Privacy Policy

We are the controller for the data we collect to run Cairn itself: accounts and sign-in, free-preview requests, requests for access, and billing.

We are a processor for the content a customer puts into or builds in its workspace, including team interview transcripts and the public posts collected for its reports. We handle that content on the customer's behalf and under its instructions. If a request concerns that content, we pass it to the customer and help it answer.

• Free-preview form: your work email, your company's website, and how you found us when the link says so.
• Request-access form: your email and, if you give them, your company, your role and what you want to track, plus how you found us.
• The human check: on the preview and sign-in pages, Cloudflare Turnstile collects your IP address and browser and device signals to tell people from bots.
• Your account and workspace: your email address (you sign in with an emailed link, so there is no password), your workspace, and the products, communities and web sources you track.
• Billing: Stripe collects your card and billing details directly. We store only the Stripe customer and subscription ids and a record of Stripe's billing events.
• What you do in Cairn: the reports generated for you, your chat questions and the answers, and the interview links you create.
• Team interviews: taking part is voluntary. We store the interview transcript. The company that invited you never sees it: only anonymized findings reach its reports, labelled as a numbered team interview, never by name. Interview links carry no name or email.
• Public posts and web pages: to build a report we collect public Reddit posts and comments, including the poster's public username, and public web pages about the product. They are stored as cited evidence in the customer's workspace.
• Logs: our hosts record each request, including its IP address, the page or address requested and the time, and our services log errors and security events.

• To provide the service you asked for (a contract with you or your company): the preview, sign-in, workspaces, reports, chat, interviews, emails about your reports, and billing.
• Our legitimate interests: keeping Cairn secure and working, and preventing abuse. That includes the human check, usage caps, logs, and the rule of one free preview per company, which we enforce by keeping the company's web domain or, for a personal email provider, a normalized form of the address. It also includes answering requests for access.
• Consent for team interviews: you give it on the interview's first screen, and you can withdraw it by emailing us, with no reason needed.

We do not sell personal data, and we do not use it for advertising.

These providers process personal data on our behalf:

• Supabase: our database, sign-in and backups.
• Vercel: hosts the website and app, and keeps request logs.
• Railway: runs the service that collects, analyses and runs interviews, and keeps its logs.
• Stripe: takes payments and manages subscriptions.
• Resend: delivers our emails, including sign-in links and report emails.
• Anthropic: its Claude models write the reports, chat answers and interview questions from the collected posts, your product details, your questions and interview answers. Anthropic does not use data sent through its API to train its models, and keeps API data under its own data-retention policy.
• Brave Search: receives the search queries, built from product and company names, that find public web pages.
• Reddit: its Data API is how we read public posts and comments.
• Cloudflare: runs Turnstile, the human check, which receives visitors' IP addresses and browser signals.
• Porkbun and Google: Porkbun forwards email sent to our address to a Google (Gmail) mailbox, where we read and answer it.

• Your account and workspace, including everything built in it: while the account exists, including after a plan ends. We delete them within 30 days of your request.
• An unused preview account (one that never moved to a plan) is kept until the account is deleted; you can ask us to delete it at any time.
• The free-preview record. The company's domain, or for a personal email provider the normalized address, is kept permanently, even after you ask us to delete your data. It is the only way to enforce one free preview per company. The rest of the record (your email, the website you gave, how you found us) is erased on request.
• Requests for access: until you ask us to delete them.
• Team interview transcripts: for the life of the workspace. Withdrawing removes your transcript and the findings drawn from it. A finished report may still paraphrase them.
• Collected public posts: for the life of the workspace. If you wrote a post we collected and want it removed, email us your username.
• Logs: our hosting providers (Vercel and Railway) keep request and error logs for up to 30 days.
• Backups roll off after 7 days, so deleted data can survive in a backup until then.

Stripe, Resend and Anthropic keep their own records under their own policies, and our sign-in provider keeps an audit log of sign-ins.

You can ask us for a copy of your personal data, or to correct, delete or export it, or to restrict or object to how we use it. Where we rely on consent, you can withdraw it at any time. Email hello@cairnreports.com. We answer within 30 days.

You also have the right to complain to a data protection authority, such as the one where you live or work.

Cairn and its providers process data in the United States. When data about people in the European Economic Area, the United Kingdom or Switzerland is transferred there, the transfer relies on the providers' Standard Contractual Clauses (or the UK and Swiss equivalents).

We use only strictly necessary cookies: the ones that keep you signed in. There are no analytics, advertising or tracking cookies, which is why there is no cookie banner. The report page also remembers one display choice you make (how much detail to show) in your browser's local storage.

Cairn is a service for businesses and is not meant for children. We do not knowingly collect data from anyone under 16. If you think we have, email us and we will delete it.

When we change this policy, we update the date at the top. If a change is material, we email account owners before it takes effect. Our Terms cover the rest of how Cairn works.