AI features use the context needed to respond
When you use an AI feature, CrystalSpec sends the relevant prompts, chat history, project or workspace context, and requested structured-output schema to its AI providers so the feature can respond.
Data Privacy
Your specs are product IP.We treat them that way.
Know how your project context is handled before you use AI. Free-plan AI may be subject to provider training. This page explains the plan differences and the safeguards around your workspace.
Privacy posture
Free AI
May be used for model training
AI providers
Data use follows provider terms
Data retention
Human gate
Every AI edit reviewed
Free AI uses Contributor mode, which may allow provider training on prompts and project context. Review the applicable provider terms before submitting your content. Contact us if your project needs specific data-handling guarantees.
Controls
The practical safeguards
Human approval stays in front of every AI edit
AI can draft, analyze, and propose changes, but it cannot silently rewrite your project. Proposed create, update, and delete actions wait for review before they become part of the spec.
Access follows the same project permissions
Users and integrations operate within the roles, teams, projects, and revisions they are allowed to access. CrystalSpec uses access controls, transport encryption, password hashing, role-based permissions, and operational monitoring to protect personal data.
Free AI comes with a data-use tradeoff
Free AI runs in Contributor mode. AI providers may retain inputs or outputs and use them for model training. This can include prompts and project context sent with an AI request. Avoid confidential or sensitive content when using Free AI.
Deletion and retention are documented
Account and workspace data is deleted or anonymized within 90 days after verified deletion, subject to legal, security, fraud-prevention, billing, dispute, and backup requirements. The Privacy Policy explains the remaining records and how to request their removal.
AI Data Handling
Useful AI, constrained by design.
The model receives project context and returns a proposed result; humans decide what lands in the spec. That approval step does not prevent the provider from processing the request. On Free, inputs and outputs may be retained and used for model training under the provider's terms.
- BYOK is a pilot for invited paid teams using their own OpenRouter key. CrystalSpec still sends the context needed for each request; your provider terms govern its processing. Public AI use of the team key requires explicit team permission, with a separate project permission for anonymous visitors.
- Free-plan AI requests may be routed to providers that retain inputs or outputs and may use them for model training.
- Paid plans use Standard and Smart models. Provider training, retention, and abuse monitoring are governed by the applicable provider terms, data-processing agreement, and subprocessor list. Upgrading does not undo prior Free-plan data processing.
- AI features send relevant prompts, chat history, project or workspace context, and requested structured-output schemas to AI providers so they can respond.
- AI usage and quota data is processed to provide, secure, and maintain the service.
- Do not submit sensitive personal data, secrets, credentials, or content you are not authorized to process through AI features.
Enterprise
Need enterprise controls?
For privacy, data-handling, security-review, or procurement questions, contact us at support@crystalspec.com.
Privacy practices you can review.
Customer Content is processed to provide and secure the service.
A current subprocessor list is available on request from support.
International transfers rely on adequacy decisions, Standard Contractual Clauses, and supplementary measures where appropriate.
Billing, account, security, and operational records are retained as described in the Privacy Policy.
Next Step
Bring your security requirements to the table.
Share your data-handling requirements. We can explain CrystalSpec's current privacy practices before your team commits.