CAFA AIG²

Privacy notice

CAFA AIG² · effective 2026-09-29 · revision r2

This notice says what data CAFA AIG² handles, where it goes, and what stays on your device. It is written to match what the system actually does.

1. What we collect

  • Account: your email address and a display name derived from it, when you are invited and sign in.
  • Workspace content you choose to save: model versions (Item Model, Ontology Model, exclusions, notes) saved with "Save to cloud", with their fingerprints and who saved them.
  • Certificates: for each certified set, the delivery record (seed, item count, hashes) and the certificate, linked to your account.
  • Usage events: counts with timestamps — model versions saved, sets exported, certificates issued, AI drafts requested. These meter your plan; they contain no content.

What we do not collect: models and items you work on without signing in, or without pressing "Save to cloud", stay in your browser and your files. Source material given to Draft is sent to the AI model provider for that request and is not stored by CAFA Lab.

2. In your browser

The app keeps your working families, theme and language choice in your browser's local storage so they survive a reload. Your sign-in session is also held there. Nothing in local storage is sent to us except when you choose an action that does so (Save to cloud, Certify on server, Draft). We set no advertising or analytics cookies.

3. Where it goes — processors

  • Supabase — database, authentication and server functions; project region Seoul (ap-northeast-2). Holds everything in section 1.
  • Cloudflare — delivers the web pages. Sees ordinary web request data (IP address, user agent) as any web host does.
  • Resend — sends sign-in and invitation emails from cafalab.com.
  • Anthropic — the AI model used by Draft; receives the source material and conversation for each request.
  • Airtable — an audit mirror of certificate metadata (delivery id, verdict, hashes, timestamps, requester email, workspace). No item content.

4. How it is protected

Every table is under row-level security: a signed-in user can read only the organizations they belong to. Certificates and audit records can be written only by the server, never from a browser. Saved versions and certificates are immutable. Access to the database by CAFA Lab staff is limited to operating the service.

5. Retention

Account data is kept while your account exists. Saved versions, deliveries and certificates are kept as the record of what was issued; if you ask us to delete your account, we remove your email and display name and keep those records without them, unless you also ask for the content itself to be removed and no third party relies on it. Usage events are kept for plan accounting.

6. Your rights

You can export your content from the app at any time. You may ask us for a copy of the data we hold about you, for corrections, or for deletion as described above. We will answer within 30 days.

7. Contact

CAFA Lab, Inc. — support@cafalab.com. You may also write to the organizer who invited you, who will forward the request.