Privacy Policy.

Who is responsible for your data.

For the purposes of applicable data protection legislation, the data controller responsible for your personal data is:

Company

Celiums Solutions, LLC

Jurisdiction

Florida, United States of America

Website

celiums.ai

DPO

hello@celiums.ai

If you do not agree with our policies and practices, your choice is not to use our Services.

Data minimization, by design.

We collect only the information necessary to provide and improve our Services. What we collect depends on how you interact with celiums.ai.

Information you provide directly

Information collected automatically

The lawful bases we rely on.

Under the GDPR and similar frameworks, we must have a valid legal basis to process your personal data. We rely on the following lawful bases under Article 6 of the GDPR:

1. Performance of a contract (Art. 6(1)(b)): operating celiums.ai, delivering any research preview you request, and responding to your messages.
2. Legitimate interests (Art. 6(1)(f)): securing our infrastructure, preventing fraud or abuse, analyzing usage trends to improve the Services, managing our relationship with you.
3. Legal obligation (Art. 6(1)(c)): responding to lawful requests from public authorities.
4. Consent (Art. 6(1)(a)): e.g., if you opt-in to receive promotional emails. You can withdraw your consent at any time.
5. Vital interests (Art. 6(1)(d)): rarely applicable; necessary in extreme emergencies.
6. Public task (Art. 6(1)(e)): generally not applicable to our research operations.

Specific use cases & bases

• Operating the site & research previews — Legitimate interests.
• Security & fraud prevention — Legitimate interests (Cloudflare technical data for DDoS / unauthorized access).
• Usage analytics & service improvement — Legitimate interests (request counts, tool usage).
• Customer support — Performance of a contract + legitimate interests.

Your prompts, your code, your files — never persisted.

Essential only. No third-party tracking.

Unlike many modern web services, celiums.ai employs a strict “essential only” approach to cookies and tracking technologies. We value your privacy over invasive analytics.

Essential cookies only

• Authentication cookies — to keep you logged in securely during your session.
• Security cookies — CSRF protection and request integrity.
• Load balancing cookies — provided by Cloudflare to route traffic efficiently.

No third-party tracking

Because we do not use non-essential cookies, we do not require a complex cookie consent banner. By using our Services, you consent to the placement of these strictly necessary cookies.

We don't sell your data. Here is who we share it with.

We do not sell, rent, or trade your personal data. We share data only with trusted third-party service providers (subprocessors) bound by strict confidentiality and data protection agreements.

Exceptional disclosures

• Legal compliance — if required by law or in response to valid requests by public authorities.
• Protection of rights — to enforce our Terms of Service, protect our operations, or defend rights, privacy, safety, or property.
• Business transfers — in the event of a merger, acquisition, reorganization, bankruptcy, or sale of all or a portion of our assets.

Data may move across borders. Safeguards travel with it.

Celiums Solutions, LLC is located in the United States (Florida). Our infrastructure providers (Cloudflare) operate globally. Your personal data may be transferred to, stored, and processed in the United States or other countries outside the EEA, the UK, or Brazil.

Safeguards we apply

• Standard Contractual Clauses (SCCs) — including the UK Addendum — in our agreements with subprocessors like Cloudflare.
• Supplementary measures — encryption in transit and at rest, plus strict access controls, where appropriate.
• Cloudflare edge processing — much of the Technical Data is processed near your geographic location at the edge, minimizing long-distance transfer.

By using the Services, you acknowledge the transfer of your information to the United States and other regions as described in this policy.

How long we keep each category.

We retain your personal data only for as long as necessary for the purposes set out in this policy, unless a longer retention period is required or permitted by law.

What you can ask us to do.

If you are a resident of the European Economic Area, the United Kingdom, or Switzerland, you have specific rights regarding your personal data under the GDPR and UK GDPR.

• Right to access (Art. 15) — request a copy of the personal data we hold about you.
• Right to rectification (Art. 16) — request that we correct inaccurate or incomplete data.
• Right to erasure / be forgotten (Art. 17) — request deletion when no longer necessary or when you withdraw consent.
• Right to restriction (Art. 18) — restrict processing under certain conditions.
• Right to data portability (Art. 20) — receive your data in a structured, machine-readable format.
• Right to object (Art. 21) — object to processing based on legitimate interests or for direct marketing.
• Right not to be subject to automated decision-making (Art. 22) — we do not engage in such automated decisions.

To exercise any of these rights, contact our DPO at hello@celiums.ai. We will respond within one month, free of charge. You also have the right to lodge a complaint with your local Data Protection Authority.

California-specific rights and our position.

• Right to know & access — categories, sources, purposes, third parties, and specific pieces of personal information collected.
• Right to delete — subject to legal exceptions (e.g., completing a transaction, detecting security incidents).
• Right to correct — inaccurate personal information we maintain.
• Right to opt-out of sale or sharing — we do not sell or share your personal information for cross-context behavioral advertising. A “Do Not Sell or Share” link is therefore not required.
• Right to limit use of sensitive personal information — we do not collect “Sensitive Personal Information” (precise geolocation, racial/ethnic origin, biometric data) beyond what is strictly necessary, so this right is not applicable to our operations.
• Right to non-discrimination — we will not discriminate against you for exercising any of your CCPA/CPRA rights.

Submit a verifiable consumer request to hello@celiums.ai. We may need specific information to verify your identity before processing your request.

Rights broadly aligned with the GDPR.

• Confirmation of the existence of processing.
• Access to the data.
• Correction of incomplete, inaccurate, or out-of-date data.
• Anonymization, blocking, or deletion of unnecessary or excessive data.
• Portability of the data to another service or product provider.
• Deletion of personal data processed with the consent of the data subject.
• Information about public and private entities with which the controller has shared data.
• Information about the possibility of denying consent and the consequences of such denial.
• Revocation of consent.

To exercise your rights under the LGPD, contact our DPO at hello@celiums.ai.

Our Services are not directed at children.

Our Services are intended for a general audience of professionals and developers and are not directed at children. We strictly prohibit the use of our Services by anyone under the age of 16.

We do not knowingly collect personal data from children under 16. If you are a parent or guardian and you believe that your child has provided us with personal data, contact us immediately at hello@celiums.ai. If we become aware that we have collected personal data from a child under 16 without verification of parental consent, we will take immediate steps to remove that information and terminate the account.

Technical and organizational safeguards.

• Encryption in transit — all data transmitted between your client and our servers (and between our servers and subprocessors) is encrypted via TLS/HTTPS.
• Encryption at rest — sensitive data like authentication tokens is encrypted using strong algorithms such as AES-256.
• Minimal data footprint — non-retention of user payload data, source code, and AI prompts. Ephemeral processing drastically reduces the attack surface.
• Access controls — strict need-to-know basis, with Multi-Factor Authentication required for all internal access to critical systems.
• Infrastructure security — Cloudflare edge security against DDoS, malicious bots, and network-level vulnerabilities.
• Regular audits — continuous monitoring and periodic security reviews of infrastructure and codebase.

If something goes wrong, you will hear from us.

• GDPR compliance — if a breach affects users in the EEA or UK, we will notify the competent supervisory authority without undue delay and, where feasible, within 72 hours after becoming aware. If the breach poses a high risk to you, we will also communicate it to you directly.
• CCPA / CPRA compliance — if a breach affects California residents, we will comply with applicable state breach notification laws, providing notice in the most expedient time possible without unreasonable delay.
• General notification — if a breach compromises your account security or sensitive personal data, we will notify you via the email address associated with your account, describing the incident, likely consequences, and remedial measures.

How updates are communicated.

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or regulatory guidance. When we make changes, we will update the “Effective Date” and “Last Updated” date at the top of the policy.

If we make material changes to how we treat users' personal data, we will notify you by email (to the address specified in your account) or through a prominent notice on the celiums.ai website prior to the change becoming effective. We encourage you to periodically review this policy. Your continued use of the Services after revisions become effective shall indicate your agreement with the revised policy.

Reach the Data Protection Officer.