Privacy Policy

Last updated: October 20, 2026

1. Who We Are

Cambrian Catalyst LLC ("we", "us", "our") operates the Cambrian Catalyst sales intelligence platform at cambriancatalyst.ai.

2. What We Collect

We collect the following categories of information:

Account information: Name, email address, and password (bcrypt-hashed, never stored in plaintext)
Organization data: Company name, website URL, team member roster, and plan/billing status
Session data: Seller URLs, Ideal Customer Profile configurations, target accounts, research briefs, RIVER hypotheses, discovery notes, post-call analysis, and session summaries you create
Uploaded content: Sales materials, pitch decks, case studies, and other documents you upload for AI grounding (stored with content truncated to 500 characters per document on session save)
CRM integration data: If you connect HubSpot, we store encrypted OAuth tokens to push session data to your CRM on your behalf. We do not read or import your existing HubSpot data beyond what's needed to avoid duplicate records.
Usage data: API call counts, token consumption, feature usage, and session timestamps for billing and rate limiting
Technical data: IP address (for rate limiting and abuse prevention), browser type (from request headers), and origin URL

3. How We Use Your Data

Provide the Service: brief generation, fit scoring, RIVER coaching, and session management
Process AI requests through our model provider (prompts are sent, processed, and discarded — not stored for training)
Push session summaries to your connected CRM (HubSpot) when you explicitly click "Push to HubSpot"
Track usage for billing, token limits, and plan enforcement
Send transactional emails: password resets, team invitations, billing receipts
Aggregate anonymized, non-identifiable usage patterns to improve our knowledge layers and scoring models

4. What We Don't Do

We do not sell, rent, or trade your data to third parties — ever
We do not use your session content, briefs, or ICP data to train AI models
We do not share your data with other Cambrian Catalyst users or organizations
We do not display advertisements, use advertising pixels, or share data with Google for advertising
We do not access your CRM data beyond what's necessary to push your session summaries and avoid duplicate company records

5. Third-Party Services

We use the following third-party services to operate the platform:

Supabase (authentication, database, row-level security) — SOC 2 Type II compliant. Your data is stored in their managed PostgreSQL infrastructure with encryption at rest.
Anthropic (AI model provider) — Prompts are sent for real-time processing. Per their commercial terms, prompts and outputs are not stored or used for model training. We use their Claude model family.
Vercel (hosting and serverless functions) — SOC 2 Type II compliant. Serves the application and all API endpoints over HTTPS.
Stripe (payment processing) — PCI DSS Level 1 compliant. We never see or store your full credit card number. Stripe handles all payment data directly.
HubSpot (CRM integration, optional) — Only activated when you explicitly connect your HubSpot account via OAuth. Data flows one way: from Cambrian to HubSpot. We push company records, notes, deals, and tasks that you initiate.
Google Analytics 4 (product analytics) — Measures which pages and features of the website and app are used, so we can see where the product helps and where people get stuck. See section 9.
Apollo.io (company enrichment, optional) — Used to supplement company data (employee count, industry, domain verification). No personal contact data is purchased or stored without explicit user action.

6. Data Security

We take the security of your data seriously:

JWT-based authentication with JWKS cryptographic signature verification
Row-level security (RLS) in Supabase isolating each organization's data
HTTPS/TLS encryption in transit with HSTS preload enforcement
AES-256-GCM encryption for stored OAuth tokens (HubSpot integration)
Content Security Policy (CSP), X-Frame-Options, and other security headers on all responses
Rate limiting on all API endpoints (per-IP and per-user)
Input validation and sanitization on all user-supplied data
Proprietary knowledge layers served only to authenticated, paid users — never included in the client-side bundle
Production console output suppressed to prevent intellectual property leakage

7. Data Retention

Active accounts: Session data is retained as long as your account is active. You can delete individual sessions from within the app at any time.
Cancelled accounts: Upon account cancellation, we will delete your data within 30 days of your written request.
CRM tokens: HubSpot OAuth tokens are deleted immediately when you disconnect the integration.
Usage logs: Anonymized usage metrics may be retained for up to 12 months for aggregate analysis.

8. Your Rights

Regardless of where you're located, you have the right to:

Access: Request a copy of all data we hold about you
Correction: Request correction of inaccurate data
Deletion: Request deletion of your data ("right to be forgotten")
Export: Export your sessions and briefs from within the app
Disconnect: Revoke CRM integrations at any time from Settings
Close your account: Contact us to permanently close your account and delete all associated data

California residents (CCPA): You have the right to know what personal information we collect, request deletion, and opt out of any sale of personal information. We do not sell personal information.

EU/EEA residents (GDPR): Our legal basis for processing is contract performance (providing the Service you signed up for) and legitimate interest (improving the platform). You may contact us to exercise any GDPR rights.

9. Cookies and Local Storage

We use sessionStorage (not cookies) for authentication tokens. We use localStorage to cache your ICP data for performance and to persist authentication across browser restarts. We do not use advertising cookies or advertising pixels.

Analytics. On our production website and app (cambree.ai and cambriancatalyst.ai) we use Google Analytics 4 to understand how the website and app are used. It records the pages and app screens you view and the actions you take in the app (for example, building an ICP, generating a brief, or exporting), together with device and browser type and approximate location (country or city, derived from your IP address). When you are signed in, these events are tied to a pseudonymous account ID, your organization ID, plan and role — never to your name or email address. We do not send your email, name, website, the companies you research, anything you type into the app, or the parameters in your links (such as invite or password-reset tokens) to Google. Google advertising features and ad signals are turned off. Visitors from the European Economic Area, the United Kingdom and Switzerland are measured without analytics cookies (cookieless pings). Google Analytics may otherwise set first-party cookies (_ga, _ga_*) to distinguish visits. You can opt out with Google's Google Analytics Opt-out Browser Add-on.

10. Children

The Service is designed for business professionals. It is not intended for anyone under 18 years of age. We do not knowingly collect data from minors.

11. International Data Transfers

Your data may be processed in the United States. By using the Service, you consent to the transfer of your data to the US. We rely on our service providers' compliance frameworks (SOC 2, GDPR DPAs) for data protection.

12. Changes to This Policy

We may update this policy as the platform evolves. We'll notify you of material changes via email or an in-app notice. Continued use of the Service after changes constitutes acceptance.

13. Contact Us

Privacy questions, data requests, or concerns? Email joe@cambriancatalyst.ai.