Legal

Privacy policy

Effective October 31, 2026

This policy explains what personal data Felspar collects, why, who we share it with, how long we keep it and the choices you have. It covers the website at felspar.ai, the Felspar web app at app.felspar.ai, the REST API at api.felspar.ai and the MCP server at mcp.felspar.ai (together, “Felspar”). We have written it in plain English; if anything is unclear, email hello@felspar.ai.

1. Who we are

Felspar is a service that turns a company’s approved policy documents into versioned Decision Packs that the company’s software agents follow. felspar is a product of Orchid Automation (“we”, operator of felspar). 121 E Jackson Ave, Suite 1000, Knoxville, TN 37932.

When a company uses Felspar, that company controls the workspace and decides which people, documents and agents it includes. We process workspace data to provide the service to that company. If you use Felspar through your employer’s workspace, your employer’s own policies also apply.

2. What we collect

Account and sign-in

Sign-in is handled by WorkOS. When you sign in, we receive your name, email address and the account identifiers WorkOS returns. We store your identity, the workspaces you belong to, your role (owner, approver or member) and the grants you hold. A signed-in browser session uses a cookie that lasts up to 30 days; it is needed to keep you signed in and is not used for advertising or tracking.

Workspace content

We store what you and your colleagues create in Felspar: exact versions of the policy documents you add as sources, drafts and proposals, approvals (with who approved and when), released Decision Packs, agent registrations and usage counters. Agent key values are shown once and are not stored by Felspar; WorkOS manages the credentials. Felspar retains registration and revocation records.

Documents you connect

You can connect Google Docs, and Notion pages (in beta), using your own account through WorkOS Pipes. Felspar reads only the documents you choose: for Google, the Docs you pick in Google’s file picker. See Google user data for details.

Decisions made for your agents

When your agents ask Felspar for a decision, they send evidence: short text excerpts they choose to send, with details about each excerpt’s source (such as its type, identifier, location and when it was observed) and the case they concern. We store that evidence with the resulting classifications, results and receipts, and attempt records that hold question keys and source locations but no text. Felspar stores only what agents send, not everything they see.

Forms

The inquiry form on felspar.ai asks for your name and work email, and optionally your company, a description of a decision you maintain, how it is managed today and your LinkedIn profile URL. The request-access form in the web app asks for your name, work email, optional company and what you want to use Felspar for. Both forms are sent to us as an email; neither form stores your submission in a Felspar database.

Website analytics

The felspar.ai website uses Vercel Web Analytics, which does not use cookies. It records page views and one event when someone clicks an email link, so we can see in aggregate how the site is used.

Service logs and error reports

Our service logs record technical event labels, timings and counts, not request URLs, headers, keys or content. Error reports sent to our monitoring provider are rebuilt from an allow-list: they keep the route pattern, status, error type and similar technical details, and never request bodies, headers, cookies, document text, excerpts, tokens, keys or email addresses.

3. How we use it

To provide Felspar: sign you in, check your access on every request, read the documents you connect, build and release Decision Packs, make decisions for your agents and issue receipts that can be checked later.
To show reviewers the exact source text and evidence behind a proposal or decision, and to replay and verify decisions and run backtests.
To notice when a connected document changes, so a person can decide whether a new release is needed.
To enforce limits, keep the service secure, investigate abuse and fix errors.
To answer inquiries and access requests, and to understand in aggregate how the website is used.

We do not sell personal data, and we do not use it for advertising.

4. Google user data

This section describes how Felspar accesses, uses, stores and shares data it receives from Google APIs.

What we access

Felspar requests Google’s narrow “files you pick” permission (https://www.googleapis.com/auth/drive.file). With it, Felspar can see only the Google Docs you choose in Google’s file picker. It cannot see or list the rest of your Google Drive.
For each Doc you pick, Felspar reads its content (exported as text) and its version information, so it can capture an exact, fingerprinted version of the document as a source.
While a Doc is watched, Felspar checks for changes on a once-per-minute schedule, subject to processing limits. It keeps only a version marker, revision and state; the text read during a check is not stored.
When you approve a change in the Felspar web app, Felspar can write that approved change back into the same Google Doc you picked. It never writes to any other file, and only on a person’s explicit action.

How we use it

We use Google user data only to provide the features you see in Felspar: capturing versions of the Docs you pick, quoting them in Decision Packs, showing them to reviewers in your workspace, detecting changes and writing approved changes back. Access is checked on every request against your own connection: workspace roles never grant access to a document, and Felspar never falls back to someone else’s connection.

How we store and protect it

We store the document text you capture as a source in your workspace, for the periods in How long we keep it. We never store or log Google access or refresh tokens: Felspar asks WorkOS for a fresh, short-lived token for each read or write.

How we share it

We do not sell Google user data, use it for advertising, or transfer it to advertising platforms, data brokers or information resellers. We do not use it to determine creditworthiness or for lending. We transfer it only to the service providers listed in Who we share it with that help us run the features above with your consent, when needed for security or to comply with law, or as part of a merger, acquisition or sale of assets with your explicit prior consent. Our staff do not read your Google user data unless you affirmatively agree to our viewing specific data (for example, for support), it is needed for security, or the law requires it.

AI and machine learning

We do not use Google user data to develop, improve or train generalized artificial intelligence or machine-learning models. Released Decision Packs may quote your Docs, and those quotes can be included in classification requests described in How models are used, only to make decisions for your own workspace.

Limited Use

Felspar’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

You can stop Felspar’s access at any time by disconnecting Google in the Felspar web app or by removing Felspar from your Google Account’s third-party connections.

5. How models are used

Felspar uses bounded model evaluation to classify evidence against policy definitions and to check submitted output text against a Pack’s output requirements. Draft checks and backtests can also evaluate supplied excerpts. Requests include the text being evaluated and the relevant definitions, which can quote your policy documents. The model we use is Jev, developed by TypeSafe, which we run through Cloudflare Workers AI under Felspar’s own account. Customer request contents are not stored in Cloudflare’s AI Gateway logs.

Answers are cached for 30 days, keyed by a fingerprint of the request rather than by its text. The decision itself, including numbers, dates, rules, outcomes and receipt verification, uses no model. Felspar does not run your agents or generate their downstream content. Explicitly requested document write-back is described above.

We share personal data only with service providers that help us run Felspar, under their terms with us, and only as needed for the purposes below:

Cloudflare: hosts the web app, API and MCP server; private object storage; database connections; and runs model classification (Workers AI).
TypeSafe: provides the Jev classification model reached through Cloudflare Workers AI.
Google: Google Drive and Docs APIs and file picker, including explicitly requested write-back to a selected Doc.
Neon: managed PostgreSQL database.
WorkOS: sign-in, workspace membership and invitations, agent credentials, and the Google and Notion connections you authorize.
Vercel: hosts the felspar.ai website, its inquiry form handler and Web Analytics.
Resend: delivers inquiry and access-request form submissions to us by email.
Sentry: error monitoring, receiving only the scrubbed technical details described above.

Google and Notion are services you choose to connect; Felspar reads from them on your behalf, and can write approved changes back to a selected Google Doc as described above. If you use ChatGPT or Claude, those clients process your conversation and tool results under your agreement with OpenAI or Anthropic. We may also disclose data if the law requires it, to protect the rights and safety of our users or the service, or as part of a merger, acquisition or sale of assets, subject to this policy.

We process data in the United States and in other countries where our subprocessors, including Cloudflare, Vercel, Sentry and model providers, operate. Where required for international transfers, we use appropriate safeguards, including the European Commission’s Standard Contractual Clauses and the UK addendum where applicable under our providers’ data-processing agreements. Contact hello@felspar.ai for information about applicable safeguards.

7. How long we keep it

Retention depends on the record’s purpose, not simply the date you cancel. Disconnecting a source or ending access does not automatically delete every stored copy. Contact us at hello@felspar.ai about deletion requests.

Data	Retention
Uploaded or connected source files, proposals and approvals	Unreleased records normally expire 30 days after they are added; re-adding the same content refreshes that draft period. Records supporting a serving release are retained with that release. Shared sources and records referenced by retained results may stay longer.
Released Decision Packs and their source chain	Kept while serving, including releases pinned to agents or environments. When no longer serving, a 90-day grace period applies. Daily cleanup deletes eligible expired records and their authority files, retaining files still referenced elsewhere. There is no blanket age-based expiry for authority files.
Evidence, job results and receipts	Case access expires 720 hours (30 days) after the case’s first accepted request. Later decisions do not restart the clock. Case deletion ends access earlier; daily cleanup removes expired records. Case files in object storage expire 32 days after upload.
Generated output submitted for checking	Your agents generate the output. Felspar processes the text for the check but does not retain that text in its output-check record. The retained check, digest and receipt expire with the decision they check, and case deletion ends their access.
Saved backtest and preview reports	30 days after the report is run; access to expired or deleted case details is withheld.
Attempt records and classification cache	30 days. Attempts contain question keys and source locations; the cache stores model answers under a fingerprint rather than the request text.
Account information, access records, agent registrations and aggregate usage counters	There is no automated account-closure purge. We manually delete account and workspace data within 30 days of a written deletion request or account closure, except information we must retain by law. Shorter case expiry periods still apply.
Backups	The recorded production database recovery window is six hours. Object storage has no version history or backup. Temporary database recovery branches are manually removed within 24 hours under our recovery procedure. Other recovery copies are kept for up to 30 days, then deleted or rolled off; these deadlines are operational commitments, not automated application expiry.
Service logs, error reports and website analytics	Cloudflare Workers logs are retained for up to seven days, and Vercel runtime logs for up to 30 days, depending on the provider plan. Our retention commitment for Sentry error reports and full-fidelity traces is up to 90 days. Provider reporting can keep sampled trace data for up to 13 months depending on plan. Website analytics reporting windows range up to 24 months depending on plan; reporting availability is distinct from a physical deletion deadline and from runtime logs. Application code does not enforce these provider-managed retention periods.
Inquiry and support emails	We keep correspondence as long as needed to resolve the request, then for up to two years. This is a manual retention commitment; Felspar does not implement automatic mailbox deletion.
Signed-in browser session	Up to 30 days.
Google and Notion connection tokens	Managed by WorkOS; fetched for an operation and not persisted or logged by Felspar.

Expiry and physical removal are different: cleanup runs daily in bounded batches and retries failed storage deletions. Unfinished file uploads are aborted after seven days. Recovery can leave unreferenced authority files that have no age-based expiry. We commit to removing orphaned authority files within 30 days; this currently requires manual cleanup rather than an automated orphan-removal job.

8. Security

All traffic uses HTTPS.
Each customer has its own workspace. Every query is scoped to the caller’s verified workspace, and the database enforces row-level security on every workspace table.
Every request is checked against the person’s live membership and grants; removing a person or revoking an agent takes effect on their next request.
Approving and releasing are always a person’s explicit action in the web app. Assistants and agents cannot approve or release.

No system is perfectly secure. Felspar holds no security or compliance certification today. Please report security concerns to hello@felspar.ai.

9. Your choices and rights

You can disconnect a Google or Notion account in the Felspar web app at any time, and remove Felspar’s access from your Google or Notion account settings.
Depending on where you live, you may have the right to access, correct, delete or export your personal data, or to object to or restrict how we use it.
To make a request, including a request to delete your data, email hello@felspar.ai. If your data is in a company’s workspace, we may refer your request to that company, which controls the workspace.

Felspar is a business service and is not directed to children.

10. Changes to this policy

We will post any change on this page and update the effective date. If a change affects how we use Google user data or other data you have already given us, we will tell you before it takes effect and ask for your consent where required.

11. Contact

Questions about this policy or your data: hello@felspar.ai.
Orchid Automation. 121 E Jackson Ave, Suite 1000, Knoxville, TN 37932