDPR, and the Swiss FADP. Information about these safeguards is available at privacy@circa.ai.

Data Processing Agreement. Organizational customers that need a Data Processing Agreement, including Standard Contractual Clauses, can request one at privacy@circa.ai.

8.4 United States state privacy laws. Several states, including California, Colorado, Connecticut, Virginia, and Texas, grant residents privacy rights. Whether a given law applies to Circa depends on thresholds such as revenue and processing volume. Rather than assess and re-assess that for each law, we extend the substantive rights in Section 8.1 to all Users, and we will honor a request under any US state privacy law without requiring You to establish that the law applies to us.

For clarity, and whether or not any particular statute currently applies to us:

• We do not sell personal information, and we do not share it for cross-context behavioral advertising, as those terms are defined in the CCPA as amended by the CPRA.
• We do not process sensitive personal information to infer characteristics about You.
• We do not use personal information for profiling in furtherance of decisions producing legal or similarly significant effects.
• We treat a Global Privacy Control signal as a request to opt out of the sale and sharing of personal information. We do neither, and on circa.ai the signal also keeps advertising cookies off unless You accept them (Section 5.3).
• You may designate an authorized agent to submit a request on Your behalf; we may require proof of the agent's authority.
• We do not knowingly process the personal information of consumers under sixteen (16). The Service is restricted to adults (Section 10).

Where Circa acts as a service provider or contractor to a customer that is itself subject to these laws, we process personal information only for the business purposes specified in our agreement with that customer, and not for our own commercial purposes, cross-context behavioral advertising, or the improvement of products offered to other customers. The commitment in Section 9.1 is consistent with, and is intended to preserve, that status.

8.5 Other jurisdictions. If You are in a jurisdiction not addressed above and believe its law grants You rights beyond those in Section 8.1, contact privacy@circa.ai and we will engage with the request in good faith.

9. AI features and model training

The Service incorporates artificial intelligence and machine learning technologies, particularly within Alia. This Section governs how Your data is used in connection with those features and takes precedence over any more general statement about service improvement elsewhere in this Policy.

9.1 Private uploaded data is not used to train models served to others. Files, datasets, and models You upload or create for private use within Alia, Gesserit, or the Library:

1. Are used to provide the Service to You, including to parse, structure, match, and enrich Your data and to generate outputs You request;
2. Are not used to train, fine-tune, or otherwise adapt any AI model made available to other Users, to the public, or to any third party;
3. Are not disclosed to other Users;
4. Are not sold, licensed, or made available for licensing unless and until You affirmatively elect to publish them, at which point the Terms of Use govern.

This commitment extends to the contents of Your uploads and to any embeddings, indices, or intermediate representations derived from them, which are scoped to Your account.

9.2 Prompts and interaction data.

We do not currently use prompts, queries, responses, or feedback to train, fine-tune, or otherwise improve AI models. Interaction data is used to operate the Service, provide support, meet billing obligations, prevent abuse, and secure the platform, and is retained as stated in Section 7. If we decide in future to use interaction data for model improvement, we will give advance notice under Section 13, and where applicable law requires consent we will obtain it before applying the change to data already collected.

9.3 Third-party AI model providers. Alia's AI features and the AI assistant in Gesserit use Claude models from Anthropic, PBC, either directly or through Amazon Bedrock, operated by Amazon Web Services. Your inputs are transmitted to that provider to generate outputs. Under Anthropic's and AWS's commercial terms, inputs and outputs are not used to train their models, and retention is limited to what is necessary for processing and for limited abuse monitoring. To let You continue a conversation with the assistant, its conversation history is held by Anthropic on our behalf and retained as described in Section 7. Neither provider receives Your account identity beyond what is necessary to deliver the Service. If You add Your own Anthropic or OpenAI API key in the assistant's settings, Your inputs are sent to that provider under Your own account and its terms.

9.4 Human access to your data. Circa personnel do not access the contents of Your private uploaded data except: with Your permission or at Your request, to provide technical support; where strictly necessary to investigate a suspected security incident or a suspected violation of the Terms of Use, in particular unauthorized redistribution of Licensed Data; or where required to comply with law or valid legal process. Such access is limited to authorized personnel, limited to what the purpose requires, and logged.

9.5 Aggregate and de-identified data. We may create and use aggregated or de-identified data (for example, counts of Data Pulls by category, search-term frequency, or feature adoption rates) for analytics, service improvement, capacity planning, and to inform which datasets we seek to add to the Library. Such data is derived so that it cannot reasonably be used to identify You, Your organization, or the contents of Your uploads, and we do not attempt to re-identify it.

9.6 Accuracy of AI outputs. AI-generated outputs are provided for informational purposes only. Circa makes no representations or warranties regarding their accuracy or completeness, and Users should verify all outputs against original source data before relying on them for any purpose.

10. Age restriction

The Service is not directed to individuals under eighteen (18), and we do not knowingly collect personal information from anyone under 18. If we become aware that we have, we will take reasonable steps to delete it promptly. Contact privacy@circa.ai if You believe we have collected such information.

11. Relationship to the Terms of Use

This Policy and the Terms of Use are intended to be read together. Where this Policy imposes a narrower limit on how we may use Your data than the Terms of Use, this Policy controls, and we will not rely on a broader permission in the Terms of Use to act inconsistently with Sections 4, 7, or 9 of this Policy.

12. Third-party services and links

The Service may contain links to, or integrations with, third-party websites, services, or applications not operated or controlled by Circa. This Policy does not apply to their practices. We encourage You to review their privacy policies before providing them with Your information.

13. Changes to this Policy

We may update this Policy to reflect changes in our practices, technologies, or legal requirements. When we make material changes, we will notify You by posting the revised Policy with an updated effective date and by sending notice to the email address associated with Your account at least fifteen (15) days before the change takes effect.

We will not apply a material reduction of the commitments in Section 9 to data already collected without Your consent. Any such change will apply prospectively and, where Section 9 requires Your consent, only with it.

14. Governing law

This Policy is governed by and construed in accordance with the laws of the State of Delaware, without regard to its conflict of law principles, consistent with the Terms of Use. Nothing in this Section limits any non-waivable right or remedy available to You under the mandatory data protection law of Your place of residence.

15. Contact information

Circa Technologies, Inc.

496 Old Homestead Hwy, Richmond, NH 03470, United States

Privacy and data protection requests: privacy@circa.ai

General inquiries: contact@circa.ai