Privacy Policy

When you create an account, we collect:

• Name and email address
• Profile information (optional, such as profile picture)
• Organization name and role
• Authentication credentials (managed securely via OAuth providers)

When you use the Service, you may submit:

• Workshop notes and session content
• Discovery templates and questions
• Requirements and user stories
• Project and client information
• Stakeholder details and contact information

Note: This content may contain personal data of third parties (e.g., your clients' stakeholders). You are responsible for ensuring you have appropriate consent or legal basis to share such information.

We automatically collect:

• Log data (IP addresses, browser type, device information, pages visited)
• Usage patterns and feature interactions
• Performance metrics and error reports
• Session duration and navigation paths

When you use AI features, we process:

• Input content you submit for AI processing
• AI-generated outputs
• Usage metrics (tokens consumed, operations performed)

We collect information when you:

• Contact our support team
• Submit feedback through the Service
• Respond to surveys or communications

• Create and manage your account
• Deliver the features and functionality you request
• Process your workshop content through AI features
• Provide customer support and respond to inquiries
• Maintain and improve the Service's performance and security
• Develop new features and services

• Send service-related notifications (e.g., security alerts, updates)
• Respond to your requests, comments, and questions
• Send administrative information about your account

• Analyze usage patterns to improve user experience
• Generate aggregated, anonymized insights
• Conduct research to enhance our products

• Detect, prevent, and address technical issues
• Protect against fraud, abuse, and security threats
• Enforce our Terms of Service and policies
• Comply with legal obligations

Our AI features include:

• Note Mapping: Automatically linking workshop notes to template questions
• Requirements Generation: Creating user stories from workshop content
• Template Enhancement: Suggesting improvements to discovery templates
• Gap Analysis: Identifying missing coverage areas

We use the following AI service providers:

Under applicable privacy laws, you have the right to:

• Request information about the logic involved in automated decisions
• Object to automated processing in certain circumstances
• Request human review of automated decisions
• Opt out of AI features entirely

We engage third-party service providers to perform functions on our behalf. These providers have access to personal information only to perform their functions and are obligated to maintain confidentiality.

If you use the Service as part of an Organization, other members of your Organization (particularly administrators) may access certain information about your account and activities.

We may disclose your information if required to do so by law or in response to:

• Valid legal process (e.g., subpoenas, court orders)
• Government requests that meet applicable legal requirements
• Protection of our rights, privacy, safety, or property
• Emergency situations involving potential threats to persons

If Exordia is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any change in ownership or uses of your personal information.

By using the Service, you acknowledge that your information will be stored and processed in the United States. We take appropriate measures to ensure your data remains protected in accordance with this Privacy Policy.

For GDPR-related inquiries, you may contact our data protection point of contact:

In addition to the rights listed in Section 10, EEA/UK residents have the right to:

You have the right to lodge a complaint with a supervisory authority in the EU/EEA member state of your habitual residence, place of work, or place of the alleged infringement. A list of EU Data Protection Authorities can be found on the European Data Protection Board website.

Your personal data may be transferred to and processed in the United States. For transfers of personal data from the EEA/UK to the United States, we rely on:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• Data processing agreements with our subprocessors that include appropriate safeguards

You may request a copy of the safeguards in place by contacting us at the address above.

In accordance with GDPR Article 22, we inform you that the Service uses AI-assisted processing to generate requirements and map workshop notes. These outputs are recommendations only and are not used to make decisions that produce legal effects or similarly significantly affect you. All AI outputs require human review before use. You may opt out of AI features at any time.

We retain personal data only for as long as necessary for the purposes set out in this policy and as required by applicable law. When the lawful basis for processing is consent, we will delete or anonymize the data promptly upon withdrawal of consent, unless another lawful basis applies. See Section 8 for specific retention periods.

California "Shine the Light" Law: California residents may request information regarding disclosure of personal information to third parties for direct marketing purposes.

To exercise any of these rights, please:

• Email us at admin@exordiacloud.com
• Use the account settings within the Service (for data export and deletion)

We will respond to your request within 45 days. We may need to verify your identity before processing your request.

• Essential Cookies: Required for the Service to function (authentication, security, preferences). Cannot be disabled.
• Analytics Cookies: Help us understand how users interact with the Service. Can be disabled in browser settings.

Most web browsers allow you to control cookies through their settings. Note that disabling certain cookies may affect the functionality of the Service.

We currently do not respond to "Do Not Track" signals. However, we honor Global Privacy Control (GPC) signals as opt-out requests where required by applicable law.