Skip to main content

Privacy Policy

Last updated: July 11, 2026

This Privacy Policy explains how Celesto AI, Inc., a Delaware corporation ("Celesto AI", "we", "us", or "our"), collects, uses, and shares personal information when you visit celesto.ai, use our products and services, or otherwise interact with us. We are registered in the State of Delaware and operate a global headquarters in London, United Kingdom. If you do not agree with this policy, please do not use our services.

We design for security and privacy from day one.

Scope

This policy applies to visitors to our website and users of Celesto AI's software and integrations. When we process personal information on behalf of a customer through connected systems (for example, CRM, DMS, or other APIs), we act as a processor/service provider. In those cases, the customer's privacy policy governs and you should direct requests to that organization.

Information We Collect

  • Information you provide: account details, contact information, messages, preferences, and payment/billing details (processed by our payment processor; we do not store full card numbers).
  • Usage and device data: depending on your cookie choices, this may include pages viewed, links clicked, browser and operating-system details, performance data, device or browser identifiers, approximate location derived from an IP address, and referring URLs. We use cookies and similar technologies to operate, secure, measure, and improve the service.
  • Integrations data: data from systems you connect (e.g., CRM, DMS, email, document storage, custom APIs) as configured by you. We access and process this data only to provide the features you enable.
  • Communications: support requests, feedback, and other communications.

How We Use Information

  • Provide, operate, and secure the services.
  • Process transactions and manage accounts and subscriptions.
  • Integrate with third‑party systems at your direction.
  • Monitor performance, troubleshoot errors, and improve features, using optional analytics only when you allow it.
  • Communicate about updates, security, and service‑related notices.
  • Comply with legal obligations and enforce terms.

Legal Bases (EEA/UK)

Where applicable, we rely on:

  • Performance of a contract (to provide the services you request).
  • Legitimate interests (to secure and operate our services, prevent abuse, and diagnose errors).
  • Consent (for analytics and marketing cookies or similar technologies where required).
  • Legal obligation (to comply with the law and lawful requests).

Sharing of Information

  • Vendors and service providers who perform services for us.
  • Third‑party systems you connect, strictly at your direction.
  • Analytics and performance providers, including Google Analytics 4, PostHog, Vercel Analytics, and Vercel Speed Insights, when you allow analytics.
  • Business-visitor identification providers, including RB2B, when you allow marketing.
  • Professional advisors, law enforcement, or regulators as required by law.
  • Business transfers in connection with a merger, acquisition, or sale.

Data Retention

We retain personal information for as long as necessary to provide the services, comply with legal obligations, resolve disputes, and enforce our agreements. Retention periods differ based on the data type, purpose, and provider. Withdrawing optional cookie consent stops future collection through those tools in your browser and removes known Google Analytics and RB2B browser cookies; it does not require us to delete information that was lawfully collected before withdrawal. You may separately request deletion where applicable.

Security

We employ administrative, organizational, and technical safeguards designed to protect personal information. No system is 100% secure; we cannot guarantee absolute security of information transmitted or stored.

International Transfers

We may transfer, store, and process information in countries other than your own. Where required, we use appropriate safeguards (such as Standard Contractual Clauses) for cross‑border transfers.

Your Rights

Depending on your location, you may have rights to access, correct, delete, or restrict the processing of your personal information, as well as the right to data portability and to object to certain processing. If our processing is based on consent, you may withdraw consent at any time.

California residents may have additional rights under the CCPA/CPRA, including rights to know, delete, correct, and opt out of certain sharing. We do not sell personal information as defined by the CPRA.

To exercise rights, contact us at privacy@celesto.ai. If we process your information on behalf of a customer, please direct your request to that customer.

Cookies and Tracking

We separate browser storage and tracking technologies into necessary, analytics, and marketing categories. Optional tools do not load unless you allow the matching category.

Necessary

Necessary storage supports authentication, security, your cookie preferences, and core service operation. Sentry also processes limited operational telemetry so we can diagnose errors and maintain reliability. Sentry remains active without optional consent, but we disable default PII collection and remove cookies, query strings, URL fragments, and known private route identifiers from events before they are sent.

Analytics

If you allow analytics, we use Google Analytics 4, PostHog, Vercel Analytics, and Vercel Speed Insights to understand product usage, page performance, and errors. We remove query strings, URL fragments, authentication handshake values, shared trace tokens, and computer identifiers from analytics URLs before transmission. For signed-in users who allow analytics, PostHog may receive a stable Celesto user ID, account email address, and user type so activity and session replays can be associated with the correct account.

Marketing

If you allow marketing, RB2B uses first-party cookies and related technical data to identify organisations and business visitors showing interest in Celesto. This may allow RB2B or its data partners to associate site activity with business contact information held by them. RB2B cookies can include persistent visitor, attribution, geolocation, session, and identity-resolution identifiers.

Your choices

You can accept all optional tools, customise analytics and marketing separately, or continue with necessary storage only. Open Cookie settings in the footer to review or change your choice at any time. Changes apply across open Celesto tabs. When you withdraw consent, we stop the affected tools, reload open tabs where needed, and remove known Google Analytics and RB2B cookies from the Celesto domain. Withdrawing consent does not affect the lawfulness of earlier processing.

Our providers receive only the information needed to operate their services and are required to safeguard it. See our subprocessor registry for more information.

You may also opt out directly through Retention.com and use the RB2B GDPR opt-out form.

Children's Privacy

Our services are not directed to children under 16, and we do not knowingly collect personal information from children. If you believe a child has provided us information, contact us and we will take appropriate steps.

Do‑Not‑Track

Some browsers send Do‑Not‑Track (DNT) signals. We do not currently respond to DNT signals.

Changes to This Policy

We may update this policy from time to time. The "Last updated" date at the top reflects the most recent changes. Your continued use of the services means you acknowledge the updated policy.

Contact Us

Questions or requests? Email us at privacy@celesto.ai.

You can also reach us by mail at:

Celesto AI, Inc.
2810 North Church Street
Suite 90391
Wilmington, DE 19802
United States