Privacy Policy

1. Scope of this Policy

This Privacy Policy explains how Cajal Technologies, Inc. ("Cajal," "we," "us," or "our") collects, uses, and shares information about you when you access or use our products and services, including our website, applications, APIs, and related offerings (collectively, the "Services").

This Policy does not cover the privacy practices of third parties (for example, payment processors, analytics providers, or platforms you use to access the Services). Their practices are governed by their own policies.

Relationship to Other Agreements

If you use the Services under a separate written agreement with Cajal, such as a Master Services Agreement (MSA) or Data Processing Addendum (DPA), those agreements may contain additional or different terms regarding our processing of information. In the event of a conflict between this Policy and your specific enterprise agreement, the terms of the written agreement will control.

Changes to this Policy

We may update this Privacy Policy from time to time. If we make changes, we will revise the "Last updated" date above and may provide additional notice where appropriate (for example, within the Services or by email).

2. Information We Collect

We collect information in three main ways: (a) information you provide, (b) information collected automatically, and (c) information we generate or infer.

A. Information You Provide

Depending on how you use the Services, you may provide:

• Account information, such as your name, email address, organization/company name, and login credentials.
• Billing and purchase information, such as billing address and purchase history. Payment card information is typically processed by our payment processor and not stored by Cajal, though we may receive transaction-related details (e.g., amount, date, and payment status).
• Communications, including messages you send to us (support requests, feedback, inquiries) and any information you choose to share in those communications.
• Content and inputs you submit, which may include requests, queries, or files you upload to access or evaluate our formally verified mathematical datasets (and any metadata associated with those submissions).
• Team/administrative information, such as details for colleagues you invite or administer within an organization account (e.g., name, email, role).

B. Information We Collect Automatically

When you access or use the Services, we may automatically collect:

• Device and usage data, such as browser type, device identifiers, operating system, IP address, pages viewed, access times, referring/exit pages, and interactions with the Services.
• Approximate location, which we may infer from your IP address.
• Log data, including error reports, crash data, and performance metrics.

C. Information We Create or Infer

We may derive information from what we collect, such as inferred general location from IP address or basic usage patterns (e.g., feature adoption).

3. How We Use Information

We use information we collect to operate our business and provide the Services, including to:

• Provide, operate, maintain, and improve the Services and our offerings of formally verified mathematical data.
• Create and administer accounts, including organizational accounts and user permissions.
• Process transactions and manage subscriptions, invoicing, and billing.
• Respond to requests and provide customer support.
• Send service-related communications, such as security alerts, account notices, receipts, and administrative messages.
• Send marketing communications (where permitted by law) and tailor messages to be more relevant; you can opt out as described below.
• Monitor and analyze usage, performance, and trends to improve reliability and user experience.
• Secure the Services, including detecting, preventing, investigating, and responding to fraud, abuse, security incidents, and illegal activity.
• Comply with legal obligations and enforce applicable terms, policies, and agreements.

We may also use information for any additional purpose disclosed to you at the time of collection.

Legal Bases for Processing

Where required by applicable law, we process personal information based on: performance of a contract, our legitimate interests in operating and securing the Services, compliance with legal obligations, and consent where required.

Model Training and Data Integrity

Notwithstanding anything to the contrary, Cajal does not use customer content, mathematical theorems, API inputs, or files uploaded for verification to train our proprietary models or develop datasets for other customers without your explicit written consent. Our use of submitted mathematical data is strictly limited to providing verification results and maintaining the integrity of your specific proof environment.

4. How We Share Information

We do not sell personal information, and we do not share personal information for cross-context behavioral advertising as those terms are defined under applicable privacy laws (such as the CCPA).

We may share information in the following circumstances:

A. Service Providers

We share information with vendors and service providers that help us run the Services (for example, hosting, database infrastructure, analytics, customer support tooling, communications, security, and payment processing). They are authorized to use information only as necessary to provide services to us. A current list of our third-party subprocessors is available on our Subprocessor List.

B. Legal, Safety, and Rights Protection

We may disclose information if we believe disclosure is necessary to:

• comply with applicable law, regulation, legal process, or lawful government request;
• protect the rights, safety, and security of Cajal, our users, or others; or
• prevent, investigate, or address fraud, abuse, security, or technical issues.

C. Corporate Transactions

If we are involved in a merger, acquisition, reorganization, financing, sale of assets, or similar transaction, information may be shared or transferred as part of that transaction.

D. With Your Direction or Consent

We share information when you instruct us to do so or when you provide consent.

E. Aggregated / De-identified Information

We may share aggregated or de-identified information that cannot reasonably be used to identify you.

5. Cookies, Analytics, and Similar Technologies

We and our service providers may use cookies and similar technologies (such as pixels and local storage) to:

• keep you signed in and maintain sessions,
• remember preferences,
• understand usage and improve the Services,
• measure performance and troubleshoot issues.

You can usually adjust your browser settings to remove or reject cookies. If you disable cookies, some features of the Services may not function properly.

6. Social Features and Third-Party Integrations

The Services may include integrations or embedded content provided by third parties (for example, social sharing widgets or platform integrations). If you use these features, information may be collected directly by the third party and subject to their privacy policy and settings.

7. Data Retention

We retain information for as long as reasonably necessary to:

• provide the Services,
• maintain business and financial records,
• comply with legal obligations,
• resolve disputes, and
• enforce our agreements.

Retention periods can vary depending on the type of information, how it is used, and legal requirements. For example, account information is generally retained for the duration of the account and a reasonable period thereafter for legal, audit, and business record purposes, while routine access logs are typically retained for up to 12 months.

8. Security

We implement administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, alteration, disclosure, or destruction. These measures include encryption of data in transit and at rest, access controls and authentication, monitoring and logging, and regular review of our security practices. No method of transmission or storage is fully secure, but we work to maintain and improve our protections.

9. International Transfers

Cajal is headquartered in the United States, and we may process and store information in the U.S. and other jurisdictions where we or our service providers operate. These locations may have data protection laws different from those in your jurisdiction. We take commercially reasonable measures designed to protect information when it is processed outside your region. Where required by applicable law (such as the GDPR or UK GDPR), we rely on appropriate safeguards for international transfers, including Standard Contractual Clauses (SCCs) or other lawful transfer mechanisms.

10. Your Rights and Choices

Depending on where you live, you may have certain rights regarding your personal information.

A. Account Updates

You may be able to access, update, or correct certain account information through your account settings (if available). You can also contact us for assistance.

B. Marketing Communications

You can opt out of promotional emails by using the unsubscribe link in those emails. Even if you opt out, we may still send non-promotional messages (for example, account notices, security updates, or transaction confirmations).

C. Cookies

You can control cookies through your browser settings. Some analytics providers may also offer opt-out mechanisms.

D. Access, Deletion, and Other Requests

Depending on your location, you may have the right to access, correct, delete, restrict, or object to our processing of your personal information, and to request portability of your information. To make such a request, contact us at the email below. We may need to verify your request and may retain certain information as required by law or for legitimate business purposes. If you are located in the EEA or UK, you also have the right to lodge a complaint with your local data protection authority.

11. Children's Privacy

The Services are not directed to children under 16, and we do not knowingly collect personal information from children under 16. If we learn we have collected such information, we will take reasonable steps to delete it. If you believe a child has provided us with personal information, please contact us at the email below.

12. Contact Us

If you have questions or concerns about this Privacy Policy or our privacy practices, contact: