Effective date: October 21, 2026
Crimson Ray Inc. (“Crimson Ray,” “we,” “us,” or “our”) is an enterprise software company building AI-powered tooling for security teams. This Privacy Policy describes how we handle information in connection with the website at crimsonray.ai (the “Site”) and the Crimson Ray Desktop application (the “App”), described at crimsonray.ai/app.html.
The Site is an informational website. We collect only the following:
The Site does not include account registration.
We do not sell personal information. We share information only with:
The App runs on the user’s own computer. Information the App retrieves from the systems a user connects, along with the user’s conversations with the App’s assistant, is stored on that computer. To answer a request, the App sends the relevant information to the AI model provider that the user or their organization has configured (for example, Anthropic, OpenAI, Amazon Bedrock, or Google Vertex AI), under that provider’s terms. Credentials for connected systems are stored in the operating system’s secure credential store, or in a secret manager the user’s organization has configured.
This section applies when a user connects their Google account to the App. It describes how the App accesses, uses, stores, and shares Google user data.
Data accessed. With the user’s permission, granted on Google’s consent screen, the App can access the user’s basic profile (name and email address), Gmail messages, attachments, labels, and drafts; Google Drive files, including Google Docs and Sheets; Google Calendar calendars and events; and Google Contacts. The user can decline any of these permissions.
How the data is used. The App uses Google user data only to carry out tasks the user asks for in the App, such as searching their mail for a reported phishing message, summarizing a document, or scheduling a meeting. Actions that change the user’s Google data, such as sending an email, changing labels, editing a file, or creating an event, are shown to the user and run only after the user approves them. The App does not access Google user data in the background for any other purpose.
How the data is stored. The App calls Google’s APIs directly from the user’s computer. The authorization token Google issues is stored in the operating system’s secure credential store (the macOS Keychain or Windows Credential Manager) or in a secret manager the user’s organization has configured. Google data the App retrieves is kept on the user’s computer as part of the conversation in which it was requested. Crimson Ray does not receive, store, or have access to the token or to the user’s Google data.
How the data is shared. Google user data is shared only with the AI model provider that the user or their organization has configured, and only the portion needed to answer the user’s request. We do not sell Google user data, and we do not use or transfer it for advertising, for credit-worthiness or lending decisions, or to data brokers or information resellers. We do not use Google user data, and do not transfer it to others, to develop, improve, or train generalized AI or machine-learning models. No person at Crimson Ray reads a user’s Google data unless the user asks us to (for example, for support) and gives explicit consent, or where required for security purposes or by law.
Retention and deletion. A user can disconnect their Google account at any time in the App under System → Connectors, which deletes the stored token. Deleting a conversation in the App deletes the Google data it contains; anything the user asked the assistant to remember stays in the App’s memory, on the user’s computer, until the user deletes it. A user can also revoke the App’s access at myaccount.google.com/connections. Uninstalling the App and deleting its data folder removes all remaining data from the computer.
Limited Use. Crimson Ray’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
We retain correspondence for as long as needed to address your inquiry and for our legitimate business records. Server logs are retained for a limited period consistent with our hosting provider’s standard practices.
We use commercially reasonable technical and organizational measures to protect information, including serving the Site exclusively over HTTPS. No method of transmission or storage is completely secure.
The Site is not directed to children under 13, and we do not knowingly collect personal information from children.
Depending on where you live, you may have rights regarding your personal information, such as the right to request access to or deletion of information we hold about you. To make a request, contact us using the details below.
We may update this Privacy Policy from time to time. The effective date above reflects the latest revision. Material changes will be posted on this page.