Privacy Policy

This policy explains how A2 Foundry, Inc. collects, uses, and protects information in Chrona Actions, available at app.chronaactions.com.

1. How Chrona Actions handles your content

Chrona Actions reconciles what a team discusses against what its systems of record say, and it has to do that continuously, over months. That requires us to store content: the meeting artifacts you provide, the evidence that justifies each finding, and the record of how work evolved. That content is stored on systems we operate.

We store what the service requires and no more, we tell you how long we keep it, and we delete it when you leave. The rest of this policy is the detail.

2. Our role

Your organisation decides what artifacts to provide, which systems to connect, and what to do with the findings. Your organisation is the controller of that information. A2 Foundry is a processor acting on its instructions, under the data processing agreement between us.

We are the controller only of account and usage information — the data in Section 3 under "Your account" and "How you use the product."

3. What we collect

Your account

Email address, display name, and organisation name.

Access is by invitation. An account can only be created for an address an authorised administrator of your organisation has already added to a workstream. You sign in either through Microsoft Entra single sign-on or with a single-use numeric code sent to your email address, depending on your organisation's configuration.

If you sign in with Microsoft: we receive the identity claims your organisation releases through Microsoft Entra — your name and email address. This sign-in is for authentication only. It does not give Chrona Actions access to your files, mail, calendar, or any other Microsoft 365 content. Chrona Actions requests only the openid, profile and email scopes. Access to a system of record is a separate, explicit authorisation you grant in that system.

Content your organisation provides or connects

Meeting transcripts, recaps, notes, status documents, decks, and similar recurring artifacts. Records read from the systems of record you connect — item titles, owners, statuses, dates, and change history.

What we derive and keep

To reconcile work across time, Chrona Actions creates and stores:

• workstreams, lanes, topics and actions, with the people who hold them, dates and statuses
• findings — proposals awaiting human review, and the wording each proposal suggests
• evidence as a pointer to its source — which artifact, and where within it — so every finding can be traced back and checked
• status reported by the person holding an action, and the decisions reviewers make on findings
• a timeline of observable changes, including changes made directly in your connected systems

Information about people who are not our users

Meeting artifacts and connected records name people who may never use Chrona Actions — participants in a meeting, people holding an action, people mentioned in a discussion. We store their names, organisational identity, work assignments, statements attributed to them in the artifacts provided to us, and the status they report. Section 7 explains what that means for them.

Where identity is unclear, we do not guess. If we cannot confidently match a name in an artifact to a person, the item stays unresolved for a human to decide. We do not assign work to someone by inference.

How you use the product

Pages visited and features used, together with browser and device information, collected through PostHog. This is product analytics — it does not include your meeting content, your evidence, or your findings.

4. How we use it

To operate your account, run reconciliation and generate findings, deliver requests to the people your organisation designates, maintain and secure the service, support you, and comply with law.

5. What we don't do

• We do not train AI models on your content. Not on your artifacts, transcripts, evidence, findings, or reviewer decisions — and we do not permit our service providers to do so.
• We do not sell personal information or share it for third-party marketing.
• We do not use Chrona Actions to evaluate individual performance, and we do not provide our customers with tools to do so.
• We do not record or transcribe meetings.
• We do not use information about non-users for any purpose other than delivering the service to the customer that provided it.

6. AI processing

Chrona Actions uses a large language model provider to generate findings from the artifacts you provide, under an agreement that prohibits the provider from retaining your content or using it to train its models.

7. Service providers

We share information only with the providers that operate the service:

These providers access your information only to perform services on our behalf and are not permitted to use it for any other purpose. We give at least 30 days' notice before adding or replacing a subprocessor that handles Chrona Actions content.

We may also disclose information if required by law or legal process, or to protect the rights or safety of A2 Foundry, our customers, or others.

8. If you appear in a workstream but aren't a Chrona Actions user

Your information is in Chrona Actions because the organisation running that workstream provided it. Requests to access, correct, or delete it should go to that organisation, which decides how to respond.

If you contact us at contact@chronaactions.com, we will identify the relevant customer and pass your request to them.

9. Separation between customers

Each customer's data is isolated at the database level through row-level security, and access is scoped by workstream and role. Within a customer, a person invited only to respond to a request sees only what is directed to them — not the workstream, not other people's work, not findings under review.

Credentials for a connected system of record are held in an encrypted secret store, keyed to the individual person who authorised the connection, and are never readable by the browser or by any signed-in user. Disconnecting a system deletes the stored credential.

10. How long we keep it

Artifacts and evidence are kept for the duration of your subscription, unless your agreement specifies a shorter period.

Workstream, lane, topic, action and timeline records are kept for the duration of your subscription and for 90 days afterward, to support export.

Account information is deleted within 30 days of account closure.

After the export window, we delete or de-identify your content within 60 days, unless law or your enterprise agreement requires otherwise. Changes already applied to your connected systems of record remain in those systems, because they are records in your systems rather than ours.

11. Security

We use encrypted connections, encryption at rest, role-based access controls, tenant isolation enforced at the database layer, and audit logging of changes and access. Access by A2 Foundry personnel is limited to what is required to operate and support the service.

12. Cookies

We use cookies for session management and for product analytics. We do not use advertising or cross-site tracking cookies, and we do not track you across other websites.

13. Your rights

You may request a copy of your information, ask us to correct or delete it, and opt out of product communications, by emailing contact@chronaactions.com.

We honour rights under the EU and UK GDPR and the California Consumer Privacy Act for all users regardless of location. Where we act as a processor, we assist our customers in responding to individuals' requests and act on their instructions — see Section 8.

14. Age

Chrona Actions is not intended for anyone under 18.

15. Changes to this policy

Material changes take effect on an updated "Last updated" date, with notice by email or in the product.

16. Contact

contact@chronaactions.com
A2 Foundry, Inc.

See also our Terms of Service.