In short
- Continuumship decides how personal data is used on this website and in Continuumship accounts, and is responsible for it.
- The content of a workspace belongs to the customer that runs it; there we act only on its instructions, as its processor.
- Your data is stored in the European Union. We do not sell it, and we do not use it to train AI models.
- Website analytics run only if you allow them. You can change that at any time.
- You can ask to see, correct, export or delete your data by writing to hello@continuumship.com.
Who we are
Continuumship (“we”, “us”) is the controller of the personal data described in this notice — under the EU and UK General Data Protection Regulation (“GDPR”) and, as veri sorumlusu, under Türkiye’s Law No. 6698 on the Protection of Personal Data (“KVKK”). This notice also serves as our information notice (aydınlatma metni) under Article 10 of the KVKK.
For anything in this notice, write to hello@continuumship.com.
What this notice covers
This notice covers personal data we decide about ourselves:
- people who visit our website at https://continuumship.com;
- people who hold an account in Continuumship, and the people who manage a customer’s subscription and billing;
- people who write to us, ask for a pilot or a security review, or take part in one.
It does not cover the content our customers put into their workspaces or bring in from the tools they connect — work items, comments, approvals, attachments, commit and review history, and the names and addresses of the people in them. For that content the customer is the controller and we are its processor: the customer’s own privacy notice applies, and our commitments to it are in the data processing addendum. If you want to exercise your rights over such content, ask the company that runs the workspace; we help it answer you.
The personal data we collect
When you visit the website
- Technical data: your IP address, the browser and operating system you use, the address you asked for and when. Our servers need it to deliver pages and to defend against abuse.
- Measurement data, only with your consent: how pages are scrolled and clicked, and the pages of a visit, collected by the providers named in the cookie notice. In use today: Microsoft Clarity (Analytics).
- Your cookie choice, kept in your browser.
When you hold an account
- Identity and contact: your name and email address, and your preferred language.
- Sign-in: your password, stored only as a one-way hash; the public keys of your passkeys; your two-factor authentication secret, encrypted; and, when your organisation uses single sign-on or SCIM, the identifiers your identity provider sends.
- Sessions: the IP address, browser and time of last activity of each signed-in session.
- Activity records: the audit log that records who did what and when in a workspace — required for the product to show an auditor how a decision was made.
- Billing: the billing contact, company name, address and tax number of the paying customer. Card details are entered on Stripe’s own pages and never reach us.
When you contact us
The content of your messages, your name, email address, company and role, and what we agreed.
We do not ask for special categories of personal data (such as health data or political opinions), and we ask you not to put them into the service.
How we collect it. Electronically: from you, when you fill in a form, sign in or write to us; automatically, when your browser asks for a page or, with your consent, when a measurement provider’s script runs; and from your organisation’s identity provider when it uses single sign-on or SCIM.
Why we use it, and on what legal basis
| Purpose | Data | Legal basis under the GDPR | Legal basis under the KVKK |
|---|---|---|---|
| Providing the service and your account | identity, sign-in, sessions, activity records | performance of a contract (Art. 6(1)(b)) | necessary for the performance of a contract (Art. 5(2)(c)) |
| Keeping the service secure, preventing abuse, keeping the audit trail | technical data, sessions, activity records | legitimate interests in security and accountability (Art. 6(1)(f)) | legitimate interests (Art. 5(2)(f)) |
| Billing, invoicing and tax records | billing data | legal obligation (Art. 6(1)(c)) and contract (Art. 6(1)(b)) | legal obligation (Art. 5(2)(ç)) and contract (Art. 5(2)(c)) |
| Answering your messages and running a pilot | contact data | steps before a contract (Art. 6(1)(b)) and legitimate interests (Art. 6(1)(f)) | contract (Art. 5(2)(c)) and legitimate interests (Art. 5(2)(f)) |
| Telling you about changes to the service, these documents or your subscription | identity and contact | contract (Art. 6(1)(b)) | contract (Art. 5(2)(c)) |
| Understanding how the website is used | measurement data | your consent (Art. 6(1)(a)) | your explicit consent (Art. 5(1)) |
| Establishing, exercising or defending legal claims | the data relevant to the claim | legitimate interests (Art. 6(1)(f)) | establishing, exercising or protecting a right (Art. 5(2)(e)) |
Where we rely on legitimate interests, we have weighed them against your interests and rights; you can ask us for that assessment. We send marketing email only to people who asked for it, and each message lets you stop it.
Agents, models and your content
Continuumship coordinates work done by people and by AI agents. Agent runs execute on runners the customer operates, with model credentials the customer holds; the service keeps the process, the decisions and the evidence. We do not use personal data, the content of a workspace or source code to train any AI model, ours or anyone else’s.
The service does not take decisions about people based solely on automated processing that have legal or similarly significant effects on them.
Transfers to other countries
We store personal data in the European Union: the application and its database run on Google Cloud in Frankfurt, Germany, and files are kept in Cloudflare R2 storage in the EU jurisdiction.
Some providers may access data from other countries, such as the United States. Where a country does not have an adequacy decision, we rely on the European Commission’s Standard Contractual Clauses and, for certified providers in the United States, on the EU–US Data Privacy Framework.
For people in Türkiye, storing data in the European Union is a transfer abroad under Article 9 of the KVKK. We make these transfers on the basis of the standard contracts published by the Personal Data Protection Board, notified to the Board as the law requires, or, where they apply, on the other grounds Article 9 allows. You can ask us for a copy of the safeguards at hello@continuumship.com.
How long we keep it
| Data | How long |
|---|---|
| Account data | while the account exists, then deleted within 30 days of its closure |
| Sessions | until you sign out, or after 120 minutes without activity |
| Activity records (the audit log) | 12 months by default; a customer can set a longer period, up to 84 months |
| Billing records | as long as tax and commercial law requires, up to ten years |
| Messages and pilot records | up to two years after our last contact, unless they become part of a contract |
| Technical data in server logs | up to 30 days, longer only when needed to investigate an incident |
| Your cookie choice | 6 months, then you are asked again |
| Website measurement data | as the provider’s own retention sets it — for Microsoft Clarity, recordings for 30 days and aggregated data for up to 13 months |
Deleted data leaves our backups as they expire on their regular cycle. When a period ends we delete or anonymise the data, as Article 7 of the KVKK and the Regulation on the Deletion, Destruction or Anonymisation of Personal Data require.
Your rights
Under the GDPR you have the right to access your personal data, to have it corrected, to have it erased, to restrict its processing, to receive it in a portable format, to object to processing based on legitimate interests, and to withdraw a consent at any time without affecting what was done before.
Under Article 11 of the KVKK you have the right to learn whether your personal data is processed; to request information about it; to learn the purpose of the processing and whether it is used accordingly; to know the third parties to whom it is transferred in Türkiye or abroad; to request its correction if it is incomplete or inaccurate; to request its deletion or destruction under Article 7; to request that third parties to whom it was transferred are notified of a correction or deletion; to object to a result against you that arises from analysis exclusively by automated systems; and to claim compensation for damage arising from unlawful processing.
How to exercise them. Write to hello@continuumship.com from the address we know you by, or tell us how we can confirm it is you. Applications under the KVKK can also be made in writing, by registered electronic mail (KEP) or with a secure electronic signature, as the Communiqué on the Procedures and Principles of Application to the Data Controller sets out. We answer within one month under the GDPR and within thirty days under the KVKK, free of charge unless a request is manifestly unfounded or excessive.
Complaints. You can complain to the data protection authority of the country you live or work in. In Türkiye, after applying to us, you can complain to the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu).
How we protect it
Data is encrypted in transit and at rest. The database has no public address and is reached only over a private, encrypted network; every workspace is isolated by row-level security, and the isolation is tested on every change. Tokens are stored as hashes, credentials are short-lived, and the audit log is append-only and hash-chained. Accounts can be protected with passkeys, two-factor authentication and your own single sign-on.
The full list of measures is in the data processing addendum, and the trust page explains how tenancy, evidence and access work. If we learn of a breach that is likely to put your rights at risk, we tell you and the authorities as the law requires.
Children
The website and the service are for businesses and the people who work for them. They are not directed at children, and we do not knowingly collect personal data from anyone under 16.
Changes to this notice
When this notice changes, the date at the top changes with it. If a change matters to how we use your data, we tell account holders by email or in the product before it takes effect.