CinnaLab Privacy Policy

1. Who we are

CinnaLab.io is operated by Cinna Lab SLU, registered in Andorra la Vella, Andorra. We provide AI-powered Partner Relationship Management (PRM) software and a Vendor & Partner Directory for software companies and their partners.

For your account data, website visitors and the Vendor & Partner Directory, we are the data controller. For the partner, lead and deal data a customer stores in its own CinnaLab workspace, the customer is the controller and we process that data on its behalf as a processor.

You can contact our data team at support@cinnalab.io.

2. What data we collect

We collect data you provide directly, data generated by your use of the service, and limited public business information for the directory:

• Account data: name, work email, company name, job title, phone number, password (stored only as a hash) and multi-factor authentication settings.
• Usage data: pages visited, features used, clicks, session duration, browser and device type, IP address and security logs.
• Partner program data: partner details, leads, deal records, training completions, commission and payout information that customers and their partners enter or sync.
• Communications: emails, support messages, and demo request information.
• AI connector data: when you connect an AI assistant (see section 4), the connection record, the permissions you granted, and a log of which tools were called and when.
• Directory data: company-level profile information and, for some listings, the names and job titles of company leaders, taken from public sources (see section 5).
• Introduction requests: the message you write and the company you send it to.
• Payment data: subscription payments are handled by PayPal and partner payouts by Wise. We do not store card numbers.

3. How we use your data

We use collected data to:

• Provide, operate, secure and improve the CinnaLab.io platform and directory.
• Answer requests you make through an AI assistant you have connected, within the permissions you granted.
• Pass introduction requests to the company you chose.
• Send transactional emails (account confirmation, onboarding, deal notifications, billing).
• Provide customer support and respond to enquiries.
• Send product updates and marketing communications (with your consent).
• Comply with legal obligations.

4. AI assistants and connectors (Claude, ChatGPT and others)

You can connect CinnaLab to an AI assistant such as Claude or ChatGPT through our MCP connector. Connecting is always your choice and needs a CinnaLab account. You sign in to CinnaLab and approve the specific permissions on our consent screen. A free account can be created on that screen.

Depending on the permissions you approve and your plan, the assistant can search the Vendor & Partner Directory and send introduction requests, read your workspace’s partner, lead, deal and program data, and, only if you separately approve write access, create or update records. Directory results never include contact details.

When the assistant calls CinnaLab, the requested results are sent to that assistant’s provider (for example Anthropic or OpenAI) under your instruction. Their handling of that data is governed by your agreement with them and their privacy policies, not by this policy.

We record each connection, the permissions granted and the tools called, for security and audit. You can see and revoke any connection at any time under Settings → AI Connectors. Revoking stops access immediately, and existing access tokens stop working.

Free plans include a monthly allowance of directory searches and introduction requests.

5. Vendor & Partner Directory

The directory lists software vendors and the partners that sell and implement them. Profiles are company-level: name, website, description, countries, industries, partner types and vendor ecosystems. Some listings also show a company’s leaders (name and job title). We take these only from the company’s own public pages, show the source link, and never publish personal email addresses or phone numbers.

We rely on our legitimate interest in helping software companies find partners, and keep listings limited to business information. Directory access requires a signed-in account.

Any company or person listed can ask for a correction or removal through the “remove me” link on the listing or by emailing us. Opted-out companies are excluded from search, including through AI assistants.

When you send an introduction request, we share your name, company and message with the company you chose, so it can accept or decline.

6. AI features inside CinnaLab

Some in-product features, such as the AI assistant, summaries, coaching and digests, send the relevant workspace content to a large language model provider to produce the answer. We use Groq and Anthropic for this. We use their API services, which do not use API inputs to train their models under their terms.

7. Integrations you connect

If you connect a third-party tool, such as HubSpot, Salesforce, Slack or Microsoft Teams, we exchange data with it only as needed to run the integration you set up. You can disconnect it at any time in Settings. The third party’s own privacy policy applies to the data it holds.

8. Legal basis (GDPR and Andorran law)

We rely on the following lawful bases:

• Contract performance: processing necessary to deliver the service you have signed up for, including AI connectors you choose to connect.
• Legitimate interests: the Vendor & Partner Directory, product analytics, security and fraud prevention.
• Consent: marketing emails and non-essential cookies.
• Legal obligation: compliance with applicable laws.

9. Data sharing and sub-processors

We do not sell your personal data. We share data only with the sub-processors needed to run the service, under written agreements:

• Render: application hosting and database.
• Amazon Web Services (EU region): file storage and encryption keys.
• Resend: transactional email.
• Sentry: error monitoring.
• Groq and Anthropic: AI features (section 6).
• PayPal: subscription payments. Wise: partner payouts.
• Documenso: the signing service behind documents you send for e-signature in CinnaLab.
• Google (Google Analytics 4 via Google Tag Manager): visit statistics on the cinnalab.io website, with consent.

10. International transfers

Some sub-processors are located outside Andorra and the European Economic Area, for example in the United States. Where this happens we rely on appropriate safeguards, such as the European Commission’s standard contractual clauses or an adequacy decision.

11. Data retention

We retain account data for the duration of your subscription plus 2 years, unless a shorter period is required by law. AI connector records are kept for as long as the connection exists and then for security and audit purposes for a limited period. Directory entries remain until they are corrected or removed. You may request deletion of your data at any time by contacting us.

12. Security

We protect data with encryption in transit and at rest (sensitive fields are encrypted with keys held in a key management service), multi-factor authentication, short-lived access tokens for AI connectors, rate limiting, and tenant isolation that keeps each customer’s workspace separate.

13. Your rights

You have the right to:

• Access the personal data we hold about you.
• Correct inaccurate or incomplete data.
• Request deletion of your data ("right to be forgotten"), including removal from the directory.
• Object to or restrict certain processing, including processing based on legitimate interests.
• Data portability: receive your data in a machine-readable format.
• Withdraw consent at any time for consent-based processing.
• Lodge a complaint with the Andorran Data Protection Agency (APDA) or your local supervisory authority.

14. Cookies

We use essential cookies (required for the service to function) and analytics cookies (to understand usage). You can manage cookie preferences via the banner on your first visit. We do not use advertising cookies.

15. Changes to this policy

We may update this policy as the service changes. We will show the new date at the top of this page and tell account holders about material changes by email or in-app notice.

16. Contact

To exercise your rights or ask questions about this policy, email support@cinnalab.io.

Questions about this policy? Contact us at support@cinnalab.io