Privacy Policy

This Privacy Policy explains what personal data Savi LoopIQ (the “Service”) collects, why we collect it, who processes it on our behalf, how long we keep it, and how you can access or delete it. The Service is operated by Lee Savage, Savage Management Holdings Inc., Las Vegas, NV, USA. It applies to the web application, Android package io.loopiq.app, mobile experiences, and our public website.

1. Who we are

Data controller: Lee Savage, Savage Management Holdings Inc., Las Vegas, NV, USA.
Privacy contact: privacy@savagetechnicalsolutions.com

2. Data we collect

Account and identity data

• Email address and authentication metadata needed to create and secure your account.
• For team and enterprise accounts: membership, role, invitation status, and directory attributes your organization sends where SCIM is enabled.

Education eligibility data

• If you apply for LoopIQ Education: your eligibility category (student, educator, or registered apprentice), verification method, institution or program name, verification status, review timestamps, and eligibility expiration date.
• For institutional-email verification: the signed-in email address and its institutional domain.
• For document fallback: the supporting PDF, JPEG, or PNG you choose to submit, plus technical integrity metadata such as file type, size, and a cryptographic hash.
• Review and audit records needed to document approval, rejection, expiration, revocation, reverification, and deletion of reviewed evidence.

Supporting Education documents are stored in a private, access-restricted storage bucket and are available to authorized reviewers through short-lived signed access. Reviewed documents are automatically scheduled for deletion within 30 days after review. The verification decision and minimum audit record may remain after the document itself is deleted so we can operate eligibility, renewal, fraud-prevention, and dispute workflows.

Billing data

• Subscription tier, status, billing interval, renewal date, and customer/subscription identifiers issued by Stripe.
• We do not receive or store your full card number, CVC, or bank details; payment details are entered on Stripe's hosted checkout.

Content you provide

• Bump-test and trend files (CSV), saved loops, tuning parameters, plant models, tags, site/unit names, and notes.
• Generated tuning reports and exports.
• Questions/context submitted to the AI Instructor and feedback on its answers.
• Learning Lab activity, attempts, scores, and progress records.
• Where enabled, historian, OPC-UA, or edge-agent process readings and connector configuration.

Technical and usage data

• Server/platform logs such as IP address, user agent, timestamps, and requested paths.
• Privacy-oriented product analytics such as page views, performance timings, and funnel events including Education pricing viewed, verification started/submitted/approved/rejected, checkout started/completed, entitlement granted, first Learning Lab exercise, first successful tune, AI Instructor use, renewal, expiration, cancellation, refund, and upgrade. Education analytics must not contain verification documents, document URLs, document hashes, institution names, email addresses, or unnecessary personal information.
• The Android app does not request the Google Advertising ID and the Service does not use cross-site or cross-app advertising profiles.
• Strictly necessary cookies for session, sign-in, and plan-selection flows. See our Cookie Notice.

3. Why we use it

• Provide the Service — authenticate you, run identification/tuning/simulation, store authorized content, and deliver Learning Lab and Instructor features.
• Verify Education eligibility — determine whether an account qualifies, conduct review, enforce annual reverification, expiration, grace, and revocation, and prevent misuse.
• Billing — create and manage subscriptions and prevent payment fraud.
• AI features — answer AI Instructor questions.
• Support and security — respond to requests, diagnose failures, rate-limit abuse, and maintain sensitive administrative audit records.
• Product improvement — understand feature adoption using aggregated or de-identified information.
• Legal — meet tax/accounting obligations and enforce our Terms of Service.

We do not sell personal data or share it for cross-context behavioral advertising. We do not use uploaded process data or AI Instructor prompts to train third-party AI models.

Legal bases (EEA / UK)

Where GDPR or UK GDPR applies, we rely on performance of a contract, legitimate interests for security/fraud prevention/product improvement, consent where required, and legal obligations for tax/accounting records.

4. Service providers we use

• Supabase Inc. — authentication, application database, and private/application file storage, including Education verification evidence.
• Vercel Inc. — hosting, content delivery, platform logs, and privacy-oriented product analytics.
• Stripe Inc. — subscription checkout, billing, receipts/invoices, and customer billing portal.
• Perplexity AI Inc. — inference for the AI Instructor using the question and loop context you choose to include.
• Google LLC — only if you choose Google sign-in.
• OpenAI, L.L.C. — text embeddings for an optional internal knowledge pipeline that processes our reference material rather than uploaded process data.

We may also disclose data to legal/professional advisers, a successor in a merger or acquisition, or authorities where legally required.

5. International processing

We are based in the United States and the providers listed above operate globally. Where legally required for transfers from the EEA or UK, provider agreements may incorporate Standard Contractual Clauses and the UK Addendum. See our Data Processing Addendum.

6. How long we keep data

• Education supporting documents — reviewed documents are scheduled for deletion within 30 days after review; unreviewed evidence is restricted to the pending review workflow and is deleted when no longer needed.
• Education verification decisions and audit data — retained while needed to administer eligibility, renewal, security, and dispute/fraud-prevention obligations, subject to account-deletion and legal-retention rules.
• Account/profile data — while your account exists, then removed as described in section 8.
• Uploaded files, saved loops, reports, training records, and AI Instructor conversations — until you delete them or your account is deleted, subject to required legal retention.
• Platform/server logs — retained under hosting-provider operational/security schedules.
• Billing/tax records — retained as long as tax, accounting, and audit law requires, generally up to seven years in the United States.

7. Security

Traffic is encrypted in transit with TLS, and data at rest is encrypted by our hosting/database/storage providers. Education verification tables use row-level security and are restricted to server/service-role workflows. Verification evidence is stored in a private bucket; no public evidence URL is stored in the eligibility record. Administrative review and lifecycle actions are audited.

No system is perfectly secure and we do not claim any security certification. Report suspected vulnerabilities to security@savagetechnicalsolutions.com.

8. Your rights and how to exercise them

Depending on where you live, you may have rights to access, correct, delete, restrict or object to processing, withdraw consent where applicable, export your content, and complain to a data protection authority.

Deletion: use our account deletion page.

Other requests: email privacy@savagetechnicalsolutions.com from the address on your account. We may verify account control before acting.

If you are a California resident, we do not sell or share personal information as those terms are defined by the CCPA/CPRA, and we do not discriminate against you for exercising your rights.

9. Children's privacy

The Service is intended for adults and is not directed to children. We do not knowingly collect personal data from anyone under 16. Contact privacy@savagetechnicalsolutions.com if you believe a child provided personal data.

10. Changes to this policy

We may update this Policy. Material changes will be notified by email or in-app notice where appropriate before taking effect.

11. Contact us

Lee Savage, Savage Management Holdings Inc., Las Vegas, NV, USA
Privacy: privacy@savagetechnicalsolutions.com
Security: security@savagetechnicalsolutions.com
General support: support@savagetechnicalsolutions.com