Privacy Policy
What Artifacts Beam collects, why, and what you can do about it.
Last updated 9 October 2026
Who runs this service
Artifacts Beam (artibeam.ai) is operated by VertiWorks Labs LLC.
For any privacy or data-protection question, write to privacy@artibeam.ai.
What we collect
When you sign in, your identity provider — including Microsoft, Google, Apple, or your organization's own OIDC identity provider — gives us a user identifier, your email address, and your display name. If your organization's identity provider supplies group or role claims, we receive those too and use them to determine your membership role. We never see, receive, or store a password for your account.
If your organization uses SCIM provisioning, it may create your account before you have ever signed in. In that case we receive your email, display name, and external identifier from the provisioning request.
We store the artifacts you upload and the versions of them we retain, along with the comments, annotations, reactions, tags, and collections you create.
If you belong to an organization workspace, we store your membership, your role, the teams you are in, and the sharing grants that decide who can see what.
For paid plans, we keep your Stripe Customer and subscription identifiers, plan and payment status, and invoice-related records needed to provide billing and support. Stripe processes billing contact and address details, payment methods, taxes, and payments through its hosted Checkout, Customer Portal, and subscription updates. We do not store full card numbers.
We keep an administrative audit log for organization workspaces, your notifications, and the session and refresh tokens that keep you signed in. Each session record also stores the browser user-agent string it was created from, and expires automatically.
If you use the iOS app, we store the APNs device push tokens your device registers so we can deliver notifications to it.
If you choose to connect OneDrive to import a file, we store an OAuth refresh token that gives ongoing access to your OneDrive until you revoke it. If you never connect it, we hold nothing from it.
Diagnostics
We use Azure Application Insights to record requests, errors, and performance so the service can be kept working. These records can include IP addresses.
Cloudflare Web Analytics runs on our public pages and reports aggregate traffic — page views, referrers, and broad browser and country information. It sets no cookie and does not fingerprint or follow you between sites.
We use no advertising network and no cross-site tracker, and nothing on this site profiles you or builds an advertising identity.
Cookies
Artifacts Beam uses only strictly necessary cookies. These include a session cookie that keeps you signed in, short-lived state cookies that protect OAuth exchanges (such as sign-in and the OneDrive connection flow) against forgery, a CSRF cookie that protects form submissions against cross-site request forgery, and a bot-management cookie set by Cloudflare on the proxied zone.
There are no advertising or tracking cookies, which is why you are not asked to consent to any.
Where your data is held
Your data is stored on Microsoft Azure in the West US 3 region, in the United States, using Azure Cosmos DB and Azure Blob Storage.
Cloudflare sits in front of the service as a content delivery network and handles traffic on its way to us.
If you use the iOS app, Apple Push Notification service (APNs) receives notification payloads on our behalf. Those payloads contain the name of the artifact, the actor who triggered the notification, and a short text snippet — no file contents. APNs is a processor only for users of the iOS app.
Our processors include Microsoft Azure, Cloudflare, Stripe (for paid billing), Apple Push Notification service (for iOS app users), and whichever identity provider you or your organization uses for sign-in. We do not sell your data or share it with advertisers; apart from the sharing you choose, we share data only with providers needed to operate the service.
Who can see your artifacts
Your artifacts are private by default. They become visible to other people only through something you do: sharing directly, creating a share link, publishing a live page, or placing work in an organization workspace.
A share link is a secret URL. Anyone holding it can open what it points to, which is what makes it useful and also what makes it worth revoking when it has served its purpose. You can revoke any link at any time.
A published live page is reachable by anyone who has its URL, but the page is served with an X-Robots-Tag: noindex header, so compliant search engines will not index it.
If your organization enables a public portal (at /p/{orgSlug}), that portal page is deliberately indexable and lists the live pages the organization has chosen to showcase there. Each card links to the existing live page, which itself remains noindex.
Getting your data out, and deleting it
You can export your account data at any time, on any plan, from the account menu. The export is a JSON file containing your profile, your organization memberships, your teams, and the metadata for each artifact you own. It does not contain the artifact files themselves, nor your comments, shares, annotations, reactions, or collections.
You can request permanent account deletion from the same menu. An active personal subscription must first be canceled and reach the end of its paid period; a personal workspace converted into a company workspace needs support-assisted deletion. Deleting removes your personal workspace — your artifacts, their versions, comments, shares and live pages — along with your profile. Content you authored inside a company organization workspace belongs to that organization and stays in place; you are removed as a member. If you are the sole owner of a company organization, you must transfer ownership to another member before deletion can proceed. This cannot be undone.
Neither of these is a paid feature.
How long we keep things
We keep your data for as long as your account exists. After you delete your account, certain data persists outside your personal workspace. Content you authored inside a company organization stays with that organization. Comments, replies, reactions, and annotations you left on artifacts owned by other users remain part of those artifacts. An account_erased audit record — containing your user ID, display name, and email address — is written to every company organization you belonged to; it is kept according to that organization's audit retention setting (indefinitely by default, or purged by an admin after the configured number of days). Notifications about your actions that were already delivered to other users' inboxes are not recalled.
Stripe may retain invoice and transaction records after account deletion where required by law or its retention obligations. For billing privacy requests, contact privacy@artibeam.ai.
Each plan sets how many versions of an artifact are retained. When you publish past that number, the oldest versions are removed. The current version is never removed.
An organization workspace can set its own retention window for its audit log. Purging audit entries past that window is a manual action taken by an organization admin.
Children
Artifacts Beam is not directed at children and is not intended for use by anyone under 13. We do not knowingly collect data from them. If you believe a child has an account, write to privacy@artibeam.ai and it will be removed.
Changes to this policy
If this policy changes materially, the date at the top of this page changes with it. Continuing to use the service after a change means the new policy applies to you.