Privacy Policy

Draft effective date: May 11, 2026. This policy is a working product draft and should be reviewed by the operator before public launch.

Cyber Roundtable provides AI-assisted cyber roundtable briefings and custom roundtable workflows. This Privacy Policy explains what we collect, why we collect it, who helps us process it, and what choices you have.

Data we collect

We collect the minimum data needed to operate the service:

• Account data: email address, password authentication status, email verification status, account tier, account status, and security metadata.
• Roundtable data: topics submitted for custom roundtables, generated outputs, source notes, run status, usage limits, and account-linked run history.
• Operational data: IP address, user agent, timestamps, error logs, rate-limit events, audit entries, and security events.
• Application analytics data from the approved Plausible baseline: path-level page events, Today zone reach, persona-page visits, and body-free link/event categories. Analytics events do not include account IDs, email addresses, raw search queries, or generated Roundtable body text.
• Communication data: emails sent for signup confirmation, password reset, account changes, and optional run-completion notices.

Why we use data

We use data to create and secure accounts, run custom roundtables, enforce quotas, prevent abuse, moderate inputs and outputs, improve system reliability, and preserve the agent memory needed for continuity of the service.

Roundtable artifact retention

If you delete your account, account identity and private account data are removed or anonymized. Roundtable artifacts may remain in anonymized form because they contribute to agent memory, safety checks, research continuity, and system integrity.

Public custom runs that you chose to publish may remain visible as Community runs. Private custom runs remain private, but anonymized artifacts may remain in system memory and are not deleted from model or agent-memory records solely because the account was deleted.

Public custom runs and expert profiles

When you make a custom run public, the public title, public brief, source notes, expert participation, and selected public transcript information may be used to update public expert profile cache pages. This helps visitors understand which experts participated in public conversations and what public conclusions they contributed to.

Processors and service providers

Cyber Roundtable uses trusted service providers to operate the service:

• Supabase for database, authentication, account sessions, and storage-related infrastructure.
• SendGrid for transactional email delivery.
• Anthropic and OpenAI for AI model processing used by roundtable agents, moderation, summarization, and related workflows.
• Cloudflare for DNS, security proxying, Turnstile human verification, and limited edge or browser telemetry for security, performance, and infrastructure measurement.
• Plausible for cookieless application analytics after the SLICE-322 provider review recorded IP handling, data-processing terms, and the exact enabled event set.

These providers process data only as needed to deliver the service, secure it, or meet legal obligations.

AI inputs and model training

Cyber Roundtable sends custom roundtable inputs to model providers through API routes that may include Azure-hosted Anthropic/OpenAI-compatible endpoints as well as direct Anthropic and OpenAI APIs (see Processors above). Under those providers' standard API / Azure OpenAI data-processing terms, customer inputs are not used to train or improve their foundation models by default.

OpenAI states that API data has not been used for model training by default since March 1, 2023, unless a customer explicitly opts in. Anthropic's commercial API terms similarly exclude training use by default. Microsoft documents that Azure OpenAI prompts and completions are not used to train Microsoft or OpenAI models. Providers may retain API inputs for a limited period for abuse monitoring.

If a provider's training or retention terms change, or we add a new model path, we update this section and the launch-surface claim together.

Cookies and local storage

Cyber Roundtable uses strictly necessary authentication and security cookies for account sessions and abuse prevention. The cookie notice dismissal is stored in localStorage. The AI disclaimer acknowledgement is stored as a non-tracking cookie for one year. Application analytics uses the approved cookieless Plausible baseline and must not set tracking cookies or browser-storage identifiers. Cloudflare edge analytics, if present, must be handled under the Cloudflare infrastructure review before it is used for program metrics.

See the Cookie Notice for the current inventory.

Legal bases

Depending on your location, our legal bases may include contract necessity, legitimate interests in operating and securing the service, consent where required, and legal obligations.

Your rights

Depending on your location, you may have rights to access, correct, export, object to, restrict, or request deletion of personal data. Some anonymized roundtable artifacts may remain after account deletion for the reasons described above.

To make a privacy request, contact [email protected].

Security

We use authentication controls, email verification, bot protection, role-based access, audit logging, and operational monitoring to protect the service. No online service can guarantee perfect security.

International processing

Data may be processed in countries where our service providers operate. When required, we rely on appropriate transfer safeguards, contractual controls, or provider data-processing terms.

Changes

We may update this policy as Cyber Roundtable changes. Material changes will be reflected on this page and, where appropriate, through account or email notice.

Contact

Privacy contact: [email protected]

Operator postal contact: Cyber Roundtable Legal, Istanbul, Turkiye. Full registered postal details should be confirmed before production launch.