Privacy Policy
Last updated: 14 July 2026
1. Who is responsible
The controller for the data described here is Solvera Systems, registered with the Dutch Chamber of Commerce (KvK 97843776) in Mijdrecht, the Netherlands, operating InduIndex. Privacy questions and requests: info@induindex.com.
2. The short version
- We do not train AI models on your data, do not sell it, and do not build shared datasets from it.
- Your files and everything derived from them are isolated per customer, enforced in the database layer.
- Uploaded files and analysis artifacts are stored in the EU (Amsterdam region).
- Our AI cost logs store token counts and latency — never the content of prompts or responses.
- The anonymous demo analyzer stores nothing: your file is processed in memory and discarded when the result is shown.
- Deleting your account deletes your stored files, derived data and account records; backups age out within 14 days after that.
3. What we collect and why
| Data | Why | Legal basis |
|---|---|---|
| Account data — email, display name, password (stored hashed) | Sign-in, account management, transactional email (verification, password reset, billing notices) | Contract |
| Content you upload — alarm/event exports, and the findings, KPIs, reports and AI-chat history derived from them | Providing the analysis you asked for | Contract |
| Billing data — subscription tier, credit movements; payment details are entered at Stripe and never reach our servers | Charging for the service; tax administration | Contract; legal obligation |
| Security and audit records — actions on your account with timestamp and IP address; server logs | Abuse prevention, rate limiting, a tamper-evident trail of sensitive actions (such as deletions) | Legitimate interest (security) |
| Early-access signup — email, optionally company and a note | Contacting you about early access, and nothing else | Consent (withdraw by mailing us) |
Uploaded exports sometimes contain personal data of your colleagues — operator names or user IDs in event-log columns. For that content you are the controller and we process it only on your instructions (see the Terms, section 5). The analysis does not use those columns: during normalization only the alarm fields (timestamp, tag, state, priority, description, area, value) are kept, so unmapped personal columns exist only inside your raw file, not in any derived data. Where possible, strip them before uploading.
4. AI processing
Two things are sent to our AI provider (Anthropic): the evidence behind findings so the report can explain them in plain language, and your messages to the assistant along with the issue data needed to answer them. Anthropic processes this under a data-processing agreement, does not use it to train models, and does not retain message content by default on the API we use. If we adopt asynchronous batch processing for report text later, the provider retains those requests for up to 29 days; we will update this policy before that applies to your data. The deterministic analysis itself — every number and citation — runs on our own infrastructure without AI.
5. How long we keep things
| Data | Retention |
|---|---|
| Your files, derived analyses, reports, chat history | Until you delete them or your account is deleted |
| Account data | Life of the account; erasure completes within 30 days of a verified request |
| Anonymous demo uploads | Not stored — processed in memory only |
| Audit records | IP addresses are removed after 12 months; the action trail itself is kept, including the record that an erasure was carried out |
| Early-access signups | Until public launch plus 12 months, or your request, whichever comes first |
| Billing records | 7 years (Dutch fiscal retention duty); payment history lives at Stripe |
| Encrypted backups | Rolling 14 days — deleted data leaves the last backup within 14 days |
| Server logs | Rotated within days (size-bounded) |
6. Who processes data for us
| Provider | Purpose | Location / safeguard |
|---|---|---|
| Scaleway | File and artifact storage and application hosting | EU (Amsterdam) |
| Anthropic | AI narration and assistant (section 4) | US — EU standard contractual clauses |
| Stripe | Payments and subscriptions | EU entity; SCCs for US processing |
| Sentry | Error monitoring (no user content; IPs not sent) | EU region |
| Scaleway Transactional Email | Transactional email (verification, password reset, billing notices) | EU |
We do not share your data with anyone else unless the law requires it.
7. Cookies
The site sets only functional cookies: a session cookie when you sign in and a CSRF token that protects forms. No analytics or advertising cookies are set. If we ever introduce analytics, it will be behind a consent banner — not before you agree.
8. Your rights
You can ask for access to, correction of, export of, or deletion of your personal data, and object to or restrict processing based on legitimate interest. Mail info@induindex.com from your account address; we respond within 30 days. Account deletion removes stored files, derived data, chat history and account records — what remains is the anonymized audit record that the deletion happened, and billing records we must keep for tax law. If you are not satisfied, you can complain to the Dutch data-protection authority, the Autoriteit Persoonsgegevens.
9. Security
Customer isolation is enforced with row-level security in the database on top of application-level scoping; bulk data lives in private EU object storage under per-customer prefixes; traffic is HTTPS-only; uploads are malware-scanned; sensitive actions are audit-logged; access to production systems is restricted to the operator.
10. Children
The service is for professional use and not directed at anyone under 16.
11. Changes
We will announce material changes to this policy by email or in the product before they take effect. The date at the top tells you when it last changed.