01
Introduction
This policy explains what personal information Chamfer, Inc. (“Chamfer”, “we”) collects when you visit chamfer.dev, create an account or use the Chamfer platform, and what we do with it. It covers our cloud service and everything in it, including Chamfer MCP. Chamfer Onsite runs in your own environment, so this policy applies to Onsite only where it sends us license or support data.
02
Who we are
Chamfer, Inc. is a Delaware corporation with its main office in Brooklyn, New York. For our website and for account information, Chamfer decides how personal information is used and is its controller. For the records your apps read or store, your organization is the controller, and we process that information on its instructions under our Data Processing Agreement.
03
Information we collect
We collect only what we need to run the service and look after your account:
Account details: name, work email, company, role, and your identity provider’s user ID if you sign in with SSO.
Workspace content: prompts, app definitions, queries, rules and comments that people in your workspace create.
Customer data: records your apps read from connected sources or store in Stockroom. We handle these only to run your apps.
Usage and device data: pages visited, features used, IP address, browser type and approximate location.
Billing details: billing contact and invoice history. Card numbers go straight to our payment processor, and we never see or store them.
Messages: what you send to support or sales, including walkthrough requests.
Cookies and similar tools
Our website uses a small number of cookies to keep you signed in, remember your settings and count visits. Analytics cookies load only after you agree to them, and you can change that choice at any time from the cookie settings link in the footer.
04
How we use information
We use personal information to create and secure your account, run the apps, Jobs and Operators your team builds, answer support questions, send service and billing notices, and find and fix problems. When you use an AI feature, we send the model provider you have enabled only the prompt and the context that request needs.
We don’t sell personal information. We don’t use your prompts, schemas or customer data to train AI models, whether ours or anyone else’s.
05
Legal bases
If you live in the EEA (the EU plus Iceland, Liechtenstein and Norway), the UK or Switzerland, we rely on these legal bases:
Purpose
Legal basis
Information used
Providing the service
Performance of a contract
Account details, workspace content, customer data
Keeping the service secure
Legitimate interests
Usage and device data, audit records
Billing and tax records
Legal obligation
Billing details, account details
Product news and newsletters
Consent, which you can withdraw at any time
Name, work email
Improving the product
Legitimate interests
Usage data, aggregated and de-identified
06
Sharing and subprocessors
We share personal information only with subprocessors that host, secure or support the service, such as cloud hosting, email delivery and support tools; with AI model providers your workspace has enabled, under zero-retention terms; with professional advisers and public authorities where the law requires it; and with a buyer or successor if Chamfer is part of a merger or acquisition, who must keep to this policy. Our Trust center lists every subprocessor and where it operates, and we give workspace admins 30 days’ notice before adding one.
07
International transfers
Chamfer is based in the United States, and some of our subprocessors operate in other countries. When personal information leaves the EEA, the UK or Switzerland, we rely on the European Commission’s Standard Contractual Clauses and the UK addendum to them. Workspaces that choose EU data residency keep customer data and audit records in Frankfurt.
08
Retention
We keep account details while your account is open and for 90 days after it closes, so a workspace closed by mistake can be restored. Logbook entries follow your plan: 7 days on Free, 30 days on Team, 400 days on Business, and a period you set on Enterprise. Billing records are kept for seven years to meet tax law. Backups roll off within 35 days.
09
Your rights
Depending on where you live, you can ask us to show, correct, export or delete your personal information, to stop or limit a particular use of it, or to withdraw a consent you gave. California residents can also ask which categories of information we hold about them; we don’t sell or share it for targeted advertising. Email privacy@chamfer.dev and we will reply within 30 days. If your organization owns the workspace, we may pass the request to its admins. You can also complain to the data protection regulator where you live.
10
Security
We encrypt data with AES-256 at rest and TLS 1.2 or later in transit, keep credentials in a separate secret store, and limit staff access to named engineers who need it for a specific support case, with every access recorded. Independent auditors review our controls each year for SOC 2 Type II and ISO/IEC 27001. If a security incident affects your personal information, we will tell you promptly and explain what we are doing about it.
11
Children, contact and changes
Chamfer is a tool for work and isn’t meant for anyone under 16. We don’t knowingly collect their information, and we delete it if we find we have.
If we change this policy in a way that matters, we will email workspace admins and post a notice in the product at least 30 days before the change takes effect.
Send questions to privacy@chamfer.dev, or write to us at:
Chamfer, Inc.
Attn: Privacy
100 Example Street, Suite 200
Brooklyn, NY 11201
United States