Global Privacy Policy Notice

1Who we are, and which role we play

Traffelo AI Inc. runs traffelo.ai and the sovereign edge platform under the GDPR and UK Data Protection Act 2018, KVKK, the UAE and Qatar PDPLs, and the Singapore and Malaysia PDPAs. We are the controller for anything you send through this website. Inside your own deployment we are only a processor, acting on your instructions under a signed DPA. The site is business-to-business and is not directed at anyone under eighteen.

Cláusula: Privacy 1.1 · 1.2

2Your data does not leave your perimeter

PII is detected, masked and tokenized at your sovereign edge node in sub-5ms, before any payload is transmitted to an external inference model, and the in-flight memory buffers are cleared immediately after execution. Client datasets, prompts and output payloads are never stored, monetized, or used to train public foundation models.

Cláusula: Privacy 2.1 · 2.2

3What we collect on this website

From forms: name, business email, corporate telephone, job title, organization, and the deployment preferences you describe. Automatically: a truncated IP address, operating system, browser, language and theme. Analytics load only on prior opt-in — choosing Necessary Only blocks external analytics from initializing at all. Subprocessors are contractually held to equivalent standards, and the register is available on request.

Cláusula: Privacy 3.1–3.3

4Why we are allowed to process it

Four lawful bases, and nothing outside them: performance of a contract or pre-contractual steps, legitimate B2B interests, your explicit consent for optional analytics, and statutory compliance. You can object to legitimate-interest processing at any time, and doing so does not affect contract performance.

Cláusula: Privacy 4

5Where it goes across borders

Website enquiry data crossing a border travels under a lawful mechanism: EU Standard Contractual Clauses and the UK IDTA (Modules 1 and 2) with Transfer Impact Assessments for the EEA; KVKK Article 9 terms recognized by the Kişisel Verileri Koruma Kurumu for Türkiye; localized sovereign cloud storage for the UAE and Qatar; and PDPA transfer equivalence for Singapore and Malaysia.

Cláusula: Privacy 5.1

6How long we keep it

Briefing and commercial enquiry records: twenty-four months from the last active communication, then permanently deleted or irreversibly anonymized to the NIST SP 800-88 cryptographic wipe standard. Technical security logs: ninety days. Consented analytics data: purged or aggregated after fourteen months.

Cláusula: Privacy 6.1

7Your rights, and how to use them

Access, rectification, erasure, restriction, portability and objection, subject to regional statutory limits, plus the specific enquiries KVKK Article 11 gives Turkish data subjects. Requests reach the Data Protection Office through the privacy contact on this page, and are answered within the statutory period.

Cláusula: Privacy 7.1 · 7.2

8Reaching the Data Protection Office

The Data Protection Office and the security team are both reachable through the routed contacts on this page. No mailbox is published in the page body by design — the recipient is resolved server-side — so these buttons are the route rather than a convenience.

Cláusula: Privacy 8.1 · 8.2

9Complaints, profiling and children

You keep the statutory right to lodge a complaint with your supervisory authority in the EU/UK, Türkiye, the GCC or S.E. Asia. Personal data collected through the website and commercial interfaces is not used for automated decision-making or profiling that produces legal effects. The site is not directed at children.

Cláusula: Privacy 9.1–9.3

Contacto de privacidad Equipo de seguridad