Privacy Policy

Eridian Corporation, a Delaware corporation at 251 Little Falls Dr, Wilmington, Delaware 19808, USA, is responsible for the personal information described in this notice. Contact us at security@eridian.ai.

This notice covers our public website, related business inquiries, and the usage data described in section 10. Customer data processed through Forge or an engagement is handled under the applicable customer agreement and instructions. This notice does not expand our rights to use that data. If your information was provided by one of our customers, contact that organization about its use of your information.

• Inquiries: your email address and the location of the contact form you used, followed by any information you choose to provide in correspondence. A hidden form field helps detect automated submissions. Form submissions are forwarded to our team by email through Cloudflare’s email service.
• Website requests: information such as your IP address, browser, device, requested page, referrer and request time, processed by our hosting and delivery providers to serve and protect the website.
• Optional analytics: page visits, browser and device information, referral information and pseudonymous identifiers when site analytics is on (see section 4). Our PostHog configuration disables session replay and automatic capture of form inputs and clicks.
• Optional marketing and visitor identification: when this category is on, Google Analytics, Apollo and Albacross may collect device or cookie identifiers, IP addresses, browsing activity and referral information. Apollo and Albacross can associate visits with businesses or professional profiles using information they hold.
• Preferences: your light or dark theme choice and your privacy choices.

We receive inquiry information directly from you, technical information from your browser and providers, and business-identification information from the optional marketing providers. The contact form asks only for an email address; please do not submit sensitive personal information.

We use information to respond to inquiries, discuss potential engagements, operate and secure the website, investigate misuse, maintain business records and meet legal obligations. We also use optional tools, as section 4 describes, to understand website performance, measure marketing and identify potential business customers. You can ask us to stop direct marketing at any time.

Where UK or European data-protection law applies, our legal bases are our legitimate interests in responding to business inquiries and operating a secure website; steps requested before entering a contract or performance of a contract with you where applicable; compliance with legal obligations; consent for the optional tracking described below where the law requires it; and, in the UK and Switzerland, our legitimate interests in site analytics, which only measures how the website is used.

You may object to processing based on legitimate interests, including direct marketing, by emailing security@eridian.ai. Providing inquiry information is voluntary, but we need a way to contact you to respond.

Optional tracking has two categories: site analytics, and marketing and visitor identification. Its default depends on where you visit from, which we estimate from your IP address.

• In the EEA, Gibraltar, the Channel Islands and the Isle of Man: optional tracking is off until you choose to allow it. A bar at the bottom of the page lets you accept or reject both categories, or choose each one in Settings. We ask again after 180 days. If we cannot tell where you are, we treat you as being in this group.
• In the UK and Switzerland: site analytics is on by default, because it only produces statistics about how the website is used, which we use to improve it. You can turn it off through Cookies in the footer. Marketing and visitor identification stays off until you choose to allow it, and we ask again after 180 days.
• Everywhere else: both categories are on by default. You can turn either one off through the Cookies link in the footer. Your opt-out stays in place until you change it or clear your browser storage.

You can change your choice at any time through Cookies in the footer. Rejecting or turning off optional tracking does not prevent you from browsing the website or contacting us.

Manage cookies

• Essential and preference storage: local storage remembers your theme choice and your privacy choice until you clear them; where we ask for consent, we ask again after 180 days. Session storage remembers the region we estimated until you close the browser tab, so we look it up once per visit. Hosting or security services may process technical information needed to deliver the website and prevent abuse.
• Site analytics: PostHog uses a first-party identifier cookie configured for up to 180 days, which may renew with use, and browser session storage. Analytics is sent to PostHog’s US service. It helps us understand visits; we do not send the contact form’s email address to PostHog.
• Marketing and visitor identification: Google Tag Manager loads Google Analytics, Apollo and Albacross only when this category is on. Their cookies and identifiers can recognize visits over time and associate visits with business or professional information. Their storage lifetimes and handling are described in the provider notices linked below.

We honor Global Privacy Control as an opt-out of the marketing category wherever you are, even if an earlier choice allowed it. When your browser sends this signal, the footer shows “Opt-out preference signal honored”. We do not respond to Do Not Track signals; Global Privacy Control is the signal we honor.

Turning a category off reloads the page to stop tracking scripts that already run. Withdrawing consent does not undo earlier lawful processing. You can also delete existing cookies and local storage through your browser; third-party storage may need to be cleared there separately. Choices apply to the browser and device where you make them. If your browser blocks storage, the site cannot save a choice and applies the default for your location.

We use providers for hosting and website delivery, email, security, analytics and business development. Relevant providers include Vercel and Cloudflare for website infrastructure and delivery, Cloudflare for contact-form email delivery, our business email provider, and the optional providers below. Information needed for their services is disclosed to them, subject to applicable contractual protections and their roles.

• PostHog privacy notice — site analytics.
• Google privacy notice — Tag Manager and Google Analytics.
• Apollo privacy notice — business and visitor identification.
• Albacross privacy notice — business and visitor identification.

Some marketing providers use information for their own purposes as described in their notices. Depending on applicable law and how a provider uses that information, these disclosures may constitute a sale, sharing or targeted advertising. They occur only while the marketing category is on, which outside the EEA, the UK and Switzerland is the default. Use the Cookies settings to opt out; Global Privacy Control also opts you out.

We may disclose information to professional advisers, where legally required, to protect rights and security, or in connection with a merger, acquisition or transfer of our business, subject to applicable protections.

Retention depends on the purpose and type of information. We retain inquiry correspondence while handling your request and maintaining the resulting business relationship; technical and security records for operating the website and investigating incidents; and business records for applicable legal, accounting and claims periods. Optional tracking providers also apply their own retention settings and policies.

We assess retention using whether the purpose remains active, the sensitivity of the information, applicable contractual and legal requirements, and the need to resolve disputes or prevent abuse. We delete or de-identify information when it is no longer needed for those purposes. You may request deletion or information about retention by contacting us. The browser-storage periods above do not describe how long server-side records are retained.

Eridian is based in the United States. Information may be processed in the United States and other countries where our providers operate, whose laws may differ from yours. Our providers’ published data-protection terms describe international transfer protections, including standard contractual clauses and, where applicable, adequacy arrangements. Contact us for information about processing locations and a copy of any applicable safeguards for your information.

We use technical and organizational measures designed to protect personal information, including access restrictions and secure transmission. No website, email system or storage system is completely secure.

Depending on your location and applicable law, you may have rights to access or obtain a copy of your information, correct it, request deletion, restrict or object to processing, obtain portability, withdraw consent, and opt out of sale, sharing or targeted advertising. We do not use website information to make solely automated decisions producing legal or similarly significant effects about you.

Email security@eridian.ai to make a request, appeal a decision where an appeal right applies, or ask us to stop marketing. We may need proportionate information to verify a request or an authorized agent’s authority. We will respond within the period required by applicable law and will not discriminate against you for exercising applicable privacy rights.

You can also send a privacy complaint to that address or our postal address below. We will acknowledge it within 30 days, investigate without undue delay, keep you informed and explain the outcome. A complaint does not extend the deadline for a separate privacy-rights request.

You may also complain to your local data-protection authority. UK residents can contact the Information Commissioner’s Office; EEA residents can contact their national supervisory authority. Contacting us first is optional.

This website is intended for business audiences, not children under 16. We do not knowingly collect their personal information. If you believe a child has provided information, contact us so we can address it. Third-party websites linked from our site have their own privacy practices.

This section covers people who use our products, including Loom, Designer and client applications, as users of a customer’s account. When you do, we collect your name, email address and organization, and records of your interactions with the service (“usage data”). Eridian is the controller of usage data.

• Purposes and legal basis: we use usage data to provide, secure, support and improve the service. Where UK or European data-protection law applies, our legal basis is our legitimate interests in doing so.
• Processor: PostHog processes usage data for us in the United States.
• Your choices: in the products, PostHog records which pages you open and which buttons you click, never what you type or what is on your screen. It uses a first-party identifier cookie and browser storage. In the EEA, Gibraltar, the Channel Islands and the Isle of Man it runs only after you agree. In the UK and Switzerland it runs anonymously by default and is linked to your email address only after you agree. Elsewhere it runs and is linked to your email address by default. In the EEA, Gibraltar, the Channel Islands, the Isle of Man, the UK and Switzerland, you can turn it off, or stop the link to your email address, at any time through Privacy choices in the product’s profile menu. Elsewhere, email security@eridian.ai to turn it off. Global Privacy Control stops the link to your email address wherever you are.
• Retention: we keep usage data while the customer’s account is active and delete it within 12 months after the account closes.

Usage data is not the customer data that the customer agreement governs (see section 1). We do not sell usage data or use it for advertising. To exercise your rights over it, email security@eridian.ai.

We will update this notice when our practices change and revise the date above. Where required, we will provide additional notice or obtain consent before a material change takes effect.

Privacy questions: security@eridian.ai. Postal contact: Eridian Corporation, 251 Little Falls Dr, Wilmington, Delaware 19808, USA, Attention: Privacy.