Privacy Policy
This policy explains what we collect, why, who we share it with, and your rights. We wrote it in plain language on purpose.
1. Who this covers
- Visitors to petricor.ai (marketing site, ideas/blog, pricing).
- Waitlist and newsletter subscribers.
- Account users of the petricor application (the observability product).
If you use petricor on behalf of a company (your employer connects its data), that company is the controller of its business data and petricor is a processor — governed by the separate Data Processing Agreement (DPA), not this policy. This policy governs the personal data petricor controls directly.
2. Information we collect
On the website
| Data | When | How captured |
|---|---|---|
| Email address | You join the waitlist or newsletter | You type it |
| User-agent, approximate country, referrer, timestamp | Any waitlist/newsletter submission | Automatically, from the request |
| IP address, request logs | Any page visit | By our host (Cloudflare) |
We do not run advertising or analytics trackers, and we self-host our fonts, so your visit is not shared with Google or any ad network.
In the application
| Data | Purpose |
|---|---|
| Name, email, authentication credentials, session tokens | Account creation and sign-in (via Clerk) |
| Your organization's connected business metrics and operational data | To provide the service — stored in our database (Railway Postgres) |
| Content you submit to AI-assisted features (prompts, context) | To generate briefs and answers (processed by Anthropic) |
| Functional cookies / local storage | Keep you signed in and remember your current workspace. No advertising or cross-site tracking cookies. |
3. How we use it
- Provide, operate, and secure the website and application.
- Respond to waitlist interest and send newsletters you subscribed to.
- Communicate with you about your account or the service.
- Debug, prevent abuse, and comply with law.
We do not sell your personal information, and we do not use it for third-party advertising.
4. Legal bases (GDPR / EEA & UK)
- Consent — newsletter, waitlist.
- Contract — operating your account and providing the service.
- Legitimate interests — security, abuse prevention, product improvement, and responding to inquiries.
You may withdraw consent at any time (e.g. unsubscribe link, or contact us).
5. Cookies and tracking technologies
We use only strictly necessary cookies and local storage — to keep you signed in and remember your current workspace. We do not use advertising, analytics, or cross-site tracking cookies, so there are no optional cookies to consent to and we don't show a cookie banner.
Do Not Track. Some browsers can send a “Do Not Track” signal. There is no industry-standard way to respond to it, and because we don't track you across sites, our behavior is the same whether or not the signal is set.
6. How we share data (sub-processors)
We share only what each service needs to function. Each is a data processor bound by its own terms.
| Provider | Purpose | Data reaches them |
|---|---|---|
| Cloudflare | Hosting, CDN, waitlist storage (KV) | Site traffic, IP, waitlist/newsletter records |
| Resend | Transactional/notification email | Waitlist email address |
| beehiiv | Newsletter delivery | Newsletter email address |
| Clerk | Authentication | Account name, email, credentials |
| Railway | Application database hosting | Account + application data |
| Anthropic | AI-assisted features | Content submitted to those features |
We also disclose data where required by law, to protect our rights or users' safety, or in connection with a merger, acquisition, or sale of assets (with notice where required). A current list of sub-processors is available on request, and we will update this policy before adding a materially new category of processor. We do not sell or “share” personal information for cross-context behavioral advertising.
7. International transfers
Our providers may process data in the United States and elsewhere. Where required, transfers out of the EEA/UK rely on Standard Contractual Clauses or an equivalent safeguard.
8. Retention
- Waitlist / newsletter: until you unsubscribe or ask us to delete, then removed within 30 days.
- Account data: for the life of your account, then deleted or anonymized within 90 days of closure, unless we must keep it to meet a legal obligation.
- Logs: 90 days.
9. Your rights
Everyone: access, correct, delete, or export your data, and unsubscribe from email, by contacting privacy@petricor.ai. We will verify your request before acting on it and won't discriminate against you for exercising a right.
EEA/UK (GDPR): access, rectification, erasure, restriction, portability, objection, and the right to complain to a supervisory authority.
California (CCPA/CPRA): the categories of personal information we collect, and our purposes, are described in Sections 2–3. You may request to know, delete, and correct your information, and to opt out of “sale” or “sharing” — we do neither, so there is nothing to opt out of. You may use an authorized agent to make a request.
We respond within the timeframe the applicable law requires (generally 30–45 days).
10. Security
Data is encrypted in transit (TLS). Access to production systems is restricted. No system is perfectly secure; we cannot guarantee absolute security, and you use the service at your own risk to that extent.
11. Children's privacy
The Service is not directed to children. We do not knowingly collect personal data from anyone under 13 (or under 16 in the EEA/UK). If you believe a child has given us personal data, contact us and we will delete it.
12. Third-party links
Our site and product may link to third-party sites or services we don't control. Their privacy practices are their own — review their policies. We are not responsible for their content or how they handle data.
13. Changes to this policy
We may update this policy. Material changes will be posted here with a new effective date and, where appropriate, notified by email.
14. Contact
Petricor AI Inc.
privacy@petricor.ai