Privacy Policy

1. Data we collect

• Account data — your email address and authentication details, used to create and secure your account.
• Content you create — the tasks, notes, brain-dump text, labels, and workspaces you enter. This is the core of the service and is stored so we can show it back to you.
• Payment data — if you subscribe to Team, billing is handled by Stripe. We receive subscription status and the last four digits/brand of your card; we never see or store full card numbers.
• Optional integrations — if you connect Telegram or a calendar feed, we store the identifiers needed to run them (e.g. a Telegram chat ID, a revocable calendar-feed token).
• Technical data — an essential session cookie and minimal server logs needed for security and reliability.

2. How we use your data

• To provide, maintain, and secure the service.
• To turn your brain-dump into a daily plan using AI (see section 4).
• To process Team subscriptions and send billing receipts.
• To send transactional email (sign-in, workspace invites, account notices). We do not send marketing email without your consent.
• To respond to support requests and enforce our Terms.

3. Legal bases (GDPR)

We process your data under the following bases:

• Performance of a contract — to provide the service you sign up for.
• Legitimate interests — to keep the service secure and working.
• Consent — for optional integrations you choose to connect (you can withdraw this at any time).
• Legal obligation — where we must keep records (e.g. tax/accounting for payments).

4. AI processing

To plan your day, the text you enter is sent to our AI providers — Anthropic (Claude) and/or OpenAI — which generate the structured plan and return it to us. This content is processed only to produce your plan. Under these providers’ API terms, data sent through the API is not used to train their models. You choose which model provider to use in settings.

5. Service providers we share with

We do not sell your data. We share it only with the processors that run Cerno, under contracts that limit them to processing on our instructions:

• Supabase — database and authentication hosting.
• Anthropic and OpenAI — AI planning.
• Stripe — payment processing.
• Resend — transactional email delivery.
• Telegram and your calendar provider — only if you connect them.

6. International transfers

Some of our providers are located outside the European Economic Area (for example, in the United States). Where data is transferred internationally, it is protected by appropriate safeguards such as the European Commission’s Standard Contractual Clauses.

7. Data retention

We keep your data for as long as your account is active. If you delete your account or ask us to erase your data, we remove it from our live systems promptly, except where we must keep limited records to meet a legal obligation. Backups are rotated and expire on a rolling basis.

8. Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you;
• correct inaccurate data;
• erase your data (“right to be forgotten”);
• restrict or object to processing;
• receive your data in a portable format;
• withdraw consent for optional integrations at any time.

To exercise any of these, email privacy@usecerno.xyz. You also have the right to lodge a complaint with your local supervisory authority — in Poland this is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, UODO).

9. Security

Data is encrypted in transit. Every row is scoped to your account at the database level (row-level security), not just in the interface, so your data is isolated from other users by default. No system is perfectly secure, but we work to protect your data using industry-standard measures.

10. Cookies

Cerno uses only strictly-necessary cookies — the session cookie that keeps you signed in. We do not use analytics, advertising, or tracking cookies, so no cookie-consent choice is required beyond the notice we show.

11. Children

Cerno is not directed to children under 16, and we do not knowingly collect their data. If you believe a child has provided us data, contact us and we will delete it.

12. Changes to this policy

We may update this policy from time to time. When we make material changes, we will update the date above and, where appropriate, notify you in the app or by email.

13. Contact

Awake Agency, Poland · privacy@usecerno.xyz