Privacy policy

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG) is:

IP Strategy UG (haftungsbeschränkt), trading as “Siyaya Digital” (product: CertX), Niederrheinstraße 46f, 41472 Neuss, Germany. Represented by Managing Director Ilya Piontek. Email: privacy@siyaya-digital.com.

No data protection officer is appointed; there is currently no obligation to appoint one under Art. 37 GDPR or § 38 BDSG. For data protection questions, please use the address above.

2. Scope and legal bases

This notice applies to the certx.app website and the CertX application. We process personal data solely in accordance with the GDPR, the BDSG and the German Telecommunications-Digital-Services Data Protection Act (TDDDG).

Depending on the processing, the legal bases are: Art. 6(1)(b) GDPR (contract/use), Art. 6(1)(a) GDPR (consent), Art. 6(1)(c) GDPR (legal obligation) and Art. 6(1)(f) GDPR (legitimate interest, in particular security and operation).

3. Hosting and infrastructure (EU)

The application is operated in the European Union; data is held in the EU region of Frankfurt am Main.

Vercel (hosting/CDN)

The frontend and server functions are provided via Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA. Server functions are pinned to the EU region (Frankfurt, “fra1”). A data processing agreement under Art. 28 GDPR is in place; any US transfers rely on Standard Contractual Clauses (Art. 46 GDPR) and — where certified — the EU-US Data Privacy Framework. Legal basis: Art. 6(1)(f) GDPR.

Supabase (database, storage, authentication)

Database, file storage (uploaded drawings) and authentication run on Supabase (Supabase Inc., USA), hosted in the EU region of Frankfurt (AWS eu-central-1). A data processing agreement under Art. 28 GDPR is in place; third-country transfers rely on Standard Contractual Clauses (Art. 46 GDPR). Tenant isolation is enforced technically via Row-Level Security (RLS).

4. Server log files

When the website is accessed, technically necessary access data transmitted by your browser is processed:

• requested URL and referrer
• date and time of access
• browser type and operating system
• IP address (for delivery and attack prevention)

Processing serves the delivery, stability and security of the service. The legal basis is Art. 6(1)(f) GDPR. Data is stored only as long as necessary for these purposes.

5. Cookies and consent management

We use technically necessary cookies (session/sign-in, language and theme settings, and storage of your cookie consent). Storing or reading this information is strictly necessary and exempt from consent under § 25(2) TDDDG.

Non-necessary cookies (e.g. statistics, marketing) are set only with your consent under § 25(1) TDDDG together with Art. 6(1)(a) GDPR. Via the cookie banner you can consent or object per category; you can change or withdraw your choice at any time via “Cookie settings” in the footer.

No statistics or marketing services are currently active; the corresponding categories are kept available and are only activated after your consent.

6. Fonts

The fonts used are served locally from our server (self-hosting). No connection to Google Fonts or other third parties takes place; in particular, your IP address is not transmitted to third parties for font delivery.

7. Demo requests via the form on the home page

If you request a demo using the form on the home page, we process your name, company, work email address, your optional message, the page language and the time of the request. The details are stored in our database in the EU (see section 3) and used only to handle your request and arrange the demo.

The legal basis is Art. 6(1)(b) GDPR (pre-contractual steps at your request). We delete the request once it has been fully handled and no statutory retention obligation applies, and in any case no later than 12 months after receipt unless a contract results from it.

8. User account, sign-in and two-factor authentication

To use CertX an account is created. We process name, email address, role, tenant membership, language setting and sign-in/security metadata (time of first sign-in, password-change status and 2FA status).

For security reasons you must change an initial password set for you by an administrator on first sign-in and set up two-factor authentication (TOTP) right after; CertX cannot be used without it. Passwords are stored only as a cryptographic hash; TOTP secrets are managed by our authentication provider (Supabase).

The legal basis is Art. 6(1)(b) GDPR (performance of the use relationship) and Art. 6(1)(f) GDPR (account security).

Sign-up and trial

Businesses can sign up themselves at certx.app/signup. We process the company, your name, your email address, the chosen password (as a hash only) and your confirmation that you act for a business. To confirm the email address, our authentication provider (Supabase) sends an email with a link. Only after confirmation does CertX create your tenant; the first account becomes its administrator and can add further users. The trial is free and requires no payment details. The sign-up is recorded with time and email address in the event log. The legal basis is Art. 6(1)(b) GDPR.

Subscription, payment and usage counting (Dodo Payments)

Paid plans are handled by Dodo Payments. Dodo Payments acts as merchant of record: you make the purchase with Dodo Payments, which issues the invoices, remits VAT and processes your payment data (e.g. card or account details, billing address, VAT ID) as an independent controller under its own privacy policy (dodopayments.com). CertX receives no card or account details. We pass to Dodo Payments your name and email address for checkout, your tenant’s identifier, the chosen plan, the number of users (Starter plan) and, for every Claude read, a usage event (identifier and time, no drawing content) so that reads beyond the quota can be billed. From Dodo Payments we receive the plan, status and term of the subscription as well as customer and subscription identifiers. CertX counts Claude reads per tenant and billing period from the event log; all users of the tenant see this counter. Dodo Payments may process data outside the EU (see section 13). The legal basis is Art. 6(1)(b) GDPR; invoice data is retained according to commercial and tax law obligations (Art. 6(1)(c) GDPR).

Optionally, you can store a company name, address and logo under “Profile & settings → Letterhead”; CertX prints them on your inspection protocols and RFQs. The logo is kept in your tenant’s storage area in the EU.

9. Processing of uploaded drawings and AI extraction

The core function of CertX is reading technical drawings. Uploaded files and the characteristics extracted from them are stored tenant-scoped in the EU (see section 3).

For extraction, the content is transmitted server-side to the Claude API. Our contracting party and processor (Art. 28 GDPR) is Anthropic Ireland, Limited, Dublin, Ireland, under its data processing addendum, which is part of the API terms. Processing also takes place in the USA, among others by the parent company Anthropic, PBC, San Francisco, as a sub-processor; this transfer relies on the EU Standard Contractual Clauses (Art. 46 GDPR) incorporated into the data processing addendum. Under the API terms, the transmitted content is not used to train the models and is retained only transiently for operational and safety purposes. The same applies to questions to the CertX Butler, which only receives data from your own tenant.

For each read, the CertX built-in reading engine can be chosen instead. CertX then reads the drawing itself — from the PDF text layer or by text recognition on the CertX server in the EU (Frankfurt) — and sends no content of that drawing to an AI provider. A tenant’s administrators can lock the built-in engine for all users; every drawing of that tenant is then read without an AI provider. If a tenant sets the built-in engine as its default, the CertX Butler is switched off as well.

With “Read privately”, the built-in engine runs in the user’s browser: the drawing and the reading result are neither transmitted to CertX or third parties nor stored. For this, the browser only loads the engine’s program code and text-recognition models from CertX, plus the rules learnt from the tenant’s corrections (see below).

Client data on a drawing (e.g. company name, address, names in the title block) can be blacked out before reading. CertX suggests these areas (client data, possible logos, the whole title block) on the CertX server in the EU (Frankfurt), without an AI provider. When a blacked-out drawing is read with Claude, CertX sends only the redacted first page: the covered areas are removed from the image and are not transmitted. Title block details Claude therefore cannot see (e.g. material, drawing number) are read by CertX on the CertX server from the original file. A tenant’s administrators can switch on automatic redaction: CertX then blacks out the title block, detected client data and possible logos on the CertX server before every Claude read; if CertX finds no title block and nothing is blacked out, the drawing is not sent to Claude. Before a drawing that is not blacked out is read with Claude, CertX advises blacking it out first; users can turn this notice off for their own account.

The API key is a server-only secret; AI processing happens exclusively within CertX, tenant-scoped, and is logged per tenant: time, acting person, model and number of tokens processed (for billing) — not the content of Butler questions and answers. The legal basis is Art. 6(1)(b) GDPR. Technical drawings may contain personal data (e.g. operator initials); do not transmit personal data that is not required for the inspection.

10. Improving recognition (corrections / learning loop)

Corrections that reviewers make to the automated read may be used to improve the central recognition engine. Before any cross-tenant use, the data is de-identified: customer and drawing names, drawing numbers and other identifying information are removed; only geometry and characteristic data remain.

To improve the built-in reading engine, CertX compares its result with Claude’s reads of the same drawings and with reviewers’ corrections. A tenant’s administrators can run this comparison as an engine benchmark on their own drawings; it runs on the CertX server in the EU (Frankfurt), without an AI provider. Only metrics (e.g. the number of characteristics found) and numbers derived from them (position, size, type of a read characteristic) are logged — no drawing content. Weights computed from such numbers (e.g. for the filter that discards false hits) become part of the engine for all tenants; they contain no drawing content.

When reviewers correct, add, move or delete characteristics on a reading of the built-in engine, CertX stores with each correction which engine read the drawing and where the characteristic sat on the drawing (position and size, no image data). From this the engine learns per tenant: a label deleted on several drawings is no longer read; a label corrected the same way on several drawings is read in that form from then on. These learnt rules apply only to the tenant’s own readings, are computed from its corrections and are not used across tenants. Administrators see them in the engine benchmark and can take back individual rules; this is logged.

To train the built-in engine’s text recognition, a tenant’s administrators can export training data from the engine benchmark: small image crops of the dimension and characteristic labels of their drawings (not whole drawings, not the title block) with the matching values of the Claude reading or of the reviewers’ corrections on built-in engine readings (including crops of deleted false hits). The export lies in the tenant’s storage area, can be fetched through a link valid for one hour, and is logged. Siyaya Digital uses the crops solely to train the text recognition; training takes place in our development environment, which uses AI-assisted development tools from Anthropic (USA, see section 9). The crops are deleted afterwards; only the trained weights become part of the engine.

The cross-tenant master dashboard shows only metrics (counts, accuracy percentages, categories) — never drawing content. The legal basis for the improvement is Art. 6(1)(f) GDPR; where personal data is concerned, we additionally rely on consent given in the terms of use. You can object to the processing under Art. 21 GDPR.

11. No solely automated decision-making

The AI extraction is a proposal that is reviewed, corrected and released by a human. There is no solely automated decision producing legal effects within the meaning of Art. 22 GDPR.

12. Recipients / processors

We disclose personal data only where necessary. Processors used:

• Vercel Inc. (USA) – hosting/CDN, server functions (EU region).
• Supabase Inc. (USA) – database, file storage, authentication (hosting EU/Frankfurt).
• Anthropic Ireland, Limited (Ireland) – AI extraction (Claude API); processing also in the USA.

Data processing agreements under Art. 28 GDPR are in place with all processors. For paid plans, Dodo Payments as merchant of record is an independent controller for payment processing (see section 8). No disclosure for third parties’ own advertising purposes takes place.

13. Transfers to third countries

Processing may take place in the USA (see section 12). Where data is processed outside the EU/EEA, we ensure an adequate level of protection through the European Commission’s Standard Contractual Clauses (Art. 46(2)(c) GDPR) and — where the recipient is certified — through the EU-US Data Privacy Framework (Art. 45 GDPR).

14. Retention and deletion

We store personal data only as long as necessary for the stated purposes or to meet statutory retention obligations. Account, drawing and protocol data is stored for the duration of the use relationship and deleted after it ends, unless retention obligations (e.g. under commercial/tax law) apply. Thereafter the data is deleted or restricted.

You can delete your account yourself at any time (Profile & settings → Delete account); your company’s administrators can remove accounts too. This deletes your sign-in data, your profile and your letterhead including the logo. Drawings and inspection protocols belong to your company and stay, no longer linked to your account.

Individual drawings can be deleted by the person who uploaded them and by administrators — with the file, preview, extracted characteristics and protocol drafts. Drawings with completed inspection protocols are kept as quality records. When the use relationship ends, we delete your company’s data including all uploaded files.

Actions in CertX (e.g. sign-in, upload, reading, changes and deletions) are recorded with time and acting person in an event log to ensure security and traceability (Art. 6(1)(f) GDPR). When an account is deleted, the link to it is removed; the entries recording the creation and deletion of the account keep its email address as evidence. Decisions on protecting client data are likewise recorded with name and email address: the answer to the notice advising redaction before a Claude read (with the notice text shown), turning that notice off or on, and changes to the reading-engine settings and automatic redaction. They serve as evidence of who decided what and when (Art. 6(1)(f) GDPR). Event log entries cannot be altered afterwards.

15. Your rights

Under the GDPR you have the following rights:

• access (Art. 15 GDPR)
• rectification (Art. 16 GDPR)
• erasure (Art. 17 GDPR)
• restriction of processing (Art. 18 GDPR)
• data portability (Art. 20 GDPR)
• objection to processing based on Art. 6(1)(f) GDPR (Art. 21 GDPR)
• withdrawal of consent with effect for the future (Art. 7(3) GDPR)

To exercise your rights, a message to privacy@siyaya-digital.com is sufficient.

16. Right to lodge a complaint

Without prejudice to other remedies, you have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is:

Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW), Postfach 20 04 44, 40102 Düsseldorf (https://www.ldi.nrw.de).

17. Data security

We take appropriate technical and organisational measures (Art. 32 GDPR): transport encryption (TLS/HTTPS), tenant isolation via Row-Level Security, role-based access control, server-side secret management (no AI key in the browser) and mandatory two-factor authentication.

18. Status and changes

Status of this privacy policy: 24 October 2026. We will update this notice if the processing or the legal situation changes.