Privacy Policy

1. Scope and controller

This Privacy Policy explains how Cybrient Technologies SA ("Cybrient", "we", "us", or "our") collects, uses, discloses, stores, and otherwise processes personal data in connection with BoldWorkspaces, https://boldworkspaces.com, related pages, communications, support, accounts, and the services described below.

It applies when a person visits the Site, creates, administers, or joins a workspace, invites users, uses chats, uploads or shares content, selects Models, purchases or uses Credits, communicates with us, or uses any future BoldWorkspaces web, mobile, or desktop client. It does not replace the privacy terms of an employer, other Customer, Model Provider, or integration.

This Policy should be read with the applicable Terms of Use, any Order Form, and any data processing agreement ("DPA"). If a signed DPA applies to Customer Personal Data, the DPA controls to the extent of a conflict about that processing.

The controller for the processing described in this Policy is Cybrient Technologies SA, Rue Liotard 6, 1202 Genève, Switzerland, UID CHE-211.912.834. Privacy requests may be sent to [email protected].

2. Our role, Customer role, and administrator role

Cybrient's role depends on the data and purpose:

• For Site visits, account registration, contracts, billing, communications, security, compliance, and service analytics, Cybrient generally acts as an independent controller.
• For Workspace Content that a business Customer submits and instructs Cybrient to process, Cybrient generally acts as processor or service provider for that Customer.
• For security, abuse detection, billing integrity, legal compliance, and protection of the Service, Cybrient may process limited workspace data for its own legitimate and legal purposes as a controller, where permitted.
• A Model Provider may act as a subprocessor or independent controller depending on the Model Terms and arrangement.

The Customer that creates or provides a workspace is responsible for personal data it places there, including employee and contractor information, conversations, files, monitoring data, and content relating to clients or other individuals. Customer must provide required privacy and workplace notices, establish lawful bases, consult worker representatives where required, configure access and retention, and respond to individuals.

Admin Users act for Customer. Within the workspace they may access, review, export, retain, delete, restrict, or disclose Authorized Users' Workspace Content, usage, settings, and account information. An Authorized User should direct employment or organization-specific privacy questions to the relevant Customer or Admin User.

3. Personal data we collect

Account, organization, and contact data

• name, business email, telephone number, job title, employer, department, address, avatar, and profile information;
• credentials, authentication information, workspace membership, invitations, roles, permissions, group assignments, and Admin User actions;
• workspace name, organization details, model permissions, budgets, privacy rules, retention settings, sharing settings, and integrations;
• billing contact, invoice information, VAT or tax information, transaction history, Credit balance, wire reference, and net amount received;
• KYB, sanctions, fraud, tax, or compliance information; and
• support requests, correspondence, Feedback, surveys, disputes, and complaints.

Workspace Content

• prompts, chats, instructions, files, documents, images, audio, video, code, data, and other Inputs;
• Outputs returned by Models;
• shared links, comments, collaboration records, titles, folders, tags, and content metadata; and
• usage, model selection, token or cost information, audit events, and administrative records.

Data from third parties

• information from Customer, an Admin User, a person who invites a user, an integration, or an authentication provider;
• payment, fraud, and transaction information from Stripe, banks, and payment networks;
• usage, error, availability, pricing, and policy information from BoldRouter and Model Providers; and
• lawful public or commercial information used for business verification, sanctions screening, security, or fraud prevention.

Data collected automatically

When a person visits the Site or uses the Service, we may automatically collect:

• IP address, approximate location derived from IP, browser type, operating system, device type, language, time zone, and device or session identifiers;
• pages, screens, links, features, Models, routes, and settings used; timestamps; referring pages; response times; error events; and diagnostic data;
• authentication, API, network, security, fraud, audit, and access logs; and
• cookie identifiers, consent choices, preferences, and other information collected by cookies, local storage, pixels, or similar technologies.

We use Cloudflare for content delivery, network security, bot and abuse protection, and related traffic processing. We may use first-party systems for operational analytics, performance monitoring, billing integrity, and product improvement. We do not currently use third-party advertising cookies or sell personal data for advertising.

Strictly necessary technologies support authentication, security, load balancing, fraud prevention, and core preferences and cannot always be disabled. Where required by law, optional functional or measurement technologies are used only after consent. Browser or device settings can block or delete cookies, but this may prevent parts of the Service from working.

4. Workspace Content and AI processing

When an Authorized User submits an Input, BoldWorkspaces processes it according to workspace settings and sends it through BoldRouter to the selected Model Provider or a provider selected by configured routing. The provider processes the Input to generate an Output, which may be stored in the workspace if the feature or Customer settings provide for storage.

Workspace Content may contain personal data about users, employees, contractors, customers, suppliers, patients, applicants, or other individuals. Customer is responsible for minimizing data and ensuring that collection, monitoring, sharing, Model selection, and retention are lawful and consistent with its notices and policies.

CYBRIENT DOES NOT USE WORKSPACE CONTENT TO TRAIN CYBRIENT MODELS UNLESS CUSTOMER SEPARATELY AND EXPRESSLY OPTS IN TO A CLEARLY IDENTIFIED PROGRAM.

Cybrient may process Workspace Content to provide collaboration, search, display, storage, support, security, abuse prevention, billing, and requested AI functions. Limited access by authorized personnel or vendors may occur when needed to resolve support or security issues, enforce terms, or comply with law.

5. BoldRouter and Model Provider data practices

BoldWorkspaces uses BoldRouter as underlying model-routing infrastructure. The BoldRouter layer handles Inputs, routing metadata, provider selection, retries or fallback, usage measurement, and provider responses.

Model Providers have different retention, training, safety review, region, and security practices. Some may retain or use Inputs and Outputs for training or improvement; others offer no-training or zero-retention terms for particular endpoints or enterprise accounts.

Customer and Admin Users must review provider information and allow only Models suitable for their organization. Provider labels are based on information available to Cybrient and may change or be incomplete. Cybrient cannot reverse provider-side use after data is transmitted to a provider that permits retention or training.

Automatic routing or fallback may cause a request to be processed by a different provider than the user's initial preference. Admin Users should configure provider and model permissions consistent with Customer requirements.

6. Privacy controls and private-data filtering

BoldWorkspaces may provide model permissions, sharing restrictions, budgets, retention settings, and predefined privacy rules. Where private-data filtering is enabled, the original Input is processed within BoldWorkspaces and BoldRouter systems to attempt to detect, remove, mask, replace, or transform selected categories before transmission to a Model Provider.

PRIVACY CONTROLS AND AUTOMATED FILTERING REDUCE CERTAIN RISKS BUT DO NOT GUARANTEE ANONYMIZATION, COMPLIANCE, CONFIDENTIALITY, COMPLETE DATA REMOVAL, OR PREVENTION OF UNAUTHORIZED DISCLOSURE.

Rules may miss context-dependent information, create false positives, alter meaning, or leave re-identifiable data. A budget or permission may also be affected by delayed metering, retries, configuration, or system error. Customer is responsible for testing, training users, reviewing access, and applying independent legal and technical safeguards.

7. Cookies, logs, and similar technologies

When a person visits the Site or uses the Service, we may automatically collect:

• IP address, approximate location derived from IP, browser type, operating system, device type, language, time zone, and device or session identifiers;
• pages, screens, links, features, Models, routes, and settings used; timestamps; referring pages; response times; error events; and diagnostic data;
• authentication, API, network, security, fraud, audit, and access logs; and
• cookie identifiers, consent choices, preferences, and other information collected by cookies, local storage, pixels, or similar technologies.

We use Cloudflare for content delivery, network security, bot and abuse protection, and related traffic processing. We may use first-party systems for operational analytics, performance monitoring, billing integrity, and product improvement. We do not currently use third-party advertising cookies or sell personal data for advertising.

Strictly necessary technologies support authentication, security, load balancing, fraud prevention, and core preferences and cannot always be disabled. Where required by law, optional functional or measurement technologies are used only after consent. Browser or device settings can block or delete cookies, but this may prevent parts of the Service from working.

8. How and why we use personal data

We process personal data for the following purposes and, where the GDPR or a similar law requires a legal basis, on the following bases:

• Provide and administer BoldWorkspaces; authenticate users; route or generate requested results; maintain accounts and settings — performance of a contract; steps requested before a contract.
• Process purchases, wire receipts, Credits, invoices, taxes, and accounting records — contract; legal obligation; legitimate interests in payment and record integrity.
• Secure systems; detect fraud, abuse, malware, prohibited use, and account compromise; investigate incidents — legitimate interests; legal obligation; protection of rights and systems.
• Support, troubleshoot, monitor reliability, measure performance, and improve features — contract; legitimate interests in operating and improving the Service.
• Communicate service notices, policy changes, security alerts, and requested support — contract; legal obligation; legitimate interests.
• Send product news or marketing — consent where required; otherwise legitimate interests, with an opt-out.
• Comply with law, sanctions, lawful requests, tax, audit, litigation, and enforcement of terms — legal obligation; legitimate interests; establishment or defense of legal claims.
• Corporate transactions, restructuring, financing, or due diligence — legitimate interests, subject to confidentiality and applicable law.

Where processing is based on consent, consent may be withdrawn at any time without affecting processing already performed. Where based on legitimate interests, we consider the relevant business need, necessity, safeguards, and impact on individuals.

9. How we share personal data

We may disclose personal data to the following categories of recipients, only as reasonably necessary for the purposes described in this Policy:

• Model Providers. Inputs and related metadata are sent to the provider selected by Customer or selected through configured routing. Providers may process Inputs and Outputs under their own Model Terms and data practices.
• Hosting and infrastructure. Infomaniak provides hosting or cloud infrastructure; Cloudflare provides content delivery, network, security, and traffic services.
• Payments. Stripe processes card payments and related fraud and compliance information. Banks and correspondent institutions process wire transfers. Cybrient receives and credits only the net funds actually received.
• Communications. Microsoft and Resend may process contact details, message content, delivery data, and related metadata for email and business communications.
• Professional advisers and vendors. Lawyers, auditors, accountants, insurers, security specialists, and contractors may receive data where needed and subject to duties of confidentiality.
• Affiliates and corporate transactions. Data may be shared within the Cybrient group or with a buyer, investor, lender, or successor in a merger, acquisition, reorganization, financing, insolvency, or asset transfer, subject to appropriate safeguards.
• Authorities and protection. We may preserve or disclose data when required by law or a valid order, or where reasonably necessary to protect rights, safety, systems, users, providers, or the public; investigate fraud or abuse; or enforce agreements.
• Customer-directed recipients. We disclose Workspace Content and account information to integrations, workspace members, shared-link recipients, or other parties when Customer or an Authorized User directs or enables that disclosure.

Service providers are required by contract to process personal data only for permitted purposes and with appropriate confidentiality and security obligations, except where a recipient acts as an independent controller under its own legal duties and terms.

10. International data transfers

Cybrient is established in Switzerland and uses Swiss hosting through Infomaniak for core infrastructure. However, the Service is global. Cloudflare, Stripe, Microsoft, Resend, Model Providers, banks, support personnel, and other recipients may process personal data in Switzerland, the EEA, the United Kingdom, the United States, or other countries.

The destination of an AI request may depend on the Model Provider, route, configuration, and provider capacity. Customer should review provider information before selecting a Model if data residency is important.

Where personal data is transferred to a country that is not recognized as providing adequate protection, we use an available lawful transfer mechanism, such as contractual clauses recognized under Swiss data protection law, the European Commission's Standard Contractual Clauses with Swiss adaptations where appropriate, binding contractual safeguards, or a statutory exception. Copies or information about relevant safeguards may be requested at [email protected], subject to confidentiality and legal restrictions.

11. Data retention

We retain personal data only for as long as reasonably necessary for the purpose collected, Customer instructions, contractual commitments, security, dispute resolution, and legal, tax, accounting, and regulatory obligations. Retention may differ by data type, configuration, provider, and jurisdiction.

• Account, contract, and business contact data is generally retained while the account or commercial relationship is active and for a reasonable period afterward.
• Transaction, invoice, tax, wire-transfer, and accounting records are retained for applicable statutory periods.
• Security, fraud, abuse, access, and diagnostic logs are retained for periods reasonably necessary to investigate incidents, enforce terms, protect systems, and meet legal obligations.
• Support and legal correspondence is retained for the time necessary to resolve the matter and establish, exercise, or defend claims.
• Workspace Content is generally retained while the relevant workspace is active and according to Customer settings, deletion actions, contractual commitments, and available product controls.
• A Customer or Admin User may delete content or remove a user. Deletion may be irreversible. An Authorized User may lose access immediately when removed, even if the content remains under Customer control.
• On workspace closure or termination, Customer should export data it needs before access ends. Cybrient may delete Workspace Content after the service relationship ends, subject to a signed agreement, legal duties, security needs, and reasonable backup cycles.
• Image, audio, and video content may be stored as part of Workspace Content if saved in a conversation or file feature. If not saved, it is intended to be retained only as needed for routing, security, billing, debugging, or legal compliance.

Deletion from active systems may be followed by deletion from backups on a rolling cycle. We may retain limited information where required by law, to prevent fraud or repeated abuse, to document a rights request, or to establish or defend claims. Where feasible, data no longer needed may be deleted or irreversibly anonymized.

Model Providers apply their own retention periods. Deleting data from Cybrient does not necessarily delete copies independently retained by a Model Provider or a recipient to whom Customer disclosed it.

12. Data security

We use technical and organizational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access. Measures are selected according to risk and may include access controls, authentication, encryption in transit, network protection, logging, monitoring, backup practices, vendor controls, and incident procedures.

No internet transmission, Model Provider, storage system, or security measure is completely secure. Customer is responsible for protecting credentials, configuring permissions, limiting submitted data, maintaining endpoints and backups, and promptly reporting suspected compromise.

Where required by applicable law or contract, we will notify the competent authority, affected Customer, or affected individuals of a qualifying personal-data breach.

13. Privacy rights and complaints

Depending on applicable law and subject to conditions and exceptions, an individual may have rights to:

• obtain information about processing and access personal data;
• correct inaccurate or incomplete data;
• request deletion or restriction of processing;
• object to processing based on legitimate interests or to direct marketing;
• receive certain data in a portable format;
• withdraw consent at any time where processing is based on consent;
• request review of certain solely automated decisions, where applicable; and
• lodge a complaint with a competent data protection authority.

Requests may be sent to [email protected]. We may need to verify identity and authority and may ask for information needed to locate the data. We may refuse or limit a request where permitted by law, including to protect others, preserve legal privileges, comply with retention duties, or address manifestly unfounded or excessive requests.

For personal data controlled by a business Customer, the individual should contact that Customer. We will assist the Customer as required by a DPA and applicable law.

Individuals in Switzerland may contact the Swiss Federal Data Protection and Information Commissioner (FDPIC). Individuals in the EEA or United Kingdom may complain to the supervisory authority for their place of residence, work, or alleged infringement.

14. Administrator access and business-user expectations

A workspace is provided by and for a business Customer. Admin Users may see identity, role, usage, cost, model selection, audit information, and Workspace Content to the extent permitted by product functionality and Customer configuration. Customer may use this information for governance, security, billing, records management, compliance, and internal policy enforcement.

Cybrient does not determine how Customer uses administrator information. Customer is responsible for transparency, proportionality, labor and employment rules, works-council or union obligations, and any required consent. Users should not place personal material in a business workspace.

If an Authorized User leaves Customer or loses workspace access, Customer may retain and control content created within the workspace, subject to applicable law and Customer policy.

15. Marketing, cookies, and sale choices

A recipient may unsubscribe from marketing messages using the link in the message or by contacting [email protected]. The opt-out does not stop transactional, account, security, billing, or legal communications needed to provide the Service.

Cookie or similar-technology choices can be managed through any consent control provided on the Site and through browser settings. A user may also disable optional analytics where such a control is offered.

Cybrient does not sell personal data for money and does not currently share personal data for cross-context behavioral advertising. If that practice changes, this Policy and any legally required choice mechanism will be updated before the change applies.

16. Sensitive, image, audio, video, and biometric data

Some Models accept or generate images, audio, video, voice, faces, documents, health information, identifiers, financial information, or other sensitive data. Certain features may analyze voice or facial characteristics in a manner treated as biometric processing under applicable law.

A Customer that submits an image, voice, video, or other data relating to another person is responsible for providing required notice, obtaining valid consent or another lawful basis, and ensuring that the selected Model and use are permitted. Customer must not submit another person's biometric or highly sensitive data without appropriate authority and safeguards.

Images, audio, video, and related Outputs may be stored as Workspace Content where a user or Customer saves them. They are also transmitted through BoldRouter to the selected Model Provider for inference. Retention at Cybrient and the provider depends on workspace settings, requested features, security and legal needs, and provider terms.

Cybrient does not independently use Customer Content to identify individuals through biometric templates or train Cybrient models unless a separate feature and notice expressly state otherwise. Model Providers may perform or retain biometric processing under their own terms.

17. Business use and age eligibility

BoldWorkspaces is intended only for business users and is not directed to consumers or children. Every user must be at least 18 years old. We do not knowingly create accounts for a person under 18.

If we learn that a person under 18 has provided personal data in violation of this restriction, we may suspend access and delete the data, subject to Customer instructions and legal retention duties. Customer must not place children's data in the Service unless the processing is lawful, necessary, appropriately safeguarded, and permitted by the selected Model Terms.

18. Additional disclosures for U.S. residents

Where a U.S. state privacy law applies, residents may have rights to know or access categories and specific pieces of personal data, correct inaccuracies, delete data, obtain a portable copy, opt out of sale or certain sharing or profiling, and appeal a refusal. We will not discriminate against a person for exercising an applicable privacy right.

During the preceding twelve months, the categories of personal data we may have collected are identifiers and contact details; account credentials; commercial and transaction information; internet or network activity; approximate location; communications; professional or employment information supplied for business use; Customer Content; and inferences or usage statistics. Sources, purposes, and recipients are described in this Policy.

We do not sell personal data for monetary consideration. Model Provider processing is part of providing the requested Service; a provider may independently use data under its Model Terms. Customers that do not want provider training should select a provider and configuration that contractually or publicly commits not to use Inputs and Outputs for training.

An authorized agent may submit a request where law permits, but we may require proof of authority and direct identity verification. Requests and appeals should be sent to [email protected].

19. Third-party sites, applications, and integrations

BoldWorkspaces may link to or integrate with repositories, identity providers, business applications, storage services, and other third-party systems. Their privacy practices are governed by their own notices. Customer and Admin Users are responsible for authorizing connections and determining what data may flow to or from them.

Disconnecting an integration stops future authorized transfers but may not delete data already received by the third party. Cybrient is not responsible for independent third-party processing.

If mobile or desktop applications are introduced, they may process device identifiers, operating-system information, diagnostics, local storage, and notification tokens as needed for the selected functionality. Material changes will be reflected in this Policy or an in-app notice.

20. Policy changes and contact

We may update this Policy to reflect changes in law, providers, features, or practices. The updated version will be posted with a revised date. Where a change materially affects how account holders' personal data is used or their rights, we will provide advance notice by email or in-product message where reasonably practicable or legally required.

Continued use after the effective date means the updated Policy applies to processing from that date, subject to applicable law. Where consent is legally required for a new purpose, we will request it.

Questions, complaints, rights requests, and privacy notices may be sent to [email protected].

Controller: Cybrient Technologies SA, Rue Liotard 6, 1202 Genève, Switzerland. UID CHE-211.912.834. VAT CHE-211.912.834 MWST.

Service website: https://boldworkspaces.com

To the extent legally permitted, this Policy is governed by Swiss law and disputes are subject to the courts of Geneva, Switzerland, without limiting non-waivable privacy rights or a person's right to complain to a competent supervisory authority.