Privacy Policy
1. Who we are
Confiway is operated by Confiway, MB, a company registered in Lithuania (company code: 307494063), Naujakurių g. 33-76, LT-47118 Kaunas, Lithuania ("Confiway", "we", "us").
This policy explains what personal data we collect, why, who we share it with, how long we keep it, and what rights you have. It applies to confiway.com and to the Confiway product.
For any privacy question or request, email inbox@confiway.com.
Effective date: 22/09/2026
2. Whose data this covers, and our role
We handle three kinds of data, and our legal role differs for each.
| Data | Whose data | Our role |
|---|---|---|
| Contact form submissions | Website visitors | Controller |
| Account data (name, email, company) | Confiway users | Controller |
| Workspace data from connected tools (Linear, GitHub), briefings, chat history | Our customers' employees and collaborators | Processor, on behalf of the customer |
If you use Confiway through your employer: your employer (our customer) decides which tools to connect and is the controller of your workspace data. We process it only to provide the service to them, under our agreement with them. You can contact us directly and we will help, but some requests may need to go through your employer.
3. What we collect
We collect only what we need to run the service. We do not use analytics or tracking tools on our website.
Contact form. When you use the form on confiway.com, we receive the details you enter, such as your name, email, company and message.
Account data. When you create an account, we collect your full name, email address and company name.
Sign-in data. You sign in with a magic link sent by email, or with a passkey. For passkeys we store only a public key. Your fingerprint, face or device PIN never leaves your device.
Workspace data from connected tools. When your organisation connects a tool, we read and store content from it, including:
- Linear: issues, issue descriptions, comments, statuses, assignees and related metadata.
- GitHub: pull request metadata, reviews and review comments.
This content can include names, usernames and anything people wrote in those tools.
Product usage. We store the briefings Confiway generates and your conversations with the assistant.
Technical data. Our servers record basic technical information, such as IP address and browser type, to keep the service running and secure.
4. How we use it, and our legal basis
We use personal data only for the purposes below. Where we act as controller, the GDPR requires a legal basis for each.
| Purpose | Data used | Legal basis (GDPR) |
|---|---|---|
| Reply to your enquiry | Contact form data | Legitimate interest in responding to people who contact us |
| Create and run your account, send sign-in links | Account and sign-in data | Performance of our contract with you |
| Generate briefings and answer your questions | Workspace data, product usage | Performance of our contract with the customer (we act as processor) |
| Keep the service secure, prevent abuse, fix errors | Technical data, and other data only when strictly needed | Legitimate interest in a secure, working service |
| Meet legal obligations | Any data a law requires | Legal obligation |
We do not use your data for advertising or marketing. We do not make decisions about you that have legal or similarly significant effects based solely on automated processing.
5. How we use AI
Confiway uses large language models (LLMs) from third-party AI providers to generate briefings and answer questions. The providers we currently use are listed in section 6. Whichever provider we use, the same rules apply:
- Data minimisation: we send only the workspace data and chat messages needed for a specific request.
- No training: we do not use your data to train or fine-tune AI models. We only use providers whose terms prohibit training on the data we send them.
- Limited retention: we only use providers that delete the data we send within 30 days, except where they must keep it longer to enforce their usage policies or comply with law.
- No evaluation datasets: we do not build test or evaluation sets from your data, and our logs do not record prompts containing it.
6. Who we share data with
We share personal data only with the service providers below ("sub-processors"), and only what each needs to do its job. Each is bound by a data processing agreement.
| Provider | What they do for us | Data involved | Location |
|---|---|---|---|
| netcup GmbH | Hosts our application and database | All account, workspace and product data | Germany (EU) |
| Anthropic PBC | AI model that generates briefings and answers | Workspace data and chat messages needed for each request | United States |
| Twilio Inc. (SendGrid) | Sends emails, such as sign-in links | Name, email address, email content | United States |
| Web3Creative (Web3Forms) | Receives and forwards contact form submissions | What you enter in the contact form | United States (servers); company based in India |
We will update this list before adding a new sub-processor.
We may also disclose data when the law requires it, or to a buyer if Confiway is sold or merged. In that case we will tell you before your data becomes subject to a different privacy policy.
We do not sell personal data. We do not share it for advertising or cross-context behavioural advertising.
7. Where your data is stored and transferred
We store all data in the EU, on servers in Germany. This applies to every customer, including customers outside the EU.
Some sub-processors process data in the United States. When personal data leaves the European Economic Area, we rely on these safeguards:
- Anthropic: EU Standard Contractual Clauses, incorporated in Anthropic's data processing addendum.
- Twilio (SendGrid): the EU-U.S. Data Privacy Framework, under which Twilio is certified.
- Web3Forms: Standard Contractual Clauses in the provider's data processing agreement.
You can ask us for a copy of the relevant safeguards at inbox@confiway.com.
8. How long we keep data
We keep your data while your account is active and delete it when the account is deleted.
| Data | How long we keep it |
|---|---|
| Account data, workspace data, briefings, chat history | Until the account is deleted |
| Pilot data | Deleted automatically when the pilot ends, unless the customer asks us to keep it |
| Contact form messages | Up to 36 months, unless you become a customer |
| Server logs (technical data) | 90 days |
| Data sent to AI providers | Deleted by the provider within 30 days, as described in section 5 |
Deleting your account. Email inbox@confiway.com and we will delete your account within 30 days, usually much sooner. Deleted data is removed from our live systems immediately. Copies remain in encrypted backups for up to 30 days and are then permanently overwritten. We never restore deleted data from backups. Customers can also ask us to delete all data for their organisation.
If a law requires us to keep specific data longer, we keep only that data and only for as long as required.
9. How we protect your data
We use technical and organisational measures that fit the sensitivity of the data we handle:
- Encryption in transit: all traffic to and from Confiway uses TLS.
- Encryption at rest: stored data, including content from connected tools, is encrypted.
- Separation between customers: each organisation's data is kept separate from every other organisation's.
- Passwordless sign-in: magic links and passkeys, so there are no passwords to steal.
- Limited human access: our team accesses production data only when it is the only way to resolve a specific technical problem, and only to the extent needed.
No system is perfectly secure. If a personal data breach affects your data, we will notify affected customers without undue delay, and no later than 48 hours after we become aware of it. Where required, we will also notify the supervisory authority within 72 hours.
10. Your rights
Under the GDPR you have the right to:
- Access the personal data we hold about you and get a copy.
- Correct data that is wrong or incomplete.
- Delete your data.
- Restrict how we process your data.
- Object to processing based on our legitimate interests.
- Portability: receive your data in a machine-readable format, or have it sent to another provider.
- Withdraw consent at any time, where we rely on consent.
- Complain to a data protection authority.
How to use them. Email inbox@confiway.com. We respond within one month, free of charge. We may ask you to confirm your identity first. If your request concerns workspace data your employer controls, we will help you and involve your employer where needed.
Complaints. Our lead supervisory authority is the Lithuanian State Data Protection Inspectorate (Valstybinė duomenų apsaugos inspekcija), L. Sapiegos g. 17, LT-10312 Vilnius, vdai.lrv.lt. You can also complain to the authority in the EU country where you live or work. We would appreciate the chance to resolve your concern first.
11. If you are in the United States
We apply the same privacy protections to every user, wherever they are. If you live in a US state with a consumer privacy law, such as California, you have the right to:
- Know what personal data we collect, use and disclose, and receive a copy.
- Correct inaccurate personal data.
- Delete your personal data.
- Opt out of the sale or sharing of personal data, or its use for targeted advertising. We do none of these, so there is nothing to opt out of.
- Not be discriminated against for using any of these rights.
The categories of personal data we collect are described in section 3, the purposes in section 4, and the recipients in section 6. We do not collect sensitive personal information as defined by California law, other than account sign-in credentials used only to secure your account.
To make a request, email inbox@confiway.com. You can use an authorised agent; we may ask the agent for proof of authority and ask you to verify your identity. If we deny your request, you can appeal by replying to our decision, and we will respond within 45 days.
12. Cookies
We use only cookies that are strictly necessary to keep you signed in and to keep the service secure. We use no analytics, advertising or tracking cookies, so we do not show a cookie banner. If this changes, we will ask for your consent first.
13. Age limit
Confiway is a business service for people aged 18 and over. We do not knowingly collect data from anyone under 18. If you believe we have, email us and we will delete it.
14. Changes to this policy
We will post any update on this page and change the effective date. For material changes, such as a new category of data or a new sub-processor, we will notify customers by email before the change takes effect.
15. Contact us
Confiway, MB
Naujakurių g. 33-76, LT-47118 Kaunas, Lithuania
inbox@confiway.com