Privacy Policy

1. Our Enterprise Security & Data Philosophy

As an engineering-first company, we treat data privacy as a non-negotiable architectural requirement, not just a legal checkbox. This policy outlines exactly how we handle telemetry, client data, and application state across our web applications, MVP deployments, and AI pipelines.

2. Exactly What We Collect

We believe in data minimization. We only ingest what is strictly necessary to compile your software or route your inferences:

• Technical Telemetry: We collect aggregated error logs, API latency metrics, and crash reports to maintain our 99.9% SLA. This data is stripped of personally identifiable information (PII) before it ever hits our logging servers.
• Client Onboarding Data: When you partner with us, we store billing details, technical requirements, and architectural schematics in secure, AES-256 encrypted vaults.
• Ephemeral AI Payloads: During AI model execution, prompts and context windows are processed entirely in memory. They are explicitly configured to bypass persistent storage unless you specifically request a vector database implementation for RAG (Retrieval-Augmented Generation).

3. How Your Data is Processed

We do not sell, rent, or lease your data. We use it strictly for:

• Engineering Execution: Compiling codebases, running automated CI/CD security tests, and provisioning your cloud infrastructure.
• Infrastructure Optimization: Analyzing anonymized traffic patterns to autoscale our Kubernetes clusters and prevent DDoS attacks.
• Compliance Logging: Maintaining secure, tamper-proof audit trails to satisfy SOC2 Type II and ISO 27001 requirements.

4. Subprocessors and Vendor Management

To deliver world-class infrastructure, we partner with top-tier cloud providers (like AWS, GCP, and Anthropic). We enforce strict Data Processing Agreements (DPAs) with every subprocessor. They are legally barred from using Acadify client data for their own model training. You can request our full subprocessor registry at any time.

5. Your Data Rights & Portability

You have full sovereign rights over your data. You can ping our security team at any time to execute:

• Full Data Extraction: Request a complete, machine-readable export (JSON/CSV) of your project metadata.
• Cryptographic Erasure: Request the absolute, unrecoverable deletion of your account records across all our primary and backup databases.
• Consent Revocation: Immediately halt any non-essential telemetry tracking on your projects.

6. Data Retention Protocols

We do not hoard stale data. Our automated chron-jobs securely wipe records based on strict TTL (Time-to-Live) policies:

• Active Project Data: Retained securely for the duration of our contract plus 7 years for strict tax and legal compliance.
• Application Logs: Automatically rotated and purged every 30 days.
• Ephemeral Processing: Wiped from memory milliseconds after the compute task resolves.

7. Policy Updates

We push updates to this policy the same way we push code: transparently and with detailed change logs. If we make material changes to how we handle your core data, we will alert your technical point of contact directly via email.