Privacy Policy
Last updated: March, 19 - 2026
This Privacy Policy describes how Terran Labs BV BV ("Tuplex", "we", "us", "our"), a company incorporated under the laws of Belgium, collects, uses, discloses, and protects personal data when you use our platform and services (the "Service").
Tuplex is committed to protecting the privacy of individuals and complying with applicable data protection legislation, including Regulation (EU) 2016/679 (the "GDPR"), the Belgian Data Protection Act of 30 July 2018, the California Consumer Privacy Act (as amended by the CPRA, the "CCPA"), and other applicable international data protection laws.
1. Data Controller and Data Processor Roles
Tuplex operates in two distinct capacities depending on the type of data processing:
1.1 Tuplex as Data Controller
Tuplex acts as a data controller for personal data we collect and process for our own purposes, including:
- Account registration and management data
- Billing and payment data
- Website analytics and usage data
- Marketing and communications data
- Support and correspondence data
1.2 Tuplex as Data Processor
Tuplex acts as a data processor for personal data that Customers submit to or process through the Service on behalf of their own end-users or data subjects. This processing is governed by our Data Processing Agreement.
This Privacy Policy primarily addresses Tuplex's role as data controller. For information about how we process data on behalf of Customers as a data processor, please see our Data Processing Agreement.
2. Personal Data We Collect
2.1 Data You Provide to Us
| Category | Examples | Purpose | | ----------------------- | -------------------------------------------------------------- | -------------------------------------------------- | | Account Data | Name, email address, company name, job title, profile picture | Account creation, authentication, service delivery | | Billing Data | Payment method, billing address, tax identification number | Payment processing, invoicing, tax compliance | | Communications Data | Support tickets, emails, feedback | Customer support, service improvement | | Content Data | Inputs to AI features, agent configurations, workspace content | Service delivery, generating AI outputs | | Integration Data | OAuth tokens, API keys for connected services | Providing integrations and connected features |
2.2 Data We Collect Automatically
| Category | Examples | Purpose | | --------------- | --------------------------------------------------------------------- | --------------------------------------------- | | Usage Data | Features used, actions taken, frequency, session duration | Service improvement, analytics | | Device Data | Browser type, operating system, device identifiers, screen resolution | Compatibility, troubleshooting | | Log Data | IP address, access times, pages visited, referral URLs, error logs | Security, debugging, performance monitoring | | Cookie Data | Session cookies, preference cookies, analytics cookies | See our Cookie Policy |
2.3 Data from Third Parties
| Source | Data | Purpose | | ------------------------------------------------ | -------------------------------------------- | ----------------------------------- | | Identity providers (e.g., Google, Microsoft) | Name, email, profile picture (via SSO/OAuth) | Account creation and authentication | | Payment processors | Transaction confirmations, payment status | Billing management | | Public sources | Company information from public registries | Account verification |
3. How We Use Your Data
We process your personal data for the following purposes and on the following legal bases:
| Purpose | Legal Basis (GDPR Art. 6) | | -------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------ | | Providing the Service — account management, AI processing, feature delivery | Performance of contract (Art. 6(1)(b)) | | Billing and payments — processing payments, issuing invoices, managing subscriptions | Performance of contract (Art. 6(1)(b)) | | Customer support — responding to inquiries, resolving issues | Performance of contract (Art. 6(1)(b)) | | Security and fraud prevention — protecting accounts, detecting abuse, preventing unauthorized access | Legitimate interest (Art. 6(1)(f)) | | Service improvement — analyzing usage patterns, improving features, developing new functionality | Legitimate interest (Art. 6(1)(f)) | | Legal compliance — fulfilling legal obligations, responding to lawful requests | Legal obligation (Art. 6(1)(c)) | | Marketing communications — sending product updates, newsletters (with consent where required) | Consent (Art. 6(1)(a)) or legitimate interest (Art. 6(1)(f)) | | Analytics — understanding service performance and user behaviour | Legitimate interest (Art. 6(1)(f)) |
Where we rely on legitimate interest, we have conducted balancing tests to ensure our interests do not override your fundamental rights and freedoms.
4. AI-Specific Data Processing
4.1 AI Inputs and Outputs
When you use AI features of the Service, we process the inputs (prompts, instructions, attached data) you provide and generate outputs. This processing is necessary for the performance of our contract with you.
4.2 No Model Training
Tuplex does not use Customer Content (inputs or outputs) to train, improve, or develop AI models. Your data is processed solely for the purpose of providing the Service to you. The third-party AI model providers we use (Anthropic, OpenAI, Google, Mistral) are contractually prohibited from using your data for model training when accessed through their commercial API agreements.
4.3 AI Model Provider Processing
To generate AI outputs, we transmit input data to third-party AI model providers. This transmission is governed by our data processing agreements with these providers. For details on our sub-processors, see Section 8 and our Sub-processor List.
4.4 Automated Decision-Making
The Service does not engage in solely automated decision-making that produces legal effects or similarly significant effects on individuals within the meaning of GDPR Article 22. AI agents operate under Customer configuration and supervision, and Customers are responsible for implementing appropriate human oversight over agent actions.
5. Data Sharing and Disclosure
5.1 Sub-processors
We share personal data with the following categories of sub-processors to provide the Service:
| Category | Purpose | Examples | | ------------------------ | ------------------------------------------ | ---------------------------------- | | AI model providers | Generating AI outputs | Anthropic, OpenAI, Google, Mistral | | Cloud infrastructure | Hosting, databases, authentication | Supabase, Railway | | Code execution | Sandboxed code execution for AI agents | E2B | | Payment processors | Payment processing and billing | Stripe | | Email services | Transactional and marketing emails | Resend | | Analytics | Usage analytics and performance monitoring | Sentry, Axiom |
A complete and up-to-date list of sub-processors is maintained at [•].
5.2 Other Disclosures
We may also disclose personal data:
- With your consent or at your direction;
- To comply with law, including responding to lawful requests from public authorities;
- To protect rights and safety, including enforcing our Terms and investigating potential violations;
- In connection with a business transfer, such as a merger, acquisition, or sale of assets, in which case we will notify affected individuals;
- To professional advisors, such as lawyers, auditors, and insurers, where necessary.
5.3 No Sale of Personal Data
Tuplex does not sell personal data. Tuplex does not share personal data for cross-context behavioural advertising purposes within the meaning of the CCPA.
6. International Data Transfers
6.1 Transfer Mechanisms
Tuplex is based in Belgium (EEA). We may transfer personal data to countries outside the EEA, including to sub-processors located in the United States. When we do so, we rely on the following transfer mechanisms:
- EU-U.S. Data Privacy Framework (DPF): Where the receiving party is certified under the EU-U.S. Data Privacy Framework;
- Standard Contractual Clauses (SCCs): We use the European Commission's Standard Contractual Clauses (Decision 2021/914) as incorporated in our Data Processing Agreement;
- Adequacy decisions: Where the European Commission has determined that the receiving country ensures an adequate level of protection.
6.2 Safeguards
In addition to the transfer mechanisms above, we implement supplementary technical and organizational measures to protect personal data during international transfers, including encryption in transit and at rest, access controls, and contractual obligations on recipients.
7. Data Retention
We retain personal data only for as long as necessary to fulfil the purposes for which it was collected:
| Data Category | Retention Period | | ------------------------- | ---------------------------------------------------------------------------------------- | | Account Data | Duration of account plus 3 months after deletion | | Billing Data | 3 years after the last transaction (as required by Belgian tax law) | | Usage and Log Data | 12 months | | Support Data | 3 years after resolution | | AI Inputs and Outputs | Deleted within 365 days after processing, unless Customer has enabled persistent storage | | Marketing Data | Until consent is withdrawn or subscription is cancelled |
After the applicable retention period, personal data is securely deleted or anonymized.
8. Your Rights
8.1 Rights Under the GDPR
If you are located in the EEA or the processing of your data is otherwise subject to the GDPR, you have the following rights:
| Right | Description | | --------------------------------- | ----------------------------------------------------------------- | | Access (Art. 15) | Request a copy of your personal data | | Rectification (Art. 16) | Request correction of inaccurate data | | Erasure (Art. 17) | Request deletion of your data ("right to be forgotten") | | Restriction (Art. 18) | Request restriction of processing | | Portability (Art. 20) | Receive your data in a structured, machine-readable format | | Objection (Art. 21) | Object to processing based on legitimate interests | | Withdraw consent (Art. 7(3)) | Withdraw consent at any time (without affecting prior processing) | | Automated decisions (Art. 22) | Not be subject to solely automated decisions with legal effects |
8.2 Rights Under the CCPA
If you are a California resident, you have the following additional rights under the CCPA:
- Right to Know: You may request information about the categories and specific pieces of personal information we have collected, the sources, the purposes, and the categories of third parties to whom we disclose it.
- Right to Delete: You may request deletion of your personal information, subject to legal exceptions.
- Right to Correct: You may request correction of inaccurate personal information.
- Right to Opt-Out: You have the right to opt out of the sale or sharing of your personal information. As stated above, Tuplex does not sell or share personal information for cross-context behavioural advertising.
- Non-Discrimination: We will not discriminate against you for exercising your CCPA rights.
8.3 Exercising Your Rights
To exercise any of your rights, please contact us at:
- Email: [•]
- Data Subject Request Form: [•]
We will respond to your request within 30 days (GDPR) or 45 days (CCPA). We may request identification verification before processing your request.
8.4 Right to Lodge a Complaint
If you believe your data protection rights have been violated, you have the right to lodge a complaint with a supervisory authority. Our lead supervisory authority is:
Belgian Data Protection Authority (Gegevensbeschermingsautoriteit) Rue de la Presse 35 / Drukpersstraat 35 1000 Brussels, Belgium Website: https://www.gegevensbeschermingsautoriteit.be Email: contact@apd-gba.be
You may also lodge a complaint with the supervisory authority of your country of habitual residence or place of work.
9. Security
We implement appropriate technical and organizational measures to protect personal data against unauthorized access, alteration, disclosure, or destruction. These measures include:
- Encryption of data in transit (TLS 1.2+) and at rest (AES-256)
- Access controls and authentication (including multi-factor authentication)
- Regular security assessments and vulnerability scanning
- Employee access limited on a need-to-know basis
- Incident response procedures
- Sub-processor security requirements
While we take reasonable precautions, no method of transmission or storage is completely secure. We cannot guarantee absolute security of your data.
10. Children's Privacy
The Service is not directed to individuals under the age of 18 (or the age of legal majority in the relevant jurisdiction). We do not knowingly collect personal data from children. If we become aware that we have collected personal data from a child, we will take steps to delete such data promptly.
11. Third-Party Links and Integrations
The Service may contain links to third-party websites or enable integrations with third-party services. This Privacy Policy does not apply to third-party services. We encourage you to review the privacy policies of any third-party services you connect to the Service.
12. Changes to This Privacy Policy
We may update this Privacy Policy from time to time. We will notify you of material changes by email or through the Service at least 30 days before the changes take effect. The "Last updated" date at the top of this page indicates when the Privacy Policy was last revised.
13. Contact Us
If you have questions about this Privacy Policy, data subject request or our data practices, please contact:
Data Protection Officer
Terran Labs BV
Email: privacy@tuplex.ai