Privacy Policy

Firmament gives your company’s AI agents shared context and holds their work to your standards. This page explains what we collect, why, and the choices you have, in plain language. Questions: [email protected].

Who this covers

This policy applies to the Firmament website (getfirmament.com) and the Firmament product (platform.getfirmament.com, with its desktop app and command-line tools), together "the Service." Firmament AI, Rhijnspoorplein 10-38, 1018 TX Amsterdam, the Netherlands, is responsible for your data.

What we collect

Account information. When you sign up, our authentication provider handles your login and gives us your name, email, and organization.
Your context pages. The pages you and your agents write. They live in a folder on your machine and sync to our servers, so your devices, and the people and agents you share them with, can use them. This is your content, and you own it.
Work sent to a review gate. When an agent submits work for review, we receive that work, check it against the standards you set, and keep the verdict, the feedback and the history of runs.
Usage. Which features you use, how much model work each workspace uses, and how many reviews each workspace, person and API key runs, to run the Service, keep it within limits and charge for reviews.
Payments. When a workspace admin adds credit, Stripe processes the payment and keeps the card and billing details, including any billing address and VAT ID. We never see or store full card numbers. We keep the amount, the invoice and, if you save a card for automatic top-up, its brand and last four digits.

We try not to collect secrets. Our tools detect common ones, such as private keys and access tokens, and keep them out of your pages. No detector catches everything, so please do not paste secrets into pages.

How we use it

To run the Service: storing, syncing and serving your context to your agents, and reviewing their work.
To process your text through the language models that do that work (see below).
To keep the Service secure and to improve it.

We do not sell your data.

AI models and your data

We use language models from OpenAI, TypeSafe and Voyage AI to organise your context and review your agents’ work. Each of them works with us under an enterprise agreement. Your data is never used to train, fine-tune or improve any model, theirs or ours, and it stays private to your workspace.

Subprocessors

We rely on a small set of vendors to run the Service:

WorkOS handles sign-in and identity.
Railway hosts the product and stores your data.
OpenAI provides the language models that organise your context and review work.
TypeSafe provides the language model used for reviews.
Voyage AI turns text into the vectors we use to find relevant context.
Stripe handles payments, invoices and tax.
Cloudflare serves the website and counts visits anonymously.

We keep this list current and will give notice of material changes.

Keeping and deleting your data

We keep your data while your account is active.
You can request a full copy of everything you have stored, at any time.
When you delete something or close your account, we remove it within 30 days, except where the law requires us to keep it longer, such as invoices and payment records, which Dutch tax law requires us to keep for seven years.
Access follows your login: inside your workspace, an agent sees exactly what the person it works for is allowed to see.

Cookies and analytics

The website sets no cookies and stores nothing on your device. We count visits with Cloudflare Web Analytics, which records the page, the site that sent you, your country and your device type, without identifying you or following you across sites. The product itself uses only the cookies needed to keep you signed in.

Your rights

You can ask to see, correct, export or delete your personal data, and you can object to how we use it. Email [email protected] and we will answer within a month. If you are unhappy with our answer, you can complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens, or to the authority where you live.

Security

Knowledge is kept separate for each workspace, access is enforced on every request, and secrets are screened out when pages are written.

Children

The Service is for businesses and is not directed to children under 16.

Changes

We may update this policy. When we do, we will revise the date above and, for material changes, give notice.

Contact

Questions about privacy: [email protected].