The short version
- Your code, transcripts, prompts and Anthropic API key stay on your machine. We never receive them.
- Model requests go from your PC to Anthropic with your own key, under your agreement with Anthropic.
- Today we hold only what you send through the forms on this website. When accounts open, we will hold what we need to run your account and plan: name, email, billing details, linked devices and support messages.
- We do not sell personal data and do not use advertising trackers.
- Use the contact form and choose Privacy to see, correct or delete your data.
The full text below is what applies. If the summary and the full text differ, the full text wins.
1Who we are
PN & CPS Technology Ltd (20 Swan Street, Manchester, M4 5JW, United Kingdom) is an IT consultancy and the maker of Command Center. For the personal data described in this policy we are the controller under applicable data protection law (for example the GDPR or UK GDPR, depending on where you live).
You can reach our data protection contact through the contact form: choose Privacy, or by email at info@pncpstechnology.com. We have not appointed a Data Protection Officer; the same people handle every privacy request.
2What this policy covers
This policy covers personal data we handle when you visit this website, create and use a Command Center account, buy a plan, use the account and licence functions of the app, use a Team Hub we host, or contact us.
Command Center is in early access. Accounts, plans, the licence check and a Team Hub hosted by us are not open yet, and the parts of this policy about them apply once they open. Today we hold only what you send through the forms on this website.
It does not cover the content of your sessions on your own machines (see section 3), or personal data inside a Team Hub we host for your organisation. For that content your organisation is the controller and we act as its processor under the Data processing agreement.
3What stays on your machine
Command Center is local first. The following never reaches our servers:
- your code, files, prompts, transcripts, session reports and audit reports;
- your Anthropic API key, which is stored encrypted with your Windows account and stripped from logs;
- the requests your sessions send to Anthropic's models and the answers they get back.
Model requests go straight from your machine to Anthropic, using your own API key. Anthropic handles that data under the agreement and privacy terms you accepted with Anthropic; we are not involved in that processing and cannot see it. If you have questions about how Anthropic uses that data, contact Anthropic.
The phone remote runs between your own devices over a network you control. If you use it, questions and your answers move between your PC and your phone without passing through us.
4Information we collect
| Category | What it includes | Where it comes from |
|---|---|---|
| Account | Name, email address, company (if given), account settings. | You |
| Billing | Plan, member count, invoices, billing name and address, VAT number, the last four digits and expiry date of your card. | You and our payment provider, named before billing starts |
| Devices and licence | A device identifier the app generates, the device name you choose, Windows and app version, the time of the last licence check. | The app |
| Team membership | Who belongs to which team, roles, invitations, membership history. | Your team admin |
| Support | Your messages and anything you attach. | You |
| Website | IP address, browser and device type, pages requested and times, kept in server logs; the cookies described in the Cookie policy. | Your browser |
| Release notes | Your email address and the date you subscribed. | You |
| Website forms | What you type into a form on this website, such as your name, email, company, team size and message, and the page you sent it from. This includes enquiries about our consultancy work: we use the name, email, company and message you send to reply to you and to scope a project. | You |
We do not ask for special category data (such as health or religious beliefs) and ask you not to send it to us.
5How we use it and why we are allowed to
| Purpose | Lawful basis |
|---|---|
| Create and run your account, check your plan in the app, link your devices | Contract |
| Take payments, send invoices, keep accounting records | Contract; legal obligation for tax records |
| Answer support requests and fix the bugs you report | Contract; legitimate interests in improving the product |
| Keep the Service secure, prevent fraud and abuse, investigate incidents | Legitimate interests |
| Send service emails: receipts, security notices, changes to terms | Contract; legal obligation |
| Send release notes by email | Consent, which you can withdraw with one click in any email |
| Understand which plans and app versions are in use, in aggregate | Legitimate interests |
| Comply with the law and respond to lawful requests | Legal obligation |
Where we rely on legitimate interests, we have weighed them against your rights. You can ask us for that assessment through the contact form (topic Privacy). We do not make decisions about you based solely on automated processing.
6Who we share it with
We do not sell or rent personal data, and we do not use advertising trackers. We share personal data only with:
- Service providers who process it for us under contract: Vercel Inc. (United States) to host this website and store the messages sent through its forms, and Resend (United States) to deliver those messages to our team. No payments are taken yet. Paid plans will be billed through a payment provider that we name here before billing starts. The same list is on the security page and in Annex 3 of the Data processing agreement.
- Your organisation, if you are a member of a Team or Enterprise plan: your admin can see your name, email, devices and membership status.
- Professional advisers, such as accountants and lawyers, under a duty of confidentiality.
- Authorities, when the law requires it. We push back on requests that are not lawful.
- A buyer, if PN & CPS Technology Ltd or the Service is sold. We would tell you before your data becomes subject to a different policy.
7International transfers
Our service providers named in section 6 are in the United States, so your data may be processed outside the country where you live. When it is, we protect the transfer with the safeguards that applicable data protection law requires, such as an adequacy decision or standard contractual clauses. You can ask us for a copy of the relevant safeguards.
8How long we keep it
| Data | How long |
|---|---|
| Account and device data | While your account is open, then 90 days, then deleted |
| Invoices and accounting records | As long as the tax law that applies to us requires |
| Support messages and attachments | 2 years after the case is closed |
| Website server logs | 30 days |
| Release notes subscription | Until you unsubscribe |
9How we protect it
Data is encrypted in transit. Access is limited to the people who need it for their work. We keep our dependencies up to date and run the same audit gate on our own code that we sell. If a breach puts your rights at risk, we tell you and the competent data protection authority without undue delay. More detail is on the security page.
10Your rights
Under applicable data protection law you have the right to:
- get a copy of the personal data we hold about you;
- have inaccurate data corrected;
- have your data deleted, where we have no legal reason to keep it;
- restrict or object to how we use it, including objecting to processing based on legitimate interests;
- receive the data you gave us in a portable format;
- withdraw consent at any time, where we rely on consent.
Use the contact form, choose Privacy, and give the email on your account. We reply within one month, and tell you if we need longer for a complex request. There is no fee. When accounts open, you will also be able to delete your account yourself at any time.
If you are not happy with how we handle your data, please tell us first. You also have the right to complain to the data protection authority where you live.
11Children
The Service is for adults and professional use. We do not knowingly collect personal data from anyone under 18. If you believe a child has given us personal data, tell us through the contact form (topic Privacy) and we will delete it.
12Changes to this policy
When we change this policy we update the date at the top of the page. If a change affects how we use data you have already given us, we email you before it takes effect.
13Contact
Privacy questions and requests: use the contact form and choose Privacy.