Skip to main content

Legal

Privacy Policy

Last updated: August 6, 2026

Overview

This policy describes how ArtifactAuth Inc. (“ArtifactAuth”, “we”, “us”) collects, uses, and protects information when you visit artifactauth.com or use the ArtifactAuth cloud service. We build authorization-aware memory for AI agents; treating data carefully is the product, and this policy is written to match how the service actually works.

Information we collect

We collect the following categories of information:

  • Account information. When you sign up or log in, our authentication provider (Auth0) collects your email address, name, and authentication identifiers, which we use to create and secure your account.

  • Contact form submissions. When you use our contact form, we collect the name, email address, optional company name, and message you provide, and deliver them by email to our internal inbox so we can respond.

  • Customer content. Content your organization submits to the service through the API — conversation segments, authorization labels, and related metadata — is stored and processed solely to provide the service to your organization.

  • Usage data. On our production website we use Google Analytics to understand aggregate site usage (pages visited, referrers, approximate location derived from IP). Our servers and hosting infrastructure also record standard log data such as IP address, user agent, and request timestamps.

How we use information

We use the information above to operate and secure the service, respond to your messages, understand how the site is used, and meet our legal obligations. We do not sell personal information, we do not use your data for advertising, and we do not use customer content to train machine-learning models.

Cookies

We use a small number of cookies:

  • Session cookies (essential). A first-party, httpOnly session cookie keeps you logged in to the console for up to 24 hours. Our authentication provider sets its own cookies during login. The service does not work without these.

  • Analytics cookies. Google Analytics sets cookies on our production website to distinguish visitors. Analytics runs only in production; staging and development builds ship none.

Service providers

We rely on a small set of providers to run the service: Amazon Web Services (hosting, storage, and transactional email), Auth0 (authentication), and Google Analytics (website usage measurement). Each provider processes data only as needed to provide its service to us.

Data retention

We keep account information for as long as your account is active. Customer content is retained under your organization’s control and deleted when your organization deletes it or closes its account. Contact-form emails and server logs are kept only as long as needed for support and security purposes.

Security

Data is encrypted in transit and at rest. Access to production systems is restricted and authenticated, and the service is designed fail-closed: where authorization is unknown or unverifiable, the default is to show less, never more. Paid plans offer stronger encryption tiers, including per-tenant and per-label derived keys. If a breach affects your personal data, we will notify you without undue delay, consistent with applicable law.

International transfers

We are based in North America and our infrastructure runs on Amazon Web Services in the United States. If you access the service from elsewhere, your information will be processed in the United States.

Your rights

You can request access to, correction of, or deletion of your personal information at any time via our contact form. Depending on where you live, you may have additional rights under laws such as the GDPR or CCPA; we will honor valid requests under applicable law.

Children

The service is intended for business use and is not directed to children under 16. We do not knowingly collect personal information from children.

Changes to this policy

We may update this policy as the service evolves. We will post the new version here and update the date at the top; material changes will be announced to account holders by email or in the console.

Contact

Questions about this policy or your data? Reach us through the contact form and we’ll route your request to the right person. Organizations that process personal data in the service can request a data processing agreement the same way.