Privacy Policy

1. Who we are

CorpusIQ LLC (“CorpusIQ,” “we,” “us,” or “our”) is a private AI platform headquartered in Scottsdale, Arizona, USA. We operate the CorpusIQ service at corpusiq.io and the API at api.corpusiq.io.

2. What data we collect

• Account data: Email address, name, and password hash when you register.
• OAuth tokens: Read-only access tokens for the third-party services you connect (e.g., Gmail, Shopify, SHOPLINE, QuickBooks). Tokens are encrypted at rest.
• Query and audit logs: Local AUDIT logs record raw query text and tool parameters plus bounded result summaries. In Azure, the Log Analytics workspace retains those logs for 30 days. Logs are not shared across accounts.
• Usage metadata: Request timestamps, connector types used, and feature flags. Used for billing and abuse prevention.
• Payment data: Processed by Stripe. We do not store card numbers or full payment details.

3. What we do NOT do

• CorpusIQ does not train AI models on your business data. The selected AI client's plan and settings govern conversation handling after it receives authorized source context.
• We do not sell or share your data with third parties for advertising.
• We do not pool data across accounts for any purpose.
• We do not retain raw customer files or full connector response payloads for MCP connector requests.

For direct MCP connector requests, CorpusIQ fetches source records live and returns them to the requesting AI client. The direct path does not retain raw customer files or full connector response payloads, and it does not build embeddings, file indexes, or cached or indexed summaries. Local AUDIT logs record raw query text and tool parameters plus bounded result summaries. In Azure, the Log Analytics workspace retains those logs for 30 days. The selected AI client's plan and settings govern conversation handling after it receives the data. Optional indexed search is separate and retains embeddings and minimal metadata until connector revocation or account deletion.

4. How we use your data

• To authenticate your identity and protect your account.
• To connect to third-party services on your behalf using OAuth.
• To answer your queries by retrieving authorized records live from your connected sources.
• To provide billing, usage reporting, and support.
• To comply with legal obligations.

5. Data sharing

We share data only with service providers required to operate CorpusIQ: Microsoft Azure (infrastructure), Stripe (payments), and Supabase (authentication). All providers are contractually bound to data protection standards. For AI-assisted requests, authorized source context is sent to the AI client you selected so it can produce the answer. That client's plan and settings govern its conversation handling.

6. Data retention

Account data, encrypted OAuth tokens, and aggregate usage records are retained while your account is active. Operational logs in the Azure Log Analytics workspace are retained for 30 days. Optional indexed-search metadata remains until connector revocation or account deletion. Submit an account-data deletion request to privacy@corpusiq.io.

For SHOPLINE connections, CorpusIQ reads store data only when an authorized user asks a question. We do not maintain a separate database of SHOPLINE customer records. A signedcustomers/redactnotice is acknowledged after confirming that raw customer files and full connector response payloads are not retained; scoped operational logs may persist for up to 30 days. A signedmerchants/redactnotice deletes the store's OAuth token, account mapping, and cached connection.

7. Your rights

You have the right to:

• Access a copy of the data we hold about you.
• Correct inaccurate data.
• Request deletion of account data by emailing privacy@corpusiq.io.
• Revoke OAuth access to any connected service at any time from the Connectors dashboard.
• Port your data in a machine-readable format.
• Lodge a complaint with your local data protection authority (GDPR users).

To exercise any of these rights, contact privacy@corpusiq.io.

8. Security

CorpusIQ is CASA Tier 2 certified, assessed by DEKRA. All data is encrypted in transit (TLS 1.2+) and at rest (AES-256). We perform regular penetration testing and maintain an incident response plan. See our Security page for full details.

9. Cookies

We use a single session cookie (ciq_token) to authenticate your session. We do not use tracking cookies or advertising pixels.

10. Children

CorpusIQ is not directed at children under 13. We do not knowingly collect personal information from children.

11. Changes to this policy

We may update this policy. Material changes will be communicated by email or in-app notification. Continued use of the service after the effective date constitutes acceptance.

12. Contact

CorpusIQ LLC · Scottsdale, Arizona, USA
privacy@corpusiq.io