Privacy Policy

1. Summary

• We collect a limited set of account information: your name, your email address and information about your use of the Service.
• We do not sell personal information, and we do not use advertising, cross-site tracking or marketing analytics.
• All information is stored in the United States (AWS us-east-2).
• Information that a customer records within its Workspace belongs to that customer. We process it on the customer's behalf and in accordance with its instructions.
• The Service must not be used to store protected health information. See Section 4.

2. Scope and Our Roles

2.1 This Privacy Policy applies to the CEIBA platform, its associated websites and the electronic communications it sends (together, the "Service"), operated by CEIBA Inc. ("CEIBA", "we", "us" or "our"). Capitalized terms not defined here have the meanings given in our Terms of Service.

2.2 Controller of account information. When you create an account, sign in or contact us, CEIBA determines the purposes and means of processing that information and acts as its controller. This Privacy Policy governs that processing.

2.3 Processor of Workspace Content. When a customer records information about its clients, contacts, vendors, interpreters or projects within its Workspace, that customer determines what is recorded and why, and acts as the controller. CEIBA processes that information solely to provide the Service to the customer. Individuals who wish to access, correct or delete information held within a customer's Workspace should contact that customer directly; CEIBA will assist the customer in responding. If you do not know which customer holds your information, please contact privacy@ceibanetwork.com and we will endeavor to direct you to the appropriate organization.

3. Information We Collect

3.1 Account information

• Your name and email address.
• Your chosen sign-in method. If you sign in with Google, we receive your name, email address and profile picture from Google. We never receive your Google password.
• Your role and permissions within each Workspace, and the Workspaces to which you belong.
• The date and time of your most recent sign-in.

Passwords are handled by our authentication provider, Supabase, and are stored only as a cryptographic hash. CEIBA does not have access to your password.

3.2 Workspace Content

Information that a customer chooses to record in its Workspace, which may include clients and their contacts, vendors and interpreters and their rates, projects, quotes, invoices, appointments, uploaded files and messages sent through the Service on the customer's behalf. CEIBA does not determine the content of a Workspace and uses Workspace Content only to operate the Service for the relevant customer.

3.3 Technical information

• IP address and browser user agent, recorded in server logs.
• Information about the pages and features used and any errors encountered by the application.

3.4 Beta access requests

The beta access form on our website collects your work email address and, optionally, your company name. This information is delivered to CEIBA by email and, where enabled, to an internal Google Chat channel so that the request can be reviewed promptly. It is not added to any advertising list and is not shared with third parties. The form includes a hidden field that is not visible to human visitors, which allows automated submissions to be identified without profiling individuals.

4. Prohibited Information

5. How We Use Account Information

We use account information to:

• (a) provide access to the Workspaces to which you belong and apply your permissions;
• (b) send communications that are necessary for the Service, including invitations and password resets, and notifications and daily digests that you have enabled;
• (c) maintain the security of the Service, investigate misuse and diagnose faults;
• (d) respond to your inquiries and support requests; and
• (e) understand how the Service is used in order to improve it. During the beta program, this may include reviewing a support request together with the Workspace to which it relates.

We do not use personal information to build advertising profiles, and we do not sell or rent personal information to any third party.

6. Legal Bases for Processing (EEA and United Kingdom)

Where the General Data Protection Regulation or the United Kingdom General Data Protection Regulation applies, we rely on the following legal bases to process account information: performance of a contract, for processing necessary to provide the Service; legitimate interests, for security, fault diagnosis and product improvement; consent, where we request it, such as for optional notification emails; and compliance with legal obligations, where applicable law requires us to retain or disclose information. Where we act as a processor of Workspace Content, the relevant customer is the controller and its own privacy notice applies.

7. Service Providers and Disclosures

7.1 We engage a limited number of service providers (subprocessors) to operate the Service. Each processes only the information necessary for its function, under written contractual obligations, and may not use that information for its own purposes. Our current subprocessors are:

• Supabase: Database, authentication and file storage. Location: United States.
• Vercel: Application and website hosting, and page speed measurement (Speed Insights). Location: United States.
• Resend: Outbound email delivery. Location: United States.
• Google: Google sign in, and Google Chat notifications where a workspace enables them. Location: United States.

7.2 Google processes information only where you choose to sign in with Google, or where a Workspace administrator connects Google Chat to receive notifications.

7.3 We disclose personal information to other parties only where required by law. In the event of a merger, acquisition or sale of assets involving CEIBA Inc., we will provide notice before personal information is transferred, and this Privacy Policy will continue to apply unless and until it is replaced by a policy providing no less protection.

8. International Transfers

All information is stored in the United States (AWS us-east-2). If you access the Service from outside the United States, your information will be transferred to and processed in the United States. We do not operate infrastructure in other regions during the beta program and will update this Privacy Policy if that changes.

9. Data Retention

• Account information: retained for as long as your account exists, and deleted within 30 days after the account is closed.
• Workspace Content: retained until the Workspace is deleted. Deletion of a Workspace removes its entire database schema, so its content is deleted rather than hidden. Residual copies in routine encrypted backups expire within 30 days.
• Beta access requests: retained until the end of the beta program, or earlier upon request.
• Server logs: retained for a limited operational period measured in weeks.

10. Security

We implement technical and organizational measures designed to protect personal information, including:

• encryption of data in transit and at rest;
• separation of each Workspace into its own database schema, so that separation is enforced structurally and a query issued for one Workspace cannot read another Workspace's data;
• access controls under which an account may access a Workspace only after an invitation to that Workspace has been issued and accepted; and
• restriction of CEIBA personnel access to customer content to support and fault diagnosis purposes, with such access recorded.

No system can be guaranteed to be completely secure, and the Service is pre-release software. If we become aware of a security breach affecting your personal information, we will notify you and any affected customer without undue delay, describe the nature of the breach and explain the measures we are taking in response.

11. Cookies and Similar Technologies

11.1 We use only the cookies and browser storage necessary to operate the Service:

• Session cookies, which keep you signed in. They are set on your Workspace address and on app.ceibanetwork.com, which allows a single sign-in to reach every Workspace to which you belong, and are cleared when you sign out.
• Short-lived cookies used during sign-in and signup to return you to the correct page, which expire within minutes.
• Browser local storage, used for display preferences such as light or dark mode and collapsed sections. This information remains in your browser and is not accessible to CEIBA.

11.2 We do not use advertising cookies, cross-site trackers or marketing analytics on our website or within the Service. Our typefaces are served from our own domains, so loading a page does not disclose your visit to a font provider.

11.3 The Service measures its own performance using Vercel Speed Insights, provided by our hosting provider, Vercel. For a sample of page loads, it records page load and response times together with the page address and general device and browser type. It does not set cookies, does not track you across other websites and does not record anything you type or view on the page. We use it solely to identify and resolve performance issues.

11.4 Because we use only cookies that are strictly necessary to provide the Service, we do not display a cookie consent banner.

12. Your Rights and Choices

12.1 Subject to applicable law, you may request access to, correction of, deletion of or a portable copy of your account information, and you may object to processing that is based on our legitimate interests. To exercise these rights, contact privacy@ceibanetwork.com. We will respond within thirty (30) days.

12.2 You may disable optional notification emails and the daily digest in the Service's notification settings, or by using the unsubscribe link included in those emails, which does not require you to sign in. Communications that are necessary for the Service, such as password resets and invitations, cannot be disabled while your account remains active.

12.3 Requests concerning information held within a customer's Workspace will be referred to that customer, as the controller of that information.

12.4 If you are located in the European Economic Area or the United Kingdom, you have the right to lodge a complaint with your local data protection supervisory authority.

13. Children

The Service is intended for business use and is not directed to individuals under the age of eighteen (18). We do not knowingly collect personal information from children. If you believe that a child's personal information has been provided to us, please contact privacy@ceibanetwork.com and we will delete it.

14. Changes to this Privacy Policy

This Privacy Policy is versioned. The current version is beta-2026-09-19, effective September 19, 2026. We will notify account holders by email of any change that materially affects them before the change takes effect. As the Service is in beta, this Privacy Policy may be updated from time to time.

15. Contact Information

CEIBA Inc.
10260 SW Greenburg Rd, Ste 476, Portland, OR 97223, United States
Privacy and data requests: privacy@ceibanetwork.com
All other inquiries: legal@ceibanetwork.com