Privacy Policy

Version 8 · Last updated 26 October 2026
Earlier versions: 7
All documents Back Sign in

TUA Platform — Privacy Policy

Effective date: 2026-10-26 Version: 8

Version 8 supersedes Version 7 (2026-10-14). It is a full revision: every statement in it was checked against how the Service works today, and it now names every place your information goes. Section 14 lists every change.

This Privacy Policy explains how TUA Platform ("the Service") collects, uses, stores, shares and protects information about you. By creating an account or using the Service you acknowledge that you have read and understood this Policy.

The Service is owned and operated by CelestiNet (celestinet.com), which is the responsible party for the personal information described in this Policy. "CelestiNet", "we" and "us" mean CelestiNet. TUA Platform is a service that CelestiNet runs; nobody installs their own copy.

When a company is responsible instead. A company that uses the Service may keep information about its own people and customers in it: its employees in Personnel, its clients in Company Finance, the people it lets use its AI bots, the people who write to it through its contact pages. For that information the company is the responsible party, and CelestiNet processes it on the company's behalf under the Business Terms. Questions about it go to the company first.

Versions. We may change this Policy by publishing a new version. Every change is a new version, and every earlier version stays readable on the Service. Where a change is material you are asked to accept the new version before you continue.

1. Information we collect

1.1 Your account

  • your username and email address;
  • your password, stored only as a salted hash (never in plain text);
  • the profile and contact card you choose to fill in: full name, cellphone, time zone, pronouns, organisation, job title, department, further email addresses, phone numbers, websites and social profiles, addresses, birthday and anniversary;
  • if you choose to give it, your gender, which only you can see and which nothing in the Service reads;
  • an optional profile picture, stored inside the Service's database rather than as a file;
  • your account role and the apps you have access to;
  • your confirmation that you are 18 or older and when you gave it, or, for an account an administrator made, that administrator's confirmation and name;
  • a record of each version of the Terms, this Policy and the other legal documents you accepted, when, and the IP address and browser you accepted from;
  • sign-in and account records: when the account was created, when you last signed in, failed sign-in attempts and any lock they caused, and an email address change waiting to be confirmed.

1.2 Security and sign-in

  • if you turn on two-factor sign-in, its secret (stored encrypted), your backup codes and the last code you used, so a code cannot be used twice;
  • for each device you mark as trusted: a hashed device token, its expiry, the browser it was trusted from and the IP address it was trusted from;
  • for API keys and application passwords you make: only a hash, never the key itself, and for an API key a short prefix so you can recognise it in a list. A lost key cannot be recovered, only revoked and replaced. Where an integration you set up signs the messages it sends (a webhook), its signing secret is stored encrypted, because the Service has to use it.

1.3 Content you create

  • notes, diary entries, lists, calendar entries, reminders, tasks and projects, bookmarks, savings and budget data, contacts, statistics, documents, worlds and stories in the Lore app, and any other data you save while using the Service's apps;
  • entries stored in the Password Manager — credentials, notes, licence keys and authenticator secrets — which are encrypted at rest. Personal vault keys are protected by your password or recovery key; company-shared entries use a separately protected company key whose material is divided between the server and an authorised user's personal vault. See section 6.1.
  • images and files you upload.

The apps a company uses for its own people and clients are described in section 1.8.

1.4 Email, chat, connections and safety

  • Email app. You give us your own mail account's server details and password, which we store encrypted with a key the server holds, so the Service can check your mail in the background. You can instead connect a Gmail account by signing in with Google; that gives the Email app full access to the mailbox, because it reads, sends, moves and deletes your mail, and we store its access tokens encrypted. Messages fetched from your mail server are cached so the Service can show them. What you do in the Email app changes your real mailbox: deleting, moving, archiving or sending a message there does it on your mail server. If you use spam filtering, it learns from the messages you mark as spam or not spam.
  • TUA Chat. We store the messages you send, the files you attach, the conversations you belong to, and what you add to them: mentions, reactions, polls, saved messages, drafts, scheduled messages, reminders and keyword alerts. We also store how far you have read, whether you are active and any status text you set. Read receipts are off unless you turn them on, in TUA Chat → Settings. How long a company's conversations are kept is set by that company (section 5).
  • Connections. When you connect with somebody, we store the request, any QR connect code you make, and the connection. Your contact card is copied into their Contacts and kept up to date, showing only the fields your visibility settings allow (Profile → Connections). Your time zone appears on their Clock unless you withhold it.
  • Blocks and reports. A block records who blocked whom. A report records who made it, who it is about, the reason chosen and anything written with it. Reports are read by CelestiNet, and the person reported is not told who reported them.

1.5 Calendars you connect

  • If you connect a Google or Microsoft calendar, we store encrypted access and refresh tokens for that account, its email address, the permissions you granted, and the calendars and events being synchronised. The tokens let the Service act on your calendar until you disconnect it, which you can do at any time in Calendar → Settings; you can also remove the permission in your Google or Microsoft account.
  • We ask only for calendar access here. The calendar connection does not read your mail. The Email app's Google sign-in does, to show your mailbox (section 1.4).
  • If you add a calendar server (CalDAV) or a calendar feed address, the Service contacts that server or address on your behalf, with the username and password you gave for a calendar server.

1.6 AI features

  • Who decides. Bots are set up by a person or a company (the bot's owner), who chooses the AI model and its provider and supplies the key that pays for it. CelestiNet does not supply or sell the use of any AI model.
  • What the provider receives. When you use a bot, your message, any files you attach, the conversation so far and the instructions the bot's owner wrote are sent to the provider the bot uses, which the bot's page names (Messages go to). That provider's own terms and privacy policy apply to what it receives, and it may process it outside South Africa and the European Union (section 10).
  • What the bot is told about you. Each bot has two settings, chosen by its owner:
  • Who you are: your full name and email address. Off for a new bot.
  • Where and when: your time zone, the date and time there, your country and the web search region. On for a new bot.

Bots made before this version keep both on until their owner changes them. With both off, the bot is still told the current date and time in UTC, which identifies nobody. - Web search. A bot searches the web only if its owner has chosen a search service for it (Brave Search or Tavily) and pays for it. Your search words then go to that service. The Service may also open web pages the bot asks for, from our own server. Where a search service's terms allow its results to be kept only briefly, the results are removed from the stored conversation once the answer is written; your question stays. - What is stored. Your conversations, so you can return to them; the ratings you give answers and any answer you report; and a usage record for each answer (the number of words in and out, as the provider counts them, and an estimated cost), which the people who manage the bot can see per bot and per person. Files you attach to a conversation are deleted after 30 days. - The bot's owner sees your ratings. When you rate an answer, the rating and the conversation around it go to the bot's owner, who may use what it holds to make training material for its own bots. The owner must have the right to do so and must tell you. CelestiNet never uses anybody's content to train, fine-tune or improve any AI model. - Reporting an answer. A report goes to the bot's owner, not to CelestiNet. - How long conversations are kept is set by the bot's owner: until you delete them, or 30, 90 or 365 days. The owner can also export or delete your AI data if you ask them. - Automated AI Tasks may store credentials you give them, encrypted.

1.7 Purchases

  • the order: what was bought, the price, the currency and the date, and its status;
  • your name, email address and country, recorded on the order when you pay, and for a company its name and any VAT number;
  • the country used to choose how you can pay. We work it out from your IP address, using public-domain country data read on our own server; nothing is sent to anybody to do it, and an address the data does not know is offered the worldwide way of paying;
  • the receipt and the invoice or purchase record;
  • for a quote paid by bank transfer: the quote, the payments we record against it, and any proof of payment you upload.

Card details never reach CelestiNet. You give them to the payment processor on its own page (section 4.2).

1.8 Company apps that hold information about other people

A company can keep information about its own people and clients:

  • Personnel: employee records (contact details, pay, documents, and, if the company asks for it, a self-declared gender and pronouns), clock-in and clock-out times, and where the company has turned it on, the location a clock-in was made from. A PIN used to clock in is stored only as a hash.
  • Company Finance: clients and their contact details, quotes, invoices, supplier bills, bank statement lines and attached files. Documents can be sent to a client by email or by a link.
  • Project Management: projects, tasks and the time people record on them.

For this information the company is the responsible party (see the preamble). By default a clock-in location is removed after 90 days while the clock-in itself is kept for about seven years, as pay records are; each company can change both.

1.9 People who do not have an account

  • QR code scans. When somebody scans a QR code made in the Service, we record the time, a one-way code made from their IP address with a key that changes every day (never the address itself), their browser, operating system and kind of device (never the version), and the website they came from (its host only). We record no country. Single scans are kept for 90 days by default (the code's owner can change this); after that only a count per day is kept.
  • Invitations. When a company invites somebody by email, we store that address and email them a link.
  • Public homepages. Bookmarks a person marks as public on their Internet Homepage can be seen by anyone with the link; private ones are protected by a PIN.
  • The contact form. A message sent through /contact stores the name, email address, subject and message given, and the IP address and browser it was sent from.
  • A company's contact pages. A company can publish contact pages where anybody, with or without an account, sends it a message. We store what the person gives (their name, email address and phone number where the page asks for them, the reason for contact, the message, answers to the company's own questions, and any files sent), and the IP address and browser it was sent from. If you send one while signed in, your account is recorded with it. We email a code to the address typed, and the message reaches the company only once that code is entered; a message whose code is never entered is deleted after 24 hours. Where the company allows it, we email the person a link to follow the conversation and read its replies. A company may keep a list of addresses, domains, networks or words it blocks. For these messages the company is the responsible party (see the preamble).

1.10 Technical and usage information

  • IP addresses of devices that use the Service, and the number of requests from each, to prevent abuse and to run the block and allow lists;
  • the browser's user-agent string;
  • an audit log of significant actions, such as sign-ins, sign-ups, searches and changes made by administrators. A search is recorded without the words you typed;
  • error reports: the page address, your username, IP address and browser, and technical details of the error;
  • a log of the emails the Service sends: from, to and subject;
  • the server's own log files, which record usernames and IP addresses (for example of a failed sign-in) and are replaced in rotation;
  • page addresses that were asked for and do not exist, with no identity attached;
  • anonymous page-performance measurements: the page and how long parts of it took to load, with no identity attached.

1.11 Cookies and browser storage

Cookies:

  • a session cookie that keeps you signed in. Remember me keeps it for up to 30 days;
  • a theme-preference cookie;
  • if you complete a bot check, a signed cookie recording it, for one day, tied to your account or to the homepage you opened;
  • a trusted-device cookie, if you mark a device as trusted at two-factor sign-in, for the number of days you chose;
  • on an Internet Homepage, a cookie recording that you entered its PIN, for 30 days.

The token that protects your form submissions is kept inside your session, not in a cookie of its own. On the sign-in, sign-up and password reset pages and the Internet Homepage, Google reCAPTCHA may set Google's own cookies. We use no advertising or cross-site tracking cookies.

Your browser also keeps, on your device: which tab you last had open on a page, a copy of a form you had not yet saved (so a refused or interrupted save does not lose what you typed), and copies of pages so the Service can show an offline page.

2. How we use your information

We use the information we collect to:

  1. provide, operate, secure and improve the Service;
  2. authenticate you and protect your account from unauthorised access;
  3. communicate with you about your account (for example email verification, password resets, warnings before an unused account is deleted, and important notices);
  4. deliver the notifications you asked for: in the app, by email where you turned that on, and as push notifications to a browser or device you allowed;
  5. synchronise data with services you connected, such as a calendar or your own mail server;
  6. detect, investigate and prevent abuse, fraud and security incidents;
  7. keep audit and error logs for the safe operation of the Service;
  8. record which versions of the legal documents you accepted, so we can show it if asked;
  9. administer your purchases, subscriptions and access to apps.

We do not sell your personal information, and we never use anybody's content to train, fine-tune or improve any AI model.

Where data-protection law requires a legal basis, we rely on:

  • performance of a contract with you (providing the Service you signed up for);
  • your consent, in particular for connecting another account and for optional features you turn on;
  • our legitimate interests in operating, securing and improving the Service; and
  • compliance with legal obligations, for example keeping tax records.

Where you connect a third-party account, that consent is specific to that connection and you may withdraw it at any time by disconnecting the account. For information a company keeps about its own people and clients (section 1.8), the company decides its basis.

4. Who receives your information

We do not sell your personal information. This section lists everyone who receives it. When we add a provider to section 4.1 or 4.2 we publish a new version of this Policy first and ask you to accept it; removing one is announced in a new version.

4.1 Providers that run the Service

Who What they receive Where
Hetzner Online GmbH, which hosts the Service's server everything the Service stores, as its host Helsinki, Finland
Our email provider, which sends the Service's own email the email address, name and message of each email the Service sends the provider's own locations
Google reCAPTCHA, on the sign-in, sign-up, password reset and homepage PIN pages what Google's check collects from your browser on those pages Google's own locations
An error-monitoring service, where the Service uses one details of an error in the Service, sent without personal information the provider's own locations
Have I Been Pwned (Pwned Passwords), when the Password Manager checks whether a stored password has appeared in a known breach the first 5 characters of a one-way code (a SHA-1 hash) of the password, never the password or the rest of its code its own locations
The push service of your browser (for example Google, Mozilla, Apple or Microsoft), if you allow push notifications each notification, encrypted so the push service cannot read it, and the address of your device's subscription the browser maker's locations

4.2 Payments

Who When What they receive Their role
Paddle.com Market Ltd (United Kingdom) you pay by card in US dollars the items and our order number from us; your email, country and payment details, which you give Paddle directly Paddle is the seller. It sells to you under its own buyer terms and privacy notice, so it decides how it uses what you give it; it is not acting for us
Payfast (South Africa) you pay by card in South African rand our order number, the amount, the item name, and the email address and full name on your account; your payment details, which you give Payfast directly Payfast is our payment processor. We are the seller, and Payfast processes the payment for us
Your bank and ours you pay a quote by bank transfer the transfer and its reference the banks handle the transfer; any proof of payment you upload stays with us

Your receipt names which of these handled your order. We never receive your card details.

4.3 Recipients you, or a bot's owner, choose

  • the AI provider a bot uses, and the web search service its owner chose (section 1.6);
  • web pages a bot asks the Service to open;
  • your own mail server, through the Email app;
  • Google or Microsoft, for a calendar or a Gmail account you connect;
  • a calendar server or calendar feed address you add;
  • an address you set up to receive messages from an integration (a webhook in the QR API or a TUA Chat integration), which receives what you send to it;
  • the people the Service emails on your behalf, for example someone you invite to a company or a client you send a document to.

4.4 Other people, where you share

  • the members of a company, for content shared into it, according to the access its administrators set; this content stays with the company if you leave it;
  • the people you name, for something you share with them;
  • your connections, who receive your contact card as your visibility settings allow (section 1.4);
  • anyone with the link to your Internet Homepage, for bookmarks you mark as public;
  • a company's client, for a document the company sends them by email or link.

4.5 When the law or safety requires it

  • where required by law, regulation, court order or other legal process;
  • to protect the rights, property or safety of CelestiNet, our users or the public.

5. How long we keep information

Information How long
Your account as long as it exists. An account nobody signs in to for two years is deleted after warning emails (Terms, section 1.8)
A sign-up whose email address was never confirmed 48 hours
Failed sign-in attempts 7 days
Audit log 365 days
Error reports 180 days
IP address records 365 days after the address was last seen
Records of refused requests 90 days
Log of emails the Service sent 90 days, or 365 days for an email that failed
Notifications 30 days once read, 90 days if never read
Pending connection requests 90 days, then they expire
Items you delete in an app with a recycle bin, including Lore 30 days in the bin, then removed. Lore also keeps a limited number of earlier versions of each item
Push notification subscriptions removed once the push service says they no longer work, or after 180 days unused
Trusted devices and password reset links until they expire
Revoked API keys kept as a record that they existed and were revoked. A deleted application password is removed
Files attached to AI conversations 30 days
AI conversations, ratings and reports as the bot's owner sets: until deleted, or 30, 90 or 365 days
AI usage records and records of AI administration as long as the account exists
Link previews in TUA Chat 180 days after they were last refreshed
A company's TUA Chat conversations kept until the company sets a period; after it, older messages are permanently deleted. Your own direct and group conversations outside a company are kept until deleted
QR code scans 90 days by default, then only a count per day
Personnel clock-in locations 90 days by default; clock-ins about seven years by default (section 1.8)
Anonymous page-performance measurements 30 days
Messages sent through the contact form until CelestiNet deletes them
Messages sent to a company's contact pages until the company is deleted. One whose emailed code is never entered: 24 hours

When you delete your account, your personal account data and the content you created are removed, except:

  • the record of which version of each legal document you accepted, which stays with your username so we can show what was agreed;
  • your orders, receipts and invoices (below);
  • content you contributed to a company, which stays with that company.

Deleting your account deletes the access tokens we stored for your connected accounts; the permission may still be listed at Google or Microsoft until you remove it there. Deleting your account, or a cached email, does not touch your mailbox; deleting a message in the Email app does (section 1.4).

Orders, receipts and invoices are kept for ever, because tax law requires us to keep them and they are the record of what was sold. Once the period that tax law requires has passed, the buyer's personal details on them (name, email address, address, a company's name and VAT number, and a bank reference that is a person's name) are removed, so the numbers, amounts and dates stay. A purchase made through Paddle is also kept by Paddle, as the seller, under its own rules.

When a company closes, its administrators can download its data for 30 days; after that the company and its data are deleted.

Backups. We back up the Service every day, so up to 24 hours of changes can be lost in a recovery, and we keep a limited number of recent backups. Something you delete stays in the backups taken before you deleted it until those backups are replaced. Backups are not searched or restored to recover individual deleted items.

6. Security

We use a range of technical and organisational measures to protect your information, including:

  • passwords are stored only as salted, hashed values, using a modern memory-hard hashing algorithm;
  • optional multi-factor authentication;
  • sensitive content — Password Manager entries, mail-account credentials, connected-calendar tokens, and AI Task secrets — is encrypted at rest;
  • personal and company-shared Password Manager entries use the distinct encryption arrangements described in section 6.1;
  • two-factor secrets and the AI provider keys bot owners enter are also encrypted at rest;
  • each person's own app data is separated at the database level, so the database itself, not only the application, keeps one person from reading another's. Company and shared information is protected by the application's access rules;
  • the Service is served only over HTTPS;
  • a strict Content Security Policy, protection against forged form submissions, and security headers on every response;
  • rate limits, and protection against repeated sign-in and two-factor guessing;
  • per-IP and per-account abuse controls;
  • no page of the Service is indexable by search engines.

No electronic service can promise complete security. We take reasonable steps to protect information, and some risks remain.

6.1 Password Manager encryption and access

The Password Manager uses different encryption arrangements for personal and company-shared entries. Both are intended to protect credentials from ordinary administrative access, although their key arrangements and sharing permissions differ.

Personal vaults. Each personal vault has its own encryption key. That key is stored only in encrypted ("wrapped") form, protected by a key derived from your account password and, where configured, by your recovery key. When you unlock your vault, the Service uses your password to open the wrapped key in server memory for the unlocked session. The vault key is not sent to your browser, and the vault locks after 24 hours without use.

CelestiNet does not have a stored master key or an ordinary administrative process for opening your personal vault without your password or recovery key. If your password is reset, the vault can be reconnected using your old password or valid recovery key. If neither is available, the encrypted contents cannot be recovered through the Service's normal recovery processes. Recovery keys are shown once, are not kept in retrievable form and should be saved securely outside the Service. Using, replacing or reconnecting a recovery key makes the previous key invalid.

Company-shared entries. Entries shared with a company are encrypted using a company key, which allows authorised members to work with shared credentials under permissions set by that company's administrators. Protection of the company key is divided into separate components:

  • one component is kept in an encrypted file on the server; and
  • another is encrypted within an authorised user's personal vault, so it is not directly accessible to CelestiNet independently of that vault's unlocking process.

Under the intended design, the server-held component alone does not provide routine access to the company's passwords. CelestiNet does not ordinarily view or extract shared passwords. The relevant key material is brought together by the Service when authorised users access shared entries. This is different from saying that a company vault can never be compromised: company administrators control member access, and a person with the appropriate company permissions may reveal entries.

Security safeguards and their limits. The application is not designed to capture and store a user's password as it is typed. We maintain unit tests intended to detect code that would introduce that behaviour. Tests can help identify regressions, but they cannot establish that malicious code or an intrusion is impossible. For example, someone who unlawfully changes the application to capture credentials, or compromises the server and introduces code that intercepts an authorised user's unlocking of a vault, could potentially obtain passwords. Those would be unauthorised, malicious activities rather than the normal operation of the Password Manager. We work to reduce these risks, but no electronic medium can be guaranteed completely secure. Any responsibility for a security incident remains subject to applicable law and the Terms; this explanation does not remove rights or duties that cannot lawfully be excluded.

Shared-vault permissions and retention. Company administrators decide who may view or use entries by category and subsection. Revealing, changing or deleting an entry is logged for their review. Reveal records are retained for 90 days, other audit records for 365 days, and deleted shared entries remain in the recycle bin for 30 days before permanent removal. Shared entries remain with the company when a member leaves. If key material required to unlock the company vault is lost and cannot be recovered, affected entries may become unreadable; this does not alter the separate encryption arrangement for personal vaults.

7. Your rights

Subject to applicable law, you may have the right to:

  • access the personal information we hold about you;
  • request correction of inaccurate information;
  • request deletion of your account and associated data;
  • object to or restrict certain processing;
  • receive your data in a portable, machine-readable form;
  • withdraw consent where processing is based on consent;
  • complain to the Information Regulator of South Africa, or to the data-protection authority where you live.

You can exercise several of these yourself:

  • Profile → Your data → Export my data downloads a machine-readable archive of the data the apps keep for you personally, your connections, your purchases and your Lore. It does not include content you shared into a company or TUA Chat messages;
  • Profile → Your data → Delete my account;
  • Preferences → Notifications, to choose which apps notify you;
  • TUA Chat → Settings, to turn read receipts on or off;
  • Calendar → Settings, to disconnect a connected calendar account.

For your AI conversations with a bot somebody else owns, ask the bot's owner, who can export or delete them. For information a company holds about you as its employee or client, ask the company. For anything else, contact CelestiNet through the contact form at /contact.

8. Content about other people

Some apps let you store information about people other than yourself, for example contacts, calendar invitees, email correspondents, and free-text content such as notes, diary entries and stories.

For that information you decide what is collected and why, and you are responsible for having a proper basis to store it and for handling any request you receive about it. The Service processes it on your instruction. A company that keeps information about its employees or clients (section 1.8) is responsible for it in the same way, under the Business Terms.

9. Automated decision-making

The Service does not make automated decisions that produce legal or similarly significant effects about you. Automated processing that does occur, such as spam filtering in the Email app and the AI features you use, assists you and does not decide anything about you.

10. International transfers

CelestiNet is registered in the Republic of South Africa. The server that runs the Service is hosted by Hetzner Online GmbH, a German company, in its data centre in Helsinki, Finland, so your information is stored and processed in Finland, in the European Union, and is accessed from South Africa to operate and support the Service.

Your information also leaves that server by these routes, each described in this Policy:

  • the providers in section 4.1, each in its own location;
  • when you pay by card, the processor for your currency (section 4.2): Paddle in the United Kingdom, or Payfast in South Africa;
  • the AI provider a bot uses and the web search service its owner chose, wherever they operate (section 1.6). The bot's page names its provider;
  • the other recipients you or a bot's owner choose (section 4.3);
  • backup copies, which are sent over an encrypted connection and kept at CelestiNet's offices in South Africa.

Where information is transferred internationally we rely on the safeguards applicable law permits, including the conditions for transborder information flows in section 72 of the Protection of Personal Information Act 4 of 2013 (POPIA).

11. Children

The Service is for people 18 or older. Everybody confirms this when they sign up, accounts that existed before were asked once at their next sign-in, and an administrator who makes an account for somebody else confirms it for them. We do not ask for a date of birth.

If you believe an account belongs to somebody under 18, tell us through the contact form at /contact. We suspend the account and delete its data.

12. If there is a breach

If a security breach affects your personal information, we tell you and the Information Regulator as the law requires. We aim to tell affected customers within 72 hours of confirming a breach.

13. Changes to this Policy

We may change this Policy by publishing a new version. Every change is a new version, and every earlier version stays readable on the Service. Where a change is material you are asked to accept the new version before you continue.

14. What changed in Version 8

Version 8 is a full revision. In plain words:

  • Everything we collect is listed, including what was missing: your full contact card and the optional gender only you see (1.1); your 18+ confirmation (1.1); the IP address and browser recorded when you accept a document (1.1); two-factor backup codes and how webhook secrets are kept (1.2); spam filtering and Gmail sign-in in the Email app (1.4); everything TUA Chat stores and that read receipts are off unless you turn them on (1.4); connections, and that your contact card is copied to them (1.4); calendar servers and feeds (1.5); purchases (1.7); the company apps that hold information about employees and clients (1.8); people without an account, such as QR code scans, invitations and messages sent to a company's contact pages (1.9); the audit log, email log and server logs (1.10); and every cookie and what your browser keeps (1.11).
  • AI features are rewritten (1.6): a bot's owner chooses the AI model and its provider; exactly what is sent, including what a bot's settings allow it to be told about you; web search through Brave Search or Tavily, only where the owner chose one; that your ratings go to the bot's owner; and how long conversations are kept. Version 7 said a self-hosted model was used by default and that content is never used for training; the first is no longer true, and the second is now stated exactly: CelestiNet never trains any model on anybody's content, while a bot's owner may use what it holds for its own bots.
  • Section 4 names everybody who receives information: our host, our email provider, Google reCAPTCHA, Have I Been Pwned, push services, the payment processors Paddle and Payfast, and the recipients you choose. Version 7 said none of these was used by default and to ask "your administrator"; TUA Platform is a service CelestiNet runs.
  • Retention periods are stated (section 5), including that orders and invoices are kept for ever with your personal details removed after the legal period, that a deleted account's legal acceptances are kept, and the 30 days a closing company has to download its data.
  • Children: the Service is for people 18 or older, and section 11 says how to report a child's account.
  • New sections on your right to complain (7) and on breaches (12).
  • The Password Manager descriptions (sections 1.3 and 6.1) are unchanged.

Earlier changes: Version 7 (2026-10-14)

Version 7 (2026-10-14) changes only the product's name. The Utility App is now called TUA Platform. It is the same Service, CelestiNet is still the party responsible for your personal information, and this version does not change what is collected or how it is used.

Earlier changes: Version 6 (2026-09-25)

Version 6 reflects the chat app's new name and its free version. Company Chat is now called TUA Chat, and every account can use it for direct messages and groups; TUA Chat Plus adds company channels and other features. Section 1.4 now describes chat for every account, blocking and reporting; sections 4 and 5.5 use the new name. This version does not change what is collected from a message or a file.

Earlier changes: Version 5 (2026-09-19)

Version 5 clarifies the split protection of company-vault key material, the role of password-protected personal vaults, and the distinction between ordinary authorised operation and malicious interference. It also updates the tone throughout. This is a correction to the description supplied in earlier versions, not a claim that security risks have been eliminated.

Earlier changes: Version 4 (2026-09-17)

Version 4 clarified that anonymous page-performance measurements are stored, the self-hosted AI model may run on a separate machine outside Finland, and encrypted backup copies are held in South Africa. It also clarified backup timing and Company Chat retention.

Earlier changes: Version 3 (2026-09-16)

  1. CelestiNet is named as the owner and operator of the Service and as the party responsible for the personal information described here (preamble and section 16).
  2. The description of Password Manager encryption is CORRECTED. Versions 1 and 2 said the vault key was "derived from your master password". That was true of an earlier design. The key is now a value of its own, stored only in wrapped form — encrypted under a key derived from your account password, and under a recovery key if you create one. The practical assurance is unchanged and is stated more precisely in section 6.1: we cannot read your personal vault, and we cannot recover it either.
  3. A new section 6.1 describes the Password Manager in full, including the consequence the earlier text did not state: if you forget your password and hold no recovery key, the contents of your personal vault are permanently lost and nobody can restore them.
  4. Company-shared entries are described for the first time. They use a key held by the Service on the company's behalf, which is what lets other members use them — and which was described in that version as operator-accessible; Version 5 corrects the description to reflect divided key material. Section 6.1 also covers permissions and audits.
  5. Section 1.3's inventory of what we collect is updated to match, and now names notes, licence keys and authenticator secrets alongside passwords.
  6. Section 10 now names where your information actually is — servers in Helsinki, Finland (EU), hosted by a German provider, operated by a company registered in South Africa — rather than referring vaguely to "the country where the Service is operated", and names the POPIA condition relied on for that transfer.
  7. Nothing in this version widens what we collect or what we do with it.

Earlier changes: Version 2 (2026-07-31)

Version 2 (2026-07-31) describes existing practice more completely. It does not introduce any new use of your information. Newly described:

  • multi-factor authentication, trusted devices, application passwords and API keys (section 1.2);
  • profile pictures being stored in the database (section 1.1);
  • Company Chat, including read receipts and presence, and administrator-set retention (sections 1.4, 5.5);
  • connected Google and Microsoft calendar accounts, the tokens involved, and how to revoke them (sections 1.5, 5.8);
  • AI Chat, AI Search and AI Tasks, and where prompts are sent (section 1.6);
  • which external providers may receive data and the fact that none is enabled by default (section 4);
  • retention for Lore's recycle bin and revisions (section 5.6);
  • the self-service tools for exercising your rights (section 7);
  • your responsibilities for information about other people (section 8);
  • a statement on automated decision-making (section 9).

15. Contact

The Service is owned and operated by CelestiNet — celestinet.com, which is the responsible party for the personal information described in this Policy.

For questions about this Policy or the personal information we hold about you, contact CelestiNet through the contact form at /contact.