Privacy Policy

Last updated: October 1, 2026

This Privacy Policy describes how Cifral Solutions LLC ("we", "us", or "our"), operating as Cifral at cifral.io, collects, uses, protects, and shares your personal information.

For most of the processing described in this policy, Cifral Solutions LLC acts as the data controller. Where a Cifral Custom implementation involves Cifral processing personal data on a customer's behalf, Cifral instead acts as a data processor under a signed Data Processing Agreement — the roles are different and are explained where relevant.

1. Information We Collect

1.1 Information You Provide

We collect personal information that you voluntarily provide when you:

• Contact us: Name, email address, company name, role/title, message content
• Join our waitlist: Name, email address, company name
• Use our services: Business information, project requirements, technical specifications
• Create an account: Email, name, account details
• Purchase a service: Billing details processed by our payment processor (Stripe) — see Section 6
• Use QuoteGen (once available): Account and authentication details, organisation/business profile information, customer/contact information you enter, quotation content (line items, descriptions, commercial terms), customer-facing quotation responses, and subscription/billing metadata — see Section 13

We generally do not seek to collect special categories of data (e.g., health, biometric, or religious data). If you choose to include such information in a message to us, we will only use it to respond to your inquiry and will not use it for any other purpose.

1.2 Information We Collect Automatically

When you visit our website, we automatically collect:

• Technical data: IP address, browser type, device information, operating system
• Usage data: Pages visited, time spent, referral source, click patterns
• Cookies: See our Cookie Policy for details

2. Legal Basis for Processing (GDPR)

We process your personal data based on the following legal grounds under the EU/UK General Data Protection Regulation:

• Consent (Art. 6(1)(a)): When you submit forms, subscribe to communications, or accept non-essential cookies. You may withdraw consent at any time without affecting processing already carried out.
• Contract performance (Art. 6(1)(b)): To provide services you've engaged us for, including delivering a Cifral Custom implementation.
• Legitimate interests (Art. 6(1)(f)): Website security, fraud prevention, direct-marketing to existing business contacts, and improving our services — balanced against your rights and interests.
• Legal obligations (Art. 6(1)(c)): Tax, accounting, and other statutory record-keeping requirements.

Where Cifral processes personal data as a processor on behalf of a customer, the legal basis for that processing is determined by the customer/partner as controller, not by Cifral.

3. How We Use Your Information

We use your personal information for the following purposes:

• Service delivery: Provide sales/process automation services, customer support, project management
• Communication: Respond to inquiries, send updates about our services, send transactional emails
• Payment processing: Process purchases and manage billing through Stripe
• Product development: Improve our services, develop new features, understand user needs
• Marketing: Send promotional materials (only with your consent or as a legitimate interest to existing business contacts; you can opt out anytime)
• Legal compliance: Meet tax, accounting, and legal requirements
• Security: Protect against fraud, abuse, and security threats
• Operating QuoteGen: Provide the QuoteGen quotation workflow, enforce plan entitlements and, once QuoteGen is available, process QuoteGen subscription billing

4. Automated Decision-Making and Profiling

Certain workflow automations use AI language models to draft responses and support internal triage. These tools assist our team; they do not make decisions that produce legal effects or similarly significant effects concerning you without human involvement, and you may always request to speak with a human by contacting info@cifral.io.

If you believe a decision about you was based solely on automated processing without meaningful human review, you may exercise your rights under Section 8.

QuoteGen is not a general-purpose AI assistant. It includes optional, contextual AI-assisted features for specific quotation tasks (for example, turning a description of work into draft line items). These features only process your input when you deliberately choose to use them, and the output is a draft you review before it is used — QuoteGen does not send a quotation to your customer or take any other action on your behalf based on the AI output alone. See Section 13 for the provider involved.

5. Data Retention

We retain your personal data only as long as necessary for the purposes set out in this policy:

• Contact form submissions: 2 years from submission
• Waitlist signups: Until product launch or 2 years, whichever comes first
• Service contracts and billing records: Duration of contract + 7 years for legal/tax purposes
• Marketing data: Until you unsubscribe or withdraw consent
• Website analytics: 26 months maximum
• QuoteGen account and quotation data: Retained for as long as your account or subscription remains active, and for a reasonable period afterward to allow account recovery and to meet legal/tax obligations, after which it is deleted or anonymized

When a retention period expires, we securely delete or anonymize the data unless a longer period is required by law.

6. Data Sharing and Recipients

We do not sell your personal information. We do not sell or share your personal information for cross-context behavioral advertising. We share personal data only with the following categories of recipients, each bound by a data processing agreement or equivalent contractual safeguards:

• Stripe — payment processing for Cifral Custom invoices and, once available, QuoteGen subscription billing
• Resend — transactional email delivery (contact form notifications and QuoteGen account/authentication emails)
• Notion — internal CRM/database storage of contact and lead information
• Supabase — authentication, database, file storage, and server-side (Edge Function) infrastructure for the QuoteGen application
• OpenAI — processes the specific quotation content you submit only when you use a QuoteGen AI-assisted feature
• n8n (self-hosted) — workflow automation infrastructure we operate ourselves to route contact and service data
• Vercel — hosting infrastructure for our website and the QuoteGen application
• Cal.com — scheduling for booking calls
• Professional advisors: Lawyers, accountants, auditors, under confidentiality obligations
• Legal authorities: When required by law, court order, or to protect our rights, users, or the public
• Successors: In connection with a merger, acquisition, or asset sale, subject to equivalent protections

7. International Data Transfers

Cifral Solutions LLC is based in the United States. Your personal data may be transferred to, stored, and processed in the United States and other countries outside your country of residence, including outside the European Economic Area (EEA) and United Kingdom.

Where we transfer personal data of individuals in the EEA/UK to the United States or another country not subject to an adequacy decision, we rely on appropriate safeguards recognized under GDPR, in particular the European Commission's Standard Contractual Clauses (SCCs) and, where applicable, the UK International Data Transfer Addendum, together with supplementary technical and organizational measures. You may request a copy of the relevant safeguards by contacting info@cifral.io.

8. Your Rights (GDPR & Other Privacy Laws)

Depending on your location, you have rights regarding your personal data under GDPR and similar laws, including the right to:

• Access — obtain confirmation of and a copy of the personal data we hold about you
• Rectification — correct inaccurate or incomplete data
• Erasure — request deletion of your data ("right to be forgotten"), subject to legal exceptions
• Restriction — limit how we use your data in certain circumstances
• Data portability — receive your data in a structured, machine-readable format
• Objection — object to processing based on legitimate interests or direct marketing
• Withdraw consent — at any time, where processing is based on consent
• Lodge a complaint — with your local data protection supervisory authority (in the EU/EEA, the authority of your country of habitual residence, place of work, or place of the alleged infringement)

To exercise your rights, email us at info@cifral.io. We will respond within 30 days (or as required by applicable law). We may need to verify your identity before fulfilling a request.

9. California Privacy Rights (CCPA/CPRA)

If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act ("CCPA/CPRA"), gives you additional rights over the personal information we collect about you:

• Right to know what personal information we collect, use, disclose, and the categories of sources and recipients
• Right to delete personal information we have collected from you, subject to certain exceptions
• Right to correct inaccurate personal information
• Right to opt out of the "sale" or "sharing" of personal information — Cifral does not sell or share personal information as those terms are defined under CCPA/CPRA, so there is no sale/share to opt out of
• Right to limit use of sensitive personal information — we do not use sensitive personal information for purposes requiring this right beyond what is necessary to provide our services
• Right to non-discrimination for exercising any of these rights

You may exercise these rights by emailing info@cifral.io or having an authorized agent submit a request on your behalf. We will verify your request using the information reasonably available to us and respond within the time required by law.

10. Cookies and Tracking Technologies

We use cookies and similar technologies to improve your experience on our website. For detailed information, please see our Cookie Policy.

11. Data Security

We implement appropriate technical and organizational measures designed to protect personal data against unauthorized access, alteration, disclosure, or destruction, including encryption in transit, access controls on a least-privilege basis, and regular review of our vendors' security practices. No method of transmission or storage is completely secure; if we become aware of a data breach affecting your personal data, we will notify affected individuals and relevant authorities as required by applicable law.

12. Children's Privacy

Our services are not directed to individuals under 16 years of age (or under 13 in the United States). We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it.

13. QuoteGen Service

QuoteGen is Cifral's self-serve quotation web application. It is in development and not yet available. This section describes the processing that is specific to the QuoteGen waitlist on cifral.io and, for when QuoteGen launches, to the product itself, in addition to the general provisions above.

When you join the QuoteGen waitlist on cifral.io, we collect the email address you submit so we can notify you when QuoteGen becomes available. See Section 5 for how long we keep it.

Once QuoteGen is available, when you create a QuoteGen account and use the product, we expect to process:

• Account and authentication information, such as your email address and login/session data
• Organisation or business profile information you provide
• Customer and contact information you enter into QuoteGen about your own customers
• Quotation content you create, including line items, descriptions, and commercial terms
• Responses your customers submit to a shared quotation, such as approval, requested changes, or decline
• Basic product usage information needed to operate the service and enforce plan entitlements (for example, the number of quotations or AI-assisted requests used in a billing period)
• Subscription and billing metadata associated with your QuoteGen plan

Payment-card details for QuoteGen subscriptions are collected and processed directly by Stripe; Cifral does not receive or store your full card number.

As described in Section 4, certain QuoteGen features let you deliberately invoke AI assistance for a specific quotation task. When you use one of these features, the quotation content relevant to that request is sent to our AI provider, OpenAI, to generate the response. We do not control, and this policy does not make any representation about, OpenAI's own data retention or model-training practices; please refer to OpenAI's own terms for that information.

QuoteGen's other service providers — Supabase (authentication, database, storage, and server-side infrastructure), Resend (transactional email), and Vercel (hosting) — are listed with the rest of our service providers in Section 6.

14. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be posted on this page with an updated date, and where required by law we will provide additional notice.

15. Contact Us