Privacy policy

In short. We collect what we need to run your workspace and bill for it. Project content goes to our AI provider only when you use an AI feature, and we never use it to train models. We do not sell personal information, and we use no advertising or analytics cookies. You can ask for a copy of your data, or for its deletion, at any time.

1. Introduction

This Privacy Policy explains how Ngenaire Inc. ("Ngenaire", "we", "us") collects, uses, shares and protects personal information when you use the Ngenaire website and application at ngenaire.com (the "Service"). Ngenaire is the controller of the personal information processed through the Service. This Policy supplements our Terms of Service.

2. Information we collect

• Account information. Your name, email address and username, and optional profile details you choose to add, such as your title, department, phone number, time zone and theme preference.
• Authentication data. A password hash (argon2id) if you set a password; if you sign in with Google, the account identifier and email Google provides (we never receive your Google password); the public keys and names of any passkeys you register; and hashes of your recovery codes and access tokens. We never store passwords, recovery codes or tokens in readable form.
• Content you create. Projects, requirements, documents, diagrams, models, files, risks, schedules, test artifacts, comments, co-engineer conversations, project memory and anything else you submit to or generate with the Service.
• Security and usage data. Sign-in events, sessions, approvals, membership changes and other governance actions, recorded with the time, IP address and browser user agent, plus the operational logs needed to run and secure the Service.
• Billing information. Your plan, subscription status, credit balance and transaction history, a customer identifier from our payment provider, and the billing address used to calculate tax. Card details are collected and processed directly by Stripe; we never see or store your full card number.
• Website analytics. When you visit our public pages (home, pricing, security, legal and help pages, and the sign-in and sign-up pages), we count the visit with Plausible Analytics: the page address and any campaign tags, the referring site, and your browser, operating system, device type and country, derived from your IP address and user agent. We also count which sign-up and contact buttons are used and whether a sign-up succeeded, never what you typed. Plausible sets no cookies, does not store your IP address and cannot follow you across sites or from one day to the next. Nothing inside your workspace is counted.

3. How we use information

We use personal information to:

• provide, operate, maintain and improve the Service;
• power AI features by processing the content you ask them to work with (see section 4);
• process payments, manage subscriptions and credits, and calculate taxes;
• authenticate you, secure the Service, keep audit trails, and prevent fraud and abuse;
• respond to your requests and provide support;
• send transactional messages, such as email verification, password resets, invitations, and account and billing notices; and
• comply with legal obligations and enforce our Terms.

We do not sell personal information and we do not use it for advertising.

4. AI processing

When you use an AI feature, such as the co-engineer, a critique, quality analysis, drafting or the AI report builder, the content needed for that request is sent to our AI provider, Anthropic, to generate a response. Only the data the request needs is sent, and nothing is sent when you are not using an AI feature. Requests made from an MCP client with your access token are handled the same way.

We do not use Your Content to train models. Our AI provider processes data on our behalf under its commercial terms and data-handling commitments. Each AI action is recorded in your credit transaction history with the project and feature it relates to.

5. Subprocessors and sharing

We share personal information with service providers ("subprocessors") that process it on our behalf to operate the Service:

We may also disclose information if required by law, to enforce our Terms, to protect the rights, safety and security of Ngenaire and its users, or in connection with a merger, acquisition or sale of assets, subject to this Policy.

6. Cookies and local storage

When you sign in, we set one essential session cookie. It is HttpOnly, so page scripts cannot read it, and it holds an opaque random token; we store only a hash of that token. It expires after 7 days of inactivity or 30 days at most, and is deleted when you sign out.

We keep a few preferences in your browser's local storage, such as your theme and the width of the co-engineer panel. These never leave your device.

We do not use advertising or analytics cookies. Visits to our public pages are counted with Plausible Analytics, which stores nothing on your device (see section 2). When you pay, Stripe's payment form may set cookies of its own to prevent fraud, and if you choose Google sign-in, Google may set cookies on its own domain; their policies govern those cookies.

7. Data retention

We keep personal information for as long as your account is active or as needed to provide the Service. Expired sessions and used or expired sign-in links are removed automatically. When you close your account or ask us to delete your data, we delete or de-identify your personal information within a reasonable period, except where we must keep it to meet legal, tax or accounting obligations, resolve disputes or enforce our agreements. For example, billing and credit-transaction records and security audit records are kept as long as those obligations require.

8. Security

We protect personal information with technical and organizational measures, including argon2id password hashing, optional passkey sign-in with recovery codes, HttpOnly server-side sessions, CSRF protection, a strict Content Security Policy, encryption of traffic in transit, role-based access control, tenant isolation, signed approvals and audit logging. Our security page describes each control. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. You are responsible for keeping your credentials, recovery codes and access tokens confidential.

9. Your rights

Depending on where you live, you may have rights to access, correct, update, delete or export your personal information, to object to or restrict certain processing, and to withdraw consent. Residents of the European Economic Area and the United Kingdom have rights under the GDPR and UK GDPR; California residents have rights under the CCPA and CPRA, including the right not to be discriminated against for exercising them.

Many changes you can make yourself: edit your profile, end sessions, remove passkeys and revoke tokens in your account settings, and export requirements and reports from your projects. For anything else, including a complete copy or deletion of your data, contact privacy@ngenaire.com. We will respond as applicable law requires and may need to verify your identity first. You may also complain to your local data-protection authority.

10. International transfers

Ngenaire Inc. is incorporated in and operates from Canada, and our subprocessors are located in Canada, the United States and the European Union. Your personal information may therefore be processed in countries other than your own, which may have different data-protection laws. Where required, we rely on appropriate safeguards, such as standard contractual clauses, for these transfers.

11. Children's privacy

The Service is intended for business and professional use and is not directed to children. We do not knowingly collect personal information from anyone under 18. If you believe a minor has given us personal information, contact us and we will delete it.

12. Changes to this policy

We may update this Privacy Policy from time to time. If we make material changes, we will give reasonable notice, such as by posting the updated Policy with a new "Last updated" date or by notifying you in the Service. Continuing to use the Service after changes take effect means you accept the updated Policy.

13. Contact

Questions or requests about your privacy? Contact us:

• Email: privacy@ngenaire.com
• Ngenaire Inc., 50 Shemer Dr, Thornhill, ON L4J 9C1, Canada