Privacy & Data Protection Policy

Account and contact information may include names, business email addresses, organization details, workspace settings, support correspondence, and billing administration details.

Customers may submit datasets, schemas, pipeline configurations, prompts, derived artifacts, and feature representations for processing. Customers determine the purpose and lawful basis for those submissions.

Where the selected deployment supports it, pipeline transforms use ephemeral CPU, RAM, and GPU VRAM buffers, including Apache Arrow-compatible in-memory representations. Processing buffers are cleared after the relevant run according to the configured execution and retention policy.

Temporary operational copies may exist when required for orchestration, retries, security, backup, or audit operations. The applicable deployment and order terms define those exceptions and retention windows.

Account telemetry may include login and access events, pipeline execution metadata, resource utilization, error traces, configuration changes, latency, throughput, and support diagnostics.

We use telemetry to provide service visibility, detect abuse and security incidents, measure reliability, produce billing records, and improve platform operations. We do not use customer datasets, feature vectors, or private content to train public foundation models.

Depending on the contracted architecture, workloads may run in shared service boundaries, isolated environments, or single-tenant VPC and private-cluster deployments. Access controls, network boundaries, encryption, and administrative separation are selected during deployment review.

Regional placement may be requested for supported environments. Customers remain responsible for confirming that the selected region and deployment model satisfy their legal, regulatory, and contractual requirements.

The reference infrastructure model may include Cloudflare for CDN and edge delivery, AWS for cloud infrastructure and storage services, and NVIDIA infrastructure or GPU technologies for accelerated workloads. Specific subprocessors and services depend on the customer deployment and contract.

We use contractual, technical, and operational controls appropriate to the service relationship. Enterprise customers may request additional subprocessor, region, and security information through the DPO or security contact.

To submit a data subject access request, email info@datasculpt.lk with your identity, organization, request type, affected account or data scope, and preferred response channel. We may verify identity and authority before responding.

We will assess requests under applicable law, respond within the required period, and explain any lawful limitation or exception. Requests may also be made through an authorized representative where applicable.

Customers may request deletion of account data, submitted content, derived artifacts, or telemetry by contacting the DPO or security team. Include the workspace, data category, requested scope, and desired completion window.

Deletion requests are reviewed against backup, fraud-prevention, security, billing, dispute, and legal-retention obligations. Once required retention ends, data is deleted or irreversibly de-identified according to the applicable policy and deployment controls.

Contact the Data Protection Officer at info@datasculpt.lk for privacy rights, DSAR, retention, and processing questions. Contact info@datasculpt.lk for suspected security incidents, access concerns, vulnerability reports, or enterprise security documentation.

When reporting an incident, include the affected workspace, approximate time, observed behavior, and a safe callback channel. Do not include secrets, credentials, or unnecessary personal data in the initial report.