Privacy Policy

This Privacy Policy is issued by Duda, Inc., a Delaware corporation doing business as “The Craftsman & The Machine” (“TCTM,” “we,” “us”), headquartered in Louisville, Colorado. It describes how we handle personal information when you visit tctm.ai, use our customer platform, or work with us on managed website services (collectively, the “Services”).

Our Services are built for businesses. Most of the information we handle relates to the people at those businesses — account holders, team members, and points of contact. This policy is incorporated into our Terms of Service.

This policy does not cover the websites we design and host for our customers, which are addressed in Section 7.

Information you provide directly:

• Account information — your name, email address, and a password (stored in hashed form; we cannot read it).
• Organization and project information — your organization’s name, team membership, and the goals, tasks, and project details you enter in the platform.
• Content you upload — files such as logos, brand documents, photos, copy, spreadsheets, and video that you add to your projects.
• Messages — conversations with our AI agents (Section 4) and communications you send us by email.
• Payment information — collected and stored by our payment processor, Stripe. We receive your name, email, and a reference to your payment method; we never see or store your full card number.

Information collected automatically:

• Session records — when you sign in, we record your IP address and browser (user-agent) information as part of your login session, for security.
• Agreement records — when you accept our Terms or a Service Agreement, we log the date, document versions, and the IP address used, so both parties have a record of what was agreed.
• Technical logs — standard server logs generated in operating the Services.

We do not collect precise location data, biometric data, or other sensitive categories of personal information, and we ask that you not upload such data to the platform.

We use personal information to:

• provide the Services — operate your account and organization, store and serve your project content, run AI features, and deliver the managed website services you purchase;
• process billing through Stripe, including the charge-on-delivery flow described in your Service Agreement;
• secure the Services — authenticate sign-ins, investigate suspicious activity, and prevent fraud and abuse;
• communicate with you about your account, projects, deliveries, billing, and changes to the Services or our legal terms;
• improve the Services — understand how features are used and fix problems; and
• comply with legal obligations and enforce our Terms.

We do not sell personal information, and we do not share it for cross-context behavioral advertising. We do not send third-party marketing on behalf of others.

The platform includes AI-powered agents. When you or your team use them, the content of your messages, relevant project context (such as goals and tasks), and files you attach or reference are sent to our AI model provider, Anthropic, to generate responses. File attachments are shared with Anthropic via short-lived, access-controlled links.

Conversation history is stored in our database so agents can maintain context across sessions. You can see this history in your dashboard.

We do not use your content to train AI models, and our agreements with Anthropic are commercial terms under which your content is not used to train theirs. See Anthropic’s privacy policy for how they handle data.

tctm.ai uses only essential cookies — the session cookies required to keep you signed in to the platform. We do not use advertising cookies, cross-site trackers, or third-party analytics on our own site. Because we use no non-essential cookies, there is nothing to opt out of; if that changes, we will update this policy and provide appropriate controls first.

You can block or delete cookies in your browser settings, but the platform will not function without its session cookie.

We share personal information only with service providers that help us run the Services, and only for the purposes described in this policy:

• Stripe — payment processing and card storage (privacy policy);
• Google Cloud — storage of uploaded files in access-controlled, private storage (privacy);
• Anthropic — AI model processing, as described in Section 4;
• Hosting and database infrastructure providers — the cloud providers that run our application and store our database.

We may also disclose information:

• to comply with law, legal process, or enforceable government requests;
• to protect the rights, safety, or property of TCTM, our customers, or others; or
• in connection with a merger, acquisition, or sale of assets — in which case this policy will continue to apply to your information until you are notified otherwise.

Within your organization, content and data in your projects are visible to your organization’s members, managed by your organization’s owners.

As part of managed services, we design, build, and host websites for our customers, and may configure tools like Google Analytics and Google Search Console on them at the customer’s direction. For those websites, our customer — not TCTM — is responsible for the site’s data practices, including its privacy policy, any cookie consent requirements, and the visitor data collected by tools installed on it. We handle visitor data from those sites only as needed to build, host, and maintain them on the customer’s behalf.

If you are a visitor to a website we built for someone else, please consult that website’s own privacy policy.

• Account, organization, and project data — kept while your account is active. After cancellation, you may request an export during the 30-day wind-down period described in our Terms; we then delete or de-identify this data within 90 days, except as noted below.
• Uploaded files — kept while the project exists; deleted on the same schedule as project data.
• AI conversation history — kept while your account is active so agents retain context; deleted with your account data.
• Agreement and billing records — retained longer where we have a legal obligation or legitimate need to keep them (for example, tax records and records of contract acceptance).
• Backups — deleted content may persist in encrypted backups for a limited period before being overwritten in the ordinary course.

We protect personal information with measures appropriate to a modern cloud service: encryption in transit, hashed passwords, private file storage accessible only through short-lived signed links behind authentication, role-based access within organizations, and administrative controls limiting who at TCTM can take sensitive actions. No system is perfectly secure; if we learn of a breach affecting your personal information, we will notify you as required by applicable law.

Depending on where you live, you may have some or all of the following rights over your personal information:

• Access — request a copy of the personal information we hold about you;
• Correction — ask us to fix inaccurate information;
• Deletion — ask us to delete your personal information;
• Portability — receive your data in a portable format;
• Opt-out of sale or targeted advertising — not applicable in practice, because we do not sell personal information or share it for targeted advertising;
• Non-discrimination — we will not penalize you for exercising your rights.

To exercise any of these rights, email legal@tctm.ai. We will verify your request — usually by confirming control of the email on your account — and respond within the timeframe required by applicable law (generally 30 to 45 days). If we deny a request, you may appeal by replying to our response, and you may also contact your state attorney general or data protection authority.

Note for team members: if your information is in our systems because your organization added you, we may refer your request to that organization, since the data belongs to its workspace.

We are a U.S. company and process information in the United States. If you use the Services from outside the U.S., your information will be transferred to and processed in the U.S., where privacy laws may differ from those in your jurisdiction.

If you are in the European Economic Area, the United Kingdom, or Switzerland: we process personal data to perform our contract with you (providing the Services), for our legitimate interests (securing and improving the Services), and to comply with legal obligations. Where required, transfers from those regions are protected by appropriate safeguards such as Standard Contractual Clauses with our service providers. You have the rights described in Section 10, plus the right to lodge a complaint with your local supervisory authority.

The Services are for business use by adults. They are not directed to children, and we do not knowingly collect personal information from anyone under 18. If you believe a child has provided us personal information, contact us and we will delete it.

We may update this policy as the Services or the law change. We will post updates here with a new “Last updated” date, and for material changes we will notify you — for example by email or a notice in the platform — before they take effect where practical.

Privacy questions and rights requests: legal@tctm.ai. General inquiries: hello@tctm.ai.

Duda, Inc. d/b/a The Craftsman & The Machine
Louisville, Colorado, USA