Privacy Policy

The data controller is Horsfall Ventures Ltd, a company registered in England and Wales (company number 17311818), trading as “Cerno”.

Contact: hello@cerno.solutions · Tennyson House, Cambridge Business Park, Cowley Road, Cambridge, CB4 0WZ, United Kingdom.

• Account data — your email address, used for authentication (handled via Supabase auth).
• The content you submit — the questions and context you put to the board, plus any text you upload or paste in.
• Session outputs — the AI-generated debate, consensus, and risk/confidence results, where you save a session.
• Billing data — your subscription status and the payment metadata we receive from Stripe. We do not store full card numbers.
• Basic usage data — limited technical and usage information needed to run the service securely and reliably (for example request logs and feature limits), and the domain of the site that linked you to us, if any (for example google.com), but never the full address you came from.
• The Cerno browser extension, if you install it — only when you click it or choose “Ask Cerno” on selected text, it reads the page you are on: its title, address, description, a visible price if there is one, up to 4,000 characters of its text and any text you selected. That is sent to cerno.solutions as the context for your decision and handled like anything else you submit. The extension reads nothing until you click it and does not collect your browsing history.

• To provide the service (run your decisions, save your history, manage your account) — lawful basis: performance of a contract with you.
• To take payment and manage subscriptions — lawful basis: performance of a contract.
• Joint decisions — if you open one, we email the addresses you give us an invitation. Each member's context, priorities and worries are shown to the other members inside the brief once the board has met. A note marked “for the board only” is sent to our AI processors to inform the decision but is never shown to other members. If you delete your account, your own input is removed, but a brief the group has already received stays with the other members — lawful basis: performance of a contract.
• To remind you on a decision's review date — one email per decision asking what happened, sent on the date shown on the decision (you can change or clear it there) — lawful basis: performance of a contract.
• To keep the service secure, prevent abuse, and meet legal obligations — lawful basis: legitimate interests and legal obligation.
• To improve and support the service — lawful basis: legitimate interests, balanced against your rights.

We use trusted third-party processors who handle data on our instructions:

• Supabase — hosting, database, and authentication (stores your account, saved questions/context and session outputs).
• OpenAI — AI processing. The questions and context you submit are sent to OpenAI to generate the board’s debate and consensus.
• Anthropic — AI processing. The same questions and context are also sent to Anthropic, which powers some of the board’s advisors.
• Stripe — payment processing for paid subscriptions.
• Vercel — application hosting and delivery, and privacy-friendly, cookieless website analytics (aggregate traffic only; no cookies, no cross-site tracking, no advertising).
• Google — website analytics (Google Analytics), used only if you accept analytics cookies in the cookie banner.

Please note: the content you submit (your questions, context, and any uploaded text) is sent to OpenAI to produce the board's output. Do not submit information you are not comfortable sharing with an AI processor, and avoid submitting other people’s personal data unless you have the right to do so.

Some processors may transfer data outside the UK/EEA. Where they do, the transfer is protected by appropriate safeguards (such as the UK International Data Transfer Agreement / addendum or equivalent).

We keep your account and saved sessions for as long as your account is active, and for a reasonable period afterwards to meet legal, accounting, and security needs. You can delete saved sessions, or ask us to delete your account and associated data (see your rights below). Billing records are kept for as long as the law requires.

Under UK GDPR you have the right to:

• Access a copy of the personal data we hold about you;
• Have inaccurate data corrected;
• Have your data erased (the “right to be forgotten”), where applicable;
• Receive your data in a portable format, or have it ported, where applicable;
• Restrict or object to certain processing;
• Withdraw consent where we rely on it (without affecting prior processing).

To exercise any of these, email hello@cerno.solutions. We aim to respond within one month. You also have the right to complain to the UK’s Information Commissioner’s Office (ICO) at ico.org.uk, though we hope you will contact us first.

Essential cookies. We use cookies needed to sign you in and keep your session secure (authentication cookies). These are required for the site to work and are set without consent, as the law permits. We do not use advertising cookies.

Analytics cookies. With your permission we use Google Analytics to understand how the site is used (such as which pages are visited and where visits come from). It sets its own cookies, so it is off until you accept in the cookie banner — nothing is set beforehand, and declining leaves the site fully working. You can change your mind at any time by clearing this site’s data in your browser, which removes the stored choice and lets the banner ask again.

We also use Vercel Web Analytics, which is cookieless: it measures aggregate traffic without setting cookies, without tracking you across other sites, and without building an advertising profile.

Questions about your data or this policy? Email hello@cerno.solutions, or see our Terms of Service.