Privacy, in plain words.

This policy tells you what personal data Cuiar collects, why, who gets it, how long we keep it, and your rights. It applies to the Cuiar browser, the website at cuiar.com, the CLI, the API and the MCP server ("the services"). The summary above gives the main points; this policy is the full text. It is written for the EU and UK General Data Protection Regulation (GDPR) and for the California Consumer Privacy Act as the CPRA changed it (CCPA).

1. Who is responsible

Internet Technology Services LLC ("we", "us") operates Cuiar and is the controller of your personal data. Write to us at contact@cuiar.com. When a Team customer uses Cuiar for its members, we process the team's data for that customer under the Data Processing Agreement.

2. Data that we collect and where it comes from

• Account: your e-mail address, the devices and AI clients that you sign in, API key names and prefixes (keys only as hashes), your plan and credits. From you.
• Sign-in records: the time, the IP address and the e-mail address of each sign-in request. From your device.
• Payments: payment status, period and invoices. From Stripe and NOWPayments. We never get card numbers.
• Tasks: the tasks that you start on cuiar.com, in the CLI, with the API or from a channel, with their steps, the page text that the agent reads, results and files. Routines and their runs. Approvals and your answers. From you and from the agent on your computer.
• Vault and sync: your vault items and synced browser data, sealed on your device; a log of each use of a vault login with the site's host name. From your devices.
• Channels: when you connect e-mail, Telegram or Slack, the address or chat ID that the channel needs, and the messages of each task. From you and the channel. For iMessage, the bridge on your Mac sends only the text and ID of each message from a sender that you allow, and a random key for the chat. Phone numbers and addresses stay on your Mac.
• Team: your team, role and the team's verified domains and sign-in connection. From the team's owner or admin, and from the team's identity provider when you sign in through it.
• Inferences: routine suggestions made from tasks that you repeat.
• Privacy signals: the date when your browser first sent Global Privacy Control with a request of your account.
• Plan checks: the browser checks your plan with a device ID. We do not keep the device ID.
• Cloud hand-off: a workspace that you move to a cloud browser, with its cookies and site data, until the hand-off ends.
• Mail: what you write to us.

We do not get what stays on your computer: your tabs, browsing history, the cookies and site data of each workspace, memory, the tasks that you start in the side panel with their steps, and the agent's screenshots. The browser sends no telemetry and no crash reports.

You give the account data and the tasks to use the services; without them, we cannot give you an account or run a task. Data in your tasks and files is the data that you choose to put there. Do not give a task special categories of data (for example health data) unless the task needs it.

3. Why we use it, and the legal basis

• Give you the account and the services: sign-in, tasks, routines, approvals, the vault and sync, channels, files, cloud hand-off and the model gateway. Basis: Contract (Art. 6(1)(b)).
• Bill your plan, count credits and take payments. Basis: Contract (Art. 6(1)(b)).
• Keep tax and bookkeeping records of payments. Basis: Legal obligation (Art. 6(1)(c)).
• Send the e-mails that the services need or that you ask for: codes, approvals, routine results, build e-mails. Basis: Contract (Art. 6(1)(b)).
• Keep accounts and the services secure and stop abuse: sign-in records with IP addresses, rate limits, server logs. Basis: Legitimate interests (Art. 6(1)(f)): safe accounts and a working service.
• Suggest a routine for work that you repeat. Basis: Legitimate interests (Art. 6(1)(f)): a useful product. Dismiss a suggestion to stop it.
• Keep backups to recover from a failure. Basis: Legitimate interests (Art. 6(1)(f)): no loss of your data.
• Answer your mail and your requests about your rights. Basis: Contract (Art. 6(1)(b)) and legal obligation (Art. 6(1)(c)).
• Obey the law, and set up, use or defend legal claims. Basis: Legal obligation (Art. 6(1)(c)) and legitimate interests (Art. 6(1)(f)).

We do not use your data for ads, and we do not train AI models on your content. Where we rely on legitimate interests, you can object (section 9).

4. AI models

When the Cuiar agent works, it sends the task, your messages, the text of the pages that it reads and up to 12 memories to Cuiar's built-in model. The requests go through our gateway and OpenRouter to one of these providers: DeepInfra (USA), Fireworks AI (USA), Together AI (USA), Nebius (Netherlands), Google Cloud (Vertex AI) (USA). The gateway asks for zero data retention, so the provider keeps no request data and does not train on it. It sends an anonymous ID in place of your account. We keep only the token counts, for your credits. The model gets text only; the agent's screenshots stay on your computer.

When a task ends, the model reads what you wrote and the result, and finds up to 3 things to remember. The memories stay on your computer. This does not occur for incognito tasks or when Memory is off.

When you connect your own AI client over MCP, the CLI or the API, that client reads what Cuiar sends back. Its provider's policy applies to that data. Each call goes through our server to Cuiar on your computer. We do not keep the calls or their results.

5. Who gets data

These companies process personal data for us, under contracts that limit them to our instructions. The sub-processor list tells what each one gets and where.

• Cloudflare (Cloudflare, Inc.): Hosts cuiar.com, protects and carries the traffic to our API, sends our e-mail, receives the mail of the e-mail channel, and stores task files and hand-off workspaces.
• netcup (netcup GmbH): Runs the servers of our API and database.
• Backblaze (Backblaze, Inc.): Keeps daily backups of our database for 30 days.
• Stripe (Stripe, Inc. and Stripe Payments Europe, Ltd.): Card payments, invoices and the billing portal. For fraud checks and its own legal duties, Stripe is a separate controller.
• OpenRouter (OpenRouter, Inc.): Sends each request of the agent to one of the model providers below. We ask for zero data retention: the provider keeps no request data and does not train on it.
• Zoho Mail (Zoho Corporation): The mailbox that receives mail to support@cuiar.com, contact@cuiar.com and security@cuiar.com.

These get data as their own controllers:

• NOWPayments (FD Transfers LLC, Saint Vincent and the Grenadines): Takes crypto payments on its own payment page. We send it the order number and the price only. It is a separate controller for what you give it there. The transfer is necessary for the payment that you ask for (GDPR Art. 49(1)(b)).
• Telegram and Slack: Only when you connect them as a channel: they carry your messages to and from Cuiar under their own terms.
• IP location services (get.geojs.io, ipinfo.io, ipwho.is, ipapi.co): The browser on your computer asks one of them for the location of a workspace's IP address, through that workspace's proxy, to set its time zone and language. The service sees that IP address. We do not get the answer.
• Authorities and courts: Only when a law makes it necessary.

We do not sell or share personal information, and we give no data to data brokers or advertisers.

6. International transfers

We are a company in the United States. Our API and database run in Germany, their backups stay in the EU, and task files are stored in Western Europe. Some providers are in the United States. For each transfer of personal data out of the EEA or the UK, we rely on the European Commission's Standard Contractual Clauses with the UK Addendum, in the data processing terms of Cloudflare, Stripe and OpenRouter. A crypto payment goes to NOWPayments only because you ask for it (GDPR Art. 49(1)(b)). For a copy of the safeguards, write to contact@cuiar.com.

7. How long we keep data

• Your account: e-mail address, plan, credits and team role: until you delete the account.
• Tasks, their steps and results: 12 months after the last activity of the task, or less when you delete it.
• Files that a task makes: 30 days, or less when you delete the task.
• Incognito tasks and their steps: 10 minutes after the task ends.
• Routines: until you delete them. Each run and its result: 12 months.
• Approvals, and the log of each use of a vault login: 12 months.
• Vault and sync data, sealed on your devices: until you delete them or the account.
• A workspace that you move to a cloud browser: until the hand-off ends. A copy that comes back and is not opened: 7 days.
• Sign-in records with their IP address and e-mail address: 90 days.
• Sessions, API keys and approved AI clients: until they expire or you remove them, then 30 days.
• Crypto orders that you do not pay: 30 days.
• Payment notices from Stripe (event ID and type): 90 days.
• Build e-mail requests: until the e-mail goes, then 90 days.
• IDs of the messages that your iMessage bridge sends to Cuiar: 30 days.
• Answers that wait for your iMessage bridge: until the bridge sends them, at most 7 days.
• Server logs (account and device IDs, errors; no IP or e-mail addresses, no task text): 14 days.
• Database backups: 30 days.
• After you delete the account: crypto payment record with no account, name or e-mail address: 7 years, for tax and bookkeeping.
• After you delete the account: card payments and invoices at Stripe: as long as tax and payment laws tell Stripe.
• Mail that you send to us: while we work on your request, and after that only as long as the request needs (for example, a refund).
• Memory, on your computer: until you delete it, or 30 or 90 days after its last use. You choose.

When you delete your account, we delete its data at once. Backups keep it until they are 30 days old.

8. Cookies and other storage

cuiar.com and api.cuiar.com set only the cookies below. Each one is strictly necessary for a service that you ask for, so we do not ask for consent and show no cookie banner. The site keeps nothing in your browser's local storage, and it has no analytics, ads or trackers.

• cuiar_session (set by api.cuiar.com, for cuiar.com): Keeps you signed in. HttpOnly: page scripts cannot read it. Lasts 30 days, or until you sign out.
• cuiar_signed_in (set by api.cuiar.com, for cuiar.com): Holds the value 1, so pages show Account in place of Get started. It has no ID. Lasts 30 days, or until you sign out.
• cf_clearance (set by Cloudflare): Only after Cloudflare shows a security check: it remembers that you passed it. Lasts 30 minutes.

9. Your rights

Under the GDPR and the UK GDPR, you have the right to:

• get a copy of your data and information about how we use it (access, Art. 15);
• correct data that is wrong (Art. 16);
• have your data deleted (Art. 17);
• limit how we use your data (restriction, Art. 18);
• get your data in a machine-readable format and give it to another service (portability, Art. 20);
• object to a use that relies on legitimate interests (Art. 21);
• not be subject to a decision based only on automated processing that has legal or similar effects on you (Art. 22). Cuiar makes no such decision.

How to use them:

• Self-serve, on cuiar.com/account or in the CLI: download all your data (cuiar account export), change your sign-in address (cuiar account email), delete your account (cuiar account delete). Delete tasks, routines, the vault and memories where they are. When you delete a workspace, Cuiar deletes its data at the next start.
• For any other request, write to contact@cuiar.com from your account's address. If you write from another address, we ask you to confirm the request from the account's address.
• We answer in one month. When a request is complex or there are many, we can take two more months; we tell you in the first month. Requests are free, unless a request is clearly unfounded or excessive.

You also have the right to complain to a supervisory authority: in the EU, the data protection authority of the country where you live or work, or where the problem occurred; in the UK, the Information Commissioner's Office (ico.org.uk). We ask that you write to us first, so we can try to fix the problem.

10. Your California privacy rights

Notice at collection. This section is our notice at collection under the CCPA. We collect the categories of personal information below for the purposes in section 3, and keep each kind for the time in section 7. In the last 12 months we collected these categories and disclosed them for a business purpose as follows:

• Identifiers: E-mail address, account ID, IP address of each sign-in request, names of your devices and API keys. Source: You and your devices. Why: Account, sign-in, security. Disclosed to: Cloudflare, netcup, Backblaze, Stripe (e-mail address and account ID), Zoho (when you write to us).
• Customer records: E-mail address, payment status and history. No card numbers. Source: You, Stripe, NOWPayments. Why: Billing. Disclosed to: Stripe, Cloudflare, netcup, Backblaze.
• Commercial information: Plan, purchases, credits used. Source: You, Stripe, NOWPayments. Why: Billing and credits. Disclosed to: Stripe, netcup, Backblaze.
• Internet or other network activity: Tasks with the page text that the agent reads, results, files, routines, the vault use log with site host names, sign-in records. Source: You, and the agent on your computer. Why: Run the services, security. Disclosed to: Cloudflare, netcup, Backblaze; OpenRouter and its model providers get task content with an anonymous ID only.
• Inferences: Routine suggestions made from tasks that you repeat. Source: Your tasks. Why: Suggest routines. Disclosed to: No one. Stored at netcup and Backblaze.
• Sensitive personal information: Account log-in: your e-mail address with sign-in codes and session tokens, which we keep only as hashes. Your vault passwords, sealed on your device; we cannot read them. Source: You. Why: Sign-in, security and the vault only. Disclosed to: Cloudflare, netcup, Backblaze, as stored.

We do not collect precise geolocation, biometric information, or data about protected classifications, unless you put it in a task.

No sale or sharing. We do not sell personal information, and we do not share it for cross-context behavioral advertising. We did neither in the last 12 months. We have no actual knowledge that we sell or share the personal information of consumers under 16.

Global Privacy Control. When your browser sends Global Privacy Control (Sec-GPC: 1) with a request of your account, we record it as your opt-out of the sale and sharing of your personal information. We sell and share nothing now; the opt-out holds if that ever changes. Your account page shows the date when we received it.

Sensitive personal information. We use your account log-in only to sign you in and keep your account secure, and we cannot read your vault. We do not use sensitive personal information to infer characteristics about you, so the right to limit its use does not apply.

Your rights. You have the right to know what personal information we collect, use and disclose, and to get the specific pieces; to delete it; to correct it; to opt out of its sale or sharing; and to limit the use of sensitive personal information. Use them as section 9 tells, or write to contact@cuiar.com.

Verification. When you are signed in, the account page and the CLI need no more proof. For a request by mail, we answer only mail from your account's address, or we ask you to confirm the request from that address.

Authorized agents. An agent can make a request for you with your signed permission. We can ask you to confirm your identity with us directly and to confirm that you gave the permission.

Response times. We confirm a request in 10 business days and answer it in 45 calendar days. When we need more time, we tell you why, and we can take 45 more days.

No discrimination. We do not deny you the services, charge a different price or give a lower quality because you use a privacy right.

11. Security

The vault and synced data are encrypted on your computer. We store sign-in tokens, keys and codes only as hashes, and all traffic uses HTTPS. Read Security for the details and for how to report a vulnerability. If a breach puts your data at risk, we tell you and the authorities as the law requires.

12. Children

Cuiar is for people who are 16 years old or older. We do not knowingly collect data from children under 16. If we learn that an account belongs to a child under 16, we delete it.

13. Automated decisions

Cuiar makes no decision based only on automated processing that has a legal or a similarly significant effect on you. Automatic checks of your plan, credits and request limits only allow or stop a request.

14. Changes

When we change this policy, we change the effective date at the top of it. For a large change, we tell you by e-mail or on the site before it applies.

15. Contact

Internet Technology Services LLC · contact@cuiar.com