Privacy policy
What personal data Factbed collects, why we collect it, who helps us process it, and what you can ask us to do with it.
The short version
- We collect what we need to run Factbed: your account details, what you store in your workspace, and basic usage and security logs.
- What you store in a workspace is yours. We don't sell it, we don't use it to train AI models, and we only access it to run the service, help when you ask, keep it secure, or when the law requires it.
- We count visits to this website with PostHog. In Europe, analytics cookies are only set if you accept them. Elsewhere you can turn them off in , and we respect Global Privacy Control.
- You can export your facts at any time, and ask us to show, correct or delete your personal data by emailing [email protected].
1. Who we are
Factbed is run by Factbed Inc., 131 Continental Dr, Ste 305, Newark, DE 19713, USA ("Factbed", "we", "us"). For the personal data described in this policy as ours, Factbed Inc. is the company responsible for it (the "controller" under EU and UK data protection law).
Questions about privacy go to [email protected].
2. What this policy covers
This policy covers the website at factbed.io, the Factbed dashboard, the API at api.factbed.io, the MCP server at mcp.factbed.io, the Factbed CLI, and emails between you and us. Together we call these the "service".
It doesn't cover the AI tools you connect to Factbed, such as Claude, ChatGPT or Cursor. They read and write facts on your behalf, and what they do with that data is governed by their providers' terms.
3. Your data and your workspace's data
Factbed is used by companies, so there are two kinds of data here.
- Data about you as a user or visitor, such as your account details and how you use the website. We decide how this is used, and this policy describes it.
- Data a customer stores in a Factbed workspace: facts, sources, files and their history. The customer decides what goes in, who can see it and how long it stays. We store and process it on the customer's behalf, following their instructions (in EU and UK terms, we are the "processor").
If your personal data is in a customer's workspace, for example a fact about you as one of their own customers, please contact that company first. If you contact us instead, we'll pass your request to them and help them answer it.
Please don't store sensitive personal data, such as health information, government ID numbers or payment card numbers, in facts.
4. What we collect and why
| What | Examples | Why we need it |
|---|---|---|
| Website visits | IP address, pages you visit, the page that sent you, browser and device type, approximate location worked out from your IP address | Serve and protect the website, and see which pages help people get started |
| Account | Work email, name, how you sign in (for example through your company's single sign-on), the workspaces you belong to and your role in each | Create your account, sign you in and control who can access what |
| Workspace content | Facts and their values, sources and dates, version history, review decisions and reasons, uploaded files | Provide the service: store, show and search your facts, and share them with the people and agents you choose |
| Agents and API keys | Names you give agents and keys, connected MCP clients, when each was last used | Show which person, agent or key wrote each version, and let you manage access |
| Usage and logs | How many times a day each fact is read, and by which person or agent; actions in the dashboard; API and MCP requests, including IP address and client details; error reports | Show read counts and activity, keep the service reliable and secure, and fix problems |
| Billing | Billing name and address, plan, invoices, card brand and last four digits | Charge for paid plans and keep the records tax law requires. Our payment processor handles card numbers; we never see them in full |
| Messages | Emails you send us and our replies | Answer you and help you set up |
How we use it
- To provide, maintain and secure the service, and to stop abuse.
- To send emails about your account: sign-in links, review requests, billing, and notices such as a warning before we change an inactive Free workspace. If we ever send product news, every one of those emails has an unsubscribe link.
- To understand how the website and product are used, so we can improve them. We look at this in aggregate wherever we can.
- To meet legal obligations, such as tax records or a valid legal request.
We don't use your data for advertising, and we don't build profiles of you to sell.
Legal bases (EU and UK)
If EU or UK data protection law applies to you, we rely on these legal bases:
- Contract: your account, your workspace and billing.
- Legitimate interests: security and server logs, counting visits without cookies, improving the product, and answering your messages. You can object to these, as section 10 explains.
- Consent: analytics cookies for visitors in the EU, EEA, UK and Switzerland. You can withdraw consent at any time in Cookie settings.
- Legal obligation: tax and accounting records, and responses to lawful requests.
6. AI features
Some Factbed features use AI models run by outside providers:
- Search: the text of your facts is converted into embeddings (numeric representations of meaning) so you can search by meaning, not only by exact words.
- Uploaded files: a file's text is sent to an AI model to write a summary and suggest facts. Suggested facts go to your review queue, and nothing becomes current until a person or reviewing agent confirms it.
We send each provider only what the feature needs. We don't use your workspace content to train AI models, and we only use AI providers whose terms forbid them from training on it. Each provider is listed in section 7 before it receives any data.
8. Where data is stored
Factbed is run from the United States, and our servers are in the United States. If you use Factbed from elsewhere, including the EU, UK or Switzerland, your data is transferred to the US. For those transfers we rely on safeguards the law recognizes, such as the EU-U.S. Data Privacy Framework (and its UK and Swiss extensions) where a provider is certified, or the European Commission's Standard Contractual Clauses.
9. How long we keep it
| Data | How long |
|---|---|
| Web server logs | 14 days |
| Website analytics | As long as it helps us understand how the site is used. It's linked to a visitor ID only while analytics cookies are on |
| Account | While your account is open, then deleted within 30 days of closing it |
| Workspace content | Until you or the workspace's admins delete it, or the workspace is closed. On the Free plan, versions older than 30 days are removed; current values are kept. If a Free workspace has been inactive for a long time, we email its owner before changing anything |
| Backups | Deleted data can remain in backups for up to 30 days |
| Billing records | As long as tax and accounting law requires, usually 7 years |
| Emails with us | As long as we need them to help you and keep a record of what we agreed |
10. Your rights
Wherever you live, you can ask us to:
- tell you what personal data we hold about you and give you a copy;
- correct data that's wrong;
- delete your data;
- give you your data in a format you can reuse. Workspace content can be exported as CSV or JSON at any time, without asking;
- stop using analytics cookies for you. You can do this yourself in .
Email [email protected]. We reply within 30 days, and we may ask you to confirm your identity first. It's free, and we won't treat you differently for asking. If the data belongs to a customer's workspace, we'll follow section 3.
EU, EEA, UK and Switzerland: you can also object to processing based on legitimate interests, ask us to restrict processing, and withdraw consent at any time. You have the right to complain to your local data protection authority. In the UK, that's the Information Commissioner's Office.
United States: some states give their residents specific privacy rights. We offer the rights above to everyone, so you don't need to show where you live.
11. Security
- Every connection to Factbed uses HTTPS, and our servers only accept web traffic that comes through Cloudflare.
- Each workspace's data is kept separate in the database, and access is checked on every request.
- API keys are stored as hashes, so they can't be read back after you create them.
- Only people who need access to production systems have it.
No system is perfectly secure. If a breach affects your personal data, we'll tell you and the relevant authorities as the law requires.
12. Children
Factbed is a product for businesses and isn't meant for anyone under 16. We don't knowingly collect personal data from children. If you think a child has given us personal data, email us and we'll delete it.
13. Changes to this policy
When we change this policy, we update the date at the top. For significant changes, we'll email account owners before the changes take effect. Adding a provider to the list in section 7 also counts as a change.
14. Contact us
Factbed Inc.
131 Continental Dr, Ste 305
Newark, DE 19713
USA