Privacy Policy

Who this covers

This policy applies to the Firmament website (getfirmament.com) and the Firmament product (app.getfirmament.com), together "the Service."

What we collect

• Account information. When you sign up, our authentication provider handles your login and gives us your name, email, and organization.
• The knowledge you store. The rules, knowledge pages, and submissions you and your agents create. This is your content, and you own it.
• Usage data. Basic product and site analytics (pages viewed, features used) to run and improve the Service.

We deliberately try not to collect secrets: submissions are screened as they are written, and credentials, tokens, and personal data are refused before they are stored.

How we use it

• To run the Service: storing, curating, retrieving, and serving your knowledge to your agents.
• To process your text through the language models that power curation and retrieval (see subprocessors below).
• To keep the Service secure and to improve it.

We do not sell your data, and Firmament does not use your private knowledge to train models. Your text is processed by the subprocessors listed below to provide the Service; their handling is governed by their own terms, and enterprise customers can request provider data-processing terms.

Subprocessors

We rely on a small set of vendors to run the Service:

• WorkOS handles authentication and identity.
• Railway provides hosting and infrastructure.
• DeepSeek processes your query and submission text for knowledge curation and retrieval.
• Voyage AI generates text embeddings.
• PostHog (EU-hosted) provides product analytics on how the site and product are used. We also run a first-party usage beacon.

We keep this list current and will give notice of material changes.

Your data, your control

• Export everything you have stored, at any time, with full version history.
• Delete your content or close your account; we remove your data within a reasonable period after you ask.
• Access is scoped to your login: inside your workspace, an agent sees exactly what its human is allowed to see.

Detailed log-retention windows are being finalized ahead of general availability and will be reflected here.

Cookies

The marketing site uses minimal cookies for analytics. The product uses cookies that are necessary to keep you signed in.

Security

Knowledge is tenant-scoped, access is enforced at the query layer, every action is recorded in an append-only audit trail, and secrets are screened out at write time. More detail lives in our security documentation.

Children

The Service is for businesses and is not directed to children under 16.

Changes

We may update this policy. When we do, we will revise the date above and, for material changes, give notice.

Contact

Questions about privacy: [email protected].