01 Scope and roles

This Privacy Policy explains how CactusBrain Labs collects, uses, discloses, and protects personal information when you use our websites, accounts, hosted control plane, APIs, model delivery services, SDKs, or support channels. It does not govern a customer's own application or the independent practices of model providers and other third parties.

For account and platform information described here, CactusBrain determines why and how the information is processed. A customer may separately act as controller or business for personal information it processes in its application. Lemon Squeezy, our merchant of record, processes purchase and payment information as a controller under its applicable privacy notice.

02 Information we collect

Account and organization information

Name, work email address, organization and project details, password hash, account status, role, verification state, notification preferences, analytics preference, and account-deletion request status.

Credentials and service records

API-key and license-key prefixes and cryptographic hashes, key status and last-use time, entitlements, model and artifact selections, encrypted artifact delivery, download-token records, delivery volume, model provenance, project configuration, and audit events. Plaintext API and license secrets are not retained after issuance.

Billing information

Subscription status, plan, billing period, and payment-provider customer, subscription, plan, and event identifiers. CactusBrain does not store complete payment-card details. Lemon Squeezy receives and processes payment, billing contact, tax, and transaction information needed to complete a transaction.

Operational telemetry and diagnostics

Project, event type and source, model and artifact metadata, SDK and runtime versions, platform, error code, a random installation identifier, and, when diagnostics are enabled, durations, backend, device family, and error category. The installation identifier distinguishes installations for operational counts; it is generated by the SDK and is not designed to identify a person.

Communications

Waitlist submissions, support requests, account and security notices, billing communications, and newsletter choices. We collect information you include in correspondence, so please do not send model inputs, secrets, or sensitive personal information unless needed to resolve a support request.

03 The on-device boundary

CactusBrain SDKs are designed to perform inference on the device. Operational telemetry and diagnostic schemas do not collect prompts, source text, images, audio, embeddings, labels, detected objects, identified products, or model outputs. We do not use customer inference content to train models through these telemetry channels.

Customers control the applications they build and may choose to transmit content using their own systems. Those customer-controlled practices are outside this Policy.

04 How and why we use information

• Provide accounts, projects, SDK access, entitlements, artifacts, downloads, and support.
• Authenticate users and credentials; prevent fraud, abuse, and security incidents.
• Measure delivery, apply plan allowances, maintain billing records, and reconcile payment-provider events.
• Diagnose failures and improve reliability where optional diagnostics or product analytics are enabled.
• Send requested product updates and necessary account, security, billing, and service notices.
• Comply with law, enforce agreements, and establish or defend legal claims.

Where a legal basis is required, we rely as applicable on performance of a contract, our legitimate interests in operating and securing the platform, consent for optional communications or diagnostics, and compliance with legal obligations. You may withdraw consent for future processing without affecting prior lawful processing.

05 Controls and choices

You can opt out of non-essential dashboard product analytics and marketing email in account settings. Project owners can control optional SDK diagnostics per project. Security, entitlement, artifact-delivery, integrity, accounting, and billing records are required to provide and protect the service and cannot be disabled as optional analytics.

We use necessary session and security cookies or similar storage to keep you signed in and protect account access. Lemon Squeezy may set its own checkout technologies under its notice. We have not integrated third-party advertising or cross-site behavioral analytics into the CactusBrain site, and CactusBrain does not sell personal information or share it for cross-context behavioral advertising.

06 Disclosures

We disclose information only as needed to vendors that host or support the platform, deliver email, secure services, or provide professional advice; to Lemon Squeezy for purchases, subscription administration, tax, fraud prevention, refunds, and payment support; at your direction or within your organization; in a corporate transaction subject to appropriate safeguards; or where reasonably necessary to comply with law and protect rights, safety, and security.

Service providers may process information only for the contracted services and under applicable confidentiality and data-protection obligations. We do not license account information to data brokers.

07 Retention and deletion

We retain information only as long as reasonably necessary for the purposes described here, including providing the account, maintaining security and audit history, documenting model provenance and redistribution decisions, measuring billable delivery, meeting tax and accounting duties, resolving disputes, and enforcing agreements. The period varies by record type, account status, legal requirements, and legitimate operational need.

An account-deletion request deactivates access while the request is completed. Some records may be retained or de-identified where deletion would compromise security, billing, audit, artifact provenance, the rights of other organization members, or a legal obligation. Project-linked records generally follow the project or organization lifecycle, subject to these exceptions.

08 Your privacy rights

Depending on where you live and subject to legal exceptions, you may request access to, correction of, deletion of, or a portable copy of personal information; object to or restrict certain processing; withdraw consent; and appeal or complain to a data-protection authority. California residents may also have rights to know, correct, delete, limit certain uses, opt out of sale or sharing, and receive equal service when exercising those rights. We do not sell or share personal information as those terms are used for cross-context behavioral advertising.

Send requests to [email protected]. We may verify your identity and authority before acting. An authorized agent may submit a request where permitted by law. You may also request account deletion from account settings. Lemon Squeezy must handle requests concerning information it controls for checkout and payment.

09 International processing and security

We and our service providers may process information in countries other than the one where you live. Where required, we use an approved transfer mechanism or another lawful safeguard. No transmission or storage system is perfectly secure, but we use administrative, technical, and organizational measures designed to protect information, including hashed credentials, scoped access, encrypted artifact delivery, and audit records.

10 Children and changes

CactusBrain is a developer and business platform and is not directed to children. We do not knowingly collect personal information from children below the age at which they may independently consent to online services in their location. Contact us if you believe a child provided information without appropriate authorization.

We may update this Policy as our practices or legal obligations change. We will post the revised effective date and provide additional notice where required. Questions can be sent to [email protected]. Use of our services is also governed by our Terms of Service.