# Privacy policy

Last changed 2026-09-07.

This policy explains what **Context Engine** collects when you use it, what we do with it, which other companies handle it, and how long we keep it. It is written to match what the service actually does; where the code changes, this page is updated with it.

**Context Engine** is a trading name of **LTVplus LLC**, a Delaware limited liability company. "Context Engine", "we" and "us" all mean that company below, and it is the data controller for your account.

The short version: **your engine's content is yours, it is stored on Cloudflare, it is sent to models only to answer you, it is not used to train anything, and you can export or delete all of it yourself.**

## Which of us decides what happens to it

There are two answers, and which applies depends on which data you mean. Getting this the wrong way round is the most common way a policy like this misleads people, so it is stated before anything else.

**Your engine's content — you decide, and we act on your instructions.** The notes, records, files, conversations and everything else you put in or tell an engine to capture. You choose what goes in and why; we store it, index it, and send the relevant parts to a model when you ask something. In the language of the law you are the **controller** and we are your **processor**. The [data processing agreement](/dpa) is the contract for that half, it is part of your terms, and you do not need to ask for it or sign it.

**Your account and your use of the service — we decide.** Your email address, sign-in records, what you spent, what you wrote to support. Nobody instructs us to rate-limit sign-ins or meter tokens; we do those for our own reasons, so for this half we are the **controller** and this policy is what governs it.

Where a section below could mean either, it says which.

## What we collect

**Your account.** Your email address, which is how you sign in. A display name if you set one. If you sign in with Google or GitHub, the name and avatar from that profile, copied once when you first arrive.

**Sign-in records.** When you sign in, the IP address and browser of the session, kept with the session so you can see and end it. Recent sign-in attempts and email sends are counted by address and IP address to stop abuse. If you turn on two-step sign-in, the secret for it and your recovery codes are stored hashed.

**Your engine's content.** Everything you and your members put into an engine, and everything the engine captures on your instruction: notes, records, files and their extracted text, journal entries, tasks, conversations with the assistant, and audio you dictate, which is transcribed and then treated as text. Content that arrives through a service you connect is the same.

**Usage.** For each engine, how many messages were asked, how many model tokens were used and what they cost, how many web searches and page reads were made, and how much voice was used. This is what a plan's ceilings are measured against and what your bill is based on.

**Support.** What you write to us from the console, and a copy of a conversation if you choose to attach one.

**Connections.** When you connect another service, the authorisation for it is held by Composio, the broker we use, in an account that belongs to your engine. We store which services are connected and which tools they offer, not the credentials.

**Chat channels.** An owner can connect an engine to Telegram, Slack or Google Chat, so the engine can be talked to where a team already works. In a connected chat we keep, for each person who speaks to or mentions the engine, the identifier that platform gives them, their username and display name there, and when they were first and last seen. We keep it for people who are **not** members too — somebody in a group chat who talks to the engine once — because it is how the engine knows whether to answer them and how it avoids repeating an invitation they cannot use. It is removed when the engine is deleted. If you are in a chat with one of our engines and want your record removed sooner, email [hello@contextengine.com](mailto:hello@contextengine.com) — you do not need an account with us to ask.

**Payment.** If an account pays for a plan, we hold which plan it is on and when the billing period runs. Card details are entered on Stripe's own checkout page and never reach us; we do not collect payment card numbers in the product.

## What we use it for

- To run the service: storing your content, indexing it for search, and sending the relevant parts of it to a model when you ask a question or an agent acts for you.
- To sign you in, keep your session, and stop somebody else from signing in as you.
- To enforce plan limits, and to bill paid plans.
- To answer support requests.
- To find and fix faults. Our logs record what happened, which engine it happened to, and an error id; they never contain the content of a note, a message, a search or a model answer.

We do not use your content to train models. We do not sell it, and we do not use it for advertising.

## What allows us to

Data protection law asks us to name a legal basis for each of those, rather than just a reason. For the half where we are the controller:

- **Running the service, signing you in, and billing you** — we need to do these to give you what you signed up for. The basis is **performance of a contract**.
- **Stopping abuse, finding and fixing faults, and keeping the service secure** — the basis is our **legitimate interests** in operating a service that works and is not being attacked. We use the least data that answers the question: counts and identifiers rather than content, which is why our logs carry no message, prompt or search text.
- **Answering you when you write to support** — performance of a contract where it concerns your account, and legitimate interests otherwise.
- **Keeping records we are required to keep**, such as for tax — the basis is a **legal obligation**.

For the half where we are the processor, the basis is not ours to choose: **the company running the engine decides why the content is there, and needs its own basis for it.** The [data processing agreement](/dpa) says so, and says what we do and do not do with the content in the meantime.

Where we rely on legitimate interests you can object, and we will stop unless we have grounds that override yours. Ask at [hello@contextengine.com](mailto:hello@contextengine.com).

## Who else handles it

Everything below is a company we have chosen to run part of the service on. Each receives only what its part needs.

| Who | What they do | What reaches them |
| --- | --- | --- |
| **Cloudflare** | Hosts the whole service: the database, the file store, the search index, the models that answer questions, the mail that sends sign-in codes, and the check that stops bots signing up. | Everything, because the service runs there. Model calls pass through Cloudflare's AI Gateway, which records the model, token counts and cost of each call and **not** the prompt or the answer. |
| **A web search provider** | Answers when the assistant searches the web. Serper by default, which resells Google's results, so a query reaches Serper and Google; or Brave where a deployment is configured for it. | The search query only. No engine name, no account, no conversation. |
| **Composio** | Brokers connections to other services such as Gmail or Drive, and holds the authorisations for them. | The authorisation, and a file when you ask the assistant to send one to a connected service, which is then a copy in Composio's storage on their retention. |
| **Stripe** | Takes payment for paid plans and holds the subscription. | Your email address, and what the account is subscribed to. Your card details go to Stripe directly on their own checkout page and are never seen by us. |
| **Telegram, Slack, Google Chat** | Carry the conversation when an owner has connected the engine to a chat channel. | What the engine says in that chat and what is said to it there, and — from the platform to us — who spoke, as described above. Only for a channel somebody has connected. |
| **Google, GitHub** | Sign-in, if you choose it. | That you signed in, and to us your name, email and avatar. |
| **ElevenLabs** | Speech, only if an owner has put their own ElevenLabs key into an engine. | The text being spoken, under that owner's own account with them. |
| **The service you connect** | Whatever you connect, acting on your instruction. | What the assistant sends it when you ask, and what you tell it to fetch. |

Reading a web page sends nothing of yours anywhere: the page is fetched from its own site, which learns only that it was fetched.

**This table is the list, not an example of one.** Each company on it is bound by written terms no less protective than ours, and we stay responsible for what they do with your data. **Before we add a company to it, we email every engine owner at least thirty days beforehand**, so that anybody who objects has time to say so — the [data processing agreement](/dpa) sets out what happens if you do.

## Sending data outside your country

We are a company in the United States, so running the service moves data there. That is true whatever you choose below.

For personal data that comes from the European Economic Area, the United Kingdom or Switzerland, we rely on the European Commission's **Standard Contractual Clauses**, and their UK addendum, as the legal mechanism for the transfer. They are built into the [data processing agreement](/dpa). Where we pass data on to one of the companies in the table above, the same clauses — or an equivalent approved mechanism — apply between us and them.

An owner who chooses **European Union** placement keeps that engine's database and stored files in the EU, which is described in the next section. That is a real limit on where data sits at rest, and it is not the same thing as the data never reaching the United States: we operate from there, so administering the service does.

## Where it is stored

Every engine's content and its record of changes are stored in Cloudflare's network. An owner who chooses **European Union** when creating an engine has that engine's database and stored files placed in the EU, and this cannot be changed afterwards.

That choice covers storage. It does not cover the search index built from the content, or the model that answers questions, because no region control is published for either. We say "database and stored files" rather than "residency" for exactly this reason, and we will not claim more than that until we can keep it.

Sending a file to a connected service copies it outside that boundary, whatever the engine's placement. The manual says so on the connections and files topics.

## How long we keep it

**Your engine's content** is kept until you delete it. Deleting a record or a file removes it from the engine; deleting the engine removes everything.

**Deleting an engine** is something an owner does in the console. It takes effect after a day, during which the engine stays open so you can change your mind or take an export. When it runs, it removes the engine's database, search index, stored files, its rows in every nightly backup, its account records, and any authorisations naming it. Nothing of the engine is kept afterwards except a log line saying that it was deleted.

**An engine that a subscription has lapsed on** is not deleted. It is frozen read-only, as the [terms](/terms) say, until its owner deletes it.

**Nightly backups** of the account database are kept for 30 days.

**Per-call usage events** are kept for 45 days. Monthly totals per engine are kept for as long as the engine exists, because they are what your bills are based on.

**Sign-in sessions** last 30 days unless you end them sooner. Sign-in codes and links expire in minutes.

**Support requests** are kept so we can answer them and so you can read the thread back.

**Your account** is kept until you ask us to close it. Closing it removes your email address, name and sign-in records; the content of engines you were a member of belongs to those engines and stays with them.

## Cookies

Two, and both are needed for the product to work at all. One keeps you signed in; one remembers the colour a white-labelled engine is meant to be, so the page does not flash the wrong one while it loads.

There is no third. We run no analytics, no advertising pixels and no third-party trackers of any kind, which is why you have never been asked to accept cookies here and will not be.

## Age

Context Engine is a tool for work, and it is not for children. You must be **eighteen or over** to have an account, and you may not create one for somebody who is not.

We do not knowingly collect anything about children. If you believe a child's personal data has reached us — including through an engine somebody else set up — tell us at [hello@contextengine.com](mailto:hello@contextengine.com) and we will remove it.

## If something goes wrong

If personal data is lost, exposed, or reached by somebody who should not have reached it, we will tell you **without undue delay**.

Where the engine's content is affected, we tell the engine's owner, because it is their data and they may have their own seventy-two hour deadline to a regulator — reaching them quickly enough to make that possible is what the [data processing agreement](/dpa) commits us to. Where your account data is affected, we tell you directly, and we tell the relevant supervisory authority ourselves where the law requires it.

We will not wait for a complete picture before making contact. The first message will say what we know, which engines are affected, and what we suggest you do; the detail follows as we establish it.

## Your rights

You have the usual rights over personal data about you: to get a copy of it, to correct it, to have it deleted, to restrict or object to what we do with it, and to receive it in a portable form. How you exercise them depends on which half of the split above the data sits in.

**Your account.** Ask us. Change your name on the Account page, see which engines you belong to, and for anything else — a copy of what we hold, a correction, closing your account — write from the console at [/help/write](/help/write), or email [hello@contextengine.com](mailto:hello@contextengine.com) if you have no account. We answer within a month, and we will not charge you for it.

**Content inside an engine.** Mostly you do it yourself: search it, correct a record, delete one, and **export the whole engine** as a ZIP of Markdown and JSON. An owner can **delete an engine** outright.

**Content inside somebody else's engine.** If a company put your data into an engine they run, they decide what happens to it, not us — so ask them first. If you cannot reach them, or you do not know who they are, write to us and we will either pass the request on or tell you who to ask. This is the usual case for somebody whose messages an engine has seen on a connected chat channel.

We do not make decisions about you by automated means that produce legal or similarly significant effects, so there is no right to object to one.

If you are in the EU or the UK, you can complain to your data protection authority. We would rather you told us first, and we will treat that as seriously as a regulator would.

## Changes to this policy

When the service changes in a way that changes what this page says, this page changes with it. The date at the top is when it was last changed. For a change that reduces what we promise here, we email every owner before it takes effect.

## Contact

**Context Engine** is a trading name of **LTVplus LLC**, which is the data controller for your account and the company you are contracting with. For anything that has to reach the company by post — the company is registered in Delaware and its mailing address is in Florida:

LTVplus LLC, 1032 E Brandon Blvd #1003, Brandon, FL 33511, United States.

Write to us from the console at [/help/write](/help/write), or email [hello@contextengine.com](mailto:hello@contextengine.com). Either reaches us faster than the post.