Legal
Privacy Policy
How Cairn collects, uses and protects information — written to be read, not just accepted.
LAST UPDATED OCTOBER 1, 2026
Sample content
This page is placeholder text for the Cairn template. Replace it with a version reviewed by your legal counsel before publishing.
1. Overview
This policy explains how Cairn Labs, Inc. (“Cairn”, “we”) handles personal information when you visit our website, create a workspace or use the Cairn platform. It applies to information we control. When we process data on behalf of our customers inside their workspaces, we act as a processor under our Data Processing Agreement.
2. Information we collect
We collect only what we need to provide and improve the service:
Account information — name, work email, company, role and authentication details.
Workspace content — agent configurations, connected tool metadata, runs and traces that customers create.
Usage information — pages visited, features used, device and browser data and approximate location from IP address.
Communications — messages you send to sales or support, and form submissions on this site.
3. How we use information
We use information to operate and secure the platform, provide support, bill for the service, improve product quality and communicate with you about your account. We send marketing email only where permitted and you can unsubscribe at any time.
4. Customer data and AI models
Customer data is never used to train models — ours or those of our model providers. Prompts and outputs sent to model providers are processed under agreements that prohibit training and limit retention. Customers control trace retention and can redact personal data from traces.
5. Sharing and subprocessors
We share information with subprocessors that help us run the service — such as cloud hosting, model providers, email delivery and payment processing — under written contracts with confidentiality and security obligations. We do not sell personal information. A current list of subprocessors is available on request.
6. International transfers
Workspaces are hosted in the EU or the US, as selected by the customer. Where personal information is transferred internationally, we rely on appropriate safeguards such as the EU Standard Contractual Clauses.
7. Retention
We keep account information for as long as your account is active and as needed to meet legal obligations. Workspace content is retained according to customer settings and deleted within 30 days of workspace deletion, except for backups which expire on a rolling 35-day schedule.
8. Security
We protect information with encryption in transit and at rest, least-privilege access, audit logging, regular penetration testing and an annual SOC 2 Type II audit. Learn more on our security page.
9. Your rights
Depending on where you live, you may have the right to access, correct, delete or export your personal information, and to object to or restrict certain processing. To exercise these rights, contact us. If your data is in a customer’s workspace, we’ll direct your request to that customer.
10. Contact
Questions about this policy can be sent through our contact page. We aim to respond within 30 days.