AI features use the context needed to respond
When you use an AI feature, CrystalSpec sends the relevant prompts, chat history, project or workspace context, and requested structured-output schema to its AI providers so the feature can respond.
Data Privacy
Your specs are product IP.We treat them that way.
Know how your project context is handled before you use AI. Managed AI uses no-training provider routing on every plan. This page explains how providers process requests and the safeguards around your workspace.
Privacy posture
Free AI
No-training provider routing
AI providers
Data use follows provider terms
Data retention
Human gate
Every AI edit reviewed
Managed AI uses no-training provider routing. Review the applicable provider terms before submitting your content. Contact us if your project needs specific data-handling guarantees.
Controls
The practical safeguards
Human approval stays in front of every AI edit
AI can draft, analyze, and propose changes, but it cannot silently rewrite your project. Proposed create, update, and delete actions wait for review before they become part of the spec.
Access follows the same project permissions
Users and integrations operate within the roles, teams, projects, and revisions they are allowed to access. CrystalSpec uses access controls, transport encryption, password hashing, role-based permissions, and operational monitoring to protect personal data.
Privacy applies to every plan
CrystalSpec does not train models on your projects. Managed AI on Free and Team uses provider routes that exclude training on your prompts and project context.
Deletion and retention are documented
Account and workspace data is deleted or anonymized within 90 days after verified deletion, subject to legal, security, fraud-prevention, billing, dispute, and backup requirements. The Privacy Policy explains the remaining records and how to request their removal.
AI Data Handling
Useful AI, constrained by design.
The model receives project context and returns a proposed result; humans decide what lands in the spec. That approval step does not prevent the provider from processing the request. Managed AI excludes training; retention and abuse monitoring still follow provider terms.
- BYOK is a pilot for invited paid teams using their own OpenRouter key. CrystalSpec still sends the context needed for each request; your provider terms govern its processing. Public AI use of the team key requires explicit team permission, with a separate project permission for anonymous visitors.
- Managed AI requests on Free and Team use no-training provider routing.
- Paid plans use Light and Smart models. Provider retention and abuse monitoring follow the applicable terms, data-processing agreement, and subprocessor list. No-training routing does not promise zero retention.
- AI features send relevant prompts, chat history, project or workspace context, and requested structured-output schemas to AI providers so they can respond.
- AI usage and quota data is processed to provide, secure, and maintain the service.
- Do not submit sensitive personal data, secrets, credentials, or content you are not authorized to process through AI features.
Enterprise
Need enterprise controls?
For privacy, data-handling, security-review, or procurement questions, contact us at support@crystalspec.com.
Privacy practices you can review.
Customer Content is processed to provide and secure the service.
A current subprocessor list is available on request from support.
International transfers rely on adequacy decisions, Standard Contractual Clauses, and supplementary measures where appropriate.
Billing, account, security, and operational records are retained as described in the Privacy Policy.
Next Step
Bring your security requirements to the table.
Share your data-handling requirements. We can explain CrystalSpec's current privacy practices before your team commits.