This Privacy Policy describes how [COMPANY NAME] ("we", "us") collects and uses personal data when you use the Manufacturing AI Support service (the "Service"). It is a draft pending legal review.
Who we are
[COMPANY NAME]
[ADDRESS]
What we collect
- Account data: email address, display name, and identity-provider subject.
- Workspace data: organization name, memberships, invitations, and roles.
- Uploaded documents and the text extracted from them for search and answers.
- Chat data: questions, answers, retrieved source identifiers, citations, and model-usage records.
- Audit and usage events for security-relevant actions (sign-in, document lifecycle, grants, role changes) and for attributing model cost.
- Abuse-prevention signals: a normalized form of your email address (used to spot one person opening many free accounts), and per-account request counts kept for up to a day to enforce rate limits.
How we use it
We use this data to operate the Service: authenticate you, isolate workspaces, retrieve permission-scoped sources, generate answers, show citations, and keep an audit trail. Authorized administrators of your workspace (and, for platform operations, platform administrators) can reconstruct a chat run: the question, the sources used, the model, and the answer.
Processors
We send data to the following categories of processors:
- Google, Anthropic, and OpenAI — embeddings and answer generation. Document content and questions are sent to these providers. Their paid API terms currently state they do not train on API inputs; this is pending confirmation, and we will sign each provider's data-processing addendum.
- Keycloak — identity (registration, login, email verification, optional social login). Keycloak sets strictly necessary session cookies on the authentication host.
- Google reCAPTCHA — bot protection on the account registration form only. When you open that form, Google receives your IP address, browser details, and interaction signals, and may set its own cookies, under Google's Privacy Policy and Terms of Service. Signing in with Google or Microsoft skips reCAPTCHA.
- Hosting provider — application, database, object storage, and cache for the Service.
Cookies and local storage
The application stores your sign-in session and theme preference in the browser's localStorage. The identity provider sets strictly necessary session cookies. The registration form loads Google reCAPTCHA, which may set Google cookies used for security and fraud prevention; no other page loads it. We do not set analytics or marketing cookies today, and we do not show a cookie banner because of that. If we add a cookied analytics tool later, we will update this policy and add consent where required.
Retention and deletion
We keep account, document, chat, audit, and usage records for as long as the workspace exists. Self-serve account deletion and a published retention schedule are not yet available (see the public-launch readiness backlog). Until then, you may request deletion or a copy of your data and we will handle it manually.
Age
The Service is not directed at children. You must be at least 13 years old (16 in the EU where consent is the legal basis) to create an account.
Contact
Privacy questions: [COMPANY NAME], [ADDRESS], or the contact address published on the Service if one is configured.