Privacy Policy
Effective date: 11 November 2026
CAI ("CAI," "we," "us") is operated by Nordic Raven Solutions. This policy explains what data CAI collects, why, who we share it with, and what rights you have over it.
CAI is a decision aid for business ideas: you share a social post, a tweet, or a web link into the app, and a panel of AI models evaluates it as a money-making opportunity for you specifically, then keeps it in a ranked shortlist. Everything below describes the data behind that.
1. What we collect
Account data. When you sign up, we collect your email address and (for email/password sign-up) a password, which is stored securely by our authentication provider (Supabase) and is never visible to us in plain text. If you sign in with a provider such as Google or Apple, we receive your email and basic profile information from that provider.
Your context. To personalize how ideas are ranked, we store the answers you give about yourself: your goal and ambition (for example side income, replacing a job, or building a sellable asset, and your target), your means (what you know, your interests, your network), and your capacity (your available time, runway, and tolerance for risk). You provide this; you can review and change it in the app.
Submissions and evaluations. When you submit an idea, a link, or a video, we store what you submitted and the evaluation the panel produces (its ranking, reasoning, and suggested next step), together with whether you later mark the idea as tried and how it went.
Payment status. Some features spend credits. You can buy credits through the App Store or Google Play as an in-app purchase; in the United States you can also check out through Stripe in your browser. The payment itself is handled by Apple, Google, or Stripe, and we never see or store your card details. We use RevenueCat to keep track of what you've purchased across those stores. We store your credit balance and a record of your purchases and usage, linked to your account.
Technical data. Standard operational data our infrastructure providers generate in the course of running the service (for example server request logs), used only for debugging and keeping the service running.
2. How the content you share is read
How a submission is read depends on what it is:
- Reels (TikTok / Instagram). A reel you share is read on your own device, over your own connection: the app pulls the caption, the spoken-word subtitle track, the public engagement numbers, and the top comments. We do not run accounts or scrapers on your behalf, and our server never downloads the video.
- A reel's spoken audio, when there is no subtitle track. If a reel has spoken words but no subtitle track to read, your device sends just that clip's audio to our server, which passes it to Groq to transcribe into text. The audio is used only to produce the transcript and is not stored.
- A plain web page or tweet. These have no on-device step, so our server (hosted on Fly.io) fetches the page itself to read its text.
- Text you paste. Used as-is.
YouTube links are not supported.
3. Who we share data with (subprocessors)
We use a small number of third-party services to run CAI. We don't sell your data to anyone, and we don't use it for advertising.
| Service | What it handles |
|---|---|
| Supabase | Account authentication, and your profile, submissions, evaluations, and credit balance. Our primary database. |
| Anthropic (Claude) (United States) | A member of the AI panel, and the "chair" that writes the final verdict. Receives the content you submit and your profile context to produce an evaluation. Processes data in the United States under its commercial terms, under which it states your content is not used to train its models. Governed by Anthropic's commercial terms. |
| xAI (Grok) (United States) | A member of the AI panel. Receives the content you submit and your profile context to produce its part of the evaluation, under xAI's API terms. |
| Google (Gemini) | A member of the AI panel (the leg that judges technical feasibility and breadth). Receives the content you submit and your profile context to produce its part of the evaluation, under Google's API terms. |
| Groq (United States) | Transcribes a shared reel's spoken audio into text when the reel has no subtitle track. Receives only that clip's audio, not your profile or other data. The audio is not stored. Processes data in the United States under its API terms. |
| Fly.io (EU, Amsterdam) | Hosts the backend server that fetches plain web pages and tweets, relays reel audio to Groq, and sends submissions to the AI panel. Infrastructure only; it does not independently process or retain your data beyond standard operational logs. |
| Stripe (US web checkout) | Processes credit purchases made through the optional web checkout offered to users in the United States, on its own hosted checkout page in your browser. Your card details are handled by Stripe, never by us. We receive only the result (that a purchase succeeded) so we can add the credits to your balance. |
| RevenueCat | Keeps track of your credit purchases across the App Store, Google Play, and Stripe. Receives your purchase events and an opaque account identifier, never your card details, name, email, or the content you submit. |
3a. International data transfers
Your account and content are stored with Supabase, and our backend server runs in the EU (Amsterdam). Some of our AI providers, however, process the specific content you send to an AI feature outside the EU, including in the United States (Anthropic, xAI, and Groq), and Google may process it on a global endpoint. These transfers rely on the safeguards those providers offer, such as the EU-US Data Privacy Framework and the European Commission's Standard Contractual Clauses, together with each provider's data processing agreement. We send only the specific content a feature needs to do its job.
4. Your rights
Since we operate from Denmark, GDPR applies to everyone who uses CAI, not just EU residents. You have the right to:
- Access the data we hold about you.
- Correct inaccurate data (most of your context you can already change yourself, in-app).
- Delete your account and personal data. This is built directly into the app: Settings → Delete My Account. It permanently removes your account, your profile, your submissions, and your evaluations. Deletion is immediate and cannot be undone.
- Export your data, or ask us to stop processing it, by contacting us (below).
5. Data retention
We keep your data for as long as your account is active. If you delete your account, your personal identity (email, login), your profile/context, your submissions, and your evaluations are removed immediately. We keep only what the law requires us to retain (for example, basic records of a purchase for tax and accounting).
6. Children
CAI is a tool for adults making business and money decisions. It is not directed to children, and we do not knowingly collect personal data from anyone under 16. If you believe a child has created an account, contact us and we will remove it.
7. If something goes wrong
If we discover a security incident that results in unauthorized access to, loss of, or exposure of your personal data, we'll notify you by email at the address on your account, without undue delay and within the timeframe GDPR requires. Where GDPR requires it, we'll also notify the relevant data protection authority within 72 hours of becoming aware of a breach.
8. Changes to this policy
If this policy changes in a material way, we'll update the effective date above and, where required, notify you directly.
9. Contact
Questions, data requests, or concerns: support@nordicravensolutions.com
CAI is operated by Nordic Raven Solutions, Guldsmedgade 21.4, 8000 Aarhus, Denmark.