Privacy Policy
Last updated: 2026-05-25
Draft. This document is a working skeleton pending final review. It is not yet binding legal text — the definitive version is prepared by Alligators Group with counsel.
This policy explains what data CrocoBrain processes and why. Alligators Group is the data controller. We process the minimum needed to run the service.
1. Data we process
Account data (email, workspace name, auth provider), the content you ingest (your sources) and the wiki generated from it, and operational telemetry (usage counts and AI cost metering) used to run plans and prevent abuse.
2. How we use it
To provide the service: ingestion, retrieval, the calibration interview, and chat/Enrich. Active-usage counts meter the free tier; AI cost telemetry enforces backend ceilings. We do not sell your data.
3. Sub-processors
We rely on Supabase (database & auth), Vercel (hosting), Anthropic (the Claude models that power the brain), and Stripe (payments). Your source content is sent to Anthropic only to generate your wiki and answers.
4. Tenant isolation
Every record carries a tenant_id, protected by row-level security and a server-side session binding. One tenant cannot access another's data.
5. Retention & export
We retain your data while your account is active. You can export your full vault (Obsidian-compatible) at any time, and request deletion of your account and data.
6. Your rights
Under the GDPR you may access, rectify, export, or erase your data, and object to processing. Contact us to exercise these rights.
7. Cookies
We use only the cookies required for authentication and session management. Any analytics, if enabled, is privacy-friendly and aggregate.
Questions? Contact Alligators Group at baptiste@alligator-ads.fr.