This policy explains what personal data we collect when you use SpiralSim, why, and what rights you have. It is written to meet our obligations under the EU General Data Protection Regulation (GDPR).
The data controller is Spiral Hydrogen OÜ, registry code 16896381, Õismäe tee 44-44, 13512 Tallinn, Harju County, Estonia, also established in the Netherlands at Scheepsbouwweg 8, 3089 JW Rotterdam (KVK 42018890).
Privacy contact: [email protected]
If you use SpiralSim through an organisation created by your employer or a customer of ours, that organisation controls its own workspaces and their content. We process that content on their behalf.
| Category | What it is | Where it comes from |
|---|---|---|
| Account data | Your email address, and the display name your sign-in provider gives us. Your organisation, role, and membership. | You, and your sign-in provider (Google, or an email code) |
| Content you create | Modelica models and their revision history, folders, saved simulation results, AI chat conversations, and any files you attach. | You |
| Usage data | Simulation runs and their status, AI token counts and estimated cost, which plan limits you hit. | Generated by the Service |
| Technical data | Your IP address (used for rate limiting and abuse prevention), server logs, and an audit record of administrative actions such as invitations and plan changes. | Generated by the Service |
| Communications | Emails we send you (invitations, notices) and their delivery status — metadata only, not message content. | Generated by the Service |
We do not ask for, and ask you not to submit, special categories of personal data (health, biometrics, political or religious views, and similar).
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Providing the Service: authenticating you, storing your models, running simulations, answering your AI requests | Performance of a contract (Art. 6(1)(b)) |
| Keeping the Service secure and available: rate limiting, abuse detection, sandbox containment, error monitoring | Legitimate interests (Art. 6(1)(f)) — protecting our systems and our users |
| Enforcing usage limits and preparing future billing | Performance of a contract (Art. 6(1)(b)) |
| Service emails: invitations, and notices about changes | Performance of a contract (Art. 6(1)(b)) |
| Complying with legal obligations, and establishing or defending legal claims | Legal obligation (Art. 6(1)(c)) and legitimate interests (Art. 6(1)(f)) |
The providers we use are listed in section 5. We do not use your content to train our own models. We use the providers' business/API terms, under which Anthropic and OpenAI do not train their models on API traffic by default. Where a request is routed through an aggregator (OpenRouter), it may be served by a further upstream provider whose own terms differ, and we cannot guarantee that provider's training policy. We store the raw text of your chat turns so your conversation history works; we do not store the assembled prompt.
Where a library or model is marked confidential, the Service is designed to keep it out of AI requests and to restrict which providers may be used. That is a technical control, not a guarantee about what you type yourself.
We use the following processors and sub-processors. All hosting of your content is in the European Union.
| Provider | What for | Where |
|---|---|---|
| Amazon Web Services | Hosting, storage, backups | EU (Stockholm, eu-north-1) |
| Cloudflare | Network protection, access control, bot protection (Turnstile) | EU / global edge |
| WorkOS | Sign-in and session management | United States |
| Anthropic | AI model responses | United States |
| OpenAI | AI model responses, where enabled | United States |
| OpenRouter | Routing to AI models, where enabled | United States |
| Amazon SES | Sending service emails | EU (Stockholm, eu-north-1) |
| Stripe Payments Europe, Ltd. | Payment processing for paid plans — billing name, address, VAT number and card details are entered on Stripe's pages and held by Stripe; we store only your Stripe customer and subscription identifiers | EU (Ireland) / United States |
International transfers. Some providers above are in the United States. Where we transfer personal data outside the EEA we rely on the European Commission's Standard Contractual Clauses, or on an adequacy decision where one applies, together with the provider's own safeguards.
We also disclose data where we must by law, and to professional advisers or a successor in the event of a reorganisation or sale of the business. We do not sell your personal data and we do not use it for advertising.
| Data | Retention |
|---|---|
| Models, revision history, chat conversations | Until you delete them, or your organisation's account is closed. Deleted models are recoverable from Trash until permanently removed. |
| Simulation run records and stored results | 14 days by default |
| Email delivery log (metadata only) | 90 days |
| Pending invitations | 14 days, then they expire |
| Account and audit records | For the life of the account, and for a reasonable period afterwards where needed for legal claims |
| Backups | Rolling backups are retained for up to 14 days and then overwritten |
Under the GDPR you have the right to: access your data; correct it; have it deleted; restrict or object to how we process it; receive it in a portable format; and withdraw consent where processing is based on consent. You can exercise most of these directly in the application — you can edit and delete your models and conversations, and an organisation administrator can remove members.
For anything else, write to [email protected]. We will respond within one month.
You also have the right to complain to a supervisory authority. Ours is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, aki.ee). You may instead complain to the authority where you live or work — for example the Autoriteit Persoonsgegevens in the Netherlands.
Traffic is encrypted in transit. Your content is stored on encrypted volumes in the EU. Access to production systems is limited to the people who need it. Code you submit is compiled and run inside a hardened, network-isolated sandbox that cannot reach the internet or other customers' data. No system is perfectly secure, and you are responsible for maintaining your own copies of anything you cannot afford to lose.
We use only what the Service needs to work: a session cookie that keeps you signed in, a short-lived cookie during sign-in, and Cloudflare's bot-protection cookie. We do not use advertising or analytics cookies, so we do not show a consent banner.
SpiralSim is for business use and is not intended for anyone under 16. We do not knowingly collect data from children.
We may update this policy. If a change is material we will tell you in the application or by email before it takes effect. The version and effective date at the top of this page always tell you which version applies.