Privacy Notice

1. Who we are

Galyos Ltd, trading as Galyos ("Galyos", "we", "us"), company number 16888219, registered office 71-75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom, is the controller of the personal data described in this notice. Galyos is registered with the UK Information Commissioner's Office. Contact: contact@galyos.io.

2. Who this notice covers

2.1 This notice covers people who use LithAI as Authorised Users, contacts at our customers (such as contract and billing contacts), and people who contact us about LithAI.

2.2 It does not cover personal data that appears in drawings, photographs and other material our customers upload, such as names in drawing title blocks. We process that data on behalf of our customer, as a processor, under our Data Processing Addendum. If your personal data appears in such material, the privacy notice of the business that uploaded it applies, and you should contact that business first.

2.3 Capitalised terms such as Authorised User and Job have the meaning given in the LithAI Terms of Service.

3. The personal data we collect

• Account data: your email address, your login credentials (your password is stored in hashed form by our authentication provider), the account you belong to and your role. In the app we display a first name derived from your email address.
• Usage data: sign-in times, the operations you run (such as slab processing, packing and rendering), project identifiers, timings, outcomes and errors.
• Acceptance records: the version of the Terms of Service you accepted, and the date and time of acceptance.
• Technical data: IP address, browser and device information, and logs held by our hosting providers.
• Business contact and billing data: names, email addresses, phone numbers, company details, invoices and payment records.
• Communications: support requests, emails and feedback you send us.

4. How we use it, and our lawful bases

Where we rely on legitimate interests, we have balanced them against your rights. You can ask us for details of that assessment.

5. Cookies and browser storage

We only use the browser storage that is strictly necessary to keep you signed in and to make the Service work, such as authentication tokens. We do not use advertising or cross-site tracking cookies, and we do not run analytics or tracking scripts in the Service.

6. Who we share it with

• Our service providers, who process data on our behalf: Supabase (database, authentication and file storage), Modal (compute for processing), Vercel (hosting of the web application), and our email and office software providers.
• The organisation you work for: we may tell your organisation, as our customer, how the Service has been used under your login (for example, how many Jobs were run), for account management, billing and compliance with the licence.
• Professional advisers, such as lawyers and accountants.
• Authorities, where the law requires it.
• A buyer of all or part of our business or of LithAI, subject to confidentiality.

We do not sell personal data.

7. International transfers

Some of our service providers process data in the United States, and our processing provider may run individual processing tasks in other regions. Where personal data is transferred outside the UK or the European Economic Area, we rely on adequacy regulations or decisions (including the EU-US Data Privacy Framework and its UK Extension, where the provider is certified), or on safeguards such as the UK International Data Transfer Agreement or the EU Standard Contractual Clauses.

8. How long we keep it

• Account data: while your login is active, and for 30 days after it is closed.
• Usage, invoicing and payment records: six years after the end of the financial year to which they relate, as required for tax and accounting purposes.
• Acceptance records: for the duration of the customer's agreement and six years after it ends, as evidence of the contract.
• Technical logs: in line with our hosting providers' standard retention periods, which are typically short.
• Support emails and communications: up to two years after the last contact.

9. Your rights

Depending on where you live, you may have the right to access your personal data, to have it corrected or erased, to restrict or object to its processing (in particular where we rely on legitimate interests), and to data portability. To exercise any of these rights, email contact@galyos.io. You also have the right to complain to a supervisory authority: in the UK, the Information Commissioner's Office (ico.org.uk); in France, the CNIL (cnil.fr); elsewhere, your local data protection authority. If you live in the United States or another country, you may have rights under local law, and we will respond to requests in line with that law.

10. Security

We protect personal data with encryption in transit and at rest, personal logins, verification of every request to our processing backend, account isolation in the database and restricted administrative access. No method of transmission or storage is completely secure, but we work to keep your data safe.

11. Changes to this notice

We may update this notice from time to time. If we make a material change, we will tell you by email or in the Service.

12. Contact

Questions about this notice or about your personal data: contact@galyos.io.