Privacy Policy

Who we are

Cracked Robot, Inc. ("Cracked Robot", "we") is an AI product studio at 100 Grand Lane, Suite 315, Foster City, CA 94404, USA. For anything in this policy, contact [email protected].

What we collect

This website. cracked.bot uses no advertising trackers and no analytics cookies. Our hosting provider keeps standard server logs (IP address, browser user agent, request path) for security and operations, with time-limited retention.

Platform accounts. If you sign in to the Cracked Robot platform we hold your name, email address, and basic profile details from your sign-in provider (e.g. Google), plus the work records you create. Functional session cookies keep you signed in — nothing more.

Customer engagement data. Data our customers provide under contract is processed only for that engagement, in an isolated single-tenant environment, under the contract's terms. We do not use customer data to train shared models.

What we do not do

• We do not sell or share personal information (including as defined by the CCPA).
• We do not use your data for advertising.
• We do not train shared AI models on customer-provided data.

Service providers

We rely on a small set of providers to run our services: managed cloud hosting, AI model APIs (under commercial terms that prohibit training on customer data and delete inputs/outputs within 30 days), and email. Each processes data only to provide its service to us. Engagement-specific subprocessors are disclosed to the affected customer under contract.

Security

Data is encrypted in transit (TLS) and at rest. Access is limited to named personnel under multi-factor authentication, environments are isolated per customer, and our security procedures (incident response, vulnerability management, monitoring) are maintained and reviewed by named owners.

Deletion — just ask

We keep data only as long as needed for the purpose it was provided. And we are glad to delete it sooner: email [email protected] and we will delete your personal data — or a customer's engagement data — within 30 days, with written confirmation on request. Contractual engagements carry their own (often stricter) deletion commitments, which prevail.

Your rights

You may request access to, correction of, a copy of, or deletion of your personal data at any time via the contact above. We respond to all verified requests within 30 days, and we honor applicable rights under laws such as the CCPA/CPRA and GDPR. We do not discriminate against you for exercising them.

Other things

• Our services are for businesses and adults — we do not knowingly collect children's data.
• We operate from the United States; data is processed in the United States.
• If we ever make material changes to this policy, we will post them here with a new effective date.