Continuous

Continuous LLC (cntnus) Global Privacy Policy

Effective Date: October 22, 2026

Version: 2026.10

Continuous LLC ("cntnus," "we," "us," or "our") respects your privacy and engineers our applications around data minimization, tenant isolation, and cryptographic security. This Privacy Policy explains how we collect, use, disclose, and safeguard information across all *.cntnus.app websites, applications, and APIs.

1. Our Role: Data Controller vs. Data Processor

Depending on how you interact with cntnus Services, we act in two distinct legal capacities:

  • cntnus as Data Controller: When we collect your account registration details (via Ulex), billing information, security audit logs, and first-party usage telemetry, we determine the purposes and means of processing.
  • cntnus as Data Processor / Service Provider: When you store records in our DBaaS, write notes in our wikis, sync files, or route webhooks/secrets through our APIs ("Customer Content"), you are the Data Controller and we process that data strictly on your instructions.

2. Categories of Information We Collect

  1. Identity & Authentication Data: Email address, display name, organization ID, OAuth 2.1 / OIDC subject identifiers (sub), SAML assertions, or X.509 certificate metadata.
  2. Technical, Security & Edge Telemetry: IP addresses, TLS/HTTP request headers, browser user-agent strings, rate-limiting counters, and API/MCP invocation logs required to prevent DDoS, SSRF, and unauthorized access.
  3. Service-Specific Operational Data:

Link Intelligence / Shorteners:* When an end user clicks a shortened link, we process edge request metadata (timestamp, coarse geographic region derived from IP, referrer, and device type) to execute the redirect and provide aggregate analytics.

Zero-Knowledge Secret Sharing:* We store only ciphertext payloads and DynamoDB Time-to-Live (TTL) expiration timestamps. Decryption keys kept in URL fragments (#key) are never transmitted to our servers.

Public Blockchain Indexers:* We index public Handshake (HNS) blockchain addresses, name auctions, and DNS records directly from public nodes.

3. How We Use Your Information

We process Personal Information solely to:

  • Authenticate users and autonomous agents via host-only (__Host-) session cookies and cryptographic tokens;
  • Provision, route, and scale serverless compute and storage resources;
  • Detect and mitigate security threats, fraud, bot abuse, and Denial-of-Wallet attacks;
  • Process subscription payments via our third-party payment processor (Stripe);
  • Comply with applicable legal obligations.

No Sale of Personal Information & No AI Training on Private Data: We never sell your Personal Information to data brokers, and we never share your Personal Information for cross-context behavioral retargeting. We do not use private Customer Content to train foundational AI models.

4. Global Privacy Control (GPC) & Universal Opt-Out Mechanisms

In compliance with 2026 US state privacy laws (including California CPRA, Colorado CPA, Connecticut CTDPA, Texas TDPSA, Delaware, Montana, Nebraska, New Jersey, and others), all cntnus web properties automatically detect and honor the Global Privacy Control (Sec-GPC: 1) HTTP header and navigator.globalPrivacyControl browser signal.

  • Frictionless Enforcement: When a GPC signal is detected, our applications immediately suppress any non-essential analytics or third-party scripts without requiring any pop-up confirmation or account login, and reflect "Opt-Out Signal Honored (GPC)" in the site footer/privacy status indicator.

5. Your Multi-Jurisdictional Privacy Rights (US States, GDPR, UK)

Depending on your residency, you have the right to:

  • Access & Portability: Request a machine-readable export of the Personal Information we hold about you.
  • Correction: Update inaccurate account information via your Ulex profile settings.
  • Deletion ("Right to be Forgotten"): Request permanent deletion of your account and associated Customer Content. (Note: We cannot alter or erase records written to decentralized public blockchains such as Handshake, nor can we identify or delete zero-knowledge encrypted payloads prior to their automatic TTL expiry without the payload token).
  • Appeal: If we decline to take action on a privacy request, you may appeal our decision by emailing privacy@cntnus.app with the subject line "Privacy Appeal".

To exercise any of these rights, use the self-serve deletion/export controls in your account settings or contact privacy@cntnus.app. We respond to all verifiable requests within 30 days (and never later than the 45-day statutory maximum).

6. Data Retention, Cookies & Security

  • Cookies: We rely primarily on strictly necessary, first-party __Host- prefixed cookies for session security and localStorage for UI theme preferences (theme-init.js).
  • Retention: Account data is retained while your account is active and purged within 30 days of account deletion (with encrypted database backups rotating out within 90 days). Ephemeral logs and TTL secrets expire automatically per configured schedules.
  • International Transfers: Our primary serverless infrastructure is hosted in the United States on Amazon Web Services (AWS) and Cloudflare. For EEA/UK users, cross-border transfers are governed by the EU-U.S. Data Privacy Framework and Standard Contractual Clauses (SCCs).