Privacy Policy

1. Scope and responsibility

This policy applies when Cerul determines why and how personal information is processed. It does not replace a customer agreement or data processing agreement under which Cerul processes personal information solely on behalf of an enterprise customer.

A third-party website, source, identity provider, payment provider, model provider, or integration may apply its own privacy policy to information it receives independently.

2. Information you provide

• Account and profile information, such as your name, email address, organization, profile image, language, and authentication choices.
• Billing and transaction information, such as plan, subscription status, purchase history, tax information, billing address, and payment-provider identifiers. Cerul does not store full payment-card or bank-account numbers.
• Communications, feedback, survey responses, support requests, and diagnostic files you choose to send.
• Content and instructions you choose to upload, share, submit through an API, or process with a cloud feature, including media, documents, queries, prompts, metadata, and configuration.

3. Local processing and cloud processing

Cerul is designed to support local processing. Media, local indexes, transcripts, embeddings, search history, provider credentials, and related library data intended for local use remain on your device unless you choose an action that sends them elsewhere.

Information may leave your device when you upload or share content, enable a cloud or collaboration feature, use the hosted API, connect a remote model or storage provider, synchronize account or subscription state, check for updates, or send diagnostics or support material.

Cerul Desktop cloud assistance, when available, uploads only media you explicitly select and deletes the cloud source after processing; returned indexes remain local. The hosted developer API is a separate product: uploaded API assets and indexes are retained in metered cloud storage until you delete them or the applicable retention policy ends.

When you connect your own third-party provider, the desktop software may send selected content directly from your device to that provider. Cerul may not receive that content, but the provider's terms and privacy practices will apply.

4. Information collected automatically

We limit automatic collection to what is reasonably necessary for the disclosed purposes. If we introduce optional analytics or another collection users would not reasonably expect, we will provide an appropriate notice and obtain consent where required.

• Device and application information, such as operating system, app version, language, device or browser type, update state, and approximate network region.
• Service and API records, such as IP address, request time, endpoint, response status, identifiers, quota consumption, and authentication or security events.
• Feature and reliability information, such as activation state, performance measurements, crash details, and limited diagnostics needed to operate, secure, and improve the Service.
• Session-cookie and similar information required to authenticate users, preserve security state, and provide requested website functions.

5. Content, sources, and derived data

Cloud features may process user content and create transcripts, scene descriptions, embeddings, thumbnails, indexes, search results, summaries, timestamps, usage records, and other derived artifacts. These artifacts may contain personal information present in the source material.

If you ask Cerul to retrieve or process content from a third-party source, we may receive the source URL, source metadata, access result, and information needed to perform the request. You are responsible for having the rights and permissions required for the content you submit.

6. How and why we use information

Depending on the context and applicable law, we rely on performance of a contract, legitimate interests, consent, and compliance with legal obligations. Where processing relies on consent, you may withdraw it for future processing.

• Provide local and cloud features, accounts, authentication, search, indexing, sharing, APIs, subscriptions, updates, and support.
• Process payments, administer plans and usage allowances, prevent abuse, enforce limits, and maintain transaction records.
• Protect users and the Service, investigate incidents, detect fraud, debug failures, and maintain reliability.
• Communicate about transactions, security, support, service changes, and—where permitted—product news you can opt out of.
• Comply with law, respond to valid legal process, enforce agreements, and establish or defend legal claims.
• Improve Cerul through aggregated, de-identified, or appropriately controlled product information.

7. AI and model processing

When you select a cloud or remote AI feature, the content and instructions needed for that feature may be processed by Cerul infrastructure or the identified model provider. We use contractual, technical, and product controls appropriate to the feature and disclose material provider choices where required.

For Cerul's current speech indexing and semantic search, Google Gemini receives only bounded transcript text and search-query text for embedding. Cerul does not send original video, original audio, extracted frames, or other binary media to Gemini.

Cerul does not use private customer content to train generalized models for other customers unless the customer gives separate, explicit permission. This does not prevent processing needed to provide the requested feature, detect abuse, or improve a private customer-specific system.

AI-generated descriptions and inferences may be inaccurate and should not be used as the sole basis for decisions that produce legal or similarly significant effects about a person.

8. When we disclose information

We require service providers that process personal information for us to use it only for authorized purposes and provide protections appropriate to the information.

Cerul uses Resend only to deliver passwordless sign-in codes and links, account-verification messages, and password-reset messages. Resend receives the destination email address and the applicable one-time account-action message; Cerul does not send media, library content, transcripts, or search queries to Resend.

• Service providers that support hosting, storage, security, authentication, payments, communications, customer support, software distribution, and model processing, subject to appropriate obligations.
• An organization that administers your account or workspace, including authorized owners and administrators.
• Authorities, courts, or other parties when reasonably necessary to comply with law, protect rights or safety, investigate abuse, or enforce agreements.
• A buyer, successor, or adviser involved in a merger, financing, reorganization, sale, or similar transaction, subject to confidentiality and applicable law.
• Other parties when you direct us to disclose information or give valid consent.

9. No sale or behavioral advertising

Cerul does not sell personal information for money, does not rent personal information, and does not share personal information for cross-context behavioral advertising. We do not use private service content to target advertising.

If these practices change, we will update this policy, provide any required notice, and offer legally required choices before the change applies.

10. Retention and deletion

We retain personal information only for as long as reasonably necessary for the purposes described in this policy, including providing the Service, maintaining security and business records, satisfying tax and accounting requirements, resolving disputes, and enforcing agreements. Retention depends on the data type, sensitivity, product setting, customer instructions, and legal requirements.

Local data remains under your device and backup controls. Cloud content and account data are deleted or de-identified after an authorized deletion request, subject to reasonable processing time, backup cycles, fraud and security needs, legal holds, and records we must retain by law.

You may use available account or product controls to delete content or your account, or request deletion at support@cerul.ai. Deleting an account does not automatically delete local files on your devices, and deleting the application does not automatically close a cloud subscription.

11. Your rights and choices

Depending on where you live, you may have rights to know or access personal information, correct it, receive a portable copy, delete it, restrict or object to processing, withdraw consent, and appeal a denied request. You may also have the right not to receive discriminatory treatment for exercising privacy rights.

You can manage certain information in Cerul, cancel optional communications through their unsubscribe controls, and submit a verified privacy request to support@cerul.ai. We may request information reasonably necessary to verify identity and authority, and an authorized agent may submit a request where permitted.

You may complain to your local data-protection or consumer-protection authority. Mandatory rights available in your jurisdiction are not limited by this policy.

12. United States privacy disclosures

Where applicable United States state privacy laws apply, the categories described in this policy may include identifiers, customer records, commercial information, internet or network activity, approximate location derived from IP address, audio or visual content, professional information, and inferences created to provide the Service.

We collect and use these categories for the business and commercial purposes described above and disclose them to the categories of recipients listed in Section 8. We do not sell or share these categories for cross-context behavioral advertising, and we do not use sensitive personal information to infer characteristics for unrelated purposes.

Eligible residents may exercise applicable rights to know, access, correct, delete, obtain a copy, limit certain uses, opt out where relevant, and appeal through support@cerul.ai.

13. International data transfers

Dubrio, LLC is based in the United States, and Cerul and its service providers may process information in countries other than where you live. Where required, we use recognized transfer mechanisms and supplementary safeguards appropriate to the information and destination.

14. Security

We use administrative, technical, and organizational safeguards designed to protect personal information, including access controls, encryption in transit, protected authentication cookies, credential handling, logging, and review of service providers. No system is completely secure, so you should protect account credentials, API keys, devices, and backups and promptly report suspected misuse.

15. Children

Cerul is not directed to children under 16, and we do not knowingly collect personal information from a child under 16 without legally valid authorization. If you believe a child has provided personal information improperly, contact us so we can review and delete it as appropriate.

16. Enterprise customers and integrations

When an enterprise customer controls personal information processed through Cerul, that customer is responsible for its notices, instructions, and legal basis, and Cerul acts as its processor or service provider under the applicable agreement. Requests about employer- or organization-controlled data may be referred to that organization.

Third-party integrations and content sources are operated independently. Review their privacy practices before connecting them, and remove an integration or credential when it is no longer needed.

17. Changes, contact, and language

We may update this policy to reflect product, business, legal, or security changes. We will revise the effective date and provide additional notice before a material change takes effect where required.

Privacy questions, rights requests, account-deletion requests, and complaints may be sent to Dubrio, LLC, operating as Cerul, at support@cerul.ai.

The English version is the controlling version to the extent permitted by applicable law. Translations are provided for convenience and do not reduce mandatory privacy or consumer rights.