Privacy Policy

Who this covers

This policy applies to the Firmament website (getfirmament.com) and the Firmament product (platform.getfirmament.com, with its desktop app and command-line tools), together "the Service." It also covers the Firmament plugin and connector, which let AI apps such as Claude, ChatGPT, Codex and Grok use your workspace. Firmament AI, Rhijnspoorplein 10-38, 1018 TX Amsterdam, the Netherlands, is responsible for your data.

What we collect

• Account information. When you sign up, our authentication provider handles your login and gives us your name, email, and organization.
• Your context pages. The pages you and your agents write. They live in a folder on your machine and sync to our servers, so your devices, and the people and agents you share them with, can use them. This is your content, and you own it.
• Work sent to a review gate. When an agent submits work for review, we receive that work, check it against the standards you set, and keep the verdict, the feedback and the history of runs.
• Usage. Which features you use, how much model work each workspace uses, and how many reviews each workspace, person and API key runs, to run the Service, keep it within limits and charge for reviews.
• Payments. When a workspace admin adds credit, Stripe processes the payment and keeps the card and billing details, including any billing address and VAT ID. We never see or store full card numbers. We keep the amount, the invoice and, if you save a card for automatic top-up, its brand and last four digits.

We try not to collect secrets. Our tools detect common ones, such as private keys and access tokens, and keep them out of your pages. No detector catches everything, so please do not paste secrets into pages.

Connecting AI apps

When you connect Firmament to an AI app, such as Claude, ChatGPT, Codex or Grok:

• You sign in with your Firmament account. The app can reach only the workspaces and projects you can see, and only through the Firmament tools.
• We receive what the app’s agent sends to those tools: the sentences it searches with, the pages it reads, the text it adds or changes, and work it asks a review gate to check.
• We keep its page changes and review runs like any others. We keep its search sentences, with the pages they found, to measure and improve search.
• We log each tool call’s name, time and outcome to keep the Service running. These logs do not contain your page text.
• The app’s provider receives what the agent reads from your notebook, as part of your conversation, and handles it under its own terms and privacy policy, not ours.
• You can disconnect the app at any time in its settings. A workspace admin can revoke API keys in Firmament under API keys.

How we use it

• To run the Service: storing, syncing and serving your context to your agents, and reviewing their work.
• To process your text through the language models that do that work (see below).
• To keep the Service secure and to improve it.

We do not sell your data.

AI models and your data

We use language models from OpenAI, TypeSafe and Voyage AI to organise your context and review your agents’ work. Each of them works with us under an enterprise agreement. Your data is never used to train, fine-tune or improve any model, theirs or ours, and it stays private to your workspace.

Subprocessors

We rely on a small set of vendors to run the Service:

• WorkOS handles sign-in and identity.
• Railway hosts the product and stores your data.
• OpenAI provides the language models that organise your context and review work.
• TypeSafe provides the language model used for reviews.
• Voyage AI turns text into the vectors we use to find relevant context.
• Stripe handles payments, invoices and tax.
• Cloudflare serves the website and counts visits anonymously.

We keep this list current and will give notice of material changes.

Keeping and deleting your data

• We keep your data while your account is active.
• You can request a full copy of everything you have stored, at any time.
• Earlier versions of pages, including deleted pages, review runs, and the sentences agents search with are kept for your workspace’s history period: 6 months unless a workspace admin changes it, from 1 to 120 months. Until then, earlier versions can be restored. After that, we remove them.
• When you close your account, we remove your data within 30 days, except where the law requires us to keep it longer, such as invoices and payment records, which Dutch tax law requires us to keep for seven years.
• Access follows your login: inside your workspace, an agent sees exactly what the person it works for is allowed to see.

Cookies and analytics

The website sets no cookies and stores nothing on your device. We count visits with Cloudflare Web Analytics, which records the page, the site that sent you, your country and your device type, without identifying you or following you across sites. The product itself uses only the cookies needed to keep you signed in.

Your rights

You can ask to see, correct, export or delete your personal data, and you can object to how we use it. Email [email protected] and we will answer within a month. If you are unhappy with our answer, you can complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens, or to the authority where you live.

Security

Knowledge is kept separate for each workspace, access is enforced on every request, and secrets are screened out when pages are written.

Children

The Service is for businesses and is not directed to children under 16.

Changes

We may update this policy. When we do, we will revise the date above and, for material changes, give notice.

Contact

Questions about privacy: [email protected].