Legal

Privacy Policy

Effective date: February 1, 2026

This Privacy Policy explains how Cx5 Consulting LLC ("Cx5 Labs," "we," "us") collects, uses, stores, and protects information when you use the Cx5 OS application and the cx5labs.com website (together, the "Service").

Cx5 OS is a business operating-system tool used by companies. Much of the information in the Service is business and financial data that our customers choose to enter. This policy covers both that business data and the personal information of the people who use the Service.

1. Information we collect

Account and identity information. When you sign in, we collect your name and email address through your chosen sign-in method (Google sign-in or an email magic link). We use this to authenticate you and connect you to your company's workspace.

Business data you provide. To use Cx5 OS, you and your company enter business information into the Service. This may include financial figures (budgets, income-statement line items), operational metrics, key performance indicators, organizational structure, and customer-journey data. This data belongs to your company; we process it on your behalf to provide the Service.

Technical and usage information. We collect limited technical data needed to run the Service securely, such as authentication and session cookies and basic log information (timestamps, error logs).

We do not use advertising cookies, and we do not sell personal information.

2. How we use information

We use information to: provide and operate the Service; authenticate users and maintain security; isolate and protect each company's data; respond to support requests; and maintain and improve the Service. We do not sell your information or use your business data for advertising.

3. Where your data is stored, and who processes it (subprocessors)

We operate the Service using a small set of trusted third-party providers ("subprocessors"). Depending on how you use the Service, your data may be processed by:

  • Supabase — database and hosting. Your business data and account records are stored in a managed PostgreSQL database hosted in the United States.
  • Vercel — application and website hosting.
  • Google — sign-in (OAuth). If you sign in with Google, Google authenticates you and we receive your name and email address.
  • Anthropic — AI features. Cx5 OS includes optional AI-assisted features. When you use them, the data you submit for those features is transmitted to Anthropic's API to generate a response. Depending on your configuration, this may operate under an Anthropic API key that you provide and control, or under an API key that Cx5 Labs provides on your behalf. In either case, the data is processed by Anthropic under its applicable commercial terms. If you do not use the AI features, no data is sent to Anthropic.

Each subprocessor receives only the data needed to perform its function.

4. How we protect your data

We isolate each company's data using database-level row-level security, so one customer cannot access another customer's data. Data is encrypted in transit (TLS) and at rest. Access to production systems is limited. No system is perfectly secure, but we take measures appropriate to the sensitivity of financial data.

5. Data retention and deletion

We retain your data while your account is active or as needed to provide the Service. You can request access to, correction of, or deletion of your data by contacting us at privacy@cx5labs.com. When you ask us to delete your company's data, we will remove it from our active systems, subject to routine backups that age out on a rolling basis.

6. Your rights

Depending on your location, you may have rights to access, correct, export, or delete your personal information, and to object to or restrict certain processing. To exercise these rights, contact us at privacy@cx5labs.com. Because much of the data in the Service is controlled by your company (your employer), we may direct certain requests to your company's account administrator.

7. Children's privacy

The Service is a business product. It is not directed to children and is not intended for anyone under 18.

8. Changes to this policy

We may update this policy from time to time. We will post the updated version here with a new effective date.

9. Contact

Cx5 Consulting LLC
privacy@cx5labs.com