Privacy Policy

This policy explains what personal data Continuum handles, why, and what rights people have over it. Continuum is operated by TO BE COMPLETED (TO BE COMPLETED, registration TO BE COMPLETED).

Two different roles

Continuum is a workspace that sales and customer-success teams use to run deals with their own customers. That means personal data reaches us in two distinct ways, and our responsibilities differ between them.

• Account data — we are the controller. The name, email address and password of the people who sign in to Continuum, plus the organisation they belong to. We decide how this is used, because it is how the service works at all.
• Customer data — we are a processor. Everything a customer puts into their workspace: their own clients' company records, contacts, meeting notes and transcripts, documents, and the engagement data from buyer portals. The customer organisation decides what goes in and why; we only process it on their instructions in order to provide the service.

If you are a buyer who received a portal link from a supplier, that supplier is the controller of your data. Your questions about it are best directed to them; we will support them in answering you.

What we collect

When you have an account

• Name, email address and a securely hashed password.
• The organisation you belong to and your role within it.
• A record of security-relevant actions — invitations, role changes, data exports, deletions — kept in an audit log, including the IP address the action came from.
• Failed sign-in attempts, kept briefly and only to block password guessing.

When you visit a buyer portal

Buyer portals measure engagement so the supplier can see what was useful. This measurement only happens after you agree to it. The portal asks before it measures anything, and declining leaves the room fully working — just unmeasured. Your choice is remembered in your own browser.

If you accept, we record:

• That the portal was opened, and how long it was open.
• Which documents, links and recordings were opened.
• A name, if you chose to identify yourself, so the supplier knows who they are talking to.

Actions you deliberately take — sending a message, completing a step, submitting a form — are recorded either way. Those are you talking to the supplier, not passive measurement.

Email logged onto a deal

A seller can give a deal its own private address and copy it on emails with the buyer, or forward a thread to it. Those messages are stored against that deal as internal working notes — the sender, the subject, the date and the text of the message.

Two limits are worth stating plainly. Nothing logged this way is ever shown in the buyer portal — it is visible only to the seller's own team. And only the messages a seller deliberately copies in are stored; Continuum has no access to anyone's mailbox through this feature and cannot read anything that was not explicitly sent to the deal address.

Cookies and similar technology

Continuum sets one essential cookie, which keeps you signed in. It is not used for advertising or analytics and cannot be switched off without making sign-in impossible. Portal consent choices are stored in your browser's local storage rather than in a cookie. See our tracking notice for the detail.

Artificial intelligence

When a customer organisation enables AI features, meeting transcripts and deal content are sent to Anthropic's API for analysis. Two things are worth stating plainly:

• AI never writes to your data on its own. It only ever produces suggestions. A person has to approve a suggestion before anything is changed — that is enforced in the software, not a policy promise.
• Content sent for analysis is not used to train models.

Where AI has contributed to something you are reading, the interface says so.

Who else processes data

We use the following sub-processors. Each one only receives what it needs for its purpose.

Where a provider is outside the European Economic Area, transfers rely on the European Commission's Standard Contractual Clauses.

We do not sell personal data, and we do not use it for advertising.

How long we keep it

• Account data: for as long as the account exists. When an organisation is deleted, accounts belonging only to it are deleted with it.
• Customer data: for as long as the customer keeps it. They can delete it at any time, and deleting an organisation removes it permanently — including the underlying files.
• Portal engagement data: each organisation sets its own retention window (30, 90, 180 or 365 days, or indefinitely). A nightly job permanently deletes anything past that window.
• Failed sign-in records: deleted within an hour.
• Audit log: kept for the life of the organisation, as the accountability record.

Your rights

Under the GDPR you can ask for access to your data, correction of it, erasure, restriction of processing, portability, and you can object to processing. In the software:

• Any admin can export their organisation's full data as a file at any time, from Settings.
• An owner can permanently delete their entire organisation, from Settings.
• A supplier can erase an individual portal visitor's engagement data on request, from that deal's engagement panel.

For anything not covered by those, contact TO BE COMPLETED. You also have the right to complain to your national data protection authority.

Security

Passwords are stored hashed, never in readable form. Sign-in sessions use encrypted cookies. Connected-system credentials (calendar, integrations) are encrypted before storage. Data is separated by organisation, and every query is scoped so one organisation cannot reach another's data. Sign-in is rate-limited against password guessing.

No system is perfectly secure. If you believe you have found a vulnerability, please tell us at TO BE COMPLETED rather than disclosing it publicly, and we will work with you on it.

Changes

If this policy changes in a way that materially affects you, we will tell account holders before it takes effect.