Privacy policy.

Who we are

Typezo (“we”, “us”) operates https://typezo.io and the RFP response workspace sold through it. For the website, enquiries and account data, we are the controller of the personal data described here. For the documents and content a customer uploads to a workspace, the customer is the controller and we act as its processor.

Privacy and data protection requests: jason@typezo.io. We do not have a statutory data protection officer; the founder handles these requests. A postal address is available on request from the contact address below.

What this policy covers

• The public marketing site and its booking form.
• The sample workspace, which uses a fictional company and solicitation and needs no account.
• Customer workspaces: the account, the solicitation and company documents a customer uploads, the requirements and cited answers produced from them, and the exports.
• The help desk inside a workspace, including its tickets.
• Support and sales correspondence with us.

What we collect

If you visit the site

Our edge provider processes the request itself: IP address, user agent, the URL requested and the time. That is what any web server sees. We use it for security, abuse prevention and aggregate traffic measurement. We do not build a profile of you from it, and we do not run advertising trackers.

If you book a walkthrough

The booking form asks for your name, email address, company and what you want to discuss. We store the enquiry in our own database and email it to the team so it is not missed. We use it to reply and to keep a record of the conversation. We do not sell it and we do not add you to a marketing list without your agreement.

Server logs and rate limiting

The site logs the request method, path, status and duration. It does not log the query string, the request body, the email address or the message. To stop form spam, the rate limiter keeps your IP address in memory for ten minutes; it is not written to the log.

If you use a customer workspace

• Account data: name, email address, workspace name, role, sign-in events and the audit trail of actions in the workspace.
• Customer content: the solicitation and company documents you upload, the text and page spans extracted from them, the requirements and answers generated, the evidence stored for each answer, help desk articles and tickets, and the exports you create.
• Billing and usage data: plan, invoice records, token counts and the model provider used for a run. Payment card details are handled by our payment processor; we do not store card numbers.
• Operational logs: identifiers, stages, durations, token counts, status and error codes. Our rules forbid document text, quotes, answers, prompts, completions, email addresses, IP addresses beyond the audit row, cookies and tokens from those logs.

If you contact us

We keep the correspondence, including your name and email address, for as long as needed to answer and to keep a record of the request.

Cookies and analytics

The marketing pages can load Google Analytics 4. It is off until you choose Accept analytics in the banner, and it never loads in the workspace. Rejecting sets no Google Analytics cookies and sends no request to Google.

Strictly necessary cookies may be set by Cloudflare for bot management and by a signed-in workspace for your session. They are not used to track you across other sites. The marketing pages do not require a cookie to work.

If you accept, Google Analytics 4 collects the page you viewed and the page that referred you, an approximate location derived from your IP address (GA4 does not log or store the address), your device, browser and language, and interactions on the marketing pages: opening the sample, playing the demo, clicking the booking link, and submitting the booking form and whether it succeeded. It sets _ga and _ga_<container-id> cookies. We do not send your name, email, company or message to Google, and we do not send document text, prompts, quotes or tenant identifiers. Google Signals, ads personalisation and data sharing are off. Analytics data is kept for 14 months. Google LLC processes it, including in the United States.

Analytics does not load until you accept it. You can change your choice at any time:

Google may also process data as described in how Google uses information from sites that use its services. We do not use Analytics for advertising, remarketing or audience sharing.

The Typezo workspace is a separate application on a tenant host. It does not load Google Analytics, does not share the marketing site's cookies, and does not send your documents, prompts, quotes or tenant identifiers to Google.

Why we use it, and the legal bases

• To provide the service — performance of our contract with the customer.
• To secure the service and prevent abuse — legitimate interests in keeping the service and its customers safe.
• To answer enquiries and improve the product — legitimate interests, and consent where the law requires it for electronic marketing.
• To meet legal, tax and accounting obligations — legal obligation.
• Analytics cookies — consent, where consent is required.

What we do not do

• We do not use customer documents, prompts or answers to train models, and our providers are contractually barred from training on or retaining them.
• We do not sell personal data.
• We do not share personal data for cross-context behavioural advertising.
• We do not read customer content for our own purposes. Support access is a time-boxed grant from the customer and is visible in the tenant audit log.

Who we share it with

We use service providers to run the product. They may process personal data only on our instructions and under contract. The current categories are:

• Amazon Web Services — Hosting, per-tenant KMS keys, object storage and recorded administrative sessions (United States (us-east-1) and the region the workspace is provisioned in).
• Cloudflare — DNS, CDN, WAF, bot management and cookieless traffic measurement (Global edge network).
• Zoho — Mailbox for legal, privacy and support correspondence (As configured by Zoho).
• Resend — Transactional email for sign-in links (United States).
• Model providers — Generating answers. Only providers contractually barred from training on or retaining inputs are selectable: Amazon Bedrock, Anthropic, Azure OpenAI, Ollama Cloud. (As configured per workspace and shown in the product).
• Google — Analytics after consent on the marketing pages only: Google Analytics 4 (United States and Google's global infrastructure).

We may also disclose data where the law requires it, to protect rights or safety, or as part of a merger or acquisition, in which case the recipient remains bound by this policy for data already collected. A current subprocessor list and a data processing addendum are available on request.

International transfers

We operate from more than one country and use providers in the United States and elsewhere. Where personal data protected by the GDPR or UK GDPR leaves the EEA, the UK or Switzerland, we rely on an adequacy decision or on Standard Contractual Clauses (including the UK Addendum where relevant), together with the provider's contractual commitments and, where needed, additional safeguards. We do not claim certification under the EU-U.S. Data Privacy Framework.

If we are required to appoint a representative in the EU or the UK, their details will be published here before we rely on that appointment.

How long we keep it

• Enquiries: 24 months from the last contact.
• Operational logs: 30 days, unless a security incident requires them to be kept longer.
• Workspace content: for the life of the workspace, then deleted when the workspace is deleted.
• Deletion: a signed deletion receipt within 30 days; backups become unreadable when the tenant key is destroyed.

We keep billing records for as long as tax and accounting law requires. Where we keep data because the law requires it, we limit access and stop using it for anything else.

Security

The security model is published in full on the security and data page: one tenant per instance and one KMS key per tenant, a sandbox with no database credentials or provider keys, a control plane that does not store document text, and an append-only audit log. We do not hold FedRAMP, CMMC or SOC 2, and we do not claim we do.

Your rights

Depending on where you live, you may have the right to access, correct, delete, restrict or port your personal data, to object to processing based on legitimate interests, and to withdraw consent. You can also ask us not to send you marketing at any time.

To exercise a right, email jason@typezo.io. We will verify your identity, respond within the period the law requires, and explain if an exception applies. You may use an authorised agent where the law allows it. You will not be discriminated against for exercising a right.

If you are in the EEA or the UK, you also have the right to complain to your local supervisory authority or to the UK Information Commissioner's Office. We would rather you came to us first.

California and other US state rights

If you are a California resident, you may request to know, access, correct or delete the personal information we hold about you, and to opt out of its sale or sharing for cross-context behavioural advertising. We do not sell personal information and we do not share it for that purpose. We honour Global Privacy Control signals as an opt-out of sale and sharing. Similar rights may apply under other state laws; the request route is the same email address.

We do not use or disclose sensitive personal information for purposes that would require a right to limit under California law.

Children

The service is for businesses and is not directed to anyone under 18. We do not knowingly collect personal data from children. If you believe a child has provided data, contact us and we will delete it.

Changes

We may update this policy. The date at the top changes when we do. If a change materially affects how we use data already collected, we will give notice on the site or by email before it takes effect, and where the law requires it, ask for consent again.

Contact

Questions, requests and complaints: jason@typezo.io. For security reports, the same address reaches the person who operates the service.