1. Data Collection & Telemetry

We collect essential telemetry (IP addresses, JWT sessions) necessary for the secure operation of the platform. We also store the data you create while using the service: documents (metadata and encrypted extracted text), projects, hazards, compliance check results, consultation requests, and cryptographic audit trails. Source files uploaded for classification are never retained after processing.

2. Your Rights under GDPR

As an EU/UK citizen or Enterprise client, you retain the following rights:

Right to Access: You may request a copy of your personal data.
Right to Erasure (Right to be Forgotten): You may request deletion of your personal data and documents by contacting legal@enclavesystem.com. Cryptographic audit-trail records that form part of the safety evidential record are retained, in pseudonymised form (your identity replaced by an opaque identifier), for the period required by applicable safety and legal obligations under Article 17(3) GDPR, after which they are purged.
Right to Portability: You may export your entire SQL Database Dump as a JSON file.

3. AI Sub-Processing & Foundation Models

Smart Classification is performed by sending the extracted text of your documents to the commercial APIs of Anthropic (Claude) and Google (Gemini) over paid commercial API tiers. Under these terms the providers do not use your prompts or outputs to train their models, and you retain ownership of your data. Data is encrypted in transit (TLS) and at rest (AES-256-GCM). For trust, safety and abuse-prevention purposes the providers may retain inputs and outputs for a limited period (for example, up to 30 days) before deletion; this is not Zero Data Retention (ZDR), which is available only under enterprise-level commitments and may be further restricted for certain advanced models. Processing currently occurs primarily on infrastructure located in the United States; we therefore rely on the providers' contractual no-training and data-protection commitments rather than on EU-only data residency, unless an Enterprise agreement specifies a region-pinned deployment.

View our Trust Center and full sub-processor list →

4. Data Sovereignty (Tier 3)

Your RAMS documents are stored in a dedicated database isolated from other tenants. Uploaded source files are never stored — only metadata is retained. Extracted document text is retained in AES-256-GCM encrypted form to enable the document preview and audit support features. We do not use your private documents to train our core AI models.

5. Use of Cookies

We use secure cookies exclusively for maintaining your authenticated Supabase session.

6. Legal Entity & Compliance Contact

This platform is operated by Enclave System. For any privacy, GDPR, or general compliance inquiries, please contact us at legal@enclavesystem.com. Our New Zealand Business Registration Number (NZBN) is 9429053741905.