Privacy Policy

This Privacy Policy explains how Marco Restifo Pecorella, VAT IT04932430277, Calle Rovereto 10, Venezia, Italy, the operator of the Cremisi platform ("Cremisi", "we", "us", or "our"), collects, uses, and discloses information about you when you visit https://cremisi.eu, use the Cremisi web application and hosted MCP server (together, the "Service"), or otherwise interact with us. Capitalized terms not defined here have the meaning given in our Terms of Service.

Two roles matter in this policy. For your account, your profile, and your use of the Service, we decide how data is processed and are the data controller. For the content that Workspace Owners and their Members put into a Workspace (tasks, comments, documents, messages, and the personal data they may contain), the Workspace Owner or their organization is the controller and we process that content on their behalf. If you have questions about content in a Workspace you do not own, contact its Owner first.

1. Information we collect

1.1 Information you give us

• Account details: name, email address, password (stored hashed by our authentication provider), timezone, and, if you enable it, a multi-factor authentication secret.
• Profile details: profile picture, job role and position, and the Workspaces you belong to.
• Customer Content: projects, tasks, comments, reviews, documents and attachments, team chat messages and media, calendar events and call participation, design canvases and prompts, and repository references you connect.
• Integration credentials and references: the hashed value and display prefix of API Keys you create, and the repository URLs you link to projects.
• Communications: messages you send to support or feedback addresses, and replies to surveys or requests for input.
• Billing details for paid plans: billing name, address, and VAT number, plan and invoice history. Card details are entered directly with our payment processor; we receive only a token, the card brand, and the last four digits, never full card numbers.

1.2 Information collected automatically

• Usage and activity: actions you take in a Workspace (such as creating a task, changing a status, or posting a comment) are recorded in the Workspace activity feed and in task history so that your team can see who did what and when.
• Agent activity: calls made with your API Keys, including the tool invoked, the time, and the key's last-used timestamp.
• Presence: whether you are currently online, so teammates can see availability. Presence is shown only inside your Workspaces.
• Technical data: IP address, browser and device type, operating system, language, referring page, and timestamps, collected in server and security logs by us and our hosting providers.
• Cookies and local storage: see Section 5.

1.3 Information from other sources

• Workspace Owners who invite you provide your email address, and may fill in your role before you sign up.
• Teammates generate information about you when they assign you tasks, mention you, or add you to events.
• GitHub provides commit, branch, author, and workflow metadata for repositories linked to a project, which may include your name and avatar if you contribute to that repository.
• Agents you connect may send us content on your behalf, such as a task description drafted by an AI assistant.

2. How we use information

We use the information described above for the following purposes and on the following legal bases where the GDPR or similar laws apply:

• To provide the Service (performance of our contract with you): creating and securing your account, running Workspaces, syncing boards in real time, delivering notifications, hosting documents, running video calls, and executing the MCP tools your Agents call.
• To operate integrations and AI features you choose to use (performance of contract, and your consent where required): fetching GitHub data for linked repositories, issuing short-lived tokens for Agora calls, and sending your design prompts to our AI provider.
• To keep the Service safe (legitimate interests): preventing abuse and fraud, enforcing rate limits, auditing access, investigating security incidents, and approving new accounts.
• To support and communicate with you (performance of contract and legitimate interests): answering requests, sending service messages such as password resets, invitations, and notices about changes to the Service or these policies.
• To improve the Service (legitimate interests): understanding which features are used and where errors occur, using aggregated or de-identified data wherever possible.
• To comply with the law (legal obligation): responding to lawful requests, keeping required records, and establishing or defending legal claims.

We do not use Customer Content, prompts, or Output to train artificial-intelligence models, and we do not allow our AI providers to do so. We do not use your data for advertising, and we do not sell or rent personal data to anyone.

3. How we disclose information

3.1 Inside your Workspaces

Your profile (name, picture, role, position, timezone, and online status) and the content you add are visible to the other Members of each Workspace you belong to, according to their roles. Workspace Owners can see and manage everything in their Workspace, including content you added, and they keep it if you leave. Files attached to team chat messages and profile pictures are served from links that do not require signing in; anyone with such a link can open the file.

3.2 Service providers

We share data with providers that process it on our behalf under contracts that restrict their use of it. Today these are:

• Supabase (authentication, database, file storage, realtime sync, and server-side functions), hosted on Amazon Web Services in the United States (AWS us-east-1, operated by Supabase). This is where your account data and Customer Content live.
• Vercel (hosting and delivery of the website and web application). Vercel's edge network processes requests and standard server logs worldwide.
• Agora (agora.io, real-time audio and video). When you join a call, your audio and video streams are transmitted through Agora's global real-time network, which routes media through the Agora data center closest to each participant and may therefore process it outside your country. Streams are encrypted in transit. We do not record calls; only the fact that you joined and left, and when, is stored by us.
• Anthropic (AI design generation). The design brief and conversation you type into the Design tool, together with the design system text you provide, are sent to Anthropic's API to produce the mockup. Anthropic processes this data as our service provider and does not train on it.
• GitHub (repository integration). For projects with a linked repository, we query GitHub for commits, branches, workflows, and issues using our own integration token, and may create issues or trigger workflows at your request.
• Email delivery. Transactional emails such as sign-up confirmation, password reset, and Workspace invitations are sent through our authentication provider's email service.

3.3 Agents and integrations you authorize

When you create an API Key and give it to an Agent, the Agent's operator (for example the company behind the AI assistant you use) receives whatever Workspace data the Agent requests with that key. That transfer happens at your direction and is governed by that operator's privacy policy. Revoke the key to stop it.

3.4 Legal reasons and business transfers

We may disclose information if we believe in good faith that it is required by law, regulation, legal process, or governmental request; to enforce our Terms; or to protect the rights, property, or safety of our users, the public, or us. If we are involved in a merger, acquisition, financing, or sale of assets, information may be transferred as part of that transaction; we will notify you of any change in controller.

4. AI agents and AI features

Cremisi is built for teams that include AI agents. An Agent connected with your API Key acts with your permissions, so anything it reads or writes is attributed to you and recorded in the activity feed like any other action. Review your Agents' behavior and revoke keys you no longer need from Profile → Integrations → API Keys.

Output produced by AI features is generated by our provider's model from the prompt you supply. Do not put passwords, API keys, payment card numbers, government identifiers, health information, or other sensitive personal data into prompts or into chat with Agents.

5. Cookies and local storage

We use only what is needed to keep you signed in and remember your preferences. Our Cookie Policy at https://cremisi.eu/cookies lists each item; in summary:

• Authentication cookies set by our authentication provider (names beginning with "sb-"). They are strictly necessary, hold your session, and expire or are removed when you sign out.
• Browser local storage for preferences such as your theme, default task layout, and notification settings. These never leave your device.

We do not use advertising cookies, cross-site tracking, or third-party analytics on the Service today. Because we do not track you across other sites, there is nothing for a Do Not Track or Global Privacy Control signal to switch off; if we ever add analytics or marketing cookies, we will update this section and ask for consent where the law requires it.

6. International data transfers

We are established in Italy. Our primary database and file storage are located in the United States (AWS us-east-1, operated by Supabase); call media is routed through Agora's (agora.io) global network; and our other providers may process data in the United States and elsewhere. If you are in the European Economic Area, the United Kingdom, or Switzerland, this means your data is transferred outside your region. We rely on the European Commission's Standard Contractual Clauses (and the UK and Swiss addenda) with our providers, and on the EU-U.S. Data Privacy Framework where a provider is certified, together with technical measures such as encryption in transit and at rest.

7. Your choices

• Profile: edit your name, picture, role, position, and timezone under Profile → Edit Profile.
• Notifications: choose which in-app notifications you receive under Profile → Notifications. We will still send essential service emails such as password resets and security notices.
• Presence: your online status is shared with Workspace Members while you are signed in; sign out to stop sharing it.
• API Keys: list, create, and revoke keys under Profile → Integrations → API Keys.
• Workspaces: leave a Workspace you do not own, or ask its Owner to remove your content.
• Account deletion: delete your account and personal Workspace yourself from Profile → Danger Zone. See Section 9 for what happens next.

8. Your privacy rights

Depending on where you live, you may have the right to access the personal data we hold about you, to correct it, to delete it, to receive a copy in a portable format, to restrict or object to certain processing, and to withdraw consent where processing is based on consent. You will not be discriminated against for exercising these rights.

To exercise a right, email support@cremisi.eu from the address on your account. We may ask you to verify your identity and will respond within the time the applicable law requires (one month under the GDPR, extendable where permitted). If the request concerns content in a Workspace owned by someone else, we will forward it to the Owner or ask you to contact them, as the law requires us to act on their instructions for that data.

If you are in the EEA, the UK, or Switzerland and believe we process your data unlawfully, you may lodge a complaint with your local data-protection authority. If you are a California resident, the California Consumer Privacy Act gives you the rights to know, delete, and correct described above; we do not sell or share personal information as those terms are defined in that law, and we do not use or disclose sensitive personal information for purposes that require a right to limit. Authorized agents may submit requests on your behalf with written permission.

9. Data retention

• Account data and Customer Content are kept for as long as your account or the relevant Workspace exists.
• When you delete your account, your profile and personal Workspace are deleted immediately from the live database. Content you contributed to Workspaces owned by others remains there, attributed to a removed user, under the Owner's control.
• Deleted data may persist in encrypted backups for up to 90 days before it is overwritten.
• Server and security logs are kept for up to 12 months.
• We may keep limited records longer where required by law, to resolve disputes, or to enforce our agreements.

10. Security

We protect information with measures appropriate to the risk, including encryption in transit (TLS) and at rest, database row-level security that isolates each Workspace, hashed passwords and API Keys (we never store a raw key), optional multi-factor authentication, short-lived tokens for video calls, least-privilege access for our team, and logging of administrative actions. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If we learn of a breach that affects your personal data, we will notify you and the relevant authorities as the law requires.

11. Children

The Service is intended for business and professional use by adults. We do not knowingly collect personal data from anyone under 18. If you believe a minor has provided us with personal data, contact us and we will delete it.

12. Third-party services

The Service links to and integrates with services we do not operate, such as GitHub, the AI assistants you connect over MCP, and websites referenced in your content. Their privacy practices are governed by their own policies, which we encourage you to read.

13. Changes to this policy

We may update this policy as the Service and the law evolve. We will post the new version here with an updated date, and for material changes we will notify you by email or in the Service at least 14 days before they take effect. Continued use of the Service after that date means you accept the updated policy.

14. Contact

The data controller for your account data is Marco Restifo Pecorella, VAT IT04932430277, Calle Rovereto 10, Venezia, Italy. For privacy questions or requests write to support@cremisi.eu; for general enquiries, hello@cremisi.eu.