Privacy Policy
This Privacy Policy explains how Cassia (the "Service"), operated by Cassia (the data controller, "we", "us"), collects, uses, retains, and protects your personal data when you use the Service.
1. Data controller and contact
The data controller is Cassia, the individual operator of Cassia. For all privacy-related questions, requests, or complaints, contact us at cypggs@gmail.com. We aim to respond within 3 business days, and within 30 days for formal data-rights requests.
2. Data we collect
- Account data. When you sign in via GitHub or Google (OAuth), we receive your user ID, name, and email address from the identity provider. Authentication is provided by InsForge.
- Usage and task data. The instructions you give agents, session metadata, event timelines, token-usage and cost records, and your credit wallet and ledger (purchases, deductions, balances).
- Sandbox content. Files you upload and files agents produce are stored inside an ephemeral cloud sandbox for the lifetime of that sandbox.
- Payment data. Payments are processed entirely by our payment processor, Waffo Pancake, on its hosted checkout page. We never see or store your full card number or security code; we receive only order confirmations (order ID, amount, status).
- Technical logs. Standard server logs (IP address, timestamps, errors) used for security and debugging.
3. How we use data
We use the data above to operate and secure the Service: authenticating you, executing your tasks, metering and billing credits, preventing abuse, and fixing bugs. We do not use your task content to train models. We do not run advertising or sell data.
4. No sale of personal data
We do not sell, rent, or trade your personal data to anyone, and we do not share it for cross-context behavioral advertising.
5. Third-party processors
- InsForge — authentication, database, and site hosting;
- E2B — ephemeral sandbox compute where tasks run;
- Waffo Pancake — payment processing;
- LLM providers (e.g. DeepSeek) — your task instructions are sent to the model provider you configure, to produce agent output.
6. International transfers
Our infrastructure and processors are located in multiple jurisdictions (including Singapore and the United States). By using the Service, your data may be transferred to and processed in countries other than your own; we rely on our processors' contractual safeguards for such transfers.
7. Retention
- Account data: retained while your account is active; deleted within 30 days of account deletion.
- Session and event history: retained while your account is active, or until you delete the session.
- Sandbox content: deleted when the sandbox is reclaimed (typically within days of session end; dormant sandboxes may persist up to 30 days before cleanup).
- Payment and ledger records: retained for 7 years as required for accounting and tax purposes.
- Server logs: retained for up to 90 days.
8. Your rights
Where applicable law (including GDPR) grants them, you have the right to:
- Access — obtain a copy of your personal data;
- Rectification — correct inaccurate data;
- Erasure — have your data deleted ("right to be forgotten");
- Restriction — limit how we process your data;
- Portability — receive your data in a structured, machine-readable format;
- Objection — object to processing based on legitimate interests;
- Withdraw consent — where processing is based on consent, withdraw it at any time;
- Lodge a complaint — with your local data-protection authority.
To exercise any of these rights, email cypggs@gmail.com from the address associated with your account. Deleting a session in the product deletes its sandbox and event history immediately and irreversibly.
9. Children
The Service is not directed at children. You must be at least 16 years old to use it, and we do not knowingly collect data from anyone under 16. If you believe a child under 16 has provided us data, contact us and we will delete it.
10. Security
We use TLS in transit, OAuth-based authentication, isolated per-task sandboxes, and row-level access control on user data. Report security issues to cypggs@gmail.com.
11. Changes to this policy
We may update this policy from time to time. Material changes will be announced on this page at least 14 days before they take effect, with the "last updated" date revised. Continued use after the effective date constitutes acceptance.