Skip to content
Back to Home

Privacy Policy

Last updated: July 2026

1. Introduction

c137 ("we", "our", or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, store, and protect your personal data when you use our AI assistant service.

We comply with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the California Consumer Privacy Act (CCPA).

2. Data We Collect

We collect the following types of data:

  • Account Information: Email address, name, and authentication data provided through our authentication provider (WorkOS).
  • Chat Content: Your questions, our AI responses, and any conversations you have with c137.
  • Documents: Any documents or text you upload or create within the service.
  • Images: Any images you upload for analysis or reference within conversations.
  • Imported Conversations: Chat history you import from other AI providers (e.g. ChatGPT, Claude, Grok).
  • Artifacts: Work products created or edited within the service (notes, plans, summaries, etc.).
  • Memory Data: Compressed summaries of your conversations stored for context retrieval.
  • Usage Data: How you interact with the service, including feature usage, preferences, and analytics data.
  • Payment Information: Billing details processed securely through Stripe. We do not store your full card details.

3. How We Use Your Data

We use your data to:

  • Provide and improve the c137 AI assistant service
  • Process your questions through AI models to generate responses
  • Store and retrieve context to provide personalized assistance
  • Process payments and manage your subscription
  • Send important service updates and notifications
  • Detect and prevent fraud or abuse
  • Improve and develop our AI services, including training and evaluating models, using de-identified conversation data (opt out anytime in Settings → Data & Privacy, by emailing support, or by deleting your account)
  • Collect analytics to understand usage patterns and improve the user experience

4. Third-Party Services

We use the following third-party services to operate c137:

  • WorkOS: Authentication and user management
  • Neon: PostgreSQL database hosting (encrypted at rest)
  • Anthropic (Claude): AI models for generating responses
  • OpenAI (GPT): AI models for generating responses
  • xAI (Grok): AI models for generating responses
  • Google (Gemini): AI models for processing and generating responses
  • Google Cloud (Vertex AI): Document and image processing, and AI model infrastructure (enterprise terms — no training on customer data)
  • Nebius: AI model inference for internal processing (zero data retention)
  • Weights & Biases: AI model inference for internal memory processing (written no-training, zero-retention terms being finalized — current status disclosed on our Your Data page)
  • OpenRouter: AI model routing for additional model options (data collection disabled)
  • Cloudflare R2: Object storage for documents, images, and archived content
  • Stripe: Payment processing
  • Vercel: Application hosting
  • PostHog: Product analytics and session recording to improve the service (EU-hosted; all rendered text and inputs in session recordings are masked — conversation content never appears in replays)
  • Sentry: Error monitoring and diagnostics (EU-hosted; configured to exclude request bodies, cookies, and IP addresses)
  • Serper: Web search — when a response needs current information, a search query derived from your message is sent to this service

On AI providers specifically: to generate a response, your conversation text is sent to the provider behind the model you selected. We have reviewed each provider's data policy — the major providers we route to directly (OpenAI, Anthropic, Google's paid API tier, and xAI) do not use API data to train their models and retain it only briefly for abuse monitoring. Every other model in the picker is served through OpenRouter with data collection disabled, so prompts are not logged or used for training there either. Separately, our internal memory processing (the step that extracts the facts shown in your memory panel) runs on dedicated inference infrastructure — primarily Weights & Biases, with Nebius and Google Vertex AI as fallbacks. We are finalizing written no-training, zero-retention terms with Weights & Biases and disclose the current status openly on our Your Data page. If you bring your own API key, requests go to that provider under your own account and their terms.

Each service has its own privacy policy. Your data is transmitted securely using SSL/TLS encryption.

5. Data Retention

We retain your data according to the following policies:

  • Active subscribers: Data retained for as long as your account remains active
  • Free trial users (never subscribed): Data automatically deleted 14 days after trial expiry
  • Cancelled subscribers: Data automatically deleted 30 days after subscription ends
  • Manual deletion: Immediate deletion upon request through account settings

6. Your Rights

Under UK GDPR and CCPA, you have the following rights:

  • Right to Access:Request a copy of your data via the "Download Data" feature in account settings
  • Right to Rectification: Update your personal information in account settings
  • Right to Erasure: Delete your data or account via account settings
  • Right to Data Portability: Export your data in JSON format
  • Right to Object: Contact us to object to data processing

7. Security

We implement industry-standard security measures to protect your data:

  • All data transmitted over SSL/TLS encryption
  • Database encryption at rest (Neon PostgreSQL)
  • Secure authentication via WorkOS
  • Regular security audits and updates

8. Cookies & Analytics

We use the following cookies and tracking technologies:

  • Authentication cookies: To keep you signed in (WorkOS) — essential
  • Payment session cookies: To process payments (Stripe) — essential
  • Analytics (PostHog): We use PostHog for product analytics and session recording to understand how the service is used and improve it. This data is anonymized and not sold to third parties.
  • Error monitoring (Sentry): To capture technical errors and diagnostics so we can keep the service reliable.

We do not use any marketing cookies. By using the service, you consent to the use of analytics as described above.

9. Children's Privacy

c137 is not intended for use by children under 16 years of age. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us immediately.

10. California Residents (CCPA)

If you are a California resident, you have additional rights under the CCPA:

  • Right to know what personal information we collect and how it is used
  • Right to delete your personal information
  • Right to opt out of the sale of personal information
  • Right to non-discrimination for exercising your CCPA rights

We do not sell your personal information. We do not share your personal information with third parties for their direct marketing purposes. To exercise your CCPA rights, contact us at support@c137.ai.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new policy on this page and updating the "Last updated" date.

12. Contact Us

If you have any questions about this Privacy Policy or wish to exercise your data rights, please contact us at:

Email: support@c137.ai

Terms of ServiceHome