Caegis
DRAFT — not yet reviewed by a lawyer. This template is a starting point and must be reviewed by qualified counsel (India DPDP Act 2023, UK GDPR, EU GDPR, US state privacy laws) before it is relied on. Items in [brackets] need to be completed.

Privacy policy

Last updated: [date]

1. Who we are

Caegis (“we”, “us”) is operated by [legal entity name], [registered address], India. For privacy questions or requests, contact privacy@caegis.club [confirm mailbox]. [Name a Grievance Officer if required under Indian law.]

This policy covers (a) this website, caegis.club, and (b) the Caegis product when we provide it to an agency. For product data, the agency is usually the data controller / data fiduciary and we act as its processor under a separate agreement [confirm with counsel; DPA template needed].

2. Data we collect on this website

  • Demo and pilot requests: name, work email, company, role, country, roster size, platforms, your message, whether you opted in to product updates, the time of the request, and a truncated/hashed form of your IP address and browser user-agent for abuse prevention.
  • Server logs: our web server records standard request logs (IP address, time, page, user-agent) for security and troubleshooting, kept for [30] days.
  • Analytics: if enabled, we use a self-hosted, cookieless analytics tool ([Plausible or Umami]) that counts page views and button clicks in aggregate. It does not set cookies or build cross-site profiles.
  • Cookies: this website does not set cookies. Your selected region (IN, US or UK) is stored only in your browser’s localStorage so the site can show the matching copy. [Update if that changes.]
  • Approximate country: to show the most relevant regional copy we look up the country of your IP address on our own server, using an offline DB-IP Country Lite database. The lookup happens in memory for that request; we do not store the IP for this purpose. You can override the region with the IN / US / UK control or a ?region= link.

3. Data processed in the product

  • Videos, captions and hashtags uploaded by the agency, or imported from accounts the agency connects through official Instagram and YouTube APIs.
  • Derived data: transcripts, on-screen text, key frames, findings, reports and audio/video fingerprints.
  • Rights ledger records and proof files the agency chooses to upload.
  • Connected-account tokens, stored encrypted.

By default, uploaded media is deleted automatically 72 hours after upload and can be deleted earlier. Fingerprints are retained for repost matching for a period the agency controls. Disconnecting a platform account revokes access where the platform supports it and deletes the content imported through that account.

4. Why we use it (purposes and legal bases)

  • To answer your request and arrange a demo or pilot — your consent and/or our legitimate interest in responding to business enquiries.
  • To send product updates — only if you opted in; you can withdraw at any time.
  • To provide the product to an agency — performance of our contract with that agency.
  • To keep the website and product secure — legitimate interest / legal obligation.

[Counsel to confirm bases under DPDP Act 2023 (consent / legitimate uses), UK/EU GDPR Art. 6, and any US state law notices.]

5. Who we share it with

We do not sell personal data. We use these service providers (sub-processors):

  • Hosting: Hostinger (VPS hosting) [server region].
  • AI review: OpenAI and/or Anthropic, which receive transcripts, extracted text and selected frames to produce findings. [Confirm data-retention settings with each provider.]
  • Optional lookups (off by default): AudD (music identification) and Google Cloud Vision (web image search), only when the agency enables them.
  • Email: [email provider used for notifications/replies].

6. International transfers

Some providers process data outside India, the UK or the EU. Where required, we rely on appropriate safeguards [e.g. Standard Contractual Clauses / UK IDTA — counsel to confirm].

7. How long we keep it

  • Demo/pilot requests: up to [24] months after our last contact, unless you ask us to delete them sooner.
  • Product media: 72 hours by default; derived data per the agency’s settings and contract.

8. Your rights

Depending on where you live, you may have the right to access, correct, delete or port your data, to object to or restrict processing, to withdraw consent, and to complain to a regulator (in India, the Data Protection Board of India; in the UK, the ICO; in the EU, your local supervisory authority). Email privacy@caegis.club and we’ll respond within [30] days.

9. Security

Each agency runs on a dedicated instance. Data is encrypted in transit (HTTPS); connected-account tokens are encrypted at rest. No system is perfectly secure; we’ll notify affected parties of a breach as required by law.

10. Children

This website and the product are for businesses and are not directed at children.

11. Changes

We’ll post updates on this page and change the “last updated” date.

12. IP geolocation data

Approximate country detection on this site uses IP geolocation data created by DB-IP, available from db-ip.com, licensed under CC BY 4.0.