Caldyr ("we") operates caldyr.ai and the Caldyr control plane. This page explains what we collect, what we don't, and how to ask us to delete it.
What we collect
Account email and company name. Billing details (handled by our payment processor). Our site is built to send anonymous, cookieless usage statistics to Plausible, but that integration is switched off in production today, so no analytics data is being collected. Your personal vault notes are BYOK end-to-end encrypted before they reach our servers: the key that unwraps them is wrapped to you alone and we keep no copy, so we cannot read them. Your secrets, team knowledge, saved agent output and session metadata are encrypted at rest under per-team keys held by our custody service so they can be indexed, searched, and streamed, which means those classes can be decrypted by the service that operates them, and so by us. Parts of a recorded session are not encrypted at the application layer: the commands you type and the session lifecycle records are stored as ordinary database rows. The terminal-screen snapshots the replay scrubber uses are encrypted at rest under the team key. Live terminal sessions streamed to the control plane are processed server-side for real-time watching and replay; they are tenant-isolated, access-controlled, and kept only for your configured retention window. The disks of our hosts are encrypted at rest.
What we share
Nothing with advertisers. Our payment processor (Stripe) receives billing details. Our hosting provider, UK Dedicated Servers Limited of Coventry, United Kingdom, runs the hosts your data sits on. Cloudflare, Inc. is our domain registrar and authoritative DNS and routes inbound mail for @caldyr.ai addresses, so email you send us passes through Cloudflare. Mail we send you leaves a mail server we run ourselves, with no third party in between. Separately, when you run an AI coding session the agent on your own enrolled host talks straight to your model provider under your own API key; that traffic never passes through us and we are not a processor for it. The DPA carries the full list.
Where your data is processed
The managed service runs on our own hosts with one hosting provider, in one place: the United Kingdom. Your database and its backups stay there: there is no second region. In addition, encrypted copies of the database backups (the daily dump and base backup, and the write-ahead log every 6 hours) are pulled to a separate host that we operate outside that hosting provider. They are encrypted before they leave, the key that opens them is not stored on either host, and they are kept there for 14 days. Until this update, this page said a German cloud provider hosted your data. That was wrong, and this section replaces it. We do not offer EU-only or EEA-only hosting for the managed service, and you should not infer one from anything else on this site. If you self-host Caldyr, your data is processed wherever you run it and we are not a processor for it.
How long we keep it
Saved session transcripts and events are kept for your plan's retention window: 90 days on Team and 365 days on Enterprise by default; on Solo the window is the retention period of your licence. Only the ten most recent closed sessions per host are retained. Raw host metrics are kept 24 hours and five-minute rollups 7 days. Server logs are kept 30 days. Database dumps are kept 30 days, base backups 3 days, write-ahead logs 48 hours, and pre-migration dumps at most 30 days, so erased data leaves our backups within 30 days of the erasure and our logs within 30 days. The encrypted off-host copy of the database backups is kept 14 days, inside that window. An account that is terminated without an erasure request stays available to its Owner or Solo holder for export and erasure requests for 30 days, and is then erased automatically under the same rules.
Your rights
GDPR + CCPA both apply. The company Owner, or the holder of a Solo account, can export their data and request its erasure in the product; erasure takes effect after a 30-day grace period that can be cancelled meanwhile. For anything else, to correct your data, or if you cannot use the product, email privacy@caldyr.ai and we will answer within 30 days. A member of a company asks for erasure of their own data through the company Owner, who is the controller.