Privacy Policy

Last updated: 11 September 2025

Ivandt ("we", "us", "our") builds tools for importing, validating, transforming, and delivering structured data. This policy explains how we handle information for our SDK (the in-app web component) and our optional cloud services (such as Ivandt Builder, hosted portals, analytics, and auditing).

Key Principle

Local by default: The Ivandt SDK processes data in the user's browser. We do not receive or store your users' imported files or derived data unless you explicitly enable cloud storage or configure your SDK integration to submit data to your backend.

Scope

This policy covers the Ivandt SDK, the Ivandt Builder and hosted portals, and the public website and dashboard. It applies when you use our products directly or embed the SDK in your own application.

How the SDK Works (and What We Receive)

• In-browser processing: File parsing, column mapping, validation, transformation, and feedback run inside the end-user's browser. By default, these files and results are not sent to Ivandt.
• Your APIs: You may configure the SDK to submit cleaned JSON payloads directly to your own API. In this configuration, Ivandt does not receive the payload.
• Optional Ivandt storage: If you explicitly enable our secure datastore, we will receive and store imported datasets to provide features like charts, analytics, filtering, and audit logs. You can disable this at any time.

Information We Process

• Account & authentication: When you create an Ivandt account, we store basic account details and authentication information (e.g., email). Authentication may be handled by providers such as Supabase.
• Operational data (optional): If you enable the datastore, we store imported datasets and derived metadata to power analytics, dashboards, and auditing features.
• Product usage: We may collect aggregated, de-identified usage metrics to improve performance and reliability (e.g., feature engagement, error rates). We do not use imported user files for advertising or for model training.

Legal Bases (EEA/UK)

Where applicable, we process data based on one or more of the following: performance of a contract (providing the product you requested), legitimate interests (e.g., product security, troubleshooting), and consent (e.g., when you enable optional features such as cloud storage or analytics where required).

Retention

We retain account and configuration data for as long as your account is active. Optional datasets stored in Ivandt's datastore are retained according to your workspace settings and are deleted upon request or after account closure. We may retain minimal records necessary to meet legal obligations or resolve disputes.

Security

• Local-first design: The SDK runs in the browser to minimize data transfer.
• Encryption in transit: Data sent to Ivandt or your APIs uses HTTPS/TLS.
• Access controls & auditing: Optional datastore features include role-based access and audit trails to monitor activity.

International Transfers

If we process data outside your jurisdiction, we rely on appropriate safeguards (such as standard contractual clauses) to protect personal data. Details are available on request.

Sub‑processors

We use reputable infrastructure and service providers to deliver our products. Depending on your configuration, these may include hosting providers (e.g., Vercel) and authentication/storage providers (e.g., Supabase). Sub‑processors are engaged under data protection agreements and are limited to the minimum necessary scope.

Your Rights

Depending on your location, you may have rights to access, correct, delete, restrict, or port your personal data, and to object to certain processing. If we process your data as a processor on behalf of a customer (e.g., via the optional datastore), we will direct requests to the relevant customer.

Cookies & Similar Technologies

We use essential cookies to operate the service. Optional analytics and preference cookies may be used to improve user experience, subject to your choices and applicable laws.

Children's Privacy

Our products are not directed to children under the age required by applicable law. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us so we can take appropriate action.

Changes to this Policy

We may update this policy to reflect changes in our products or legal requirements. We will update the "Last updated" date above and, where appropriate, provide additional notice.

Contact

For questions or requests related to this policy, please contact us at privacy@ivandt.com.