Privacy Policy

1. Introduction

ColdAI LLC ("ColdAI," "we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our websites, software products, APIs, and services (collectively, the "Services"), including the Medusa AI Platform.

By accessing or using our Services, you acknowledge that you have read, understood, and agree to the practices described in this Privacy Policy. If you do not agree, please discontinue use of our Services.

2. Information We Collect

2.1 Information You Provide

• Account Data: Name, email address, password (hashed), and passkeys you register (we store only the public key), plus company name, job title, and billing information if you provide them.
• Communications: Messages, inquiries, and support tickets you send us.
• User Content: Prompts, files, documents, and other content you submit to our AI systems.
• Payment Data: Credit card numbers and billing details (processed by Stripe; we do not store raw card data).
• Waitlist: If you join a waitlist, your email address and the page you came from.

2.1.1 Medusa Twin Media

If you use Medusa Twin, you can upload photos, voice recordings and video of yourself (up to 12 files, 25 MB each; JPEG, PNG, WebP, MP3, WAV, OGG, WebM or MP4). These files can show your face and carry your voice. We store them privately in our object storage, linked to your account, and only you can access them. Twin drafts are generated from the text answers and writing samples you choose to share with your Twin; the uploaded media files are not sent to AI model providers. Uploads you start but do not complete are deleted automatically. Your media stays until you remove it, delete your Twin, or delete your account. When you delete your account, the account erasure described in section 6 deletes the files from our object storage. Our database backups hold only the file records (name, type, size), never the media files themselves.

2.2 Information Collected Automatically

• Usage Data: Pages visited, features used, actions taken, session duration, and interaction logs.
• Device & Technical Data: IP address, browser type and version, operating system, device identifiers, referrer URLs, and time zone.
• Cookies & Browser Storage: We use only essential first-party cookies and browser storage for sign-in, security and your preferences. We do not use analytics or advertising cookies. See our Cookie Policy.
• API Usage Logs: Timestamps, endpoint calls, token counts, model selections, and response metadata when you use our APIs.

2.3 Information from Third Parties

• Services you connect as integrations (for example Google, GitHub or Slack): the access tokens and account details needed to act on your behalf. We do not offer sign-in with these services.
• Stripe, for payment confirmation, refunds, disputes and fraud prevention.

3. How We Use Your Information

• To provide, operate, and maintain our Services.
• To process transactions and send related billing communications.
• To authenticate users and maintain security of accounts.
• To personalize your experience and deliver features you request.
• To monitor and analyze usage trends to improve our Services.
• To detect, investigate, and prevent fraud, abuse, and security incidents.
• To comply with legal obligations, resolve disputes, and enforce our agreements.
• To send administrative notices, product updates, and (with your consent) marketing communications.
• To train and improve AI models (only on anonymized or aggregated data unless you have specifically opted in to data contributions).

4. Legal Basis for Processing (EEA/UK Users)

Where applicable under GDPR or UK GDPR, we process your data under the following legal bases:

• Contract Performance: Processing necessary to deliver Services you have subscribed to.
• Legitimate Interests: Fraud prevention, security, analytics, and product improvement.
• Legal Obligation: Compliance with applicable laws and regulations.
• Consent: Marketing communications and optional data contributions to model training.

5. Sharing and Disclosure

We do not sell your personal information. We may share information with:

• Service Providers: Cloud infrastructure providers, payment processors, and the other subprocessors listed in section 5.1.
• AI Model Providers: When you use a model, your prompts, files and conversation context are sent to the provider that runs it (see section 5.1). Review their respective privacy policies.
• Legal Authorities: When required by law, court order, or to protect our rights, users, or the public.
• Business Transfers: In connection with a merger, acquisition, or sale of assets, with appropriate notice to you.
• With Your Consent: Any other sharing you explicitly authorize.

5.1 Subprocessors

These third parties process personal data for us to run the Services:

• Railway — hosting for our application servers and primary database.
• Cloudflare — network edge, content delivery and security for our sites; object storage (R2) for uploaded files, Twin media and database backups.
• OpenRouter — routes AI model requests (prompts, files and context) to the model provider you choose.
• Anthropic and OpenAI — run their models directly for some requests (prompts, files and context).
• Hugging Face — hosts and runs models listed on SF·SIX, and links your Hugging Face account when you publish a model there.
• fal — image, video and speech generation (the prompts and media you submit for these features).
• Brave Search — web search when you or your agents search the web (search queries).
• Browser Use — cloud browser sessions for browser tasks you run (task instructions and the pages visited).
• RapidAPI — third-party data APIs you call through Medusa integrations (the request parameters).
• Stripe — payments, saved cards for automatic refills, refunds and disputes.
• Resend — account emails such as verification, password reset and security notices (your email address).

Integrations you connect yourself (such as Google, GitHub or Slack) receive the data you ask Medusa to send them. Some SF·SIX exchange and ITO transactions are recorded on the Hedera public network; records written there are public and permanent and cannot be deleted by us.

6. Data Retention

We retain your personal information for as long as your account is active or as needed to provide Services.

When you delete your account from your account page:

• Immediately: your sign-in (email address, password, passkeys and sessions) is deleted.
• Right after, in the background: we delete the data your account holds in Medusa and SF·SIX: conversations, memories, knowledge sources, Studio and Code projects, Twin media and other uploaded files (removed from our object storage), agents and their prompt history, workflows, tasks, tool connections, API keys, saved-card settings, buyer scenarios and procurement data, your SF·SIX profile, handle, posts, comments, likes, follows and market reviews, your personal workspace settings (policies, organisation memory and its audit log), your waitlist sign-ups and invitations sent to your email. An organisation you own that has no other members is deleted with all of its data. This erasure is retried every 15 minutes until it completes.
• Organisations with other members: if you own an organisation that other people belong to, we do not delete your account until ownership has been transferred or the other members have been removed. Ownership transfer is not yet available in the app, so contact us at shayan@coldai.org.
• Kept, with your account id replaced by an anonymous reference: the billing and financial records we must keep for tax, accounting and anti-fraud purposes (credit balances and usage charges, top-ups, checkout and payment records, refunds and reversals, automatic-refill charges, trades, positions, custody, settlement and withdrawal records, ITO offerings, purchases and metered usage, markets you created with their bonds and fees, storage billing and marketplace payouts) and audit trails. Records of files you stored are kept for storage billing without the file name or the file. A few append-only ledger records (for example some custody and withdrawal records) cannot be changed once written and are kept as written, including your account id.
• Content other people rely on: plugin packs and workforce templates you published, or that other people installed, rated or bought, stay available with the author shown as a deleted account; your private drafts are deleted. A comment of yours that other people replied to is kept as an empty "deleted" placeholder so their replies stay in place. Other people's records that mention you (for example an approval you gave in their organisation) are kept with your account id replaced by an anonymous reference.
• Stripe: we ask Stripe to delete your Stripe customer record (saved cards for automatic refills); if that request fails, it is logged so we can delete the record by hand. Invoices, payments and refunds stay in Stripe because tax and accounting law requires them.
• Backups: our database is backed up every night and we keep only the 14 most recent nightly backups, so data erased from our live systems is gone from the nightly backups about two weeks later (once 14 newer nightly backups exist). Backups taken immediately before a database migration, and occasional manual backups, are kept until we delete them. Backups are stored in Cloudflare R2, encrypted at rest.

Records written to a public ledger (see section 5.1) cannot be erased. Aggregated, anonymized data may be retained indefinitely.

7. Security

We implement industry-standard safeguards including TLS encryption in transit, AES-256 encryption at rest, role-based access controls, multi-factor authentication for administrative systems, regular penetration testing, and formal incident response procedures. No method of transmission or storage is 100% secure; we cannot guarantee absolute security.

8. International Data Transfers

Your information may be transferred to and processed in countries other than your own, including the United States, which may have different data protection laws. Where required, we implement appropriate safeguards such as Standard Contractual Clauses.

9. Your Rights

Depending on your jurisdiction, you may have rights to:

• Access, correct, or delete your personal information.
• Restrict or object to certain processing activities.
• Data portability (receive your data in a structured format).
• Withdraw consent where processing is based on consent.
• Lodge a complaint with a supervisory authority.

From your account page you can download a copy of your data (a JSON file) and delete your account at any time.

To exercise these rights, contact us at shayan@coldai.org. We will respond within 30 days.

10. Children's Privacy

Our Services are not directed to individuals under 16 years of age. We do not knowingly collect personal information from children. If you believe we have inadvertently collected such information, contact us immediately.

11. Changes to This Policy

We may update this Privacy Policy periodically. We will notify you of material changes by posting the updated policy with a revised effective date and, where appropriate, by email or in-app notification. Continued use of our Services after changes constitutes acceptance.

12. Contact

For privacy inquiries, contact the Data Controller at:
ColdAI LLC
shayan@coldai.org