Effective date: March 25, 2026 | Last updated: March 25, 2026

Privacy Policy

This Privacy Policy describes how Cedar AI Agents, Inc. ("Cedar," "we," "us," or "our") collects, uses, and protects information in connection with the Cedar AI platform (the "Service"). Cedar is incorporated in British Columbia, Canada.

1. Information We Process

Cedar processes two categories of data:

Customer Data — data you and your organization provide through the Service. This includes:

• Employee names, email addresses, and Slack workspace identities
• Professional work history (publicly available professional data)
• Contact and profile information for individuals submitted through the Service
• Employee assessments and context provided during Cedar sessions
• Transcripts from Cedar's AI sessions

Service Data — data Cedar collects automatically to operate and improve the Service:

• Usage logs, system performance data, and error reports
• Aggregated, anonymized statistical patterns derived from Service usage

2. How We Use Information

Cedar uses Customer Data solely to provide the Service to you. Specifically:

• To conduct AI-assisted employee interviews via Slack
• To enrich profile data with professional history
• To evaluate fit using AI inference
• To submit results to your human resources systems via integrated connectors
• To notify employees of relevant updates through your workflow

Cedar does not use Customer Data to train general-purpose AI or machine learning models, to build profiles for advertising, or for any purpose other than delivering the Service to you.

3. AI and Machine Learning

Cedar's Service uses AI to generate recommendations. Our AI processes your data as follows:

• Inference only: your data is used to generate recommendations for your benefit — not to train or improve Cedar's models for other customers
• No general model training: Cedar does not use your Customer Data to train, fine-tune, or update any general-purpose AI or machine learning model
• Google Gemini: AI inference runs on Google Cloud under Google's Enterprise DPA, which prohibits Google from using your data for model training
• You own outputs: all AI-generated content relating to your use of the Service belongs to you

4. Sharing and Sub-Processors

Cedar shares data only as necessary to deliver the Service. Our key sub-processors are:

• Google Cloud Platform — infrastructure, hosting, and AI inference (United States)
• Merge.dev — HR system integration connector (United States)
• Slack Technologies — primary user interface (United States)
• Vapi.ai — voice transcription only; audio is not stored (United States)

Cedar does not sell, rent, or share Customer Data with third parties for their own purposes.

5. Data Retention and Deletion

Cedar retains Customer Data for the duration of your active subscription or evaluation period. Upon termination:

• Cedar will delete all Customer Data within 30 days of the termination date
• Cedar will provide written certification of deletion upon your written request
• You may request deletion of specific data at any time by contacting support@getcedar.ai

6. Security

Cedar protects Customer Data using industry-standard security measures, including:

• AES-256 encryption at rest and TLS 1.2+ encryption in transit
• Private VPC network isolation on Google Cloud Platform
• Role-based access controls and IAM authentication
• All infrastructure changes require CI/CD pipeline with manual approval
• SOC 2 Type II audit in progress (target completion Q3 2026)

In the event of a security incident affecting Customer Data, Cedar will notify affected customers within 72 hours of confirmed discovery.

7. International Data Transfers

Cedar is incorporated in Canada. Your data may be processed on infrastructure located in the United States (Google Cloud Platform). For customers whose employees or candidates are located in the European Economic Area (EEA), United Kingdom, or Switzerland, Cedar relies on Standard Contractual Clauses (SCCs) or other appropriate transfer mechanisms as required under applicable data protection law. A Data Processing Addendum (DPA) is available upon request.

8. Your Rights

Depending on your location, you or your employees may have rights with respect to personal data, including:

• The right to access personal data Cedar holds about you
• The right to correct inaccurate personal data
• The right to request deletion of personal data
• The right to object to or restrict certain processing
• The right to data portability

To exercise these rights, contact support@getcedar.ai. Cedar will respond within 30 days.

9. Cookies and Tracking

Cedar's Service operates primarily within Slack and does not use cookies or tracking technologies for advertising purposes. Our website (getcedar.ai) may use minimal analytics to understand visitor behavior. No personal data is sold or shared with advertising networks.

10. Changes to This Policy

Cedar may update this Privacy Policy from time to time. Material changes will be communicated to active customers with at least 30 days notice. The current version is always available at getcedar.ai/privacy.

11. Contact

For questions about this Privacy Policy, contact Cedar at: support@getcedar.ai

Cedar AI Agents, Inc., Suite 2700, The Stack, 1133 Melville St, Vancouver, BC V6E 4E5, Canada