Privacy Policy

Causal Ltd is the data controller for the personal data described in this policy. We are registered in England and Wales, company number 17280800. For anything to do with privacy, email contact@causal.so.

We are not required to appoint a Data Protection Officer, so privacy questions go to the address above.

For everything described here we act as the data controller, meaning we decide what is collected and why. If we later offer Causal to organisations for their teams, we would act as a processor for the content those teams put in, under a separate agreement. We will update this policy before that changes.

Most of this policy is about account and usage data. But the thing you probably care about most is what sits on your canvases. So we will state our position up front.

Your canvases belong to you. We do not read, mine, sell, or publish the content you put into Causal. We do not use it for advertising. We do not use it to train machine learning models.

Our staff do not access the contents of your canvases except in these narrowly limited situations:

• You ask us to. For example, you report a bug and give us permission to look at the affected canvas so we can reproduce it.
• We are legally required to. See “When we disclose data for legal reasons” below.
• To protect the service or a person. For example, investigating an active security incident, or a credible threat of serious harm.

Access in those cases is limited to what is necessary. Beyond them, your content is handled by automated systems only. It is stored, backed up, and served back to you. We are a small team, and this is a statement of how we operate. We will update this policy if it ever changes.

Information you give us

We use passwordless sign-in. You sign in with a one-time code emailed to you, a magic link, or your Google account. We never receive, see, or store a password for your account.

Your content

When you use Causal you create content, which we call Customer Content: cards and the text inside them, files, images and videos you upload, links you save, canvases and layout, and comments you write on cards.

We store this so we can give it back to you. Uploaded files are held in a private storage bucket. They are never publicly accessible, and are served only through short-lived, signed links.

Other people’s information: your canvases may contain personal data about other people, such as a name in a note, a face in a photograph, or a client’s details in a document. We do not collect that data from those people directly, and we process it only on your instructions. If you put other people’s personal data into Causal, you are responsible for having a proper basis to do so, and for telling them if the law requires it.

Information we collect automatically

• Product usage events. We record a deliberately narrow set of actions, such as signing in, creating a canvas, creating or deleting an item, uploading a file, and sharing or unsharing a canvas.
• File metadata, not file contents. When you upload a file we record its type, extension and size. We do not send the contents of your files to our analytics provider.
• Device and technical data, such as browser, operating system, screen size, referring page, and whether you are on the web or desktop app.
• Approximate location. We derive an approximate city or country from your IP address. IP anonymisation is switched on, so your full IP address is not stored against your analytics profile. We do not collect precise or GPS location.
• Error and crash diagnostics. When something breaks we log the error with structural context such as which canvas was affected and how many items were involved. These reports deliberately exclude the contents of your cards and files.
• Server logs. Our hosting provider records standard request logs, including IP address, for security and reliability.

We do not use session recording or screen replay. We do not watch a video of your session, and we do not record your keystrokes or mouse movements.

Information from third parties

If you sign in with Google, Google shares your email address, name and profile picture with us, subject to the permissions you grant. We do not receive your Google password or gain access to any other Google service.

Data stored on your own device

Causal keeps a copy of your canvases in your browser’s local storage so the app loads instantly and keeps working through a brief connection drop. We also remember which canvas you had open. This lives on your device, not on our servers, and clearing your browser data or signing out removes it. It exists solely to deliver the app you asked for, and is never used for advertising.

Under the UK GDPR and EU GDPR we must have a lawful basis for each use of your personal data.

Where we rely on legitimate interests, we have considered whether our interest is overridden by your rights, and we limit what we collect accordingly. That is why our analytics carry structural metadata rather than the contents of your work. You can object to processing based on legitimate interests.

Marketing email

When you create an account or join the waitlist, we add you to our product email list and tell you so at the point you sign up. We use it for one thing only: occasional inspiration and updates on new features. We do not send anything else, and we never pass your address to another company for their marketing.

• Every email has a one-click unsubscribe link, and you can also unsubscribe by emailing us.
• If you have previously unsubscribed, signing up again does not resubscribe you. Our system is deliberately built never to re-add an unsubscribed address.
• Unsubscribing does not stop essential service emails such as sign-in codes, which we must send in order to run your account.

What we do not do

• We do not sell your personal data.
• We do not share your personal data with advertisers or data brokers.
• We do not use your content to train machine learning models.
• We do not use automated decision-making or profiling that produces legal or similarly significant effects on you.

We share personal data only with the service providers who help us run Causal. Each is bound by a data processing agreement, may only act on our instructions, and may not use your data for their own purposes.

Your canvases and files are stored in the EU (Ireland), and our analytics run on EU infrastructure. We will update this list when our providers change.

Canvases you choose to share

Causal lets you create a read-only share link for a canvas. If you do:

• Anyone with the link can view that canvas without signing in. The link is unguessable, but it is not password-protected. Treat it as public.
• The share covers that one canvas only. Canvases nested inside it are not readable through the link.
• You can revoke a link at any time using “Stop sharing”. Access stops immediately, and any file links already handed out expire within roughly 15 minutes.

Please do not share canvases containing other people’s personal data unless you have a proper basis to do so.

When we disclose data for legal reasons

We may disclose personal data if we reasonably believe it is necessary to comply with a law, court order or binding request from a public authority; to enforce our terms or investigate potential violations; to detect, prevent or address fraud, security or technical problems; or to protect the rights, property or safety of Causal, our users, or the public.

If we receive a request for your data, we will notify you unless we are legally prohibited from doing so, or where doing so would create a risk to safety.

Business transfers

If Causal is involved in a merger, acquisition, financing or sale of assets, your data may be transferred as part of that transaction. We will notify you before your personal data becomes subject to a materially different privacy policy, and you will retain the right to delete your account.

Your canvases and account data are stored in the EU (Ireland), and our product analytics are hosted in the EU.

Vercel, Google, Resend and GitHub are based in the United States, so some personal data is transferred outside the UK and EEA. Where that happens we rely on appropriate safeguards: the UK International Data Transfer Addendum and the EU Standard Contractual Clauses, and where applicable the provider’s certification under the Data Privacy Framework agreed between the EU and the US, together with its UK Extension. You can request a copy of the relevant safeguards by emailing contact@causal.so.

The 30-day recovery window exists so an accidental deletion is reversible. If you need something erased sooner, email us.

Our main measures:

• Encryption in transit. All traffic is served over HTTPS.
• Encryption at rest. Your database and files are encrypted at rest by our infrastructure provider.
• No public file URLs. Uploads go to a private bucket, served only through signed, time-limited links. Links used by public share pages expire within about 15 minutes so revoking a share takes effect quickly.
• No passwords. We use one-time codes, magic links and Google sign-in, so there is no password of yours for us to leak.
• Access controls. Database row-level security plus an explicit ownership check on every read and write, so one account cannot reach another account’s canvases.
• Secret management. API keys and credentials are held in a managed secret store, never in our source code.

No system is perfectly secure, and we cannot guarantee absolute security. If we become aware of a personal data breach likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours as required, and notify you without undue delay where the risk is high.

Under the UK GDPR and EU GDPR you have the following rights:

To exercise any of these, email contact@causal.so. We will respond within one month. If your request is complex we may extend this by a further two months, and we will tell you if so. We will ask you to verify your identity, usually by responding from the email address on the account. We do not charge a fee unless a request is manifestly unfounded or excessive.

If you are unhappy with how we have handled your data, please tell us first so we can try to put it right. You also have the right to complain to your data protection supervisory authority. This is the regulator in the country where you live, work, or where you think the problem happened.

We do not sell personal information, and we do not share personal information for cross-context behavioural advertising, as those terms are defined under the California Consumer Privacy Act. We have not done so in the preceding 12 months, and we do not do so with the personal information of minors under 16.

If you are a California resident you have the right to know what personal information we collect and how we use it, the right to delete it, the right to correct it, the right to opt out of sale or sharing (not applicable, as we do neither), and the right not to be discriminated against for exercising these rights. Residents of other US states with comparable privacy laws have similar rights.

Several US states also give you the right to appeal if we refuse a request. If we turn you down we will tell you why, and you can reply to ask us to reconsider. If we still refuse, we will tell you how to complain to your state Attorney General.

To exercise any of these, email contact@causal.so. You may use an authorised agent; we will ask for proof of their authority. We will respond within 45 days, and will tell you if we need a further 45 days for a complex request.

Causal is not intended for children. You must be at least 16 years old to create an account. We have set a single threshold of 16 so the same rule applies across the UK and every EU member state, whose ages of digital consent vary between 13 and 16.

We do not knowingly collect personal data from children under 16. If you believe a child has provided us with personal data, email contact@causal.so and we will delete it.

We may update this policy as the product changes or the law does. When we do, we will update the effective date at the top.

If we make a material change, for example collecting a new category of data, adding a significant new provider, or changing how we use your content, we will give you reasonable advance notice by email or an in-app notice before it takes effect. We will keep previous versions available on request so you can see what changed.

Questions, requests, or concerns about privacy, including any request to exercise the rights above, should go to contact@causal.so.

We aim to acknowledge every message within a few working days, and to resolve formal data rights requests within the one-month deadline set out above.