Draft — not yet in force. This policy will be reviewed by a lawyer before CAELUM Cloud opens. Items in [brackets] are still to be confirmed.
Last updated: [launch date]
This policy explains how Issouf KANAZOE ("CAELUM", "we") handles personal data in CAELUM Cloud. [A company will take over this role once it is registered.]
The open-source CAELUM SDK alone sends nothing to us. Data reaches CAELUM Cloud only if you
configure a CAELUM key (caelum_key= or CAELUM_API_KEY).
1. What we collect
| Data | Why | Where it comes from |
|---|---|---|
| Account: email, name, sign-in identifiers | Create and secure your account | You, via our sign-in provider (Clerk) |
| Billing: name, phone number, payment reference, amount, date | Take payments, send receipts | You, via our payment provider (GeniusPay). We never see your card or mobile money details. |
| Usage metrics: model name, token counts, estimated cost and savings, cache hit or miss, latency, the customer label you choose | Your dashboard, plan limits, budget alerts | The CAELUM SDK in your application |
| Shared cache: the AI answers your application stores in it, under a hashed key | Reuse answers across your servers | The CAELUM SDK, only when cache=True |
| Emails sent (type, date) | Avoid duplicate emails | Our systems |
| Technical logs (IP address, errors) | Security, debugging | Our hosting provider |
What we never collect: your AI provider API keys, and the prompts in usage metrics. Prompts can appear in cached answers only if your provider's answer contains them.
2. Your role and ours
- For your account and billing data, we decide how it is used (we are the "controller").
- For the content your application sends (cached answers, customer labels), we act on your behalf only to provide the service (we are a "processor"). You decide what your application sends; do not put names, emails or other personal data of your users in customer labels.
3. Where data is stored, and who helps us
| Provider | Role | Location |
|---|---|---|
| Cloudflare | Hosting of the API, database and shared cache | Global network [confirm region] |
| Vercel | Hosting of the dashboard | [confirm region] |
| Clerk | Sign-in and accounts | United States [confirm] |
| GeniusPay (and its card networks) | Payments | West Africa [confirm] |
| Resend | Sending emails | United States [confirm] |
These providers only process data to provide their service to us. Some are outside your country; [we rely on the safeguards required by applicable law — to be confirmed with the lawyer].
4. How long we keep data
| Data | Kept |
|---|---|
| Shared cache entries | Until they expire: 24 hours by default, 30 days at most |
| Usage metrics | [13 months], then deleted or aggregated |
| Account data | While the account exists, then deleted within [30 days] |
| Billing records | As long as accounting and tax law requires [e.g. 10 years] |
5. Security
- CAELUM keys are stored only as a hash: our database never contains usable keys.
- Each account's cache and statistics are isolated from every other account.
- Data is encrypted in transit (HTTPS). Access to production systems is restricted.
- If a security incident affects your data, we will inform you [within 72 hours] of becoming aware of it, as required by law.
6. Your rights
You can ask to access, correct, export or delete your personal data, or object to a processing, by writing to [contact@caelum-ai.com]. You can delete API keys and stop sending data at any time from your dashboard and code. You can also complain to your data protection authority [e.g. the Data Protection Commission in Ghana, the CIL in Burkina Faso, or your EU authority].
7. Cookies
The dashboard uses only cookies needed for sign-in and security. The public website does not use advertising cookies. [Confirm once analytics are chosen.]
8. Changes
We will announce important changes by email at least [30] days in advance.
Contact: [contact@caelum-ai.com]