Privacy

Caliban is built and operated by North Star AGI VZW, a non-profit association registered in Belgium under enterprise number 1025.122.625 (BE 1025.122.625), with its registered office at Rodestraat 11, box 401, 2000 Antwerpen, Belgium. For everything described on this page, North Star AGI VZW is the data controller within the meaning of the General Data Protection Regulation.

Questions about privacy, and any request to exercise the rights set out in clause nine, go to filip@ns2agi.com or to the postal address above. We have not appointed a data protection officer, because the association is not of a size or type that requires one; the mailbox above reaches the people who can actually answer.

Reading this site is close to anonymous. There is no advertising network on it, no social tracking pixel, and no third-party script that follows you between sites. Three things do happen, and they are the whole list.

Measurement

If you allow it in the banner, page views are counted by Plausible Analytics. Plausible sets no cookie, assigns you no identifier, and keeps no profile. It derives a daily, rotating, one-way hash from your IP address and browser string purely to tell a repeat view from a new one, and discards the IP address itself. What we see is aggregate: which pages were read, which country the traffic came from, which site referred it, and which buttons were clicked. If you decline, the script is never loaded and none of that is recorded.

Getting in touch

The demo and workshop forms send us the email address you type, along with whatever you write in the message. It arrives as an email in our own mailbox and we reply to it. The mail is delivered by Resend, which processes it in transit on our behalf. We use the address to answer you and to follow up on the conversation you started; we do not add it to a marketing list you did not ask for.

Storage on your device

Two values are saved in your browser's local storage: your answer to the analytics question, and the language you picked with the switcher in the footer. Both stay on your device, are never sent to us, and exist so the site stops asking you the same question. Clause three covers them in full.

Caliban's marketing site sets no tracking cookies at all. What it stores is two functional values and, once you are signed in to the product, the session cookies that keep you signed in. Under the ePrivacy rules a strictly necessary or functional value needs no consent; measurement does, so we ask for it even though Plausible itself stores nothing on your device.

You can change your mind at any time. The Cookie settings link in the footer of every page clears the recorded answer and brings the banner back, which is how you withdraw consent as easily as you gave it. Clearing site data in your browser has the same effect.

Caliban gives a team a private workspace with an agent in it. That means the product holds two quite different kinds of data, and it is worth separating them.

Your account

To create a workspace we need a name, an email address, and the credential you sign in with — a password or a Google, Microsoft, or GitHub identity. Authentication is handled by Clerk, which means Clerk holds the credential and we never see a password. We also record which organisation and workspaces you belong to, and what you are allowed to do in them.

Your work

Everything you put in front of the agent is content you control: the messages in a chat, the files you upload to the workspace drive, the pages and answers the agent produces, the tasks it tracks, and the record of which tools it used to get there. If a document you upload happens to contain personal data about other people, you decide that and you remain responsible for it; we process it on your behalf on the bases set out below.

Connected accounts

If you connect Google, Microsoft, Slack, Notion, GitHub, or Telegram, we store the access token that connection produces and use it only for the actions you or your agent asks for. Caliban records every read as an observation and holds every write for approval, which is deliberate: it means you can see afterwards what the agent looked at. You can disconnect a connection at any time, which revokes the token.

Operational records

We keep server logs, error reports, and usage counters — how many runs a workspace used this month, which model handled them, and what failed. These exist to keep the service up and to bill the right amount, not to study you.

The GDPR requires a named lawful basis for each purpose rather than a general appeal to consent, so here they are individually.

We do not sell personal data, we do not share it with advertisers, and we do not use the content of your workspace to train models. That last point matters enough to state plainly: your messages and documents are sent to a model provider so the agent can answer you, under terms that forbid the provider from training on them, and for no other purpose.

Caliban is a small piece of software standing on other people's infrastructure. Each company below processes some personal data on our instructions, under a data processing agreement, and for nothing beyond the role named here.

Beyond these we disclose personal data only where the law leaves no choice — a valid order from a competent authority — or where you ask us to, for example when you connect your own Google or Slack account and the agent acts inside it on your behalf.

The compute that runs Caliban sits in Amsterdam, and we prefer European providers where a credible one exists. Several of the processors above are nevertheless established in the United States, which means some personal data leaves the European Economic Area. Those transfers rest on the European Commission's Standard Contractual Clauses, supplemented by the technical measures you would expect — encryption in transit and at rest, and access limited to the people who need it — and, where the provider is certified, on the EU-US Data Privacy Framework. We will send you the relevant clauses on request.

The honest general rule is that we keep data for as long as it is doing a job, and then we stop. In practice that resolves to the following.

• Workspace content — messages, documents, drive files, and answers stay while the workspace exists. Delete an item and it goes; delete the workspace and the machine and its volume are destroyed with it.
• Account data — kept while you have an account, and removed within 30 days of the account being closed.
• Invoices and accounting records — kept for seven years, because Belgian bookkeeping law requires it and our preference does not enter into it.
• Server and audit logs — kept for up to 90 days, then rotated out.
• Email you send us — kept as long as the conversation is live, and for up to two years afterwards so we can pick a thread back up.
• Analytics — aggregate counts only, with no record that can be traced back to a person, kept indefinitely because there is nothing in them to delete.

Under the GDPR you can ask us for a copy of the personal data we hold about you, have inaccurate data corrected, have data erased, have our processing restricted, receive your data in a portable form, and object to processing we base on legitimate interest. Where we rely on your consent — analytics, and nothing else — you can withdraw it at any moment without having to justify it, and withdrawing it does not affect what was lawful before.

Write to filip@ns2agi.com and we will answer within one month. If a request is genuinely complex we may take longer, up to the further two months the regulation allows, and we will tell you why before the first month is out. We may ask you to confirm who you are, but only as far as is needed to avoid handing your data to somebody else.

If you are not satisfied with how we handled it, you can complain to the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit), Drukpersstraat 35, 1000 Brussels — gegevensbeschermingsautoriteit.be. You can also complain to the authority where you live or work. We would rather you came to us first, but that is your call and not a condition.

Caliban's agent generates text, calls tools, and drafts actions. It is not used to make automated decisions about you that carry a legal or similarly significant effect, which is the category Article 22 is concerned with; it drafts, and a person decides. Writes into a connected account are held for approval for exactly that reason. The agent can be wrong, and the product is built on the assumption that you will check its work.

Caliban is a tool for work and is not directed at children. We do not knowingly create accounts for anyone under 16. If you believe a child has an account, tell us and we will remove it.

Data is encrypted in transit and at rest, each workspace runs on its own isolated machine with its own volume, access to production is limited to the people who operate it, and secrets are held in managed stores rather than in the codebase. No small team should claim more than that. If a breach occurs that is likely to risk your rights and freedoms, we will notify the supervisory authority within 72 hours and tell you directly and without decoration.

As the product changes, this page will change with it. The date at the top is the version you are reading. If a change materially affects how we handle your data — a new purpose, a new category of recipient — we will tell account holders by email before it takes effect rather than quietly editing the page and hoping.

This notice is governed by Belgian law. The controller is North Star AGI VZW, Rodestraat 11, box 401, 2000 Antwerpen, Belgium.