Privacy Policy

This Privacy Policy explains how Cedros LLC, a Wyoming limited liability company (“Cedros,” “we,” “us,” or “our”), collects, uses, discloses, and otherwise processes Personal Information.

It also explains the choices and rights that may be available to you.

Protecting customer privacy is a core commitment at Cedros. We will never sell user information to anyone, including Personal Information, Customer Data, Customer Content, or aggregated, deidentified, or other information derived from users.

This Privacy Policy applies to Personal Information processed through:

• cedros.ai and other Cedros websites that link to this Policy;
• Cedros accounts, dashboards, portals, and applications;
• Cedros website creation, hosting, and management services;
• artificial intelligence and agent-based features;
• Cedros APIs and developer services;
• extensions and integrations;
• billing and subscription services;
• communications with Cedros;
• Cedros-operated public directories, registries, feeds, and similar services; and
• other Cedros products and services that reference this Privacy Policy,

collectively, the “Services.”

This Privacy Policy does not necessarily govern information processed by businesses and other customers using Cedros to operate their own websites, applications, storefronts, directories, marketplaces, or other services (“Customer Sites”). As described below, Cedros frequently processes that information on behalf of the applicable customer.

At a glance

• Cedros has never sold user information and will never sell it, including aggregated or deidentified information.
• We use information to provide, secure, support, and operate the Services. Customer Site operators generally control the information collected through their own sites.
• Private customer content is not used to train generalized Cedros models without affirmative authorization. Section 9 explains managed AI providers, BYOK, and retention distinctions.
• We disclose information to service providers for requested functionality, to parties you direct us to, and where law or safety requires. Necessary service delivery is not permission to sell information.
• Retention varies by record and system. Section 24 lists current settings, including categories without automatic expiry.
• Send privacy requests to team@cedros.ai or use the contact form. See Sections 31 and 33 for requests and appeals.

This overview is a reading guide. The full Policy below explains the details and applicable rights.

Contents

• 1. Important Distinction: Cedros as Controller and Cedros as Processor
• 2. Definitions
• 3. Personal Information We Collect
• 4. Customer Content
• 5. Information About Customer Site Visitors
• 6. Usage and Device Information
• 7. Usage Metering Information
• 8. AI Inputs and Outputs
• 9. AI Providers
• 10. Agents and Automated Workflows
• 11. Connected Services and Integrations
• 12. Communications With Cedros
• 13. Sales, Partner, Developer, and Business Information
• 14. Information From Other Sources
• 15. Public Information
• 16. Information We Generally Do Not Request
• 17. How We Use Personal Information
• 18. Legal Bases for Processing in the EEA, United Kingdom, and Similar Jurisdictions
• 19. When We Disclose Personal Information
• 20. We Never Sell User Information
• 21. Cookies and Similar Technologies
• 22. Your Privacy Choices
• 23. Global Privacy Control and Opt-Out Preference Signals
• 24. Data Retention
• 25. Account Deletion and Customer Data
• 26. Deidentified and Aggregated Information
• 27. Security
• 28. International Data Transfers
• 29. Data Processing Addendum
• 30. U.S. State Privacy Rights
• 31. Exercising Your Privacy Rights
• 32. Authorized Agents
• 33. Appeals
• 34. California Privacy Notice
• 35. California Sources of Personal Information
• 36. California Business and Commercial Purposes
• 37. California Recipients of Personal Information
• 38. California Sale and Sharing
• 39. California Rights
• 40. California Automated Decision-Making
• 41. California Notice at Collection
• 42. Financial Incentives
• 43. EEA and United Kingdom Privacy Rights
• 44. Automated Decision-Making Under European Privacy Law
• 45. Switzerland and Other Jurisdictions
• 46. Children
• 47. Third-Party Websites and Services
• 48. Blockchain Information
• 49. Domain Registration Information
• 50. Security Incidents
• 51. Government and Law-Enforcement Requests
• 52. Changes to This Privacy Policy
• 53. Privacy Contact
• 54. Data Protection Officer
• 55. European Representative
• 56. United Kingdom Representative
• 57. Questions About Customer Sites

1. Important Distinction: Cedros as Controller and Cedros as Processor

Because Cedros is a platform used by other businesses, our role depends on the context in which Personal Information is processed.

When Cedros determines how information is used

Cedros generally acts as a controller, “business,” or similar responsible entity when we process Personal Information for our own purposes, such as:

• creating and administering Cedros accounts;
• billing customers;
• operating cedros.ai;
• providing customer support;
• securing the Cedros platform;
• managing our business;
• communicating with prospective and existing customers;
• improving Cedros products;
• operating our own marketing;
• administering partner or developer programs; and
• complying with legal obligations.

This Privacy Policy governs those activities directly.

When Cedros processes information for a customer

When a Cedros customer uses the Services to collect or process Personal Information through a Customer Site, Cedros generally acts as that customer's processor, “service provider,” “contractor,” or similar entity.

Examples may include:

• information submitted through a customer's forms;
• customer lists imported by a Cedros customer;
• ecommerce customer information;
• booking information;
• marketplace information;
• website visitor information;
• communications generated on behalf of a customer;
• CRM records;
• customer databases;
• business workflows;
• uploaded files;
• AI Inputs containing a customer's data; and
• other information that a Cedros customer instructs us to process.

The Cedros customer determines why and how that information is processed, subject to its agreement with Cedros.

If you have a privacy question or request concerning information you provided to a Customer Site, you should ordinarily contact the operator of that Customer Site directly.

Cedros will assist customers with applicable privacy obligations as required by law and our contractual commitments.

2. Definitions

For purposes of this Privacy Policy:

“Personal Information” means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked to an identifiable individual or household. Depending on applicable law, similar terms such as “personal data” may be used.

“Customer Data” means information processed by Cedros on behalf of a Cedros customer through the Services.

“Customer Content” means text, files, images, databases, prompts, instructions, records, communications, code, and other content supplied by or on behalf of a Cedros customer.

“End User” means an individual who interacts with a Customer Site.

Personal Information generally does not include information that has been lawfully deidentified or aggregated so that it cannot reasonably be associated with an individual. Cedros's no-sale commitment in Section 20 applies to that information as well, regardless of whether it qualifies as Personal Information under applicable law.

3. Personal Information We Collect

The information we collect depends on how you interact with Cedros and which Services are used.

3.1 Account and identity information

When you create or use a Cedros account, we may collect information such as:

• name;
• email address;
• username;
• organization or business name;
• job title or role;
• profile information;
• account identifiers;
• authentication information;
• account preferences; and
• information used to verify account ownership or authority.

3.2 Contact information

We may collect:

• email addresses;
• mailing addresses;
• telephone numbers;
• business contact information; and
• other contact details you provide.

3.3 Billing and transaction information

If you purchase Services, we may collect:

• billing contact information;
• billing address;
• subscription information;
• transaction identifiers;
• payment status;
• purchase history;
• tax information;
• invoices;
• refunds;
• credits;
• usage charges; and
• related financial information.

Payment-card information may be collected directly by our payment processors rather than stored by Cedros.

Where Cedros supports blockchain or digital-asset payments, we may process:

• public wallet addresses;
• blockchain transaction identifiers;
• network information;
• payment amounts; and
• other information necessary to identify and reconcile the payment.

Public blockchain transactions may remain permanently available on the applicable blockchain independently of Cedros.

4. Customer Content

We process Customer Content when you provide it to the Services.

This may include:

• website text;
• images;
• videos;
• audio;
• uploaded files;
• product information;
• inventory;
• business records;
• customer databases;
• form submissions;
• prompts;
• AI instructions;
• generated content;
• code;
• communications;
• analytics data;
• website configuration;
• and other information associated with your use of Cedros.

Customer Content may contain Personal Information.

Cedros processes Customer Content primarily to provide the functionality requested by the customer.

5. Information About Customer Site Visitors

When an individual visits a website hosted or powered by Cedros, Cedros may process technical information needed to deliver, protect, and operate that website.

Depending on the Customer Site and its configuration, this may include:

• IP address;
• browser type;
• operating system;
• device type;
• referring URL;
• pages requested;
• timestamps;
• network information;
• request and response information;
• security events;
• approximate geographic region derived from IP address;
• cookie or device identifiers;
• session information; and
• diagnostic data.

Most of this information is processed on behalf of the operator of the Customer Site.

Cedros may independently process limited infrastructure, security, fraud-prevention, and service-reliability information where necessary to operate and protect the Cedros platform.

6. Usage and Device Information

When you use the Services, we may automatically collect information about how the Services are accessed and used.

This may include:

• IP address;
• browser information;
• operating system;
• device identifiers;
• timestamps;
• pages or features used;
• API requests;
• commands or actions taken;
• session information;
• error reports;
• diagnostic logs;
• latency and performance information;
• login history;
• security events;
• feature usage;
• usage quantities;
• and other technical information.

We use this information to operate, secure, measure, troubleshoot, and improve the Services.

7. Usage Metering Information

Some Cedros Services are usage-based.

We may process information necessary to calculate and enforce usage relating to resources such as:

• hosted websites;
• artificial intelligence executions;
• generated content;
• email or communications activity;
• generated images;
• voice usage;
• API activity;
• storage;
• data transfer;
• provider usage;
• and other metered Services.

Metering information may be linked to an account, subscription, website, organization, or other Service identifier.

8. AI Inputs and Outputs

Cedros offers artificial intelligence features that may process:

• prompts;
• instructions;
• files;
• images;
• website content;
• database information;
• business information;
• conversation history;
• tool results;
• connected-service data; and
• other information supplied to an AI feature.

We refer to information submitted to an AI system as “AI Inputs” and information generated by the system as “AI Outputs.”

We process AI Inputs and Outputs to:

• provide requested AI functionality;
• maintain appropriate context within a task or workflow;
• execute authorized actions;
• detect abuse or security threats;
• troubleshoot failures;
• measure usage; and
• maintain and improve the reliability of the Services.

Generalized AI model training

Cedros does not use Customer Content, Customer Data, or Customer Site End User data to train generalized Cedros AI models unless the applicable customer affirmatively opts in or otherwise expressly authorizes that use.

We may use:

• feedback specifically submitted for product improvement;
• synthetic information;
• aggregated information;
• deidentified information;
• publicly available information lawfully obtained for that purpose; and
• information that we otherwise have a lawful right to use

to develop or improve Cedros systems.

These uses do not override the affirmative-authorization requirement for Customer Content, Customer Data, or Customer Site End User data stated above. Where Cedros acts as a processor, general references to improving our Services do not authorize using identifiable Customer Data for independent purposes outside the customer's documented instructions, applicable agreement, and law.

Where information has been deidentified, we will not attempt to reidentify it except where permitted by applicable law for purposes such as evaluating whether deidentification techniques are effective.

9. AI Providers

Cedros may use third-party artificial intelligence, model, inference, image-generation, voice, or other technology providers to provide particular features.

When Cedros supplies or manages the provider, we may transmit AI Inputs or related information to that provider as necessary to perform the requested function.

Cedros is responsible for selecting and configuring the providers it manages consistently with this Privacy Policy and its agreements with customers. Our restrictions on selling user information also apply to disclosures to managed AI providers.

We do not authorize a managed AI provider to use private Customer Content, Customer Data, or Customer Site End User data for that provider's own advertising or to train generalized models without the applicable customer's separate, affirmative authorization. Enabling an AI feature, accepting these Terms, or submitting a support request is not, by itself, that authorization. Any optional training authorization must describe the provider, information, and purpose and must not authorize a sale of user information.

These are requirements for Cedros's selection, contractual arrangements, and configuration of managed providers. A provider's general consumer-product privacy policy is not a substitute for the terms and settings applicable to the API or business service Cedros uses.

No-training and no-sale commitments do not mean that information is never retained. Depending on the feature and applicable provider terms, information may be retained or reviewed for service delivery, abuse prevention, security, legal compliance, or an expressly enabled feature. We do not promise zero data retention for every provider or feature. Contact team@cedros.ai for information about the managed provider and data-handling terms applicable to a particular feature before submitting information with special requirements.

The providers available through Cedros may change over time.

Bring Your Own Key

Certain Services allow customers to connect their own account or API credentials for an external provider.

When you use a bring-your-own-key or similar integration:

• Cedros sends information to the provider at your direction;
• that provider may receive AI Inputs, Customer Content, or other information necessary to perform the request;
• your use of the provider is governed by your agreement with that provider; and
• the provider's privacy practices may differ from Cedros's practices.

You should review a third-party provider's terms and privacy practices before connecting it to Cedros.

10. Agents and Automated Workflows

Cedros may allow AI agents, automations, or workflows to interact with information in your account or connected systems.

Depending on the permissions you grant, these systems may process Personal Information while:

• editing websites;
• generating communications;
• accessing connected applications;
• querying databases;
• managing records;
• performing searches;
• executing workflows;
• creating content;
• scheduling activities; or
• taking other authorized actions.

We process this information to perform the workflow you requested or configured.

Customers are responsible for determining what information an agent should be permitted to access and whether the requested processing is lawful and appropriate.

11. Connected Services and Integrations

If you connect Cedros to another service, we may receive information from and send information to that service.

Examples may include:

• payment providers;
• email providers;
• cloud-storage services;
• model providers;
• analytics providers;
• social platforms;
• communications providers;
• databases;
• domain providers;
• ecommerce systems;
• developer platforms;
• authentication providers;
• and other applications or APIs.

The information exchanged depends on:

• the integration;
• the permissions granted;
• the actions requested; and
• the information made available by the provider.

You may generally disconnect an integration through Cedros or through the third-party provider.

Disconnecting a service does not necessarily delete information previously transferred to either party.

12. Communications With Cedros

If you contact us, we may process:

• your name;
• contact information;
• the contents of your message;
• attachments;
• support history;
• diagnostic information;
• account information; and
• other information necessary to respond.

We may maintain support communications for customer service, security, dispute resolution, training, quality assurance, and business-record purposes.

13. Sales, Partner, Developer, and Business Information

If you communicate with Cedros about a potential commercial relationship, participate in a Cedros program, or interact with us in a professional capacity, we may collect:

• name;
• employer;
• job title;
• business contact information;
• areas of interest;
• referral information;
• program applications;
• correspondence;
• contractual information;
• commission or payment information where applicable; and
• relationship history.

14. Information From Other Sources

We may receive Personal Information from:

• your organization;
• administrators of an account you use;
• Cedros customers;
• service providers;
• authentication providers;
• payment providers;
• business partners;
• referrals;
• connected applications;
• public sources;
• publicly available websites or databases;
• and other parties where legally permitted.

We may combine information from these sources with information collected through the Services.

15. Public Information

Some Cedros features are specifically designed to publish information publicly.

Examples may include:

• websites;
• directories;
• listings;
• public profiles;
• marketplaces;
• public APIs;
• registries;
• feeds;
• portfolios;
• comments;
• product listings;
• or other publicly accessible content.

Information you choose to publish through these features may be:

• visible to anyone;
• indexed by search engines;
• accessed through APIs;
• copied;
• cached;
• archived;
• redistributed; or
• incorporated into third-party services.

Cedros may be unable to remove copies collected by independent third parties after information has been made public.

Do not publish Personal Information through a public feature unless you have the right to make it public.

16. Information We Generally Do Not Request

Cedros does not generally require users to provide information such as:

• Social Security numbers;
• passport numbers;
• driver's-license numbers;
• biometric templates;
• medical records;
• genetic information;
• precise geolocation;
• information concerning race, ethnicity, religion, sexual orientation, or other sensitive characteristics; or
• other highly sensitive Personal Information

in order to maintain an ordinary Cedros account.

However, because Cedros is a general-purpose platform, customers may choose to process certain sensitive information through their own Customer Sites or workflows.

Customers are responsible for determining whether such processing is permitted and whether additional safeguards, agreements, notices, or consent are required.

Cedros may restrict particular categories of sensitive information from certain Services.

17. How We Use Personal Information

Depending on the circumstances, we may use Personal Information to:

Provide the Services

Including to:

• create and manage accounts;
• host Customer Sites;
• execute requests;
• provide AI features;
• provide APIs;
• maintain databases;
• run automations;
• process files;
• deliver communications;
• enable integrations;
• provide extensions;
• manage domains;
• provide public feeds or directories;
• and otherwise provide requested functionality.

Process transactions

Including to:

• process purchases;
• manage subscriptions;
• calculate usage;
• issue invoices;
• process refunds;
• collect amounts owed;
• reconcile payments;
• detect payment fraud; and
• maintain financial records.

Authenticate and secure accounts

Including to:

• verify identity;
• authenticate users;
• enforce permissions;
• detect account compromise;
• detect fraud;
• investigate suspicious activity;
• prevent abuse;
• protect infrastructure; and
• maintain security logs.

Provide support

Including to:

• respond to questions;
• troubleshoot issues;
• investigate bugs;
• restore functionality;
• resolve disputes; and
• communicate about Service issues.

Operate and improve Cedros

Including to:

• understand feature usage;
• analyze reliability;
• diagnose errors;
• measure performance;
• improve user experience;
• develop new functionality;
• conduct research and testing;
• and maintain compatibility.

Communicate with you

Including to send:

• transactional messages;
• security alerts;
• billing notices;
• product updates;
• administrative communications;
• support responses;
• and marketing communications where permitted.

Enforce our agreements

Including to:

• enforce our Terms;
• enforce usage limits;
• investigate misuse;
• protect our rights;
• collect unpaid amounts; and
• resolve disputes.

Comply with law

Including to:

• maintain required records;
• respond to valid legal process;
• satisfy tax obligations;
• comply with sanctions and export-control laws;
• investigate unlawful conduct;
• and meet regulatory obligations.

Protect people and services

We may process information where reasonably necessary to protect:

• Cedros;
• our customers;
• End Users;
• third parties;
• the public;
• the integrity of the Services; or
• the security of systems and networks.

18. Legal Bases for Processing in the EEA, United Kingdom, and Similar Jurisdictions

Where applicable law requires a legal basis for processing, Cedros relies on one or more of the following.

Performance of a contract

We process information where necessary to:

• provide Services you request;
• administer your account;
• bill you;
• provide support;
• execute requested actions; or
• otherwise perform our agreement with you.

Legitimate interests

We may process information where necessary for legitimate interests such as:

• securing the Services;
• preventing fraud and abuse;
• maintaining platform reliability;
• understanding use of our products;
• improving our Services;
• operating our business;
• communicating with business customers;
• protecting legal rights; and
• preventing misuse,

provided those interests are not overridden by applicable rights and freedoms.

Consent

We rely on consent when required, including for certain:

• marketing communications;
• cookies or tracking technologies;
• optional features;
• use of information for generalized AI training where we have asked for affirmative permission; and
• other processing for which consent is the appropriate basis.

Where processing is based on consent, you may withdraw consent at any time. Withdrawal does not affect processing that was lawful before withdrawal.

Legal obligations

We process Personal Information where necessary to comply with applicable law.

Protection of vital interests

In unusual circumstances, we may process information where necessary to protect someone's life, health, or physical safety.

19. When We Disclose Personal Information

Cedros does not disclose Personal Information merely because doing so may be commercially valuable.

We may disclose Personal Information in the circumstances described below.

Service providers and subprocessors

We work with providers that perform functions such as:

• cloud infrastructure;
• hosting;
• content delivery;
• cybersecurity;
• authentication;
• payments;
• billing;
• communications;
• customer support;
• analytics;
• AI inference;
• image generation;
• voice processing;
• storage;
• monitoring;
• email delivery;
• domain services;
• and other technical or business functions.

These providers may process Personal Information as necessary to provide their services to Cedros.

Where required, we contractually restrict their use of Personal Information.

Provider information

See Service providers & subprocessors for the current configured provider disclosures, published provider identities, location information, and how to request customer-specific details or designate a notice contact. The configured services also include DigitalOcean managed hosting, Hetzner server infrastructure, Cloudflare delivery/DNS and public-site performance measurement, and Stripe payment processing when those functions are used. Provider roles vary by service.

As of September 30, 2026, providers configured for the Cedros-operated site include the following. A provider receives information only when the relevant functionality uses that provider; this table does not mean every provider receives every customer's information.

Provider or service	Relevant function	Information involved when used
DigitalOcean Spaces	Media and backup storage	Uploaded media, stored files, and encrypted backup artifacts
Amazon Web Services — Simple Email Service (SES)	Email delivery	Sender and recipient details, message content, and delivery information
OpenAI, Anthropic, Google Gemini, and xAI	AI model services	Inputs, relevant context, outputs, and request metadata
OpenRouter and the inference provider selected for a request	AI routing and inference	Inputs, relevant context, outputs, and request metadata
ElevenLabs	Voice functionality	Text or audio submitted to the feature and request metadata
Exa	Search used by requested features	Search queries and information included in those queries
Ahrefs	Backlink and search-performance analysis	Domains, URLs, and related search or backlink information used for analysis

The providers applicable to a particular Customer Site, deployment, feature, or customer-selected integration may differ. This table describes the verified configured services above; it is not a representation that every infrastructure supplier or downstream provider appears here, or that every listed service always acts as Cedros's processor. Provider roles depend on the relevant processing and contract.

Customers may request the current subprocessor information applicable to their Services at team@cedros.ai, including the contracting entity, function, processing location, downstream providers where relevant, and applicable transfer safeguards. Subprocessor authorization and changes are governed by the Data Processing Addendum, including its notice and objection process.

Third-party integrations

When you request an integration or action involving a third party, we disclose the information necessary to perform that request.

Your organization

If your account is owned or managed by an organization, authorized administrators may have access to information associated with your account or use of the organization's Services.

Other users you authorize

Information may be disclosed to people or organizations with whom you choose to collaborate or share access.

Public services

Information submitted to a public website, feed, directory, profile, API, marketplace, registry, or similar service may be disclosed publicly as described when the feature is used.

Payment providers

We disclose information necessary to process transactions, prevent fraud, and administer billing.

Professional advisers

We may disclose information to:

• lawyers;
• accountants;
• auditors;
• insurers;
• security consultants; and
• other professional advisers

where reasonably necessary for legitimate business or legal purposes.

Legal and safety purposes

We may disclose Personal Information if we reasonably believe disclosure is necessary to:

• comply with law;
• respond to valid legal process;
• enforce our agreements;
• investigate fraud or unlawful activity;
• protect the rights or property of Cedros or others;
• protect the security of the Services;
• prevent serious harm; or
• respond to an emergency.

Corporate transactions

If Cedros is involved in a:

• merger;
• acquisition;
• financing;
• reorganization;
• bankruptcy;
• sale of assets;
• change of control; or
• similar transaction,

Personal Information may be disclosed to relevant parties and advisers and may be transferred as part of the transaction.

Any recipient will remain subject to applicable privacy obligations. Disclosures and transfers under this paragraph are limited to evaluating or continuing the relevant Cedros business and remain subject to our no-sale commitment in Section 20. This paragraph does not authorize selling user information as a separate asset. A successor operating the Services must honor the privacy commitments applicable to the transferred information.

20. We Never Sell User Information

Cedros has never sold user information and will never sell user information to anyone.

This commitment covers all information about or supplied by our users, customers, and Customer Site End Users, including:

• Personal Information;
• Customer Data and Customer Content;
• AI Inputs and Outputs;
• account, transaction, usage, and behavioral information;
• aggregated, anonymized, deidentified, or pseudonymized information; and
• reports, profiles, inferences, or other information derived from that information.

The commitment applies whether or not the information identifies an individual or falls within a legal definition of Personal Information.

We will not sell, rent, trade, or license user information to others for money or other valuable consideration. We will not provide user information to advertisers or data brokers as a data product or source of revenue.

Cedros has never shared and does not share Personal Information for cross-context behavioral advertising as “sharing” is defined by the California Consumer Privacy Act.

This commitment does not prevent the processing needed to provide the Services, the use of service providers acting on our behalf, disclosures you request or authorize to deliver a feature, or disclosures required by law. Those activities remain subject to the purposes and limits described in this Policy and do not authorize Cedros to sell user information.

Our no-sale commitment applies to users of every age. It does not depend on an opt-out request, consent choice, subscription plan, or payment of an additional fee. References elsewhere in this Policy to privacy rights, deidentified information, product improvement, corporate transactions, or policy updates do not create an exception to this commitment.

21. Cookies and Similar Technologies

Our Cookies & choices notice lists the browser-storage names, purposes, lifetimes, and current choices for cedros.ai. Built-in optional analytics uses the Cedros consent notice. The public site also loads Cloudflare's performance beacon separately; Cloudflare describes its Web Analytics as not using cookies or local storage for usage measurement. Rejecting Cedros's optional analytics does not mean this separate beacon or necessary network/security processing stops.

Cedros and our providers may use:

• cookies;
• local storage;
• pixels;
• SDKs;
• server-side analytics;
• device identifiers;
• and similar technologies.

These technologies may be used for the following purposes.

Strictly necessary

To:

• maintain sessions;
• authenticate users;
• secure accounts;
• prevent fraud;
• maintain preferences necessary to provide the Services;
• and operate core functionality.

Preferences

To remember settings and choices.

Analytics

To understand:

• traffic;
• feature usage;
• performance;
• errors;
• engagement;
• and how the Services are used.

Advertising

If Cedros uses advertising or advertising measurement technologies, they may be subject to additional choices and consent requirements depending on your location.

Where required, non-essential cookies will not be used until the necessary consent has been obtained.

22. Your Privacy Choices

Depending on the Services you use, you may be able to manage privacy choices through:

• account settings;
• website cookie controls;
• unsubscribe links;
• privacy preference interfaces;
• integration controls;
• browser settings;
• or by contacting Cedros.

Marketing communications

You may unsubscribe from marketing email by using the unsubscribe mechanism included in the message.

You may continue to receive non-marketing messages such as:

• billing notices;
• security alerts;
• service announcements;
• legal notices; and
• account-related communications.

Cookies

You can control cookies through your browser and the Cedros consent notice. Our Cookies & choices notice explains how to change an earlier choice, including the need to clear stored site data because the consent preference is saved in both a cookie and local storage.

Blocking certain cookies may prevent parts of the Services from functioning correctly.

23. Global Privacy Control and Opt-Out Preference Signals

Where required by applicable law, Cedros recognizes qualifying browser-based opt-out preference signals, including Global Privacy Control (“GPC”), as a request to opt out of applicable sale or sharing of Personal Information for the browser or device sending the signal.

Where we can associate a qualifying signal with an account, we apply it to that account as required by applicable law. To request application across other devices or accounts, you may contact us using the methods in Section 31.

Because browser “Do Not Track” signals do not have a universally accepted technical or legal standard, Cedros may not respond to ordinary Do Not Track signals unless required by applicable law.

24. Data Retention

Cedros retains Personal Information only for as long as reasonably necessary for the purposes described in this Privacy Policy, subject to legal, contractual, security, and operational requirements.

The retention period for particular information depends on factors including:

• the type and sensitivity of the information;
• how long an account remains active;
• the purpose for which the information was collected;
• whether the information is part of Customer Data;
• contractual commitments;
• applicable legal requirements;
• limitation periods;
• fraud-prevention needs;
• accounting and tax obligations;
• security requirements;
• backup cycles;
• and whether retention is necessary to establish, exercise, or defend legal claims.

For example, we may retain:

• account information while an account is active and for an appropriate period afterward;
• billing and transaction records as required for tax, accounting, fraud, and legal purposes;
• security logs for periods appropriate to detecting and investigating security incidents;
• support records for customer-service and dispute-resolution purposes; and
• deleted Customer Data temporarily in encrypted backups until the applicable backup cycle expires.

Current Cedros-operated site settings

As of September 30, 2026, the Cedros-operated site uses the following configured retention windows. These describe scheduled cleanup settings, not a guarantee that every copy of information is deleted at the same moment. Customer-managed deployments and contractual retention requirements may differ.

Category	Configured window
Analytics events and visitor identities	365 days
Assistant conversations	365 days
General activity events	365 days
CRM timeline events	730 days
Email import files and import-error records	30 days
Export artifacts	14 days
Form submissions, audit logs, and assistant action-audit records	No automatic age-based expiry is currently configured

For categories without automatic expiry, information may remain until it is deleted through account administration, a valid privacy request, a customer's instruction, or a retention review. Absence of an automatic expiry does not authorize retaining Personal Information indefinitely without a continuing lawful purpose. Cedros remains responsible for applying the necessity standard above.

Encrypted backups use rotating daily and longer-period retention tiers. Retaining seven daily backup sets does not mean that all backup copies expire after seven days. Removal from active systems and expiry from backups can occur at different times.

Where Cedros acts as a processor, retention, return, and deletion of Customer Data are also subject to our agreement with the applicable customer and applicable law.

When Personal Information is no longer required, we delete, anonymize, aggregate, or otherwise dispose of it as appropriate.

25. Account Deletion and Customer Data

Closing a Cedros account does not necessarily result in immediate deletion of every record associated with the account.

Some information may remain temporarily or longer where necessary for:

• backups;
• billing;
• fraud prevention;
• legal compliance;
• security;
• dispute resolution;
• enforcing agreements; or
• other legitimate purposes permitted by law.

Cedros customers should export information they wish to retain before terminating their account, subject to the export protections in Section 32 of the Terms of Service.

A deletion request should identify the account, Customer Site, or information concerned without including unnecessary sensitive data. We will assess the request across relevant systems under our control and explain applicable exceptions or material limitations. Where we retain information for a limited legal, security, or backup purpose, that retention does not authorize unrelated marketing, model training, or sale.

Deletion from active systems does not necessarily remove information immediately from an encrypted backup. Backup copies remain subject to the relevant retention cycle and restricted recovery purposes. If a backup is restored, valid deletion instructions must be reapplied as appropriate before the restored information is used for ordinary operations. We do not promise a single deletion deadline for every system or third-party service; applicable legal and contractual deadlines still govern.

Information made public may remain accessible through:

• search-engine caches;
• third-party archives;
• blockchain networks;
• external APIs;
• copies made by third parties;
• or other systems outside Cedros's control.

26. Deidentified and Aggregated Information

Cedros may create information that has been aggregated or deidentified so that it cannot reasonably be associated with a particular person.

We may use such information to operate, protect, and improve Cedros, including for:

• analytics;
• research;
• product development;
• capacity planning;
• security;
• benchmarking;
• and understanding how the Services are used.

We will never sell aggregated, anonymized, deidentified, or other information derived from users. These forms of information remain covered by Section 20 even when privacy law does not classify them as Personal Information.

Where required by applicable law, Cedros will maintain deidentified information in deidentified form and will not attempt to reidentify it except for purposes permitted by law.

27. Security

Cedros uses administrative, technical, and organizational safeguards designed to protect Personal Information against:

• unauthorized access;
• loss;
• misuse;
• alteration;
• destruction; and
• unauthorized disclosure.

Safeguards may include measures such as:

• encryption;
• access controls;
• authentication;
• logging;
• network security;
• vulnerability management;
• monitoring;
• backups;
• security testing;
• role-based permissions;
• infrastructure isolation;
• incident-response procedures;
• and vendor-management controls.

No system can be guaranteed to be completely secure.

You are responsible for protecting your own:

• account credentials;
• devices;
• API keys;
• connected-provider credentials;
• recovery information;
• authentication factors;
• and access permissions.

If you believe your account or Personal Information has been compromised, contact Cedros promptly.

28. International Data Transfers

Cedros and our service providers may process Personal Information in countries other than the country in which it was originally collected.

Different countries may have different privacy and data-protection laws.

Where applicable law requires safeguards for an international transfer, Cedros will use a legally recognized transfer mechanism appropriate to the circumstances.

These may include:

• an adequacy decision;
• the European Commission's Standard Contractual Clauses;
• the United Kingdom International Data Transfer Addendum or other approved UK transfer mechanism;
• contractual safeguards;
• or another lawful transfer mechanism.

You may request information about the transfer mechanism applicable to your Services and, where applicable, a copy of the relevant safeguards by contacting team@cedros.ai. Confidential commercial or security information may be redacted where permitted by law.

Cedros will not make a restricted transfer without the legally required mechanism and safeguards. Regional or restricted-transfer support is available only to the extent supported by the applicable Service and lawful processing arrangement.

29. Data Processing Addendum

The Cedros Data Processing Addendum (“DPA”) forms part of the Terms of Service when Cedros processes Personal Information on a customer's behalf. It identifies the parties through the applicable account or order and includes processing, security, and subprocessor provisions. A separately executed DPA controls where it expressly replaces these standard terms.

The DPA addresses documented instructions, confidentiality, appropriate security, subprocessor authorization and change notices, assistance with individual rights, breach notification, return or deletion of Customer Data, compliance information and audits, and lawful international transfers.

The standard DPA does not require a separate signature or a blank form to be completed when incorporated into an accepted Cedros agreement. Acceptance of the DPA does not itself execute a separate international-transfer instrument or authorize processing prohibited by applicable law.

Cedros's permanent no-sale commitment and restrictions on generalized model training apply to Customer Data. General product-improvement language does not expand documented customer instructions.

For questions about the DPA, the subprocessors applicable to your Services, or supported processing arrangements, contact team@cedros.ai.

30. U.S. State Privacy Rights

Residents of certain U.S. states may have privacy rights under applicable state law.

Depending on your state and the circumstances, these rights may include the right to:

• confirm whether we process your Personal Information;
• access Personal Information;
• obtain specific Personal Information;
• correct inaccurate Personal Information;
• delete Personal Information;
• obtain a portable copy of Personal Information;
• opt out of the sale of Personal Information;
• opt out of sharing for cross-context behavioral advertising;
• opt out of targeted advertising;
• opt out of certain profiling or automated decision-making;
• limit certain uses or disclosures of sensitive Personal Information;
• withdraw consent to certain processing;
• obtain information about categories of third parties receiving Personal Information;
• and appeal a decision concerning a privacy request.

The precise rights available depend on applicable law.

Cedros will not discriminate against you for exercising legally protected privacy rights.

31. Exercising Your Privacy Rights

To submit a privacy request concerning information for which Cedros is responsible, you may use:

Online Request: Cedros contact form — enter “Privacy Request” in the subject field.
Email: team@cedros.ai — use “Privacy Request” as the subject.

You may also write to the mailing address in Section 53.

Where required by law, additional request methods will be made available.

Please describe your request clearly enough for us to understand and respond to it. Do not include passwords, authentication codes, private keys, full payment-card details, or other unnecessary sensitive information.

We may need to verify your identity before fulfilling certain requests.

Verification may depend on:

• the sensitivity of the information;
• the nature of the request;
• whether you have an authenticated Cedros account;
• the risk of fraudulent requests; and
• applicable legal requirements.

We will request only information reasonably necessary to verify the request.

If we cannot verify your identity sufficiently, we may be unable to fulfill part or all of the request.

Cedros is responsible for handling requests through the contact channels above. We will acknowledge the request where required, track the applicable response deadline, and request clarification or proportionate verification when needed. You do not need to use a particular subject line or create a new account to exercise a right where the law does not require it.

We will respond within the time required by applicable law and explain any permitted extension or refusal. Our response will describe the action taken or the reason for a refusal and any applicable appeal or complaint route. Requests to opt out of sale, sharing, or targeted advertising will not require identity verification where applicable law prohibits it.

If you have not received an acknowledgment or need to follow up, reply to your original email or contact team@cedros.ai with “Privacy Request Follow-Up” and the date of your original request. Following up does not restart the original response deadline.

32. Authorized Agents

Where applicable law allows it, you may designate an authorized agent to make a privacy request on your behalf.

We may require:

• proof that you authorized the agent;
• verification of your identity; or
• other information permitted by applicable law.

We will not require unnecessary information solely because you use an authorized agent.

33. Appeals

If applicable state law gives you the right to appeal a decision regarding a privacy request, instructions for submitting an appeal will be provided with our response.

You may also contact us at team@cedros.ai with “Privacy Appeal” in the subject or otherwise clearly identify your communication as an appeal. Include the date of the original request and the decision you want reviewed; you do not need to repeat sensitive information already provided.

Cedros will review the decision, respond within the applicable legal deadline, and explain the result. Where required, a denial will include information about contacting the relevant regulator or other complaint mechanism.

34. California Privacy Notice

This section provides additional information for California residents under the California Consumer Privacy Act, as amended (“CCPA”).

The categories described below use terminology defined by the CCPA.

Depending on your relationship with Cedros and the Services you use, during the preceding 12 months we may have collected the following categories of Personal Information.

Identifiers

Examples may include:

• name;
• email address;
• postal address;
• telephone number;
• username;
• account identifier;
• IP address;
• device identifier;
• and similar identifiers.

Sources: You, your organization, devices, Customer Sites, integrations, service providers.

Purposes: Providing Services, account administration, security, support, billing, communications, analytics, and legal compliance.

Personal information described in California Civil Code § 1798.80

Examples may include:

• name;
• address;
• telephone number;
• financial information;
• and similar information.

Sources: Primarily you, your organization, and payment or service providers.

Purposes: Account administration, transactions, support, and legal compliance.

Commercial information

Examples may include:

• subscriptions;
• Services purchased;
• transaction history;
• product usage;
• purchase preferences;
• and billing records.

Sources: You and your interaction with the Services.

Purposes: Providing Services, billing, analytics, support, and business administration.

Internet or electronic network activity

Examples may include:

• browsing activity on Cedros Services;
• pages viewed;
• interaction information;
• device data;
• logs;
• API activity;
• and Service usage.

Sources: Devices and the Services.

Purposes: Service delivery, analytics, security, troubleshooting, and product improvement.

Geolocation data

Cedros may derive an approximate geographic location from information such as an IP address.

Cedros does not ordinarily require precise geolocation for standard account use.

If a feature specifically requests precise location, Cedros will provide additional notice or obtain permission where required.

Sources: Devices, network requests, and information you choose to provide to a location-enabled feature.

Purposes: Service delivery, security, fraud prevention, analytics, and requested location-based functionality.

Audio, electronic, visual, or similar information

Examples may include:

• uploaded images;
• video;
• audio;
• voice inputs;
• support recordings where disclosed;
• and similar content.

Sources: You, your organization, or Customer Data.

Purposes: Providing requested functionality, support, communications, and security.

Professional or employment-related information

Examples may include:

• company;
• job title;
• professional role;
• business contact information;
• partner-program information;
• or information included in business communications.

Sources: You, your organization, partners, or public professional sources.

Purposes: Providing Services and managing commercial relationships.

Inferences

Cedros may derive limited inferences from usage information, such as:

• likely feature interests;
• product preferences;
• fraud or security risk indicators;
• or account usage patterns.

Sources: Your use of the Services, devices, account activity, and other information described in this Policy.

Purposes: Security, product improvement, personalization, support, and marketing where permitted.

Sensitive Personal Information

Depending on your use of the Services, Cedros may process information that California law defines as Sensitive Personal Information, including:

• account login credentials;
• financial account or payment-related information;
• contents of certain communications;
• or other information submitted through a Cedros feature.

Sources: You, your organization, payment or authentication providers, connected services, and Customer Data.

Purposes: Authentication, account security, transactions, requested communications and functionality, and legal compliance.

Cedros does not use or disclose Sensitive Personal Information for purposes requiring a “Limit the Use of My Sensitive Personal Information” right unless disclosed otherwise.

Customer Data may include additional Sensitive Personal Information selected by the applicable Cedros customer.

35. California Sources of Personal Information

We collect Personal Information from sources including:

• directly from you;
• your organization;
• Cedros customers;
• End Users;
• your devices;
• your use of the Services;
• connected applications;
• payment providers;
• service providers;
• business partners;
• referrals;
• and publicly available sources.

36. California Business and Commercial Purposes

We use and disclose Personal Information for purposes including:

• providing Services;
• maintaining accounts;
• processing transactions;
• providing customer support;
• debugging;
• analytics;
• security;
• fraud prevention;
• auditing;
• maintaining and improving Services;
• internal research;
• providing communications;
• administering commercial relationships;
• and complying with legal obligations.

37. California Recipients of Personal Information

Depending on the circumstances, we may disclose the categories described above to:

• infrastructure providers;
• service providers;
• subprocessors;
• payment providers;
• communications providers;
• AI providers;
• analytics providers;
• security providers;
• professional advisers;
• your organization;
• third parties you instruct us to interact with;
• government or legal authorities where required;
• and parties involved in a corporate transaction.

38. California Sale and Sharing

Cedros has never sold Personal Information or shared Personal Information for cross-context behavioral advertising, including during the preceding 12 months.

Cedros will never sell user information for monetary or other valuable consideration. Our commitment is broader than the CCPA's definition of Personal Information: it also covers aggregated, anonymized, deidentified, and other user information, as explained in Section 20.

California residents do not need to submit an opt-out request to receive this protection. The privacy rights and request methods described in this Policy remain available where applicable.

39. California Rights

Subject to applicable exceptions, California residents may have the right to:

• know the Personal Information Cedros has collected;
• access specific pieces of Personal Information;
• know the categories of sources from which information was collected;
• know the purposes for which information was collected, used, sold, or shared;
• know categories of third parties to whom information was disclosed;
• delete Personal Information;
• correct inaccurate Personal Information;
• opt out of sale or sharing;
• limit certain uses of Sensitive Personal Information;
• receive information in connection with certain automated decision-making technologies when applicable;
• opt out of qualifying uses of automated decision-making technology when applicable; and
• receive equal service and pricing when exercising privacy rights, subject to lawful exceptions.

Cedros will recognize opt-out preference signals when required by law.

40. California Automated Decision-Making

Cedros uses automation and AI throughout the platform, but not every use of AI constitutes regulated automated decision-making.

Cedros does not use solely automated processing to make significant decisions concerning Cedros account holders in areas such as:

• employment;
• housing;
• lending;
• insurance;
• education;
• healthcare;
• or similarly significant services

except where such processing is specifically introduced, disclosed, and operated in accordance with applicable law.

Cedros customers may independently configure Cedros tools for uses that involve significant decisions.

Where a customer determines the purposes and means of such processing, that customer is responsible for providing required notices, choices, human review, explanations, risk assessments, and other protections required by applicable law.

Cedros will provide processor assistance as required by its agreement with the customer and applicable law.

41. California Notice at Collection

This Privacy Policy describes the categories of Personal Information Cedros may collect and the purposes for which they are used.

Where California law requires additional notice at the point of collection, Cedros will provide a shorter contextual Notice at Collection that links to this Privacy Policy.

Cedros will not collect additional categories of Personal Information or use collected information for materially incompatible purposes without providing any additional notice required by law.

42. Financial Incentives

Cedros does not currently offer financial incentives or price differences in exchange for the collection, sale, or sharing of Personal Information as those concepts are defined by the CCPA.

Ordinary:

• subscription discounts;
• promotional pricing;
• referral programs;
• loyalty benefits;
• partner commissions;
• and similar commercial programs

are not intended to constitute payment for Personal Information.

If a Cedros program involving the collection or use of information constitutes a financial incentive under applicable privacy law, we will provide the required notice before enrollment. No such program authorizes the sale of user information or overrides Section 20.

43. EEA and United Kingdom Privacy Rights

If the GDPR, UK GDPR, or similar law applies to Cedros's processing of your Personal Information, you may have rights including:

• the right to access Personal Information;
• the right to correct inaccurate Personal Information;
• the right to erase Personal Information in certain circumstances;
• the right to restrict processing;
• the right to data portability;
• the right to object to certain processing;
• the right to object to direct marketing;
• the right to withdraw consent;
• and rights concerning certain automated decisions.

You may also have the right to lodge a complaint with the data-protection authority responsible for your jurisdiction.

If you are in the United Kingdom, you may contact the Information Commissioner's Office.

If you are in the EEA, you may contact your local supervisory authority.

You are not required to contact Cedros before submitting a complaint, although we encourage you to contact us so we can attempt to resolve the issue.

44. Automated Decision-Making Under European Privacy Law

Cedros may use automated systems for purposes such as:

• fraud detection;
• spam prevention;
• cybersecurity;
• abuse detection;
• usage management;
• and platform protection.

Cedros does not ordinarily make decisions about individuals based solely on automated processing where those decisions produce legal effects or similarly significant effects.

If Cedros introduces such processing, we will provide any notices, explanations, human-review mechanisms, objection rights, or other safeguards required by applicable law.

Customer use of Cedros tools may differ.

If a Cedros customer uses automated systems to make decisions about you, requests concerning those decisions should normally be directed to that customer.

45. Switzerland and Other Jurisdictions

Individuals in Switzerland or other jurisdictions with applicable privacy laws may have rights concerning their Personal Information.

Cedros will honor rights required by applicable law.

References in this Privacy Policy to GDPR concepts should be interpreted as including substantially equivalent concepts under applicable privacy law where appropriate.

46. Children

Cedros's Services are intended for adults and businesses and are not directed to children under 13.

Cedros does not knowingly collect Personal Information directly from children under 13 through ordinary Cedros account registration.

If we learn that we have collected Personal Information directly from a child under 13 without authorization required by law, we will take appropriate steps to delete it.

If you believe a child has provided Personal Information directly to Cedros, contact us at team@cedros.ai.

Cedros customers may build Customer Sites intended for different audiences.

A customer operating a service directed to children is responsible for determining whether laws such as the Children's Online Privacy Protection Act (“COPPA”) apply and for configuring and operating its Customer Site accordingly.

A customer may not use Cedros to collect children's Personal Information where required protections have not been implemented.

Cedros may require additional contractual or technical safeguards before permitting particular child-directed uses.

47. Third-Party Websites and Services

The Services may contain links to websites or services operated by other organizations.

Cedros does not control the privacy practices of independent third parties.

This Privacy Policy does not govern information you provide directly to those parties.

You should review their privacy policies before providing Personal Information.

48. Blockchain Information

Information recorded on public blockchains presents unique privacy characteristics.

If you use a Cedros feature involving a public blockchain:

• wallet addresses may be publicly visible;
• transaction information may be publicly visible;
• blockchain records may be copied and analyzed by third parties;
• records may be effectively permanent; and
• Cedros may be technically unable to alter or delete information recorded on the blockchain.

Do not place Personal Information directly onto a public blockchain unless you understand the consequences.

A privacy deletion request to Cedros cannot require Cedros to alter a decentralized blockchain that Cedros does not control.

Cedros may still delete or modify off-chain information under our control where appropriate.

49. Domain Registration Information

If Cedros provides domain-registration functionality, information may be transmitted to:

• domain registrars;
• registry operators;
• ICANN-related services;
• escrow providers;
• or other entities required to administer domain registrations.

Some registration information may be disclosed where required by domain-registration rules or applicable law.

Third-party domain providers may act independently with respect to some information.

50. Security Incidents

If Cedros experiences a security incident involving Personal Information, we will investigate and respond in accordance with applicable law and our contractual commitments.

Where legally required, we will notify:

• affected customers;
• affected individuals;
• regulators;
• or other appropriate parties

within the applicable time period.

Where Cedros processes affected Customer Data as a processor, we will generally notify the applicable customer so that the customer can satisfy its own notification obligations.

51. Government and Law-Enforcement Requests

Cedros evaluates government and law-enforcement requests for information and may require appropriate legal process.

We may disclose information when we reasonably believe disclosure is legally required.

Where legally permitted and appropriate, Cedros may notify affected customers before disclosing information.

We may preserve information in response to a legally valid preservation request even where we would otherwise delete it.

52. Changes to This Privacy Policy

We may update this Privacy Policy as Cedros changes.

When we make changes, we will update the “Last Updated” date.

If a change materially affects how we process Personal Information, we will provide additional notice where appropriate or required by law.

That notice may be provided through:

• email;
• an account notification;
• a dashboard notice;
• a website notice;
• or another appropriate method.

Where applicable law requires consent to a new processing purpose, we will request consent before beginning that processing.

53. Privacy Contact

Questions or requests concerning this Privacy Policy or Cedros's privacy practices may be directed to:

Cedros LLC
Attn: Privacy
1309 Coffeen Avenue STE 1200
Sheridan, Wyoming 82801, United States
Email: team@cedros.ai

Privacy rights requests may also be submitted through the Cedros contact form. Enter “Privacy Request” in the subject field.

54. Data Protection Officer

Cedros has not appointed a Data Protection Officer. Privacy questions and rights requests are handled through team@cedros.ai and the contact methods in Section 53.

If Cedros appoints or is legally required to appoint a Data Protection Officer, we will publish the officer's contact information in this Privacy Policy.

55. European Representative

Cedros has not appointed a representative in the European Union under Article 27 of the GDPR.

If Cedros is required to appoint such a representative, we will do so and publish the representative's name and contact information in this Privacy Policy.

For privacy questions or requests, contact team@cedros.ai or use the contact methods in Section 53. These contact methods do not replace a representative where one is legally required.

56. United Kingdom Representative

Cedros has not appointed a representative in the United Kingdom under UK data-protection law.

If Cedros is required to appoint such a representative, we will do so and publish the representative's name and contact information in this Privacy Policy.

For privacy questions or requests, contact team@cedros.ai or use the contact methods in Section 53. These contact methods do not replace a representative where one is legally required.

57. Questions About Customer Sites

If you are attempting to exercise privacy rights concerning a website, store, directory, marketplace, application, or other service operated by a Cedros customer, please contact that customer first.

The customer generally controls the relevant Personal Information and determines whether it should be:

• accessed;
• corrected;
• deleted;
• exported;
• restricted;
• or otherwise processed.

If the customer submits a valid request to Cedros concerning Customer Data, Cedros will assist in accordance with applicable law and our contractual obligations.