Privacy Policy

Overview

Consensus Studio ("we," "us," "our," or "Company") operates the Consensus Studio application and website (consensusstudio.app). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service.

We are committed to protecting your privacy and being transparent about our data practices. Please read this policy carefully. By using the Service, you consent to the practices described herein.

Information We Collect

Information You Provide

When you create an account or purchase credits, we may collect:

• Account Information: Email address (via Sign In with Apple or Google)
• Payment Information: Processed by Stripe; we do not store credit card numbers
• Transaction Records: Purchase history, credit balance, usage logs

Information Collected Automatically

• Usage Data: Features used, session duration, crash reports (anonymized)
• Device Information: Device type, OS version, app version
• API Usage: Model used, token counts, costs (for billing purposes)

Information We Do NOT Collect

• Your conversations or prompts (stored locally only)
• Your API keys (stored in macOS Keychain)
• Content of AI responses
• Personal files or documents you process

How We Use Your Information

We use collected information to:

• Provide, operate, and maintain the Service
• Process payments and manage your credit balance
• Send transactional emails (receipts, account notifications)
• Improve and optimize the Service
• Detect and prevent fraud or abuse
• Comply with legal obligations
• Respond to your inquiries and support requests

We do NOT use your data for: Advertising, profiling, selling to third parties, or training AI models.

Data Storage and Security

Local Storage (macOS App)

• Conversations: Stored locally in app sandbox (never uploaded)
• API Keys: Stored in macOS Keychain (encrypted by OS)
• Settings: Stored locally in app container

Cloud Storage (Account Data)

• Account & Credits: Stored in Supabase (PostgreSQL with encryption at rest)
• Payment Data: Processed and stored by Stripe (PCI-DSS compliant)
• Authentication: Handled by Supabase Auth with industry-standard security

Security Measures

• All data transmitted over HTTPS/TLS encryption
• Database encryption at rest
• Row-level security policies
• Regular security audits
• No plaintext storage of sensitive credentials

Third-Party Services

We use the following third-party services:

Data Retention

• Account Data: Retained until account deletion
• Transaction History: Retained for 7 years (legal/tax requirements)
• Usage Logs: Retained for 90 days, then aggregated/anonymized
• Local Data: Controlled entirely by you; deleted when you remove the app

Your Rights (GDPR/CCPA)

Depending on your location, you may have the following rights:

To exercise these rights, contact us at [email protected]. We will respond within 30 days.

Account Deletion

You may request complete deletion of your account and associated data at any time. To delete your account:

1. Email [email protected] with subject "Account Deletion Request"
2. Include the email address associated with your account
3. We will process your request within 30 days

Note: Account deletion is permanent. Unused credits will be forfeited and cannot be refunded.

International Data Transfers

Your data may be transferred to and processed in the United States or other countries where our service providers operate. By using the Service, you consent to such transfers. We ensure appropriate safeguards are in place for international transfers.

Children's Privacy

The Service is not intended for users under 18 years of age. We do not knowingly collect personal information from children. If we become aware that we have collected data from a child, we will delete it promptly.

California Privacy Rights (CCPA)

California residents have additional rights under the CCPA:

• Right to know what personal information is collected
• Right to know if personal information is sold or disclosed
• Right to opt-out of the sale of personal information
• Right to non-discrimination for exercising CCPA rights

We do NOT sell personal information. We do not share personal information for cross-context behavioral advertising.

Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be notified via email or prominent notice in the Service. Your continued use after changes constitutes acceptance. The "Last updated" date at the top indicates the most recent revision.

Contact Us

If you have questions about this Privacy Policy or our data practices, contact us at: