1. Scope and operator
STEMFRA LLC, 8 The Green, Ste B, Dover, DE 19901, United States, operates Stemfra AI. This policy covers ai.stemfra.com and the Stemfra AI workspace. Our managed website and custom software services are separate products with their own privacy information.
We handle account, support and service-administration information for our own purposes. When a customer supplies personal information about other people for workspace tasks, we process that information to provide the requested service. The customer remains responsible for the permissions and notices needed for that use.
2. Information we process
Account and team information includes names, email addresses, authentication records, workspace membership, invitations and roles. Support enquiries include the contact details and messages you send us.
Workspace content can include prompts, conversation history, generated answers, uploaded files and extracted text, drafts, knowledge sources, customer and prospect records, and appointment information. If you use an audio feature, recordings and transcripts may also be processed.
Connected services may provide account identifiers, authorisation tokens and the information needed for the feature you enable, such as calendar events. Research features may retrieve publicly available company or contact information from external sources. Availability and permissions vary by integration.
Technical records include request and error logs, device and network information, usage and credit records, and records of actions taken in the service. Online checkout is disabled; an enquiry does not collect a payment or activate a subscription. If paid service is agreed, we may retain billing contact details, invoices and payment status.
3. How and why we use information
We use information to authenticate users, provide workspace tools, generate responses, manage permissions and usage, respond to support requests, and protect the service against misuse. We also use relevant records for billing administration, resolving disputes and meeting legal obligations.
Where data protection law requires a legal basis, we rely on performing our agreement with you, our legitimate interests in operating and securing the service, legal obligations, or consent where required. You may withdraw consent without affecting processing that occurred before withdrawal.
We do not sell your personal information. Publicly available contact information is still personal information where it identifies someone; finding it does not establish permission to contact that person.
4. AI processing and service providers
To generate responses, relevant prompts, conversation context, document content and tool results may be sent to an AI provider. OpenAI is used for AI processing. Its published API policy says API data is not used for model training by default, unless the customer opts in. This is distinct from storage for service operation or abuse monitoring, and is not a promise of zero retention.
Supabase supports authentication and data storage; Cloudflare and Hostinger support hosting and delivery. Email delivery providers process recipient addresses and message content when an enabled email feature sends a message. External research and connected-service providers receive the queries, identifiers or content required for the requested task.
Providers process information under their applicable service arrangements. We may also disclose information where legally required, to protect rights and security, or in connection with a business transfer subject to applicable protections.
5. Sharing within a workspace
Shared work is available to members according to their permissions. Workspace owners control team membership, billing and connections. Private documents are scoped to the user who owns them; inviting someone does not itself grant access to those documents.
Consider who can access a shared record before adding personal or confidential information. Removing a member or disconnecting an integration does not necessarily delete information already stored in the workspace or exported to another service.
6. Storage, retention and security
We retain account and workspace information as needed to provide the service, handle support and disputes, protect security and meet legal obligations. Retention depends on the record and purpose; this policy does not promise automatic deletion on a fixed schedule. Backups and records required for legal or security purposes may remain after an account or item is deleted.
We use authentication and access controls to restrict access. No online service can guarantee complete security. Contact [email protected] if you suspect unauthorised access.
Our providers may process information outside your country, including in the United States. Applicable transfer requirements and safeguards depend on the service and jurisdiction. Contact us for information about the arrangements relevant to your data.
7. Browser storage and connected accounts
The application uses browser storage for login sessions and interface preferences. Clearing or blocking this storage may sign you out or affect functionality.
You can manage available connections in the application and revoke permissions through the connected provider. Revoking access stops future authorised access through that connection; it does not automatically erase existing workspace records or the provider’s own records.
8. Your choices and rights
Depending on applicable law, you may request access, correction, deletion, portability or restriction of your personal information, object to certain processing, withdraw consent, or complain to your data protection authority. We may need to verify your identity before acting on a request.
Email [email protected] to make a privacy request. We respond in accordance with applicable law and explain any limits, such as records we must retain. If your information was supplied by another customer, contact that customer first; we can help identify the appropriate route. Cancelling a subscription and requesting deletion are separate actions.
9. Age and policy changes
Stemfra AI accounts are intended for people aged 18 or older. If you believe a child has created an account or supplied personal information improperly, contact us so we can review it.
We update this policy as the service changes and show the revision date above. Material changes will be communicated as required by applicable law.
10. Contact
For privacy questions or requests, email [email protected] or write to STEMFRA LLC, 8 The Green, Ste B, Dover, DE 19901, United States.