Privacy Policy

1. The short version

Conare ("we", "us", "our") operates conare.ai and the API at api.conare.ai. Conare stores a company's data, keeps it in sync, and returns the right context to its AI.

• Your documents belong to your organization. Other organizations cannot read them.
• We do not train AI models on your content, unless your organization asks us in writing for a custom model built from it, which serves your organization alone. We do not sell or share it.
• You can delete documents, namespaces and sources at any time, and ask us to delete your account.
• The only third parties that touch your data are listed in section 5 and on the subprocessors page.

2. Data we collect

2.1 Account data

Sign-in runs on WorkOS. WorkOS holds your name, email address, organizations and role; we keep only the WorkOS ids we need to tie your organization to its data. We never see your password or your single sign-on credentials.

Each time you sign in to the console, we send your WorkOS user id, name, email address and sign-up date to Customer.io, which we use to send product email. It also receives account events with your organization id: signing up, creating an API key, connecting an app (the app's type only) and inviting a member (the role only). It never receives your content.

2.2 Your content

• Documents — text and metadata you write through the API, the SDK, MCP or the console.
• Source records — records from apps you connect through Polytomic, synced into the namespace you choose.
• Uploaded files — the files you upload and the text read from them.
• API keys — stored only as hashes.
• Usage counts — queries and documents written per organization per day.

We use your content only to provide the service to your organization: to store it, index it, search it and return it to your own calls.

2.3 Payments

Card payments for credits run on Stripe Checkout. Stripe receives the card and billing details, name and email address you enter there, and your organization id. We never see your card number; we keep the amount and the Stripe checkout id with your organization's credits.

2.4 Demo bookings and documentation

Demo bookings run on Cal.com, which receives the name, email address and details you enter when you book. The documentation at docs.conare.ai is hosted by Mintlify, which processes visits to it.

2.5 Access requests

If you sign in without an invite, you can request access. We store your name and email address from sign-in, and the company, team size and use case you enter, in our database on Microsoft Azure. We use them only to reply to your request and to set up your organization.

2.6 Operational data

We keep logs and metrics about requests to run and secure the service. They can include IP addresses and account identifiers, but not document or query text. Cloudflare processes traffic metadata such as IP addresses to deliver and protect the site.

3. How we use your data

• Provide the service — store, index, search, rank and return your content on your calls
• Authenticate you — verify who you are and which organization you act for
• Run the service — monitor health, investigate errors and prevent abuse
• Talk to you — replies to your messages and demo bookings, and product email about your account

We do not:

• Sell your data
• Use your content to train, fine-tune or evaluate AI models, ours or anyone else's, except a custom model your organization asks us for in writing, which serves your organization alone
• Share your content with other organizations
• Build advertising profiles or track you across the web

4. Storage and security

Conare runs on Microsoft Azure and Google Cloud in the United States. Some AI inference on Azure may run in other Azure regions. Our cloud providers do not use your data to train their models.

• Each organization's documents live in namespaces that only its API keys and members can reach.
• Traffic is encrypted in transit (TLS); data is encrypted at rest by the cloud provider.
• API keys are stored as hashes; credentials for connected apps are stored encrypted.

5. Subprocessors

These vendors process customer data for us. The same list, with how changes are announced, is on the subprocessors page. Each name links to its data-processing terms.

6. Cookies

We set only strictly necessary cookies: the sign-in session and the checks around it. They are required for the console to work and do not need consent. We set no analytics or advertising cookies, so there is no cookie banner.

Cloudflare, which delivers the site, may set strictly necessary security cookies (such as bot management). We do not use advertising cookies or cross-site tracking.

7. Your Rights

Regardless of jurisdiction, you have the right to:

• Access — request a copy of all data we hold about you
• Export — read every document through the API at any time
• Correct — update your account information through your sign-in provider or by contacting us
• Delete — request deletion of your account and all associated content
• Restrict — ask us to limit how we process your data
• Object — object to specific processing activities

To exercise any of these rights, email artem@conare.ai. Account deletion requests are honored within 30 days.

8. Data retention

• Documents — kept until you delete them, their namespace, or your organization
• Source records — kept while the source is connected; disconnecting can delete them too
• Uploaded files — the original kept until you delete its namespace's files source or the user it belongs to (a new upload of the same file replaces it); the documents read from it, as documents
• Account data — kept by WorkOS, and by Customer.io for product email, while your account exists
• API keys and usage counts — kept while your organization exists
• Access requests — kept until you ask us to delete yours
• Logs and telemetry — kept for a limited period for operations
• Security audit records — a record of administrative actions in your organization (who created or revoked a key, deleted a namespace or a source, and from which address), kept 400 days, also after your account is deleted, to secure the service and to establish or defend legal claims

9. International data transfers

Conare and its subprocessors process data in the United States, except where section 5 says otherwise: some AI inference on Azure may run in other Azure regions, and Cloudflare and Google Workspace operate globally. Where the law requires it, transfers rely on the subprocessors' data-processing terms, including Standard Contractual Clauses.

10. Children's Privacy

Conare is not intended for, and is not knowingly used by, children under 18. We do not knowingly collect data from children. If you believe a minor has provided us with personal information, contact us and we will delete it.

11. Changes to This Policy

We may update this Privacy Policy over time. Material changes will be communicated by email or in-app notification. The "Last updated" date at the top of this page always reflects the most recent revision. Continued use of Conare after a change constitutes acceptance of the updated policy.

12. Contact

For privacy questions, data requests, or anything security-related, email artem@conare.ai.