colony

Draft for review, not yet in effect

Privacy Policy

Last updated: 9 October 2026

This policy explains what personal information Colony collects, why we use it, who we share it with, and the rights you have. We do not sell your personal information.

1. Who we are

Colony is operated by AI Native Ventures ([Company legal name]), based in South Africa. Under the Protection of Personal Information Act 4 of 2013 (POPIA), we are the responsible party for the personal information this policy describes.

Information Officer
[Information Officer name]
Contact the Information Officer
[Information Officer contact details]
General contact
[support email]
Address
[Physical address]

2. What this policy covers

This policy covers the Colony desktop app for macOS, Windows and Linux, the Colony mobile app, communities hosted on Colony's relay server, and this website, colony.global.

It does not cover services you connect yourself, such as your Claude Code or Codex subscription or your own OpenRouter account, or the websites you visit using the browsers in Colony. Their own privacy policies apply.

3. Information we collect

Account information

Your email address, name and profile picture. If you use Continue with Google, Google shares your name, email address, profile picture and Google account identifier with us.

Community content

What you, your team and your AI employees put into a community is stored on Colony's relay server. That includes messages, channels, files, canvases and pins. Members of the community can see it, according to its settings.

Information on your device

The Colony apps keep some data on your device, such as settings, local copies of community content, and data from the browsers in Colony. We do not receive data that stays only on your device.

Review note: engineering to confirm exactly which data stays only on the device (including browser cookies and website sign-ins) and which is synced to Colony's servers.

AI requests when you use Colony credits

When your AI employees use Colony credits, their requests and the responses pass through Colony's server. We send the requests to OpenRouter and to the provider of the model. Requests can contain personal information that you or your team put into the work.

With these requests we send a pseudonymous customer identifier. We never send your name or email address. We also record usage, such as which model was used and how many credits it cost, so we can charge your credits.

OpenRouter and the model providers handle this data under their own terms and privacy policies.

When you bring your own AI

When you connect your own Claude Code or Codex subscription, or your own OpenRouter account, your AI employees use your account with that provider. That provider handles the data under its own terms and privacy policy.

Payment records

When you buy credits, Stripe or PayFast processes the payment. They share payment records with us, such as the amount, currency, date, status and a payment reference. We do not store your card number.

Logs and security data

Basic technical data, such as IP address, device and operating system type, app version, sign-in times, error reports and security events. We use it to run Colony, fix problems and protect accounts.

When you contact us

Your messages to us and anything you include in them.

This website

colony.global does not use analytics or advertising cookies. It stores one small setting in your browser, for the current visit only, to pick a colour theme. The early-access form prepares an email on your device and sends nothing by itself. If you send that email, we receive it. Our hosting provider processes basic request data, such as IP addresses, to deliver and protect the site.

4. How we use it

We use personal information only for these purposes, and only where POPIA allows it:

  • To provide Colony: run your account and communities, sync your work, and let your AI employees do their work. Reason: our contract with you.
  • To run AI work on credits and charge for it: send requests to OpenRouter and model providers, and record usage. Reason: our contract with you.
  • To take payments and keep records: Reason: our contract with you, and tax and accounting laws.
  • To keep Colony safe: prevent fraud and abuse, and enforce our terms and the AI providers' policies. Reason: our legitimate interests, and legal duties.
  • To support you and tell you about important changes: such as security, billing and changes to our terms. Reason: our contract with you, and our legitimate interests.
  • To follow the law: and respond to lawful requests. Reason: legal duties.

We only send marketing messages if you agreed to them or the law allows it, and you can opt out at any time.

Review note: confirm and state whether Colony uses customer content to train or improve AI models. Customers will ask.

5. Who we share it with

We do not sell your personal information. We share it only with:

  • Other members of your communities: the content you share there and your profile.
  • OpenRouter and model providers: when your AI employees use Colony credits, as described above.
  • Payment providers: Stripe, and PayFast if offered.
  • Google: if you use Continue with Google.
  • Service providers that run Colony for us: [hosting providers] and [email delivery provider]. They may only use the information to provide their service to us.
  • Authorities: where the law requires it, or to protect someone's safety.
  • A new owner: if another business takes over Colony, it must protect your information in line with this policy.

6. Other people's information

If you put other people's personal information into Colony, such as your customers' details, you are responsible for having a lawful reason to do so and for telling them as the law requires. For that information, we process it on your behalf and on your instructions.

Review note: a lawyer should confirm Colony's role as an operator (POPIA sections 20 and 21) or processor (GDPR article 28) for customer data, and whether business customers need a separate data processing agreement.

7. Sending information abroad

Colony's servers and the AI providers we use are outside South Africa. [hosting regions] This means your personal information is sent to other countries.

We only do this as section 72 of POPIA allows. For example, where the recipient is bound by law or an agreement that gives your information protection similar to POPIA, where the transfer is needed to perform our contract with you, or where you have agreed to it.

8. How long we keep it

We keep personal information only as long as we need it for the purposes above, or as the law requires.

  • Account information: while your account is open, and for [retention period after account closure] after it closes.
  • Community content: until you or the community's admins delete it, or until the community closes, plus [community content retention period]. Copies on other members' devices may remain.
  • AI requests and responses: [whether Colony's server stores AI request content, and for how long]
  • Usage and payment records: [payment record retention period], as tax and accounting laws require.
  • Logs and security data: [log retention period].
  • Backups: deleted data can stay in backups for up to [backup retention period].

9. Security

We use reasonable technical and organisational measures to protect personal information, as POPIA requires. No system is perfectly secure. If a security compromise affects your personal information, we will tell you and the Information Regulator as section 22 of POPIA requires.

10. Your rights in South Africa

Under POPIA you have the right to:

  • ask whether we hold personal information about you, and ask for a copy of it;
  • ask us to correct or delete it;
  • object to how we use it, including for direct marketing;
  • withdraw your consent, where we rely on consent; and
  • complain to the Information Regulator.

To use these rights, contact our Information Officer at [Information Officer contact details]. We may ask you to confirm your identity first. We will reply within [response time].

Requests for records under the Promotion of Access to Information Act follow our PAIA manual: [PAIA manual link, if required].

Complaints to the Information Regulator

Website: inforegulator.org.za
POPIA complaints: [email protected]

11. If you are in the EU or UK

Colony is run from South Africa. If the EU or UK General Data Protection Regulation (GDPR) applies to how we handle your personal information, you also have the right to:

  • access, correct or delete your information;
  • restrict how we use it, or object to it;
  • receive your information in a portable format;
  • withdraw consent, where we rely on consent; and
  • complain to your local data protection authority.

We rely on these legal bases: our contract with you, our legitimate interests, legal duties, and your consent where we ask for it. When we send your information to countries without an adequacy decision, we use safeguards the law recognises. [transfer safeguards used]

Our representative in the EU or UK: [EU and UK representative, if required]

Review note: a lawyer should confirm whether the GDPR applies to Colony (article 3(2)), whether EU and UK representatives are needed (article 27), and which transfer safeguards apply.

12. Children

Colony is for people aged 18 or older. We do not knowingly collect personal information from children. If you think a child has given us personal information, contact us and we will delete it.

13. Changes and contact

We may update this policy. The date at the top of this page shows when we last changed it. For important changes, we will tell you in advance by email or in the app.

Questions about privacy: [Information Officer contact details] or [support email].