Legal

Privacy Policy

Last updated: July 28, 2026. Your privacy matters. This policy explains what data we collect, why, and how you control it.

1. Data We Collect

1.1 Account & Profile Data

When you create an account, we collect:

  • Email address (verified)
  • Name (optional, for display)
  • Password hash (bcrypt, never stored in plaintext)
  • Organization/team name (optional)

1.2 License & Usage Data

To provide the CWAI service, we collect:

  • License keys (hashed for authentication)
  • Token usage counts (input/output tokens per request)
  • Model used, latency, success/failure status
  • Timestamp and tenant ID for each request
  • Daily aggregated usage summaries
Important: We never store your prompts, completions, or code. CWAI acts as a proxy — data flows from your editor → CWAI gateway → model provider → back to you. We only log metadata: token counts, latency, model used, and success/failure status for your analytics dashboard.

1.3 Billing Data

Processed by Stripe (our payment processor):

  • Payment method details (card, bank account) — handled entirely by Stripe
  • Billing address
  • Invoice history
  • Subscription status

We never see full card numbers. See Stripe's Privacy Policy.

1.4 Analytics & Telemetry

  • Page views, referrers, time on page (via privacy-friendly analytics)
  • Feature usage in dashboard (opt-in)
  • VS Code extension telemetry (opt-in, anonymous)

2. How We Use Your Data

PurposeLegal BasisData Categories
Provide CWAI service (auth, routing, budgets)Contract performanceAccount, license, usage
Billing & subscription managementContract performanceAccount, billing
Analytics dashboard for youLegitimate interestUsage metadata
Security & abuse detectionLegitimate interestUsage, license
Product improvementLegitimate interest / ConsentAnalytics, telemetry
Communications (updates, security)Legitimate interest / ConsentAccount
Legal complianceLegal obligationAll categories

3. Data Sharing & Disclosure

3.1 Model Providers

When you make a request, we forward it to the selected model provider (OpenAI, Anthropic, Google, etc.). We send:

  • Your prompt/completion content (required for the model to respond)
  • Model parameters (temperature, max tokens, etc.)

Each provider's privacy policy applies to data they receive. We have DPAs with major providers.

3.2 Subprocessors

SubprocessorPurposeLocation
StripePayment processingUSA (EU SCCs)
AWS / GCPCloud hostingUSA, EU
Postmark / SendGridTransactional emailUSA
SentryError trackingUSA

3.3 We Do Not

  • Sell your data
  • Share with advertisers
  • Use data for training models
  • Disclose to governments without valid legal process

4. Data Retention

Data CategoryRetention PeriodDeletion Trigger
Account & profileActive + 2 yearsAccount deletion request
License keys (hashed)Active + 2 yearsKey revocation + 2 years
Usage metadata13 monthsRolling window
Daily usage summaries3 yearsRolling window
Billing records7 yearsLegal requirement
Audit logs2 yearsRolling window
Analytics (opt-in)13 monthsConsent withdrawal

5. Your Rights

Depending on your jurisdiction (GDPR, CCPA, etc.), you may have:

  • Access: Request a copy of your data
  • Rectification: Correct inaccurate data
  • Erasure: Delete your data ("right to be forgotten")
  • Portability: Export your data in machine-readable format
  • Restriction: Limit processing
  • Objection: Object to legitimate-interest processing
  • Withdraw consent: For consent-based processing

To exercise rights: email privacy@cwai.dev or use the dashboard's "Export Data" / "Delete Account" features.

6. Security

  • Encryption: TLS 1.3 in transit; AES-256 at rest
  • Authentication: License-key auth (Ed25519), optional SSO
  • Access control: Least-privilege, MFA for staff, regular access reviews
  • Monitoring: 24/7 SIEM, intrusion detection, vulnerability scanning

7. Cookies & Tracking

CategoryPurposeDuration
EssentialSession, auth, CSRF protectionSession / 1 year
PreferencesTheme, language, dashboard config1 year
Analytics (opt-in)Usage stats, feature adoption13 months
MarketingNone — we don't use marketing cookiesN/A

Manage preferences in dashboard settings or browser. Essential cookies cannot be disabled.

8. Children's Privacy

CWAI is not directed at children under 16. We don't knowingly collect data from children. If you believe we have, contact privacy@cwai.dev.

9. International Transfers

CWAI is hosted in the US. If you're in the EU/UK, your data transfers rely on:

  • Standard Contractual Clauses (SCCs) with subprocessors
  • Adequacy decisions where applicable
  • Supplementary measures (encryption, access controls)

10. Changes to This Policy

We may modify this policy. Material changes: 30 days' notice via email and dashboard banner. Continued use after effective date = acceptance. Version history on GitHub.

11. Contact

Questions about this policy?

  • Email: privacy@cwai.dev
  • Postal: CWAI Inc., 123 Mission St, San Francisco, CA 94105

Ready to Build with CWAI?

Simple terms, transparent pricing, no surprises. Start your free trial today.

Get Started Free