Cedreon ← Back to security
NOTICE

Privacy notice

Last updated: 16 October 2026

This notice explains what personal data Cedreon processes, why, where each part of it is processed, and what you can ask us to do about it. It covers the public website, the signed-in workspace, the Cedreon desktop app for Windows and macOS, and any contact you have with us. We have written it in plain language rather than legal boilerplate, because the people who read it carefully are the people we build for. Where a fact is narrower than the claim the industry usually makes, we state the narrower one.

What our servers keep, in short

If you use the Cedreon desktop app, your conversations stay on your computer. Apart from what you choose to save, listed below, Cedreon's servers keep no copy of your messages, of the AI's answers, or of the real values behind the placeholders: each request is processed, and no copy of it is kept on our servers. This has been so since 11 October 2026.

The web app at cedreon.com/console/chat works differently: it saves your chats on our servers so that you can reopen them. A saved chat is encrypted, with the values our screening recognised replaced by placeholders, and the originals it needs are kept encrypted beside it. There are two exceptions. On a turn sent with web search switched on, the names of people and organisations and the addresses in your question and in the answer can be saved as they were written, because that turn does not hide them. And a turn Cedreon handled as a task of several steps can keep a word you or your organisation asked Cedreon to always hide as you typed it. A title Cedreon writes for a chat is kept readable, with the recognised values removed; a title you type yourself is kept as you typed it, except that account numbers and similar identifiers are removed. A saved chat stays until you delete it or close your account, and deleting it deletes all of that. The server that runs the web app also writes the first 160 characters of a message in which Cedreon hid a value to its log, with those values already replaced by placeholders. Ratings you leave on an answer in the web app, with any note you add, and skills you create there are kept on the server that runs the web app until you remove them; closing your account does not yet remove them, so write to us if you want them gone.

That is not the same as nothing. Whichever you use, these remain:

Who is responsible

The controller for the processing described here is SFF S26 AG, Schuetzengasse 7, 9000 St. Gallen, Switzerland. You can reach us at general@cedreon.com. Cedreon is the product, the Cedreon desktop app included; SFF S26 AG is the company that operates it and publishes the app.

We have not appointed a data protection officer, because we are not required to under Article 37 GDPR. If that changes we will name them here. Data protection questions go to general@cedreon.com and reach a person, not a queue.

Controller or processor: which one we are depends on the data

Both roles apply to us at the same time, over different data, and conflating them is the usual way a notice like this goes wrong.

For the content you put into the product, meaning your messages, your uploaded documents and the replies you receive, we act on your instructions. Where you use Cedreon through an account your employer or your firm provided, THEY are the controller for that content and we are their processor. The terms of that arrangement are the Data Processing Agreement, which is incorporated into our Terms of Service, and Annex 2 to it is the sub-processor list.

For the data we need in order to run a business, meaning your login address, your billing contact, our security logs and the integrity record described below, we are the controller and this notice is the operative document.

If you hold a personal account with no organisation behind it, we are the controller for everything, including your content, and this notice covers all of it.

If your account belongs to an organisation

An organisation account has an administrator, and some of what they can see is worth stating rather than leaving to be discovered.

Your administrator can see the members of the organisation and their email addresses, can see aggregate usage figures for the organisation and per member, can configure the guardrails every member chats under, and can execute agreements that technically restrict which AI providers the whole organisation may reach. They can invite and remove members.

Your administrator cannot read your conversations or your documents. There is no cross-account transcript access anywhere in the product, for administrators or for us. A document is shared with the organisation only when somebody uploads it to the shared library on purpose.

Ask your organisation first about content you put into their account. If you ask us, we will pass the request to them, because it is their instruction to give.

What we collect

We keep the set small on purpose. In practice it is:

What AI providers actually receive

This is the part most notices leave vague. Before a request leaves your workspace, Cedreon screens it and, while automatic detection is on, replaces detected sensitive values with placeholders such as a bracketed label or a reversible token. The AI provider receives the placeholder, not the value. The original is restored in the reply only for you. On our side it is held in memory while the request is answered, and, apart from the copies made up to and including 10 October 2026 that the first section describes, kept, encrypted, only beside something you keep, such as a chat saved in the web app; in the desktop app the originals stay on your computer, as the section on the desktop app describes.

Detection is layered and best effort, not a guarantee. It combines checksum-validated patterns for identifiers such as an IBAN, a card number or a tax number with a recognition model that runs locally on our own infrastructure and, in the desktop app, on your computer as well. Unusual formats, misspellings and values the layer was not built for can be missed. We say so plainly, because a promise of perfect detection would be false, and because screening is a reduction of exposure rather than a process that makes content stop being personal data.

Automatic detection is a setting, and it can be off. You can switch it off in the workspace and in the desktop app, unless your organisation decides it for you. With it off, Cedreon stops looking for values: your messages and the documents you attach are sent as you wrote them, except for what your organisation requires to be hidden. Pictures you attach are not screened either way: the model receives them as pictures, and nothing they show is replaced before sending.

One check reads your words before our placeholders are applied. Where rules written in plain language apply to your account, whether you, your organisation or we set them, the message you have just sent is checked against them by a model, through the same gateway, and that model receives the message as it reached us: in the web app, as you typed it; from the desktop app, as the app sent it. It is asked only whether a rule applies. We keep no copy of the message for it, and the integrity record notes which rule applied.

Two things we do not do. We do not send the placeholder mapping anywhere: ours never leaves our infrastructure, the desktop app keeps its own on your computer and never sends it, and no provider receives either. And we never mask a search query on the open web, which is a deliberate exception explained on the switch that turns web search on, because masking a query does not degrade a search, it changes the answer.

The gateway, and what the providers are actually bound to

Every model request that comes through us is made through one gateway, Eden AI, a French company, on its European endpoint. That endpoint routes only to providers cleared for processing in Europe and refuses a request no such provider can serve, rather than sending it elsewhere. We hold a data processing agreement with Eden AI. Because both parties are established in Europe, no transfer mechanism is required for this leg. A model provider you add yourself in the desktop app is outside this section: the app reaches it from your computer, without us, as the section on the desktop app describes.

Two promises are usually collapsed into one here, and they are not the same promise, so we separate them.

Use. The promise is that no provider trains on what you send or uses it for its own purposes, and what backs it has changed, so we say what backs it today. For the gateway that obligation is contractual: its data processing agreement with us states that it does not train on customer data and binds it for its own processing. For the companies that serve the models it rests on what is published: the gateway's provider data policy states that none of them trains on customer data, and none of them has given us an undertaking of its own. The promise was previously enforced as a routing flag on every request, and no such flag or instruction travels with a request today. It is worth saying plainly that the mechanism changed even though the promise did not, because a contract, a published statement and a per-request constraint are not the same kind of assurance.

Retention. That promise is about use and not about keeping: a provider can honour it and still hold a request in its own operational logs for a period, so we answer retention model by model. The gateway states that it keeps no prompt or completion content, but that is a statement about the gateway and not about the company whose servers actually answer, each of which runs its own retention and abuse-monitoring regime. For those companies, the gateway's published provider data policy lists the companies serving our models as keeping no prompt or completion, apart from operational records without content, and that holds for every model we offer except Claude Fable 5.1. That policy is the gateway's summary, which we rely on and have not verified for each company, and a company's own terms may let it keep content its abuse checks flag. Claude Fable 5.1 is the exception: Google, which serves it, logs every prompt and answer for up to 30 days for abuse monitoring and shares them with Anthropic, the model's maker, which keeps them for at least 30 days. The automatic model choice never selects it; it answers only when somebody chooses it. Annex 2 states the position of each model and its basis.

Where processing happens

Two different questions, and the honest answer differs between them. Cedreon is developed in Switzerland; that is a statement about the company, not about a server.

The application and your stored data are processed in the European Union under the GDPR, specifically in Frankfurt, Germany, on infrastructure contracted through a European entity. Daily snapshots are held in the same region. Inbound requests transit a content delivery network where TLS is terminated, so request content is processed in the clear at that edge, transiently and in memory, before being re-encrypted to our servers. That is true of every service behind a reverse proxy and is usually left unsaid.

Model inference used to be a separate question with a separate answer, and it is not any more. Every request we forward leaves through the European endpoint described above and is pinned to one named European processor with fallback disabled, so it is served in Europe or it fails. Annex 2 names which company serves which model. What that does NOT settle is who BUILT the model, which is a different question: most of them were built outside Europe, and an organisation that needs both can be placed under a compliance profile restricting it to European-built models.

Optional features add their own locations, and they are the reason this section is not one sentence. Web search, when a conversation has it switched on or you approve a search, sends the query to a provider that operates infrastructure on several continents and whose serving region we do not pin. A connected Google Drive is searched on Google's infrastructure. Both are off by default, and the compliance profile withholds them. A model provider you add yourself in the desktop app processes wherever that provider does.

International transfers

Transfers from Switzerland to the EEA rest on the Federal Council's adequacy recognition. The gateway and every company that serves a model are established in Europe and process there, so the model path through us no longer leaves the EEA and needs no further mechanism. That was a change from earlier versions of this notice, made in version 1.4. The one exception is Claude Fable 5.1: Google, which serves it in Europe, shares its prompts and answers with Anthropic, the model's maker, and neither company states from where Anthropic accesses them, so we cannot name a transfer mechanism for that access. Choosing any other model avoids it.

What remains outside Europe is the optional half: web search, whose provider does not pin its serving region, and a connected Google Drive. Those rest on the Standard Contractual Clauses with the Swiss addendum recognised by the FDPIC. Both are off unless you switch them on, and a compliance profile withholds them entirely. A model provider you add yourself in the desktop app is not a recipient we choose or contract with: the app sends to it from your computer, on your instruction and under your own agreement with that provider.

The supplementary measure differs between the two, and we state the difference rather than average it. A query sent to your connected Google account is destructively masked before it leaves, so the recipient receives no identifying value the screening layer recognised. A web-search query is sent as you typed it, with no placeholders, because masking a search changes its answer; the safeguard there is that the feature is off until you deliberately switch it on, and the switch says so. We are deliberately careful about how far the masking argument reaches, because the screening is best effort and the mapping stays with us. It reduces what a recipient holds; it does not turn the transfer into something other than a transfer of personal data.

Annex 2 to our Data Processing Agreement names every recipient, what it receives, where it processes and under which mechanism. It is published at /subprocessors and is part of the agreement.

Advertising measurement on the public website is outside that annex, because it concerns visitors to the website rather than the service: if you accept it in the cookie banner, Google may process what it receives outside Switzerland and the European Economic Area, under its own terms, on the strength of the consent you gave.

The audit record, and what erasure means

Every exchange is written to an append-only, hash-chained record. That record is what lets a regulated firm show what happened, and it is deliberately not editable: the database refuses updates and deletions to it, and each entry commits to the one before it.

It is not a record of hashes and timestamps alone, and we will not describe it that way. The audit chain holds no plaintext of your prompts or of the model's responses. It retains integrity and operational metadata, which may include identifiers, timestamps, model information, content digests, payload references, screening outcomes, policy results and usage data. A content digest is a SHA-256 fingerprint: the text cannot be read back from it, though it would match an identical copy. A payload reference pointed to a stored copy of the request or of the reply; entries made since 11 October 2026 carry none, because no such copy is made. And an entry's free-text note can name things: a file you used, a rule that applied, your organisation, an email address, or up to 300 characters of an error message a model provider sent back.

So erasure works in three parts, and we would rather explain it than overpromise. Deleting a chat, a document or your account removes our stored copy of the messages and documents concerned. It deletes the encrypted placeholder mapping kept beside them, which makes the original values unrecoverable from that chat or document, because a digest commits to something without reproducing it and a reference to a deleted row points at nothing. And the chain keeps the entries that prove the sequence was not tampered with.

Closing your account does not reach what belongs to your organisation rather than to you: documents shared with the organisation and the mappings they need, its projects, its folder connections and its protected words stay with it. Billing records stay for the period accounting law requires. And our daily server snapshots hold what was on the disk when they were taken, so a deleted item can remain in them until they are replaced.

On a deployment run in store-nothing mode, no chat is saved at all and no placeholder mapping is kept between turns.

Why we process it, and on what basis

Each purpose has its own legal basis, so here they are one by one:

Who else processes data

The full list, naming each contracting entity, what it receives, where it processes and under which transfer mechanism, is published at /subprocessors and is Annex 2 to our Data Processing Agreement. In outline it is:

Connected Google accounts

You can connect your own Google Drive or Gmail to your account from the Connectors page. Cedreon reads that account only for what you ask of it. When you ask about a file or a message, it searches for the matching items, reads them and answers you with a reference to the original. When you choose files or a folder from your Drive to bring into your Company brain, it copies those files into your library, keeps a chosen folder up to date, and treats them like any document you upload. Reading uses a read-only permission: with it, Cedreon cannot create, change, share, send or delete anything in your Google account. On our servers it keeps no copy of your mailbox, and no copy of your Drive beyond the files and folders you chose to bring in. What it reads passes through the same screening and the same model gateway as your own messages, so identifying values the screening recognises are replaced by placeholders before they leave, and no AI provider trains on them. You can disconnect at any time from the same page. Disconnecting deletes the token Cedreon stores for that connection and stops any folder from syncing; to withdraw the permission at Google as well, remove Cedreon in the third-party access settings of your Google Account. Files you brought into your Company brain stay there until you remove them or delete your account.

Google Calendar and Google Contacts can also be connected, for reading only. This is switched off on our servers until Google has finished reviewing it. Once it is on, each needs its own permission on Google's consent screen. When you ask, Cedreon reads the events of the coming 30 days on your own calendar (title, time, place, organiser, guests and description), or looks up people in your contacts (name, email addresses, phone numbers and organisation). It keeps no copy of your calendar or your contacts, what it reads passes through the same screening as what it reads from Gmail and Drive, and you can disconnect either one at any time from the Connectors page.

Gmail and Google Drive can also be connected for writing, so that Cedreon can send email and work with drafts and files for you. Writing is being introduced and is switched off on our servers until we turn it on; until then, Cedreon's access to a connected Google account stays read-only. Once it is on, writing still needs your own permission, given on Google's consent screen separately from reading: one permission to send email, one to work with drafts and one for Drive files. It is not offered in store-nothing mode, because an action has to be held until you confirm it. The assistant can only propose an action: Cedreon shows you what will be sent or changed, and it carries out that one action only after you confirm it. An action you do not confirm within 15 minutes can no longer be confirmed.

When writing is on, these are the only actions Cedreon can take. In Gmail: send a new email or a reply from the connected account, create a draft, and change, send or delete a draft that Cedreon itself created. In Drive: create a Google Doc, a plain text, Markdown or CSV file, or a folder; rename a file or folder; change the text of a file, either by replacing words or phrases in a Google Doc or by replacing the whole text of a file Cedreon created; and share one file with named people, as viewer, commenter or editor, after which Google tells them by email. Cedreon can rename, change or share only files and folders it created and those you chose for it in Google's own file picker, and it creates new ones only at the top level of My Drive or in such a folder; a new item in a folder that other people can open is visible to them too, and the confirmation says when that may be so. Cedreon keeps a list of those items and refuses any other. Apart from the text it replaces when you confirm a change to a file, the one thing Cedreon can delete is a draft it created: it never deletes, moves or trashes an email or a Drive file, never removes anyone's access to a file, never shares a folder and never shares a file by link. The confirmation shows the real values in place of the placeholders the assistant worked with, and what you confirm is exactly what is sent to Google. To prepare or carry out an action, Cedreon reads only what that action needs: for a reply, the addresses, subject and message identifiers of the email being answered and the addresses in its conversation, never the text or attachments of a message; a draft it created, before changing, sending or deleting it; the name, type and sharing settings of a Drive item and what your account may do with it; and the text of a Google Doc it is about to change, of which it keeps at most three passages of 80 characters around each replacement. It uses what it reads only to show you what you are confirming and to carry the action out.

This is what Cedreon keeps about a write. While an action waits for your confirmation and while it runs, its content is held encrypted on our servers: the recipients, subject and text of an email or draft and the names of a draft's attachments, the name and content of a file, the people a file is to be shared with, and the passages of a Google Doc around a replacement. That copy is deleted as soon as the action is carried out, fails or is cancelled, and within minutes when it lapses unconfirmed or is cut short. What remains is a record of the action without its content: the kind of action, the Google account it used, where you confirmed it, the identifiers of the request and of what it created or changed, counts, digests of the request and of what you confirmed, the outcome and the times. That record is deleted 30 days after the action ended. Cedreon also keeps the list of items it may act on: the identifiers of the drafts and files it created and of the files and folders you chose, each with its type, whether Cedreon created it or you chose it, and when it was added. An item leaves that list when a draft is sent or deleted, when Cedreon finds the item gone, when you disconnect and when you delete your account. A short record of each session in Google's file picker, which holds no name and no content, is deleted a day after the session ends. The append-only integrity record notes each action that was carried out, failed or was refused by a screen, with counts and a digest, and how many real values were restored from the placeholder mapping to prepare one; it never holds the content. The tokens for writing are stored encrypted on our servers, like those for reading. You can disconnect writing at any time from the same place you connected it: disconnecting one permission deletes its token, cancels any of its actions still waiting for your confirmation and empties its part of the list of items Cedreon may act on. To withdraw the permission at Google as well, remove Cedreon in the third-party access settings of your Google Account. Deleting your account deletes all of this, except the integrity record described above.

The desktop app can also connect Google Drive itself, from your computer rather than through our servers. The permission is then kept on your computer, encrypted with the key of the app's vault. Connecting is the instruction to read the Drive: the app reads the files in it, keeps their text in an encrypted index on your computer so that it can search them, and checks for changes every 30 minutes. That reading does not pass through our servers; only what a conversation uses leaves your computer, as part of that conversation and handled like any message. Switching the reading off deletes the index, and disconnecting deletes the index and the permission kept on your computer; to withdraw the permission at Google as well, remove Cedreon in the third-party access settings of your Google Account. To let you choose files, the app opens Google's own file picker, which loads from Google.

Cedreon's use of information received from Google APIs will adhere to Google API Services User Data Policy, including the Limited Use requirements. The use of information received from Google Workspace scopes will adhere to the Google User Data Policy, including the Limited Use requirements (developers.google.com/terms/api-services-user-data-policy). Cedreon does not use Google Workspace API data to develop, improve, or train non-personalized AI and/or ML models. In plain terms: what Cedreon reads from a connected Google account is accessed only when you ask, when you have chosen files or a folder to bring in, or when an action you asked for is being prepared or carried out, is used only to answer your questions, to keep those files in your library and to prepare and carry out the actions you confirm, is shared with the model gateway only as screened excerpts for the answer you asked for and, for an action, as its outcome (identifiers, counts, and whether it succeeded or why not), under the gateway's agreement with us, which forbids it to train on them or to use them for any other purpose, and the published policies of the companies it forwards them to, which state that they do not train on customer data, is not sold and is not used for advertising; the tokens are deleted when you disconnect or delete your account, the files you brought in are deleted when you remove them or delete your account, and what Cedreon keeps about a write is deleted as described above; and no person at Cedreon reads it unless you have asked us to look at specific items, it is necessary for security, or the law requires it. In the desktop app, Cedreon also reads a Drive you connect there to keep an index of it on your computer; that index and the permission are kept only on your computer and are deleted when you disconnect in the app, and what the app sends from it is an excerpt for the answer you asked for, screened as your own messages are, shared with the model gateway or with a model provider you added yourself and chose for that conversation, under your own agreement with that provider.

The Cedreon desktop app

The Cedreon desktop app for Windows and macOS runs the product on your computer. While its vault is on, which it is unless you or your organisation switch it off, the app screens your messages and the documents you attach there, with a recognition model that runs on your computer, before anything is sent; pictures are sent as they are. cedreon.com then handles each request as it handles one from the workspace in your browser: it applies your rules and your organisation's, and screens it again with the automatic detection your account uses, before it reaches the model gateway. If you switch the app's vault off, the app sends your messages as you wrote them and tells cedreon.com not to look for values either; only what your organisation requires to be hidden is still hidden then. Everything this notice says about what reaches us applies to what the app sends us. Two things are different, and the next sections set them out: what the app keeps on your computer, which we can neither see nor reach, and the other places it connects to.

Your conversations are kept on your computer, not on our servers. Each request the app sends to a model through us carries the conversation so far, as every chat request does. We screen it, apply your rules, pass it to the model gateway and return the answer, and we keep no copy of the request or of the answer and save none of the real values behind its placeholders. What remains on our side is its entry in the integrity record and a note of the call without its text; the first section of this notice lists what remains.

In Settings, under Models, you can add a model provider of your own, such as OpenAI, Anthropic, Mistral or another compatible service, with your own key for it. When you choose one of its models, the app sends the conversation from your computer directly to that provider, after the app's own screening while its vault is on. cedreon.com is not in the path: we neither screen nor record those requests, and what this notice says about the model gateway, where processing happens and the contracts that forbid training does not reach them. That provider's own terms, locations and retention apply, under your own account with it. The same is true if whoever set up your computer gave the app a key of its own for the model gateway: the app then reaches the gateway directly, without us.

What the desktop app keeps on your computer

The app keeps its data in a folder named .cedreon in your user folder, with a few application files (window settings, caches and a diagnostic log) in your operating system's own application-data folder. All of it stays on your computer: we cannot see, reach or delete it, and closing your account does not remove it. It holds:

What the desktop app sends, and to whom

The desktop app sends no usage analytics and no crash reports, to us or to anyone else. What we learn about how the app is used comes from the requests it makes to us, which are listed first.

Hugging Face and GitHub receive their requests the way any website does: your IP address and the ordinary technical details of a request, under their own privacy notices, and either may serve them from outside Europe. Neither receives any of your content, which is why neither is on the sub-processor list.

Where the app connects, and why:

Uninstalling the desktop app

Uninstalling removes the program. What happens to the data it kept depends on the platform and the version, and we would rather say so exactly.

On Windows, from version 1.1: the uninstaller removes the app, the models it downloaded, its application files and caches, the updater's copies of the installer, and every sign-in the app kept: your Cedreon session and the credential for this computer, the keys you added for model providers of your own, the sign-ins of the MCP servers you connected, and the permission to read your Google Drive held on your computer. Your conversations, the files and documents you added, the vault, the index of your Drive, the copy of your organisation's rules and your settings stay on the computer unless you tick the box in the uninstaller that deletes them as well, so that reinstalling picks up where you left off; a key for the model gateway written into the app's configuration file stays with them. Versions before 1.1 left everything in place; if you removed one, you can delete the .cedreon folder in your user folder and the Cedreon folder in your application data yourself.

On macOS, removing the app removes the program and nothing else. The .cedreon folder in your home folder stays, with everything listed above, and so do the app's smaller folders in your Library, until you delete them yourself.

Closing your Cedreon account does not remove any of this from your computer, because we cannot reach it.

Reporting a response

You can report an answer to us if it is harmful or dangerous; hateful, harassing or sexual; inaccurate or misleading; if it reveals personal or confidential information; or for any other reason. A report contains the reason you chose, your note if you write one, the answer's reference number and the model that wrote it. It never contains the answer itself, and the report form asks you not to put personal or confidential details in your note.

The reference number lets us find the integrity record of that exchange, which says such things as which model answered and which protections applied, and holds no text of your message or of the answer. A report does not give us your conversation.

We read reports to find and fix problems with the answers Cedreon gives, on the basis of our legitimate interest in a service whose answers are safe and accurate, Article 6(1)(f) GDPR. A report is kept while we handle it and as the record of how we handled it, and it is deleted when you close your account. The fact that you sent it, with its reason, the model, the answer's reference number and your account but without your note, is also written to the integrity record, and like every entry there it stays when you close your account.

The website, and what we measure there

The public marketing pages carry website analytics and, only if you agree, advertising measurement. The signed-in workspace at cedreon.com/console and the desktop app carry neither.

The analytics are self-hosted: the software runs in a container on our own infrastructure, in the same Frankfurt region, and no third party receives the data. It counts page views and referrers.

The advertising measurement is Google Tag Manager with Google Ads conversion tracking, and the public website loads it only after you click Accept in its cookie banner. Until you choose, and if you click Reject, nothing is loaded from Google. If you accept, it measures whether a visit that came from a Google advertisement led to a signup or to a download of the desktop app. Google then receives the address of the page, the identifier of the advertisement click and the conversion event, together with what a browser sends with any request, such as your IP address and the type of browser, and sets its own advertising cookies in your browser. We use it for no remarketing and no ad personalisation, and we send Google no email address and nothing you write in Cedreon. Google uses this data under its own terms and may process it outside Switzerland and the European Economic Area.

The basis is your consent, Article 6(1)(a) GDPR. You can change your choice at any time with the Cookie settings control on this page, which shows the banner again; withdrawing removes the Google Ads cookies the page can reach and loads nothing further from Google.

The signed-in workspace in your browser makes no third-party requests, with one exception that you start yourself: choosing files from your Google Drive opens Google's own file picker, which loads from Google. Fonts, icons and charts are served from our own servers, which is why the console loads nothing from a content delivery network. Neither the workspace nor the desktop app loads Google Tag Manager or Google Ads, whatever you chose in the banner. The desktop app is a separate program on your computer, and the connections it makes are listed in the section on the desktop app.

The cookies we set ourselves are first-party and functional: a session cookie so you stay signed in, and, if you arrive from an advertisement, the campaign name so we can tell which advertisement reached you. The campaign cookie carries no identifier and expires after 30 days. Your choice in the cookie banner is kept in your browser's local storage rather than in a cookie. The only third-party cookies are Google's advertising cookies, and only after you accept.

How long we keep it

By category, because one horizon for everything would be a fiction:

Your rights

Under the GDPR and the Swiss FADP you have all of the following. Write to general@cedreon.com and we will answer within 30 days, free of charge. Where your organisation is the controller for the content in question, we will pass the request to them, because it is their instruction to give.

What the desktop app keeps on your computer is in your hands rather than ours: you can read, copy or delete it there yourself, and a request to us reaches what we hold, as the rest of this notice describes.

Automated decisions

We make no decisions about you by automated means that produce legal effects or similarly significantly affect you, within the meaning of Article 22 GDPR. We do not profile you.

Cedreon generates text using AI models, which is automated processing, and the screening layer decides automatically whether a value is masked before a request is forwarded. Neither decides anything about you: the first produces a draft for a person to judge, and the second only ever restricts what leaves. No account is granted, refused, priced or restricted by a model.

Do you have to give us this data

You are not obliged to give us anything. But an email address and a password are what an account technically consists of, so without them we cannot create one, and without payment details we cannot take a subscription. There is no other consequence: nothing here is collected because we would like to have it.

Changes

This notice is versioned. Each version has an effective date and a content hash, and when you accepted our Terms we recorded which version of this notice you were shown along with that hash, so what you were told at the time can be established rather than argued about.

If we change this notice materially we publish it as a new version, say so on this page and, where the change affects you directly, tell you by email.