Privacy Policy

CausoAI ("we", "our", "us") is a B2B SaaS causal inference platform. We provide tools that help analytics teams discover causal relationships in their data, estimate treatment effects, and generate AI-powered insights. Our registered contact email is hello@causoplatform.com.

We collect the following categories of data:

**Account data:** Name, work email address, company name, and password (hashed) when you register.

**Usage data:** Pages visited, features used, analysis runs initiated, timestamps, and browser/device information collected via server logs and analytics.

**Uploaded and imported data:** CSV and Excel files you upload, and data you choose to import from connected sources — databases and warehouses (PostgreSQL, MySQL, BigQuery, Snowflake), Google Sheets, and business tools (Salesforce, HubSpot, Pipedrive, Stripe, Shopify, PostHog, Mixpanel, Amplitude, Google Analytics, Google Ads, Meta Ads, LinkedIn Ads). This data is stored in your organization's isolated workspace.

**Connection credentials:** The passwords, keys or access tokens needed to read from a source you connect. See section 5.

**Communication data:** Messages you send us via the contact form or email.

**Billing data:** Handled entirely by our payment processor (Stripe). We do not store raw card numbers.

We use your data solely to:

—Provide and operate the CausoAI platform and its features

—Authenticate your identity and enforce organization-level access controls

—Run causal analyses on data you explicitly upload or connect

—Generate AI-powered insights via the Anthropic Claude API on your analysis results

—Respond to support requests and product inquiries

—Send transactional emails (account confirmation, analysis completion, billing receipts)

—Improve platform reliability, debug errors, and monitor performance

—Comply with legal obligations

We do not sell your data. We do not use your uploaded datasets to train machine learning models. We do not share your data with third parties for marketing purposes.

We share data only with the following sub-processors, strictly to operate the platform:

—Anthropic — Analysis results (not raw data) are sent to the Claude API to generate plain-English insights. Anthropic's data usage policies apply.

—Hetzner Online GmbH — Servers in Falkenstein, Germany, that store and process your data and analysis results. Your data stays in the EU.

—Stripe — Payment processing. Subject to Stripe's privacy policy.

—Redis / Celery — Temporary job queues for async analysis processing. Data is not persisted beyond job completion.

All sub-processors are contractually bound to process data only as instructed and in compliance with applicable data protection law.

You can connect CausoAI to tools your company uses. Some connect with a key or password you enter; Salesforce, Google Analytics, Google Ads, Meta Ads and LinkedIn Ads connect by signing in on the provider's own page and approving access there. We never see the password for those accounts.

**What we access:** Read-only access to reporting data — for example Google Analytics reports (the analytics.readonly scope), Google Ads performance reports (the adwords scope, which Google offers only as full access; we use it only to read reports), Meta ad insights (ads_read), LinkedIn ad analytics (r_ads_reporting) and the Salesforce records your user can see. We use that access only to fetch the data you ask to preview or import, at the moment you ask. We never create, change or delete anything in your connected accounts.

**How we use it:** Data imported from a connected account is used only to run the analyses you request inside CausoAI, in the same way as a file you upload. It is not sold, not used for advertising, not shared with other customers, and not used to train AI models — ours or anyone else's. Analysis results may be sent to Anthropic to write the plain-English insights you ask for (see section 4); Anthropic does not train its models on that data.

**Google user data:** CausoAI's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy (developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements. No person at CausoAI reads data from your Google account unless you ask us to for support, it is needed for security, or the law requires it.

**Storage:** Access tokens and other connection credentials are stored encrypted and are used only by our servers. Imported data is kept like uploaded data (see section 6).

**Personal details:** From Shopify and Pipedrive we import orders, deals and activity, not the names, email addresses, phone numbers or postal addresses of your customers or contacts.

**Disconnecting:** Deleting a connection in CausoAI deletes its stored credentials and tokens. You can also withdraw access at the provider at any time — in your Google Account under Security → Third-party connections, in Meta Business Settings under Integrations, in LinkedIn under Settings → Data privacy → Permitted services, or in Salesforce under Connected Apps OAuth Usage. Data you already imported stays in CausoAI until you delete the dataset.

We retain your data as follows:

—Account data: For the lifetime of your account, plus 30 days after deletion.

—Uploaded and imported datasets: Until you delete them, or until your account is closed.

—Connection credentials and tokens: Until you delete the connection, or until your account is closed.

—Analysis results: Until you delete the analysis, or until your account is closed.

—AI-generated insights: Cached for 7 days, then regenerated on next request.

—Audit logs: Retained for 12 months for security purposes.

—Billing records: Retained for 7 years as required by applicable tax law.

You can delete your uploaded datasets and analysis results at any time from within the platform.

We take security seriously:

—All data is encrypted at rest and in transit (TLS 1.2+).

—Your organization's data is isolated at the row level — no other tenant can access your datasets or results.

—Access tokens expire after 60 minutes; refresh tokens after 30 days.

—All uploaded file paths are validated; only CSV and Excel files up to 50MB are accepted.

—Credentials and access tokens for connected sources are stored encrypted, and connections are read-only.

—We perform regular security reviews and dependency audits.

Depending on your location, you may have the following rights regarding your personal data:

—Access: Request a copy of the personal data we hold about you.

—Rectification: Ask us to correct inaccurate data.

—Erasure: Request deletion of your personal data ("right to be forgotten").

—Portability: Receive your data in a machine-readable format.

—Objection: Object to certain types of processing.

—Restriction: Ask us to restrict processing in certain circumstances.

To exercise any of these rights, email us at hello@causoplatform.com. We will respond within 30 days. We may need to verify your identity before fulfilling a request.

We use a minimal set of cookies:

—Session cookie: Required for authentication. Expires when you close your browser or your session times out.

—Analytics cookie: Used to understand aggregate usage patterns (page views, feature adoption). We do not use advertising cookies or cross-site trackers.

You can disable cookies in your browser settings, though this will prevent you from logging in.

CausoAI is operated from the European Union. If you access our platform from outside the EU, your data may be transferred to and processed in countries where our infrastructure providers operate. We ensure such transfers comply with applicable data protection law through standard contractual clauses or equivalent mechanisms.

Your datasets are stored and analysed on our servers in Germany. The one exception is the plain-English insights step: the analysis results it needs are sent to Anthropic, which processes them in the United States.

CausoAI is a B2B platform intended for use by business professionals. We do not knowingly collect personal data from anyone under the age of 16. If you believe a minor has provided us with personal data, please contact us at hello@causoplatform.com and we will delete it promptly.

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email or by displaying a notice in the platform at least 14 days before the changes take effect. Continued use of the platform after that date constitutes acceptance of the updated policy. The "Last updated" date at the top of this page will always reflect the most recent revision.

If you have any questions, concerns, or requests regarding this Privacy Policy or how we handle your data, please contact us:

CausoAI

Email: hello@causoplatform.com

We are committed to resolving privacy concerns promptly and transparently.