Andru Platform Privacy Policy

Last Updated: October 11, 2026
Effective Date: September 29, 2026

Plain Language Summary

What you need to know about your data:

We built Andru for technical founders who value authenticity and transparency. This Privacy Policy reflects those values by being honest about what data we collect, why we collect it, and how we protect it.

The essentials:

  • We collect what we need: Assessment responses, business context, and usage data to provide personalized recommendations
  • Your data stays yours: We never sell your individual business data to anyone, period
  • AI providers don't train on your data: Our primary AI provider (Anthropic) does not use API data for model training. Your product intelligence stays yours.
  • No telemetry from CLI or MCP: The andru-intel CLI and MCP server send no usage analytics or telemetry back to us
  • Security matters: Row-level database isolation, encrypted at rest and in transit, prompt injection defenses, and automated security monitoring
  • You have control: Access, export, or delete your data at any time. Deletion is permanent and cascades across all tables.
  • Transparency commitment: If our practices change materially, we'll tell you clearly and directly

Our values-driven approach:

Unlike platforms that monetize user data, we make money by actually helping you succeed. Your transformation is our business model, not your data.

1. Introduction

1.1 Who We Are

This Privacy Policy is provided by Humus & Shore LLC ("H&S," "we," "us," or "our"), the company behind the Andru revenue acceleration platform ("Platform").

Our Commitment:

We built the Platform with Empathy as a core value—people before profits. This extends to data practices. We collect only what serves your success, protect it carefully, and never exploit it for revenue beyond our subscription model.

1.2 Scope of This Policy

This Privacy Policy applies to:

  • Information collected through the Andru Platform (web-based interface at platform.andru-ai.com)
  • Information collected through the Andru CLI (andru-intel npm package)
  • Information collected through the Andru MCP Server (Claude Desktop, Cursor, and other MCP clients)
  • Information collected through the Andru Chrome Extension
  • Information collected through related communications (email, support)
  • Information processed when you use Platform features (assessments, recommendations, intelligence tools)

1.3 Your Consent

By using the Platform, you consent to the data practices described in this Privacy Policy. If you do not agree, please do not use the Platform.

2. Information We Collect

2.1 Information You Provide Directly

Account Information:

  • Name and email address
  • Company name and website
  • Job title and role
  • Payment information (processed by third-party payment processor)
  • Contact preferences

Assessment Responses:

  • Revenue readiness evaluation answers
  • ICP (Ideal Customer Profile) definition data
  • Buyer persona information
  • Go-to-market strategy details
  • Financial data (ARR, pricing, customer metrics)
  • Product capability descriptions
  • Market positioning information

2.2 Information Collected Automatically

Usage Data:

  • Pages visited and features accessed
  • Time spent on Platform sections
  • Assessment completion rates
  • Click patterns and navigation flow
  • Session duration and frequency

Technical Information:

  • IP address
  • Browser type and version
  • Operating system
  • Device type (desktop, tablet, mobile)

If you create an account, the pages you read on our sites before signing up are linked to it.

2.3 Cookies

We set one cookie of our own, andru_visitor_id, to recognise a returning browser across andru-ai.com and platform.andru-ai.com. We set it only if you choose “Accept all”, and it lasts one year.

With “Necessary only” we still count page views, time on page, how far you scroll and which sections you read, but nothing links one visit to the next.

andru-ai.com also uses PostHog, a product-analytics service, only if you choose “Accept all”.

To change your choice, clear this site's cookies and choose again.

3. How We Use Your Information

3.1 Primary Uses: Providing Platform Services

We use your information to:

Personalize Your Experience:

  • Generate customized recommendations based on your business context
  • Tailor framework guidance to your funding stage and growth trajectory
  • Prioritize relevant content and resources
  • Create business cases and analysis specific to your situation

Operate Core Platform Features:

  • Process assessments and calculate scores
  • Provide comparative benchmarking (using anonymized aggregate data)
  • Generate reports and visualizations
  • Enable export and integration functionality

3.2 Aggregated and Anonymized Data

We may use aggregated, anonymized data to:

  • Create industry benchmarks (e.g., "Companies at your stage typically have X")
  • Develop case studies and success patterns (with all identifying information removed)
  • Produce research reports on revenue strategy trends
  • Improve AI/ML recommendation algorithms

What "anonymized" means:

Data is stripped of all identifying information—company names, individual names, specific financial figures, unique circumstances—making it impossible to trace back to you.

4. How We Share Your Information

4.1 We Do NOT Sell Your Data

Clear commitment: We do not and will never sell your individual business data to third parties. Period.

Our business model is subscription revenue from helping you succeed, not monetizing your information.

4.2 Service Providers and Processors

We share information with trusted third-party service providers who help us operate the Platform:

  • AI Providers: Anthropic (primary), Google, Mistral, and Together AI (fallbacks). Your data is sent to these providers to generate intelligence (ICP profiles, competitive positioning, meeting briefs). Anthropic does not train on API data — your product intelligence is not used for model improvement. Fallback providers are used only when the primary provider is unavailable.
  • Database: Supabase (PostgreSQL on AWS, US region). All persistent customer data is stored here with row-level security.
  • Application Hosting: Render (US region). Backend API, agent platform, and MCP server hosting.
  • Payment Processing: Stripe for subscription billing
  • Email: Resend for transactional emails (account notifications, deletion confirmations)
  • Frontend Hosting: Netlify for the web application (no customer data — static assets only)

All service providers:

  • Are contractually obligated to protect your data
  • May only use data to provide services to us
  • Must comply with applicable privacy laws
  • Do not use your data for model training or their own purposes

For detailed information about our data processing practices, including sub-processor list and data transfer mechanisms, see our Data Processing Agreement available upon request at geter@andru-ai.com.

5. Data Security

5.1 Our Security Approach

Given that you entrust us with confidential business information, we implement comprehensive security measures:

Encryption:

  • Data in transit: TLS 1.2+ for all connections
  • Data at rest: AES-256 encryption (Supabase PostgreSQL on AWS)
  • Database encryption: All customer data encrypted at the storage layer

Data Isolation:

  • Row-Level Security (RLS) policies enforce tenant isolation — you can only access your own data
  • API-key-scoped sessions for CLI and MCP access — no shared state between customers
  • Each AI call is independent — your data never appears in another customer's prompt
  • Customer-supplied text in AI prompts is wrapped in structural boundaries to prevent prompt injection

Automated Security Monitoring:

  • SIEM event pipeline with real-time detection and automated containment
  • Daily database security audits (row-level security verification)
  • Dependency vulnerability scanning on every code change
  • Secret scanning to prevent accidental credential exposure
  • 15-minute uptime monitoring with automated incident response

Access Controls:

  • Role-based access: Team members access only data necessary for their role
  • API responses scanned for accidentally exposed secrets before delivery

6. Your Privacy Rights and Choices

6.1 Access Your Data

You have the right to:

  • Request a copy of all data we hold about you
  • Review your assessment responses and account information
  • Receive data in portable format (JSON, CSV)

6.2 Delete Your Data

You have the right to:

  • Delete your account at any time
  • Request deletion of specific assessment or pipeline data
  • Have your data permanently removed from all our systems

How deletion works:

  • Go to Settings → Account → Delete Account
  • You get a 3-day grace period — cancel by logging back in
  • After 3 days: permanent deletion cascade removes your data from every table in our database — profiles, assessments, ICP data, pipeline runs, generated resources, API keys, usage logs, and all AI-generated intelligence
  • Active subscriptions are cancelled automatically
  • Connected integrations (OAuth tokens) are revoked
  • Authentication credentials are permanently removed
  • Transient cache data (Redis) expires automatically via TTL
  • Local MCP cache (on your device) is your responsibility to clear

Or contact geter@andru-ai.com to request deletion.

7. Contact Us About Privacy

Privacy & Data Inquiries: geter@andru-ai.com

Data Processing Agreement: Available upon request at geter@andru-ai.com

8. CLI and MCP Server Data Practices

The andru-intel CLI and mcp-server-andru-intelligence MCP server provide buyer intelligence tools in your terminal and AI coding tools (Claude Desktop, Cursor).

8.1 What Data Is Processed

  • Product descriptions, company names, and ICP criteria you provide as tool arguments
  • This data is sent to the Andru backend API for intelligence generation
  • AI calls are scoped to your API key — your data is never mixed with other customers' data

8.2 What We Do NOT Collect from CLI/MCP

  • No telemetry: We do not track which commands you run, how often you use the tools, or any usage analytics
  • No local file access: The CLI and MCP server do not read files from your machine beyond the SQLite offline cache
  • No background communication: The tools only make API calls when you explicitly invoke a tool — no heartbeats, no check-ins

8.3 Offline Cache

The MCP server may store recent results in a local SQLite cache on your machine for offline access. This data stays on your device and is your responsibility to manage. Clear it by deleting the cache file or reinstalling the package.

9. Chrome Extension Data Practices

The Andru Chrome extension works on LinkedIn, in Gmail and on the page you have open. It sends something to Andru only when you ask it to, with one exception: Andru in Gmail, described below.

9.1 What the Extension Sends to Andru

LinkedIn profile read and first message (when you click “Read this profile”): the name, headline, company and other text visible on that profile. The read and the first message are saved in your account so you can see them again, and so the same profile isn't charged twice within 7 days.

Pre-meeting brief and account plan (when you click them): the company name, any contact name you enter, the site's domain, and a short summary of the page you have open (its title, description, main heading and up to 1,500 characters of its text). The extension never reads the text of a Gmail page. What you sent and the result are saved in your account.

Company fit score (right-click → “Score this company with Andru”, the toolbar button or the side panel): the company's domain and a short summary of that page. The score is saved in your account and reused for 30 days so the same company isn't scored twice. The page summary is not saved.

Andru in Gmail: while you write an email in Gmail, the text you are writing (not quoted earlier messages or your signature) is sent to Andru when you pause, to suggest changes. It is not saved. To count your free and paid emails, Andru keeps a random ID for each coached email, never its text. For a work address, Andru also uses the recipient's company domain for context.

9.2 Who Processes It

Everything is sent over HTTPS to the Andru API (api.andru-ai.com). To write reads, first messages, briefs, plans and email suggestions, Andru sends that content to the AI providers listed in section 4.2. They process it to produce the result and don't use it to train models. Nothing from the extension is sold or used for advertising.

9.3 Extension Permissions

  • storage: keeps your sign-in token, preferences and a short offline cache in your browser
  • activeTab and scripting: read the page you have open, only when you open the side panel, click the toolbar button or use the right-click menu
  • sidePanel: shows Andru beside the page
  • contextMenus: adds “Open Andru for this page” and “Score this company with Andru”
  • linkedin.com and mail.google.com: show the extension on LinkedIn profiles and in Gmail compose windows
  • platform.andru-ai.com: completes the Connect sign-in
  • api.andru-ai.com: the Andru API

9.4 Retention and Deletion

Reads, first messages, briefs, plans and fit scores stay in your account until you delete your account, which removes them (section 6.2). Gmail text is not kept. Install records hold no browsing data; deleting your account unlinks them from it. To clear what the extension stores in your browser, uninstall it or clear its data in Chrome settings.

9.5 Install Counts

When you install or update the extension, it sends Andru a random install ID and the version number. When you connect your account, that ID is linked to it. If you remove the extension, Chrome opens an Andru page that records the removal. Nothing about your browsing is included.

Final Note: Privacy as Partnership

Privacy isn't just about compliance—it's about respect.

We built this platform to help technical founders transform their revenue processes through systematic, authentic approaches. That same authenticity extends to how we handle your data.

You're trusting us with:

  • Confidential business information
  • Strategic plans and roadmaps
  • Financial performance metrics
  • Competitive positioning details

We honor that trust by:

  • Protecting your data as if it were our own
  • Being transparent about our practices and limitations
  • Giving you control over your information
  • Never exploiting your data for purposes beyond serving you

If you have questions, concerns, or suggestions about our privacy practices, please reach out. We genuinely want to hear from you.

This Privacy Policy is drafted to balance legal compliance with H&S's values of Transparency and Empathy.