TYLOGRAM – PRIVACY POLICY (DATENSCHUTZERKLÄRUNG)

At Tylogram, "German Engineering" means more than just precision; it means absolute respect for data privacy. This Privacy Policy explains how we collect, use, and protect your data when you use our AI-powered P&ID audit platform.

We operate in strict compliance with the General Data Protection Regulation (GDPR/DSGVO) and applicable German laws.

1. WHAT DATA DO WE COLLECT?

We distinguish between two critical types of data:

A. Account & Usage Data (Personal Data)

Information needed to manage your subscription (Free, Draft, Pro, Ultra) and access:

• Identity: Name, Job Title, Company Name.
• Contact: Email address.
• Technical: IP address, browser type, login timestamps (for security & quota enforcement).
• Billing: Payment history (Note: Credit card details are processed securely by our payment provider, Stripe; we do not store full card numbers).

B. Customer Content (Industrial Data)

The files you upload for analysis:

• Files: P&IDs (PDF, Images), diagrams, and technical notes.
• Extracted Data: Tags, symbol lists, and logic reports generated by the AI.

2. HOW WE USE YOUR DATA (PURPOSE & LEGAL BASIS)

3. ARTIFICIAL INTELLIGENCE & DATA SOVEREIGNTY

This is the most important section for our engineering clients.

3.1. No Training on Customer Data.

We use Google Vertex AI (Enterprise Edition). Per our enterprise agreement and configuration:

• Your P&IDs and engineering data are NOT used to train Google's foundation models.
• Your data is NOT used to improve Tylogram's models for other customers.
• Your data remains isolated within our secure cloud tenant.

3.2. Data Retention.

• Session Data: Once an analysis is complete and you close your session, the raw image data processed by the AI is discarded from the inference memory.
• Storage: We store your uploaded files and generated reports only as long as you maintain an active account, to allow you to download your history. You may delete specific projects at any time using the "Delete" function in the dashboard.

4. DATA SHARING & SUB-PROCESSORS

We do NOT sell your data. We only share data with trusted infrastructure providers necessary to run the service:

• Google Cloud Platform (EMEA): Hosting, Database, and Vertex AI computation.
  Location: Frankfurt (europe-west3) or Belgium (europe-west1).
• Stripe: Payment processing.
• Auth0 / Google Firebase: Secure user authentication.

We have signed Data Processing Agreements (DPAs) with all sub-processors ensuring they adhere to GDPR standards.

5. INTERNATIONAL TRANSFERS

Tylogram is hosted in the European Union (Germany/Belgium).

If any transfer to a non-EU country (e.g., to a US-based sub-processor) occurs, it is protected by the EU-US Data Privacy Framework or Standard Contractual Clauses (SCCs) to ensure your rights are preserved.

6. YOUR RIGHTS (USER RIGHTS)

Under the GDPR, you have the right to:

• Access: Request a copy of all data we hold about you.
• Rectification: Correct wrong information.
• Erasure ("Right to be Forgotten"): Request deletion of your account and all uploaded P&IDs.
• Portability: Download your data in a structured format (CSV/JSON).

To exercise these rights, email our Data Protection Officer at: privacy@tylogram.com

7. SECURITY

We employ enterprise-grade security measures, including:

• Encryption: All data is encrypted in transit (TLS 1.3) and at rest (AES-256).
• Access Control: Strict role-based access control (RBAC) for our internal staff.

8. UPDATES

We may update this policy as our technology evolves. Significant changes (e.g., introducing new AI providers) will be notified to you via email.