Privacy Policy
Version 2026-10-01 · Last updated 30 October 2026
DRAFT — pending legal review. Items in [square brackets] must be completed or confirmed before this page is final. Remove this notice and the noindex tag when done.
1. Controller
The controller for personal data processed through the Service is SaferEngineer Inc., [STREET, CITY, STATE ZIP], United States. Privacy contact: [PRIVACY EMAIL]. [If SaferEngineer Inc. has no establishment in the EU/UK but serves customers there, an EU/UK representative under GDPR Art. 27 must be named here.] [Data protection officer: if one is appointed.]
2. What we process, why, and on which legal basis
| Data | Purpose | Legal basis (GDPR) |
|---|---|---|
| Account data: email, name, company, sign-in provider identifiers, role | Create and secure your account, provide the Service, communicate with you | Art. 6(1)(b) contract |
| Billing data: plan, subscription status, Stripe customer ID, invoices (card details are handled by Stripe, we never see them) | Billing, tax and accounting duties | Art. 6(1)(b) contract, 6(1)(c) legal obligation |
| Your Content: schematics, netlists, BOMs, datasheets, stress data, analysis results | Perform the analyses you request. Sent to AI providers only when you use AI features or PDF input | Art. 6(1)(b) contract |
| Usage and log data: actions, analysis counts, AI usage and cost, request IDs, hashed IP address, timestamps, terms acceptance records | Enforce plan limits, security, fraud prevention, troubleshooting, proof of consent | Art. 6(1)(b) contract, 6(1)(f) legitimate interests (secure and fair operation) |
| Messages you send us (contact form, support) | Answer your request | Art. 6(1)(b) or 6(1)(f) |
| Website analytics (Google Analytics) [only after consent] | Understand how the website is used | Art. 6(1)(a) consent |
We do not sell personal data and do not use Your Content to train AI models.
3. Recipients and sub-processors
| Provider | Purpose | Location [confirm] |
|---|---|---|
| Amazon Web Services | Hosting of the application and temporary file storage | [United States — region to confirm] |
| Google Cloud (Vertex AI / Gemini) | AI processing of prompts that contain parts of Your Content (PDF input, effect analysis, datasheet import) | [United States (us-central1)] |
| Google Firebase Authentication | Sign-in (email, Google, Microsoft) | [Global / United States] |
| Supabase | Database for accounts, usage and results | [region to confirm] |
| Stripe | Payments and billing portal | [EU / United States] |
| Formspree | Contact form delivery | [United States] |
| Google Analytics | Website analytics (consent only) | [Global / United States] |
We have data processing agreements with these providers where required. We may also disclose data where legally required.
4. International transfers
Some providers are located outside the European Economic Area, mainly in the United States. We rely on an adequacy decision (for example the EU–US Data Privacy Framework where the provider is certified) or on the EU Standard Contractual Clauses together with supplementary measures. You can request a copy of the safeguards at the privacy contact above.
5. Retention
- Uploaded files and analysis sessions: deleted automatically [7 days] after last use.
- Account data: until you delete your account (deletion runs after a grace period of [14] days).
- Invoices and accounting records: as long as tax and accounting law requires (often 6 to 10 years).
- Terms acceptance records and security logs: [as long as needed to prove consent / for the statutory limitation period].
6. Your rights
EU / EEA / UK (GDPR). You have the right of access, rectification, erasure, restriction, data portability, and to object to processing based on legitimate interests; you can withdraw consent at any time. You may complain to the supervisory authority in your country of residence or workplace [and to the authority responsible for our EU representative, if one is appointed].
South Korea (PIPA). You may request access, correction, deletion and suspension of processing of your personal information, and may withdraw consent. We transfer personal information abroad as described in sections 3 and 4 (recipients, countries, purposes and retention are listed there); the transfer is necessary to perform the contract with you. Requests can be sent to the privacy contact. [Legal review: add the items a Korean notice must state, and a domestic contact if required.]
United States (for example California). Depending on where you live you may have the right to know, access, correct and delete personal information and to opt out of its sale or sharing. We do not sell personal information and do not share it for cross-context behavioral advertising. We will not discriminate against you for exercising your rights.
To exercise a right write to [PRIVACY EMAIL]. We may need to verify your identity. Your rights depend on where you live, not on where you connect from.
7. Cookies and analytics
The sign-in and billing pages use only the cookies and storage that are technically necessary. The website uses Google Analytics only [after you consent in the cookie banner]. [Implementation note: the website currently loads Google Analytics without a consent banner; add a consent banner or remove the script before publishing this section.]
8. Security
Data is encrypted in transit (HTTPS). Each customer’s data is isolated by account, access is authenticated, and uploaded files are stored in account-specific folders with restricted permissions. No system is perfectly secure; we will notify you and the authorities of a breach where the law requires.
9. Children
The Service is for professional use and not directed at children.
10. Changes
We publish changes here with a new version number and ask you to accept the new version when you next sign in where the change is material.