SmartCXP AI Forge Privacy Policy

Dfinitiv, Inc., a Delaware corporation, is the controller of the personal information described in this policy. Send privacy questions and requests to privacy@dfinitiv.io.

• Intake and partner forms: your business email address, your company name if you provide it, the description you write, and any utm_* parameters in the link you arrived on.
• Acceptance of the Terms: the time of acceptance, the agreement version, your email address and a SHA-256 hash of your IP address.
• Sandbox content: brand materials, descriptions and mock data you add to your Sandbox. This should be business information and mock data only (see section 8).

• Usage records: per-day counts of tool calls by tool, platform and assistant, which identify no person. For each call, an event record with the tool name, the call type (read, write or source read), the platform, the duration, whether it failed, and the call's arguments and result with passwords, tokens and similar secrets removed. Long arguments and results are kept in full, up to about 16,000 and 32,000 characters. When you are signed in, the record also holds your email address, and your account records the time of your latest activity.
• AI assistant connections: when you use the Sandbox or a demo link through an AI assistant, the assistant may send us, with a tool call, the name and effort level of the AI model it is running and the platform it runs on; the question you asked, the goal behind it and a short summary of the conversation, as the assistant words them; and the kind of request it is, such as flights, hotels or dining. When the assistant does not say what kind of request it is, we work it out from the goal. We record these with the call, together with the conversation identifier the assistant sends, if any, the assistant's name, version, user agent and OAuth client details, whether its request was cryptographically signed and by whom, and a keyed hash of the assistant's name and network address that groups one connection's calls for a day. We also note whether a call looks like a person, a script or a bot. We use them to show how assistants use each Sandbox.
• Who sees assistant records: dfinitiv staff see all of them. A prospect sees their own calls in full, and the calls made through their Sandbox's demo link, with their arguments, results and goals but not the question asked. dfinitiv partners who help build a Sandbox see its calls and the goal, but not the question.
• Widget interaction events: widgets shown in an assistant or on our site send us events about how they are used, such as that a widget was displayed, an offer was viewed or a checkout was started, with the item involved, the widget's build, the platform and a random identifier made each time a widget opens. That identifier is never stored against a person. Do Not Track and Global Privacy Control turn these events off.
• Gallery demos: when an AI assistant uses a public demo link, we record whether that assistant has used the link before, keyed by a hash, made with a secret key, of the assistant's name and the network address it calls from. That is your own address when the assistant runs on your device, and the assistant provider's when it runs on theirs. We use it to count connections that work. When you open a demo on our gallery page, we keep a keyed hash of your network address and the times of your first and latest opens, so we can measure how long a connection takes after it; the first widget shown in your browser in that time is matched to it from your browser. Do Not Track and Global Privacy Control turn off the gallery record and the widget events.
• Watermark and source-read records: records that tie each read of widget source to the watermark on your build, as described in the Terms.
• Security records: rate-limit markers keyed to a hashed IP address or email address, and a hidden spam-trap field on our forms.
• Sign-in and connections: a sign-in cookie set when you use a magic link, and OAuth client registrations created when you connect an AI assistant such as Claude or ChatGPT.
• Landing page: anonymous showcase requests, rate-limited by hashed IP address, and daily page-view counts with no identifier.
• Analytics, only if you accept analytics cookies: Google Analytics records which pages you visit by page type (such as /studio, never your project's address), how you arrived (the referring site and any utm_* values), and general browser, device and approximate location details, linked to a random identifier in a cookie. If you arrive from dfinitiv.io, which uses the same Google Analytics tag, Google Analytics links the two visits. Google's advertising features and Google signals are turned off, and we never send your email address, sign-in link or anything you type to Google.

We store a hash of your IP address instead of the address itself. A hash reveals less than the address, but it can still relate to you, so we treat it as personal information. The same goes for the keyed hashes above.

We use personal information to:

• provide and operate the Sandbox, including sending magic links and preview emails;
• respond to your request and follow up about a possible commercial relationship, including routing your intake to dfinitiv staff;
• secure the Sandbox and prevent spam, abuse and misuse;
• record and prove acceptance of the Terms, attribute leaked copies of Sandbox code, and enforce our rights;
• understand and improve the site and our products; and
• comply with legal obligations.

Legal bases (EEA, UK and Switzerland). We rely on performance of the Terms to provide the Sandbox; on our legitimate interests in operating, securing and improving the Sandbox, communicating with business contacts, and protecting our intellectual property; on your consent for analytics cookies; and on legal obligations where they apply. Where we rely on legitimate interests, you may object (section 11).

We do not sell personal information, share it for cross-context behavioral advertising, or use it for automated decisions that produce legal or similarly significant effects. We do not use personal information or Sandbox content to train AI models.

• Always set: forge_sso, a sign-in cookie (HttpOnly, SameSite=Lax, 30 days), set when you click a magic link. The Sandbox cannot work without it.
• Only with your consent: Google Analytics cookies _ga and _ga_<id>, which last up to two years. They are set only if you click Accept in the cookie banner. If you decline or make no choice, they are never set.
• Browser signals: we treat a Global Privacy Control or Do Not Track signal as declining analytics, even if you accepted earlier.
• Your choice is stored in your browser's local storage. Change it any time with Cookie settings in the site footer. Declining after accepting stops Google Analytics and deletes its cookies.

We use no advertising cookies, no tracking pixels and no session replay.

• Service providers that process information on our behalf under contract: Amazon Web Services (hosting and storage, US East region), Amazon SES (email delivery), Slack (internal notification so dfinitiv staff can respond to your request) and Google (Google Analytics, only with your consent).
• Your AI assistant provider. When you connect Claude, ChatGPT or another assistant to the Sandbox, your prompts and the content of tool calls pass through that provider and are handled under its own terms and privacy policy. dfinitiv does not control that processing.
• dfinitiv partners that help build or support your Sandbox, limited to what they need for that work.
• Legal and safety. To comply with law or legal process, respond to lawful requests from public authorities, enforce the Terms, or protect the rights, property or safety of dfinitiv, our users or others.
• Business transfers. In connection with a merger, acquisition, financing, reorganization or sale of assets, subject to standard confidentiality protections.
• With your direction or consent.

We do not share personal information with data brokers or advertising networks.

We store and process information in the United States. If you are in the EEA, the UK or Switzerland, we transfer your information using appropriate safeguards, such as the European Commission's Standard Contractual Clauses (with the UK Addendum where relevant) or the recipient's certification under the EU-U.S. Data Privacy Framework and its UK and Swiss extensions. Contact us for a copy of the safeguards that apply.

The Sandbox runs on mock data by design. Do not enter real customer or member data or any sensitive information, such as health, financial account, government ID, precise location, biometric or children's data. Anything you type into a widget or prompt may appear in the call arguments and results in our event records, and in the question, goal and conversation summary an assistant sends us.

If you enter personal information about other people anyway, you are responsible for having a lawful basis to do so and for giving any required notice. dfinitiv does not act as your processor or service provider for Sandbox content, no data processing agreement applies, and we may delete that information without notice.

• Per-call event records, including call arguments and results and the question, goal and conversation summary an assistant sends: 14 days.
• Per-day usage counters: 90 days. Per-day counters for demo links, which hold counts only: 400 days.
• Widget interaction events: 30 days. Per-day widget counters: 90 days.
• Assistant connection records: 30 days.
• Gallery demo connection records: 14 days after the assistant's last use of the link. Gallery demo open records: 24 hours after your latest open.
• Rate-limit markers: up to 24 hours.
• Source-read and watermark records: the life of your Sandbox plus 3 years, because they are the licence-enforcement record described in the Terms.
• Records of your acceptance of the Terms: the life of our relationship plus 7 years, as proof of agreement.
• Brand materials and Sandbox content: deleted within 90 days after your Sandbox ends, except copies in backups and logs that expire in the ordinary course.
• Intake submissions and related business correspondence: up to 3 years after our last contact with you, or sooner on request.
• Google Analytics data: 14 months, under our Google Analytics retention setting.

We may keep information longer where the law requires it or where we need it to establish, exercise or defend legal claims.

We use administrative, technical and physical safeguards designed to protect personal information, including encryption in transit, access controls and hashing of IP addresses. No method of transmission or storage is completely secure, and we cannot guarantee the security of information. We will notify you of a security incident affecting your personal information where the law requires it.

Depending on where you live, including the EEA, the UK, Switzerland, California and other U.S. states with privacy laws, you may have the right to:

• access the personal information we hold about you and receive a copy in a portable format;
• correct inaccurate information;
• delete your information;
• object to or restrict processing based on our legitimate interests;
• withdraw consent at any time, without affecting processing before the withdrawal;
• appeal our decision on your request; and
• lodge a complaint with your data protection authority.

To make a request, email privacy@dfinitiv.io. We verify requests, usually by confirming control of the email address we hold. An authorized agent may act for you with proof of authority. We respond within the time the law requires and will not discriminate against you for exercising your rights.

Some information is exempt from deletion. We keep records needed to comply with legal obligations, maintain security, prevent fraud and misuse, or establish, exercise or defend legal claims, including records of your acceptance of the Terms and source-read and watermark records. When we keep information after a request, we will tell you what we kept and why.

We send only emails about your Sandbox. We do not add you to a marketing list unless you opt in.

The Sandbox is for business use and is not directed to anyone under 18. We do not knowingly collect personal information from children. If we learn that we have, we will delete it.

We may update this policy. We will post the new version with a new date. If we make a material change, we will notify you by email or by a prompt before your next Sandbox session.

Dfinitiv, Inc. Email privacy@dfinitiv.io.

You can also reach us at dfinitiv.io/contact-sales.