Privacy Policy

When you create an account, we collect:

• Name and email address
• Profile information (optional, such as profile picture)
• Organization name and role
• Authentication credentials (managed securely via OAuth providers)

Exordia Cloud authenticates users through supported identity providers, including Google OAuth and Microsoft Entra ID. We access identity-provider profile information (such as name, email address, and profile image) solely for account creation and authentication purposes.

When you use the Service, you may submit:

• Workshop notes and session content
• Discovery templates and questions
• Requirements and user stories
• Project and client information
• Stakeholder details and contact information

Note: This content may contain personal data of third parties (e.g., your clients' stakeholders). You are responsible for ensuring you have appropriate consent or legal basis to share such information.

When business customers submit Customer Data through the Service, Exordia generally processes that Customer Data as a processor or service provider on behalf of the customer organization (the controller or business). If you are a data subject included in a customer's data, privacy requests relating to that data may need to be directed to the relevant customer organization first.

We automatically collect:

• Log data (IP addresses, browser type, device information, pages visited)
• Usage patterns and feature interactions
• Performance metrics and error reports
• Session duration and navigation paths

When you use AI features, we process:

• Input content you submit for AI processing
• AI-generated outputs
• Usage metrics (tokens consumed, operations performed)

When you subscribe to a paid plan, payment is processed by our third-party payment processor, Stripe. We collect:

• Stripe customer and subscription identifiers
• Subscription status, plan type, and billing period
• Seat allocation and AI credit usage

We do not store credit card numbers, bank account details, or other sensitive payment credentials. All payment data is handled directly by Stripe in accordance with Stripe's Privacy Policy.

We collect information when you:

• Contact our support team
• Submit feedback through the Service
• Respond to surveys or communications

• Create and manage your account
• Deliver the features and functionality you request
• Process your workshop content through AI features
• Provide customer support and respond to inquiries
• Maintain and improve the Service's performance and security
• Develop new features and services

• Send service-related notifications (e.g., security alerts, updates)
• Respond to your requests, comments, and questions
• Send administrative information about your account

• Analyze usage patterns to improve user experience
• Generate aggregated, anonymized insights
• Conduct research to enhance our products

• Detect, prevent, and address technical issues
• Protect against fraud, abuse, and security threats
• Enforce our Terms of Service and policies
• Comply with legal obligations

Our AI features include:

• Note Mapping: Automatically linking workshop notes to template questions
• Requirements Generation: Creating user stories from workshop content
• Template Enhancement: Suggesting improvements to discovery templates
• Gap Analysis: Identifying missing coverage areas

We use the following AI service providers:

AI processing is currently performed in United States regions. EU data residency for AI processing is not currently available.

Under applicable privacy laws, you have the right to:

• Request information about the logic involved in automated decisions
• Object to automated processing in certain circumstances
• Request human review of automated decisions
• Opt out of AI features entirely

We engage third-party service providers to perform functions on our behalf. These providers have access to personal information only to perform their functions and are obligated to maintain confidentiality.

If you use the Service as part of an Organization, other members of your Organization (particularly administrators) may access certain information about your account and activities.

We may disclose your information if required to do so by law or in response to:

• Valid legal process (e.g., subpoenas, court orders)
• Government requests that meet applicable legal requirements
• Protection of our rights, privacy, safety, or property
• Emergency situations involving potential threats to persons

If Exordia is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any change in ownership or uses of your personal information.

By using the Service, you acknowledge that your information will be stored and processed in the United States. Some authentication-related processing by third-party identity providers may occur globally, subject to those providers' own infrastructure and policies.

For GDPR-related inquiries, you may contact our data protection point of contact:

In addition to the rights listed in Section 10, EEA/UK residents have the right to:

You have the right to lodge a complaint with a supervisory authority in the EU/EEA member state of your habitual residence, place of work, or place of the alleged infringement. A list of EU Data Protection Authorities can be found on the European Data Protection Board website.

Your personal data may be transferred to and processed in the United States. For transfers of personal data from the EEA/UK to the United States, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission and the data processing terms of our infrastructure and AI service providers.

Enterprise customers requiring dedicated data processing terms may review and request execution of our Data Processing Addendum (DPA), which includes Standard Contractual Clauses and UK transfer terms. Contact us at the address above to initiate a DPA.

In accordance with GDPR Article 22, we inform you that the Service uses AI-assisted processing to generate requirements and map workshop notes. These outputs are recommendations only and are not used to make decisions that produce legal effects or similarly significantly affect you. All AI outputs require human review before use. You may opt out of AI features at any time.

We retain personal data only for as long as necessary for the purposes set out in this policy and as required by applicable law. When the lawful basis for processing is consent, we will delete or anonymize the data promptly upon withdrawal of consent, unless another lawful basis applies. See Section 8 for specific retention periods.

California "Shine the Light" Law: California residents may request information regarding disclosure of personal information to third parties for direct marketing purposes.

To exercise any of these rights, please:

• Email us at admin@exordiacloud.com
• Use the account settings within the Service (for data export and deletion). Note: system administrators should contact us directly via email for privacy-related requests.

We will respond to your request within 45 days. We may need to verify your identity before processing your request. If we require additional time, we will notify you of the extension and the reason within the initial 45-day period. For access and data portability requests specifically, you may make up to two requests per 12-month period. Deletion, correction, and opt-out requests are not subject to this limit.

Operational note: At present, withdrawal of AI processing consent immediately disables AI features. Other preference withdrawals are honored where applicable to optional processing activities and communications, but do not disable processing that is strictly necessary for service delivery, security, legal compliance, or core business operations.

You may designate an authorized agent to submit privacy requests on your behalf. To do so, you must provide the agent with written permission signed by you and submit proof of the authorization when making the request. We may still require you to verify your own identity directly with us. Authorized agent requests should be sent to admin@exordiacloud.com with the subject line "Authorized Agent Request."

If we decline to take action on a privacy request, you may appeal that decision by emailing admin@exordiacloud.com with the subject line "Privacy Appeal." We will respond to appeals within 60 days. If we deny your appeal, we will provide information on how to contact the relevant state attorney general if you wish to submit a complaint.

In the preceding 12 months, we have disclosed the following categories of personal information for business purposes (e.g., to service providers and sub-processors):

We have not sold or shared (as defined by CPRA) personal information in the preceding 12 months. We do not sell personal information or share it for cross-context behavioral advertising.

Authorized Exordia personnel may access your data as necessary to provide the Service, investigate support requests, and ensure platform security. Such access is logged, time-limited, and subject to confidentiality obligations.

If we determine that an unauthorized breach of security has resulted in unauthorized access to your personal data, we will notify you without unreasonable delay and within 72 hours of determination where feasible. Notification will describe the nature of the breach, the categories of data affected, and the measures taken or proposed to address the breach. We will also notify relevant supervisory authorities as required by applicable law.

Our essential authentication cookies include:

• __Host-authjs.session-token (production) / authjs.session-token (development) — Maintains your authenticated session (7-day duration, Secure, HttpOnly)
• __Host-authjs.callback-url (production) / authjs.callback-url (development) — Stores the redirect URL during OAuth sign-in (session duration, Secure, HttpOnly)
• __Host-authjs.csrf-token (production) / authjs.csrf-token (development) — Protects against cross-site request forgery (session duration, Secure, HttpOnly)

You can control cookies through your browser settings. Blocking essential cookies will prevent you from logging in. See our Cookie Policy for details.

Since we do not use tracking or advertising cookies, Do Not Track (DNT) browser signals do not change your experience on our platform. We recognize Global Privacy Control (GPC) browser signals as a valid expression of your privacy preferences. Because we do not sell personal information or share it for cross-context behavioral advertising, the activities that GPC is designed to restrict do not occur on our platform. For additional privacy rights requests, see Section 10.