Evidence, connected.

Privacy Policy

Effective July 27, 2026

Dorsal helps AI coding agents use current, source-backed knowledge. We collect only the information needed to provide, secure, and improve that service. We do not sell personal information or use it for cross-context behavioral advertising.

Scope

This policy applies to Dorsal websites, the Dorsal API and MCP server, the optional website research agent, and Dorsal audit features operated by Dorsal Corporation. It does not govern third-party coding agents, model providers, source websites, or services that you choose to use with Dorsal.

Information We Process

Information you provide

  • Questions, prompts, follow-up messages, and feedback submitted through the website
  • MCP and API requests, including tool names, search queries, filters, and record identifiers
  • Account, authentication, or contact information when you request access, use OAuth, or contact us
  • Information you choose to send in support or business communications

Information collected automatically

  • Network and security information, such as IP address, authentication status, and request timing
  • Usage information, such as pages viewed, feature interactions, tool calls, response latency, errors, and source-link activity
  • Device, browser, operating system, referrer, and approximate location information provided by our hosting and analytics services

MCP, Coding Agents, and LLMs

  • Dorsal MCP and API. Dorsal's MCP and API services query the Dorsal graph and return records. They do not send your tool queries or returned records to an LLM.
  • Claude Code, Codex, and other clients. When you use Dorsal through a coding agent, that agent and its model provider may process your instructions and the Dorsal records it receives. Their terms and privacy policies govern that processing.
  • Optional website research agent. When you use the chat experience on the Dorsal website, Dorsal sends your question, limited conversation context, and relevant graph evidence to OpenAI to generate the response.

Coding-History Audits

The Dorsal audit is designed so your coding agent examines raw coding history locally. Dorsal receives the generalized research questions, filters, and record requests that your agent sends to the Dorsal MCP server—not the raw history itself. Your coding agent controls those requests, so review its permissions and do not include secrets, credentials, private code, or personal information in Dorsal queries.

Public-Source Information

Dorsal indexes and connects information from public and licensed sources, including technical documentation, public repositories, research papers, issues, pull requests, releases, blogs, forums, and other public discussions. These records may contain names, usernames, professional affiliations, public statements, and links. We use this information to provide provenance, show what happened, connect related technical knowledge, and support source-backed answers.

How We Use Information

  • Provide graph search, retrieval, citations, and audits
  • Authenticate users and enforce access or usage limits
  • Operate, debug, secure, and measure the Service
  • Improve retrieval quality, coverage, and user experience
  • Respond to support, privacy, and legal requests
  • Prevent fraud, abuse, and unauthorized access
  • Comply with applicable law and enforce our agreements

Analytics and Local Storage

We use Vercel Web Analytics for aggregate website and product usage measurements. Vercel Web Analytics is designed without third-party tracking cookies and reports aggregated page-view and event information. We may also use essential cookies or local storage for authentication, security, preferences, and service operation.

When We Share Information

We share information only as reasonably necessary with:

  • Infrastructure, hosting, analytics, security, and authentication providers, including Vercel and Cloudflare
  • OpenAI when you use the optional website research agent
  • Professional advisers and authorities when required to comply with law, protect rights, or address security and abuse
  • A successor in connection with a merger, financing, reorganization, acquisition, or sale of assets

We do not sell personal information. We do not share personal information for cross-context behavioral advertising.

Retention

We retain personal information only as long as reasonably needed to provide and secure the Service, meet legal obligations, resolve disputes, and enforce agreements. The website keeps the current chat in browser memory during the session; Dorsal does not intentionally store that transcript in an application database. Infrastructure, model providers, and operational logs may retain information under their own retention settings and policies. Public-source graph records may remain while the underlying information is relevant, lawful, and publicly available.

Security

We use reasonable administrative, technical, and organizational safeguards designed to protect information. No system is perfectly secure. Keep API keys and access tokens confidential, use appropriate coding-agent permissions, and never submit secrets or sensitive production data unless necessary and authorized.

Your Privacy Rights

Depending on where you live and which laws apply, you may have the right to request access, correction, deletion, restriction, portability, or information about how we process personal information. You may also have the right to object or withdraw consent.

California residents may have rights to know, delete, correct, limit certain uses of sensitive personal information, and opt out of sale or sharing. Dorsal does not sell personal information or share it for cross-context behavioral advertising. We will not discriminate against you for exercising applicable privacy rights.

Send requests to hello@godorsal.com. We may need to verify your identity and may retain information required by law or legitimate security needs.

International Processing

Dorsal and its service providers may process information in the United States and other countries. Where required, we use appropriate safeguards for international transfers of personal information.

Children

The Service is intended for users 18 and older. We do not knowingly collect personal information from children. Contact us if you believe a child has provided personal information through the Service.

Changes to This Policy

We may update this policy as Dorsal changes. We will post the revised policy and update the effective date. We will provide additional notice when required by law.

Contact

Terms of Service