Privacy Policy

Overview

Intercis ("we," "us," "our," or "Company") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit and use the Intercis platform and website (intercis.io).

Please read this Privacy Policy carefully. If you do not agree with our policies and practices, please do not use our Services. Section 12 describes the legal bases on which we process personal data.

1. Information We Collect

1.1 Information You Provide Directly

We collect information you voluntarily provide when you sign up for our design partner program, create a dashboard account, or contact us:

• Name — Your full name
• Email address — For communication purposes
• Company name — Your organization
• Job title/role — Your position
• Message — Any inquiry or message you submit
• Account information — When you create an account at dashboard.intercis.io, we collect your email address and authentication credentials. We never store passwords; they are hashed and managed by our authentication provider (Supabase Auth). Magic-link sign-in uses your email address only.
• Provider API credentials (pass-through only) — To use the Intercis proxy, your systems include your upstream model provider API key (Anthropic or OpenAI) with each request. The proxy uses that key in memory to authenticate that request's relay and the safety-classification request described in Section 3.1, and does not persist it to our databases. The API keys Intercis itself issues for proxy access are stored only as HMAC-SHA256 hashes — plaintext keys are never stored.

1.2 Automatically Collected Information

Browser & Device Information: When you visit intercis.io, our hosting provider (Vercel) generates standard server logs — including your IP address, browser type, and pages requested — as part of operating the site. We do not use these logs for analytics or tracking, and intercis.io runs no analytics scripts.

Theme Preference: We store your light/dark mode preference in your browser's localStorage to provide a better user experience. This is stored locally on your device and is never sent to our servers.

1.3 What We Do NOT Collect

• No advertising or analytics cookies or scripts on the intercis.io website — we set no cookies of our own there (your theme preference lives in localStorage on your device), and the dashboard sets only the authentication cookies needed for sign-in; our hosting, authentication, and payment providers (Vercel, Supabase, Stripe) may set strictly necessary cookies for functions such as sign-in, security, fraud prevention, and payment
• No third-party analytics tracking (Google Analytics, Mixpanel, Amplitude, etc.) on intercis.io
• No session tracking or user behavior profiling on intercis.io
• No precise geolocation data — IP addresses processed by our infrastructure providers may reveal your approximate location
• No payment card data — subscription payments are processed by Stripe, and card details never touch Intercis servers

2. How We Use Your Information

We use the information you provide for the following purposes:

• Service Provision: To create and operate your dashboard account, and to operate the Intercis proxy for your tenant — including using the provider API credentials your systems supply with each request to relay your agents' traffic and to make the safety-classification requests described in Section 3
• Billing: To process subscription payments through Stripe and manage your subscription
• Design Partner Engagement: To evaluate your interest in our design partner program and contact you about potential collaboration opportunities
• Communication: To respond to your inquiries and provide customer support
• Product Development: To understand market demand and improve our product roadmap
• Legal Compliance: To comply with applicable laws, regulations, and legal processes

We do not use your information for marketing or advertising purposes without your explicit consent, and we do not sell or rent your data. We share it only with the service providers and in the circumstances described in Section 6.

3. Artificial Intelligence & Automated Decision-Making

Intercis is an AI agent governance platform. Being clear about where AI sits in our own service is part of the product, so this section states exactly where AI models are and are not used.

3.1 AI in the Intercis Service

• Your traffic goes to your model provider. The Intercis proxy sits between your agents and the large language model (LLM) provider you configure — Anthropic or OpenAI. Your agents' prompts, tool calls, and responses are relayed to that provider using your own API credentials, under your existing agreement with that provider. Intercis does not substitute its own provider relationship for yours.
• We use an LLM as a second-layer safety classifier. After our deterministic policy rules (allow and deny lists) evaluate an agent action, execution-class tool calls (for example shell commands and code execution) that are not blocked by the deny list may additionally be analyzed by an LLM-based classifier to detect destructive intent. The classification request contains the tool call content and is sent to the same model provider your tenant routes through, using the API credentials configured for your tenant: traffic routed to Anthropic is classified by Anthropic's Claude under your Anthropic credentials, and traffic routed to OpenAI is classified via OpenAI's Responses API under your OpenAI credentials. Tool call content is never sent to a provider other than the one you have configured. If the classification request cannot be made or fails — for any tenant — the action is not blocked by this layer (it fails open); the deterministic policy rules above remain in effect.
• Prompt injection scanning is not AI. Our injection scanner is deterministic pattern matching. If we add an AI-based detection layer, we will update this policy before it processes client traffic.

3.2 No Training on Your Data

We do not use your personal information or your organization's traffic to train AI models. Traffic relayed to your configured model provider — Anthropic or OpenAI — is sent under your own API credentials and is governed by your own agreement with that provider, including its terms on training use of API data.

3.3 Automated Decisions

Policy enforcement decisions (allow or deny) are automated and apply to AI agent actions, not to people. Intercis does not make solely automated decisions that produce legal or similarly significant effects on individuals.

3.4 AI and This Website

No AI system processes the information you submit through intercis.io (such as design partner form submissions), and no AI chatbot operates on this website.

4. Data Storage & Security

4.1 Where We Store Your Data

Design partner form submissions are stored in a Supabase PostgreSQL database. Data is encrypted in transit; our hosting providers state that stored data is encrypted at rest on their managed infrastructure.

Your model provider API credentials are not stored. Your systems present them with each proxy request; they are held in memory only for the lifetime of that request, transmitted to your configured provider over encrypted (HTTPS) connections, and are not persisted to our databases (see Section 1.1).

4.2 Security Measures

• Encrypted data transmission (HTTPS/TLS)
• Encryption at rest, as documented by our hosting providers for their managed services
• Limited access controls — database access policies deny anonymous and client-side reads of design partner submissions; they are readable only with our service credentials
• Account passwords are hashed by our authentication provider (Supabase Auth) and are never visible to Intercis
• File storage: no user uploads exist today; the storage bucket is not listable, write access is limited to service credentials, and objects, if any were present, would be readable only by direct URL

4.3 Limitations

While we implement industry-standard security practices, no system is completely secure. We cannot guarantee absolute security of your information. You use our Services at your own risk.

5. Data Retention

We retain personal information only for as long as it is needed for the purposes described in this policy. We do not yet operate automated deletion schedules; instead, we periodically review stored data and delete what is no longer needed. The criteria we apply to each category:

• Design partner submissions and inquiries: Retained while a business relationship exists or is reasonably anticipated; periodically reviewed and deleted when no longer needed
• Dashboard account data: Retained while your account remains active; you may request deletion of your account and its associated data by contacting us (see Section 10), and we will action verified requests within the timeframes described in Section 8.4
• Proxy audit trails: Generated only where Intercis is deployed for a customer organization. Audit trails are retained for 90 days by default, unless the agreement governing a deployment specifies a different period
• Provider API credentials: Not retained — presented by your systems with each request and held in memory only for the duration of that request. You can rotate or revoke your key with your model provider at any time. Intercis-issued proxy keys are stored only as HMAC-SHA256 hashes and can be revoked from the dashboard
• Error monitoring events: Retained by Sentry for its configured retention period, after which they expire
• Infrastructure logs: Server logs generated by our hosting providers (Vercel, Railway) are retained under those providers' own retention policies

You may request deletion of your information at any time by contacting us (see Section 10).

6. Third-Party Sharing

We do not sell, trade, or share your personal information with third parties except in the following limited circumstances:

6.1 Service Providers

We use a small number of providers to operate the service. We engage each of them to provide the function described below:

• Supabase — database hosting and account authentication (privacy policy)
• Railway — proxy service hosting (privacy policy)
• Vercel — website and dashboard hosting (privacy policy)
• Stripe — payment processing for paid subscriptions (privacy policy)
• Sentry — application error monitoring, configured not to automatically collect user identifiers or IP addresses (sendDefaultPii disabled); error reports may still incidentally contain data present in a failing request (privacy policy)
• Google — email hosting for our contact and security mailbox: mail sent to security@intercis.io (including privacy-rights requests and security reports) is received in a Google-hosted mailbox (privacy policy)

Web fonts on intercis.io are self-hosted and served from our own domain — loading a page does not cause your browser to request fonts from any third party.

6.2 AI Model Providers

As described in Section 3, when your organization uses the Intercis proxy, your agent traffic — and, for execution-class tool calls, our LLM safety-classification requests — is transmitted to the model provider you configure:

• Anthropic — receives relayed agent traffic when you route Claude models through Intercis, and safety-classification requests for execution-class tool calls as described in Section 3.1, in each case under the API credentials configured for your tenant (privacy policy)
• OpenAI — receives relayed agent traffic when you route OpenAI models through Intercis, and safety-classification requests for execution-class tool calls as described in Section 3.1, in each case under the API credentials configured for your tenant (privacy policy)

6.3 Legal Requirements

We may disclose your information if required by law, court order, or other legal process, or to protect the rights, property, or safety of Intercis, our users, or the public.

6.4 Business Transfers

In the event of merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will provide notice before your information becomes subject to a different privacy policy.

7. Client Data vs. Personal Data

This Privacy Policy covers personal information you provide to intercis.io and dashboard.intercis.io (e.g., design partner signups and dashboard accounts).

Important: When Intercis is deployed as a service for your organization, we act as a data processor for any data that flows through the Intercis agent governance proxy. The terms on which we process that traffic, including our obligations as a processor, will be established in the agreement governing each customer deployment before it processes traffic. The Intercis proxy is designed to be a thin security layer: it relays your agents' traffic to the model provider you configure and applies your policy rules to it, and audit trails of policy enforcement are retained as described in Section 5. Where that traffic is relayed to AI model providers, Section 3 describes exactly what is sent, to whom, and under whose credentials.

8. Your Privacy Rights

8.1 Access & Deletion

You have the right to request access to, correction of, or deletion of your personal information. Contact us at security@intercis.io with your request.

8.2 EU & UK Residents

If you are located in the EU or UK, you have additional rights under the General Data Protection Regulation (GDPR) and UK Data Protection Act 2018, including:

• Right to access your personal data
• Right to rectification (correction)
• Right to erasure ("right to be forgotten")
• Right to restrict processing
• Right to data portability
• Right to object

You also have the right to lodge a complaint with your local data protection supervisory authority.

Please contact us at security@intercis.io to exercise these rights.

8.3 California Residents

California residents have the following rights under the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA): the right to know what personal information is collected, used, and disclosed; the right to delete; the right to correct inaccurate personal information; the right to opt out of the sale or sharing of personal information; the right to limit the use of sensitive personal information; and the right not to be discriminated against for exercising these rights. We do not sell or share personal information as those terms are defined in the CCPA, but you may still submit requests to security@intercis.io.

8.4 Response Timeline

We will respond to verified requests within the timeframes required by applicable law: within one month for GDPR/UK requests (extendable by two further months for complex requests, with notice) and within 45 days for California requests. We may need to verify your identity before processing your request. If we decline a request, we will explain why, and you may appeal the decision by replying to our response or writing to the same address; we will respond to appeals within the same timeframes.

9. Children's Privacy

Our Services are not directed to children under the age of 13 (or the higher age required by applicable law, such as 16 in parts of the EU), and we do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us at security@intercis.io and we will delete it.

10. Contact Us

If you have questions about this Privacy Policy or our privacy practices, please contact us:

We will respond to privacy inquiries promptly.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by updating the "Last Updated" date at the top of this page and, if the changes are significant, by email or prominent notice on our website.

Where a change would materially affect how we process personal information we have already collected, we will provide notice before the change takes effect.

12. International Users & Legal Bases

Our Services are operated from the United States. Our database and authentication infrastructure (Supabase) and the Intercis proxy (Railway) are hosted in United States regions, so information you provide to us is processed and stored in the United States, which may have different data protection laws than your country of residence. Other service providers listed in Section 6 may process data in the United States and in other locations where they operate; each provider's own privacy policy describes the safeguards it applies to international transfers.

Where we transfer personal data of EU, EEA, or UK residents to the United States, our safeguards are as follows. Each of our infrastructure providers offers data-processing terms that incorporate the EU Standard Contractual Clauses (and the UK Addendum), and we are putting these agreements in place with each provider; once executed for a provider, the Standard Contractual Clauses are the transfer mechanism for data processed by that provider, and we will update this section to reflect it. For the limited processing we perform today — a small number of design partner inquiries and dashboard accounts, handled occasionally rather than as systematic large-scale transfers — we additionally rely on the derogations in Article 49 GDPR (and their UK equivalents): performance of our contract with you (dashboard accounts and subscription billing) and steps taken at your request prior to entering into a contract (design partner and other inquiries).

If you are a resident of the EU, EEA, or UK, we process your personal data on the following legal bases: performance of a contract for dashboard accounts and subscription billing; and legitimate interests for responding to design partner submissions and other inquiries, and for operating and securing our websites and services (including error monitoring and infrastructure logging). We do not treat your continued use of the Services as consent.

Questions? Reach out to our security team at security@intercis.io. We take your privacy seriously.