Privacy Policy

01Who we are & how to contact us

Custosa Inc. is a Delaware corporation. For any privacy question or request, email hello@custosa.com. Our registered office is 131 Continental Drive, Suite 305, Newark, Delaware 19713, USA (c/o our registered agent, Legalinc Corporate Services Inc.). Custosa Inc. is established in the United States; individuals in the EEA or UK may contact us about our processing of their personal data at hello@custosa.com.

02Information we collect

Information you provide

When you contact us, request access, or discuss a design-partner relationship, for example through a "Request access" link or by emailing us, we collect the information you choose to provide, such as your name, work email address, company, role, and the contents of your message.

Information collected automatically

When you visit the Site, our hosting infrastructure and standard web-server logs may record limited technical information such as your IP address, browser type and version, device and operating system, referring page, the pages you view, and the date and time of your visit. We use this for security, troubleshooting, and understanding aggregate usage.

Cookies and tracking

The Site does not use advertising cookies or cross-site tracking technologies. We use PostHog for privacy-friendly product analytics to understand how the Site is used; on our public pages it runs in a cookieless mode that sets no cookies and stores no identifiers on your device. We do not use advertising services.

Fonts loaded from a third party

The Site loads typefaces from Google Fonts (fonts.googleapis.com and fonts.gstatic.com). When your browser requests these fonts, Google may receive your IP address and request metadata. This is used to display the Site's typography and is governed by Google's own privacy policy.

03How we use information

We use personal information to respond to your inquiries and provide information you request; to evaluate, establish, and manage design-partner and customer relationships; to operate, secure, maintain, and improve the Site; to send communications you have requested or that relate to a relationship between us; and to comply with legal obligations and enforce our agreements.

04How we share information

We do not sell personal information, and we do not share it for cross-context behavioral advertising. We disclose personal information only:

• to service providers who process it on our behalf for the purposes above (for example, providers of website hosting and email or communications), under contracts that limit their use of the information;
• when required by law, legal process, or a governmental request, or to protect the rights, safety, and security of Custosa, our users, or others; and
• in connection with a merger, financing, acquisition, or sale of assets, in which case we will continue to protect personal information consistent with this policy.

05The Custosa service & customer data

When a customer deploys the Custosa service, Custosa inspects records in transit between the customer's data sources and the customer's AI systems, applies the customer's access and redaction policies, and produces evidence of each decision. In that role:

• Custosa acts as a service provider / data processor and handles such data only on the customer's documented instructions, under the agreement (and, where applicable, data processing addendum) between Custosa and that customer. That agreement, not this policy, governs the processing of customer data.
• The service is designed to minimize retention of record content: it evaluates records as they pass through, and its evidence ledger retains verdict metadata and cryptographic hashes, not the underlying record content.
• The evidence records Custosa generates contain decision verdicts, policy identifiers, counts, timestamps, and cryptographic hashes and signatures, not the underlying record content or the personal data within it.

If you are an individual whose data may be processed through a customer's use of Custosa, please direct your privacy requests to that organization (the controller of your data); we will assist our customers as required under our agreements with them.

05ACustosa Tools (the free MCP connector)

Custosa Tools is a free developer utility, offered separately from the Custosa enterprise service, as a remote Model Context Protocol (MCP) server at mcp.custosa.com. It helps developers check a database schema for PHI and HIPAA readiness from inside AI development tools. This section describes how we handle personal information in connection with the Tools.

Metadata only. The Tools are designed to operate on schema metadata — table names, column names, and structural definitions you choose to share. They do not require, request, or need your actual records, row values, or production data, and you should not submit such data to them.

What we collect when you use the Tools:

• Account / identity. When you authenticate, our identity provider (WorkOS) provides us with the name and email address associated with your sign-in, which we use to operate the Tools, secure access, prevent abuse, and communicate with you about the Tools and about Custosa.
• Schema metadata you submit. The table and column names and structure you pass to a tool are processed to produce the result you requested (for example, a PHI classification, a readiness score, or a suggested migration).
• Usage and operational data. We log which tools were called, timestamps, coarse result metadata such as counts and scores, and standard technical information, to run, secure, debug, and improve the service.

We use this information to provide and secure the Tools, understand aggregate usage, and communicate with you, including about related Custosa products. We do not sell it or use it for cross-context behavioral advertising; we share it only as described in section 04. Usage and analytics telemetry is retained for approximately 18 months; account and contact information is retained while your relationship with us is active and as needed for the purposes and legal obligations described in this policy.

Not a HIPAA Business Associate. Because the Tools are metadata-only and are not intended to receive protected health information (PHI), Custosa does not act as your Business Associate in connection with the free Tools, and no Business Associate Agreement is formed by your use of them. Do not submit PHI or other regulated data to the free Tools.

06Security

We use technical and organizational measures intended to protect personal information appropriate to its sensitivity, including access controls and least-privilege principles. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

07Data retention

We retain personal information for as long as necessary to fulfill the purposes described in this policy: for example, to maintain our relationship with you, to operate and secure the Site, and to comply with our legal obligations. After that, we delete or de-identify it. Retention of customer data handled by the service is governed by the applicable customer agreement.

08Your choices & rights

You may contact us at hello@custosa.com to ask about the personal information we hold about you, to request access, correction, or deletion, or to opt out of non-essential communications. We will respond consistent with applicable law. Depending on where you live, you may have additional rights:

EEA / UK

If you are in the European Economic Area or the United Kingdom, you may have rights to access, rectify, erase, restrict, or object to processing, and to data portability. Our legal bases for processing are typically our legitimate interests (operating and securing the Site and our business, and communicating with business contacts), your consent (where we ask for it), the performance of a contract, and compliance with legal obligations. You may lodge a complaint with your local data protection authority.

California

If you are a California resident, you have rights under the CCPA/CPRA to know, access, correct, and delete personal information, and to limit the use of sensitive personal information. In the past 12 months we have collected the following categories of personal information:

We disclose these categories only to the service providers and in the circumstances described in section 04, and we retain each as described in section 07. We do not sell or share personal information, or use it for cross-context behavioral advertising, as those terms are defined under California law, and we do not collect sensitive personal information for our own purposes. We honor recognized opt-out preference signals (such as Global Privacy Control) where applicable, and we will not discriminate against you for exercising your rights.

To exercise any right, email hello@custosa.com; we may need to verify your identity before responding.

09International transfers

We are based in the United States and may process and store information in the United States and other countries. Where we transfer personal information from the EEA, the UK, or other regions, we rely on appropriate safeguards where required — the European Commission's Standard Contractual Clauses for EEA transfers, and the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the SCCs for UK transfers.

10Children's privacy

The Site and the Custosa service are intended for businesses and are not directed to children. We do not knowingly collect personal information from children under 16. If you believe a child has provided us personal information, contact us and we will delete it.

11Changes to this policy

We may update this policy from time to time. When we do, we will revise the "Last updated" date above, and material changes will be reflected on this page. Your continued use of the Site after an update means you accept the revised policy.

12Contact

Questions or requests: hello@custosa.com.
Custosa Inc., 131 Continental Drive, Suite 305, Newark, Delaware 19713, USA.