PRIVACY POLICY

0. Definitions

For purposes of these Privacy Policy:

• "Service" refers to the Kouzou Assistant web application and all related features, interfaces, and hosted components.
• "User Data" means any structural calculation files, datasets, parameters, dimensions, geometry, material properties, or other engineering information uploaded or submitted by the User during an active session.
• "Outputs" means any visualizations, technical drawings, alerts, warnings, or structural "suggestions" generated by the Service in response to User Data.
• "Suggestions" means informational prompts, recommendations, or flagged anomalies generated by the Service, which are intended solely as productivity aids and not as professional engineering, architectural, or regulatory advice.
• "Organization" means any business entity, corporate team, or engineering firm that establishes an administrative account and manages Member Accounts under the Service.
• "Account Data" means administrative information collected to establish and maintain customer accounts, including profile details, authentication records, billing metadata, and audit logs.

1. The Zero-Retention Engineering Data Policy

Our platform treats your proprietary structural engineering files and calculation data using a privacy-focused zero-retention architecture designed to minimize data persistence and storage risks.

2. Categories of Information We Collect

To establish accounts, enforce secure access, maintain audit logs and operational records, and manage post-paid subscription invoicing, we must collect and maintain specific, non-ephemeral administrative data ("Account Data").

• Profile Information: First and last names, business email addresses, administrative usernames, corporate phone numbers, Organization names, and other account profile information necessary to establish and administer customer accounts.

  For business customers, we may also collect and maintain business-related information required for invoicing, accounting, taxation, regulatory compliance, and customer relationship management purposes. Such information may include:

  • Registered company name;
  • Business address;
  • Tax identification number (TIN), VAT number, or equivalent tax registration identifier;
  • Company registration number;
  • Billing contact details; and
  • Other information reasonably required to issue invoices and comply with applicable accounting, tax, or legal obligations.
• Authentication Credentials: We collect and maintain hashed passwords, authentication tokens, multi-factor authentication settings (if enabled), account recovery information, and other account security information necessary to authenticate users, maintain account security, and provide access to the Service.
• Billing and Transactional Metadata: Subscription plans, seat allocations, invoice records, transaction histories, payment status information, corporate billing details, tax-related information, and accounting records required to administer subscriptions, process payments, comply with legal obligations, and maintain financial records. We do not collect or store raw payment card data on our own systems.
• User Activity Analytics & Admin Audit Logs: To enable Organization Administrators to review system utilization and team member activity, and to enable us to maintain platform security, investigate suspicious activity, prevent abuse, troubleshoot operational issues, and administer the Service, we collect and retain certain operational metadata. Such metadata may include login timestamps, last-access timestamps, authentication events, connection IP addresses, account activity records, usage frequency metrics, and other operational records associated with the use of the Service.
  • These records are retained for administrative reporting, security monitoring, abuse prevention, audit logging, account protection, troubleshooting, compliance, and service administration purposes.
  • The contents of structural calculations, engineering datasets, uploaded files, and generated Outputs are not retained as part of these records; only administrative and operational metadata is retained.

3. Cloud Infrastructure & Regional Data Processing

The technical architecture of the Service is built upon secure cloud infrastructure provided by third-party hosting partners ("Cloud Infrastructure Providers").

• Geographic Processing Location: Computational processing, automated analysis, and transient memory operations associated with the Service are performed primarily within cloud infrastructure located in Singapore.
• Regional Data Processing: User Data is processed primarily within Singapore during active sessions. This architecture is intended to support customers that are subject to regional data residency, privacy, confidentiality, or regulatory requirements.

4. Organization Separation & Multi-Tenancy

The Service utilizes a multi-tenant software architecture designed to maintain logical separation between Organizations and their respective data environments.

Operational metadata, account activity records, audit logs, and administrative information associated with an Organization may be made available to that Organization's authorized Administrators for account management, usage monitoring, security oversight, and administrative reporting purposes.

Operational metadata, account activity records, audit logs, and administrative information may also be accessed by authorized personnel of the Service Operator where reasonably necessary to operate, secure, maintain, support, investigate, audit, or administer the Service, or to comply with legal obligations.

Such information is accessible only to authorized users within the same Organization and is not made available to other Organizations, unrelated customers, competitors, or unauthorized third parties.

We implement technical and organizational measures designed to prevent unauthorized cross-Organization access to account information and operational records.

5. Third-Party Services, Security, and Cookies

We do not sell, rent, or lease personal information to third-party marketers. We share personal information only with trusted service providers and sub-processors where reasonably necessary to operate the Service, process payments, fulfill legal obligations, provide customer support, maintain security, or administer subscriptions.

The specific service providers used to support the Service may change from time to time as our business, technical, operational, or legal requirements evolve. We may add, replace, or discontinue service providers without updating this Privacy Policy, provided that such providers are engaged for substantially similar purposes and are subject to appropriate confidentiality, security, and data protection obligations.

We share personal information with third-party service providers only to the extent reasonably necessary for them to perform services on our behalf. Such providers are contractually or legally obligated to protect information appropriately and may not use the information for their own independent marketing purposes.

6. Statutory Rights & Privacy Requests

We are committed to handling personal information in a manner that is consistent with applicable privacy, data protection, and security principles.

Subject to applicable law, Users and Organizations may request access to, correction of, updating of, or deletion of their personal information maintained by us.

Because engineering data submitted to the Service is processed using a transient session-based architecture and is automatically removed following session termination, we generally do not retain historical engineering files or calculation datasets that can later be retrieved, exported, or returned upon request.

Requests to access, correct, update, or delete personal information may be submitted through the contact methods identified at the end of this Privacy Policy.

We may decline or delay requests to delete information where retention is reasonably necessary to:

• Comply with legal, tax, accounting, or regulatory obligations;
• Maintain security, audit, or fraud-prevention records;
• Resolve disputes or investigate claims;
• Enforce agreements, including the Terms of Service; or
• Establish, exercise, or defend legal rights.

Where deletion is requested, certain information may be retained for these limited purposes even if the account is closed or access to the Service has ceased.

Billing records, seat allocation records, invoice histories, payment records, and related audit logs may be retained for the duration necessary to support accounting requirements, tax obligations, subscription administration, and dispute resolution.

7. Policy Adjustments

We reserve the right to modify this Privacy Policy or our associated Terms of Service at any time to reflect cloud modifications, vendor shifts, or updated legal guidelines.

Registered Admin Accounts will receive a direct notification via email or clear dashboard notification if substantial changes are made to how administrative profile data is protected.

Continued use of the Service following the effective date of such changes constitutes acceptance of the updated Privacy Policy. Where required by us, Users may be required to review and affirmatively accept updated versions before continuing to use the Service.

8. Contact Information

If you have questions regarding this Privacy Policy, personal data processing practices, privacy rights requests, or account information management, you may contact us using the contact information made available through the Service or on our official website.

Privacy-related requests will be reviewed and processed within a reasonable timeframe consistent with applicable legal requirements.

9. General Provisions