Legal

Privacy Policy

Last updated October 24, 2026

This policy explains how Ductile AI Inc. ("Ductile AI", "we", "us") handles personal information when you visit www.ductileai.com, use the console at console.ductileai.com, or talk to AnnE. We keep it short and say what we actually do.

Two roles

For your account, your use of the service and our website, we decide how the information is used: we are the "controller".
For the records your business processes handle (your customers, orders, invoices and so on), you decide: we process them only to run your processes, on your instructions, as your "processor". If you need a data processing agreement, ask us.

What we collect

Account details: your name, work email, password (stored only as a one-way hash), your organization and your role in it, and sign-in records such as the time and device, which we use to tell you about new sign-ins.
What you build: your business processes, settings, forms and the conversations you have with AnnE, typed or spoken.
Connections: the credentials for apps you connect, kept encrypted in a vault. AnnE and the AI model never see them.
Run records: what each run read, wrote and refused, and why, so you can check and trace your processes.
Usage: credits, runs and other counts we need to meter your plan and keep the service healthy.
Billing: Paddle, our Merchant of Record, collects your payment details. We receive your customer and subscription references, what you bought and when, and never your card number.
Our website: our page analytics use no cookies and store nothing in your browser. They record the page, the site you came from, any campaign tags in the address, your time zone, how long the page was open, and whether you went on to the console. We do not keep your IP address.

How we use it

To provide the service: sign you in, build and run your processes, meter your plan, and support you.
To keep it secure: detect misuse, protect accounts, and meet our legal duties.
To improve it, using counts and other information that do not identify you or your records.
To tell you what matters: sign-in notices, billing, changes to the service or these terms. We send marketing email only if you agreed to it, and every such email lets you stop.

Where the law asks for a legal basis, ours are: running our contract with you, our legitimate interest in a secure and working service, our legal obligations, and your consent where we ask for it.

AI and your records

AnnE uses an AI model (Anthropic's Claude) to understand your request and draft a process. It works from the names and kinds of your columns and steps; the values in your records are not sent to the model. We never use your records to train AI models. An AI step you add to a process runs on your own AI provider account, under that provider's terms.

We do not sell or share personal information for advertising. We use a small number of service providers, each bound to use it only for us:

Amazon Web Services: hosting, storage, email, and speech for talking to AnnE.
Anthropic: the AI model behind AnnE, as described above.
Paddle: payments, tax and invoices, as Merchant of Record.
Apps you connect, such as Slack, receive what your processes send them, under their own terms.

We may also disclose information if the law requires it, to protect people's safety or our rights, or as part of a merger or sale of the business, in which case this policy continues to apply.

Where it is kept

The service is hosted on Amazon Web Services in the United States. Enterprise customers can choose the region, or run their processes in their own data centre or cloud. Where personal information moves across borders, we protect it as the law requires.

How long we keep it

Run records: for your plan's run history (30 days on Free and Starter, 180 days on Team, 1 year on Business, 2 years or as agreed on Enterprise).
Your account and what you build: while your account is open. When it is closed, we delete the organization and its data within 30 days, and copies in our backups age out within a further 14 days.
Billing and tax records: as long as the law requires.

Cookies and storage

Our website sets no cookies. The console uses one cookie to keep you signed in, and stores a few preferences in your browser, such as light or dark mode. We use no advertising or cross-site tracking.

Security

Information travels encrypted, is encrypted where it is stored, and each organization's data is kept apart from every other's. App credentials are sealed in a vault; staff access is limited, protected by two-step sign-in, and recorded.

Your choices and rights

Depending on where you live (for example under the GDPR in the EU and UK, or state laws such as California's), you can ask to see, correct, delete or export your personal information, object to or restrict how we use it, or withdraw consent. Write to hello@ductileai.com; we answer as quickly as we can, always within the time the law sets, and will not treat you differently for asking. You can also complain to your local data protection authority. If your information is in a customer's processes, we will pass your request to that customer.

Children

The service is for businesses and is not meant for anyone under 18.

Changes to this policy

If we change this policy in a way that matters, we tell you by email or in the console before it applies, and update the date at the top.

Contact

Ductile AI Inc., hello@ductileai.com.