Privacy Policy

Reliatic collects information necessary to provide our industrial reliability management platform. This includes:

• Account Information: Name, email address, company details, and job title when you create an account
• Technical Data: Asset information, inspection records, maintenance history, and operational data you input into the platform
• Usage Information: Log data, IP addresses, browser types, and interaction patterns with our service
• Communication Records: Support tickets, emails, and other communications with our team

We use collected information for the following purposes:

• Service Delivery: Provide, maintain, and improve the Reliatic platform
• Risk Analysis: Perform integrity calculations, risk assessments, and projection analytics
• Customer Support: Respond to inquiries, troubleshoot issues, and provide technical assistance
• Security & Compliance: Detect fraud, ensure platform security, and maintain regulatory compliance
• Product Improvement: Analyze usage patterns to enhance features and develop new capabilities

For users in the European Economic Area (EEA), the United Kingdom, and Switzerland, Reliatic processes personal data only where one of the lawful bases set out in Article 6(1) of the EU/UK General Data Protection Regulation (GDPR) applies. The table below maps each processing activity to its corresponding legal basis.

Where we rely on consent (Art. 6(1)(a)) you have the right to withdraw consent at any time without affecting the lawfulness of processing based on consent before its withdrawal. Where we rely on legitimate interests (Art. 6(1)(f)) you have the right to object on grounds relating to your particular situation; see Section 7 (Your Rights & Choices).

We implement rigorous security measures to protect your data:

We do not sell your data. We may share information only in the following limited circumstances:

• Service Providers (Sub-processors): Trusted third-party vendors who assist in platform operations (hosting, analytics, transactional email, error monitoring) under written data-protection terms. The full list is published at /legal/subprocessors.
• Legal Requirements: When required by law, court order, or regulatory authorities
• Business Transfers: In connection with mergers, acquisitions, or asset sales (with advance notice to users)
• With Your Consent: When you explicitly authorize data sharing with third parties

Reliatic Platforms Inc. is established in the United States. Our primary production infrastructure is hosted in the United States (US-East region) for the v1 platform; a dedicated EU region is planned for Q3 2026. As a result, personal data of users located in the EEA, the United Kingdom, or Switzerland is transferred to, and processed in, the United States by Reliatic and by certain sub-processors.

Sub-processors hosting data outside the EEA

• Supabase (PostgreSQL on AWS, US-East) — primary data persistence and authentication.
• Vercel (United States, global edge network) — application hosting and delivery.
• Sentry, Resend, Upstash, PostHog — error monitoring, transactional email, rate limiting, and (consent-gated) product analytics.
• OpenAI and Anthropic — large-language-model inference for the optional AI Assistant feature. The AI Assistant is disabled by default and only invoked when explicitly enabled by a tenant administrator and used by an authorised user.

Transfer mechanisms

Where personal data is transferred outside the EEA, the UK, or Switzerland to a country that has not received an adequacy decision, Reliatic relies on one or more of the following safeguards under GDPR Chapter V:

• EU Standard Contractual Clauses (SCCs), Module Two (Controller-to-Processor, Commission Implementing Decision (EU) 2021/914) between Reliatic and each non-EEA sub-processor, supplemented by the UK International Data Transfer Addendum (IDTA) for UK data and the Swiss FDPIC addendum for Swiss data.
• EU-US Data Privacy Framework (DPF) certification where the sub-processor participates and is on the active DPF list — currently applicable to Vercel Inc. and to Supabase's underlying infrastructure provider (AWS). DPF serves as an additional safeguard alongside the SCCs.
• Supplementary technical and organisational measures: encryption at rest (AES-256) and in transit (TLS 1.3), row-level tenant isolation, immutable audit logging, vendor-side government-request transparency reports, and a documented Transfer Impact Assessment (TIA) available to customers on request.

The complete, current list of sub-processors — including each entity's region, transfer mechanism, and certifications — is published at /legal/subprocessors. The SCCs incorporated by reference into our Data Processing Agreement are available at /legal/dpa. You may request a copy of the operative SCCs and TIA by emailing legal@reliatic.com.

You have the following rights regarding your personal data:

• Access & Portability: Request a copy of your data in a machine-readable format
• Correction: Update or correct inaccurate personal information
• Deletion: Request deletion of your data (subject to legal retention requirements)
• Objection: Object to processing based on legitimate interests (Art. 21 GDPR)
• Restrict Processing: Request limitation of how we process your data
• Withdraw Consent: Where processing is based on consent, you may withdraw it at any time without affecting prior lawful processing
• Lodge a Complaint: You have the right to lodge a complaint with a supervisory authority — in particular in the Member State of your habitual residence, place of work, or place of an alleged infringement

To exercise these rights, contact us at privacy@reliatic.com. We respond to verified requests within 30 days (extendable by a further 60 days for complex requests, per Art. 12(3) GDPR).

Reliatic Platforms Inc. has designated a Data Protection Officer (DPO) and, in accordance with Art. 27 GDPR and Art. 27 UK GDPR, an EU and UK Representative for data subjects located in the European Economic Area and the United Kingdom.

Data subjects in the EEA, UK, or Switzerland may contact either the DPO or the Article 27 representative directly regarding any matter related to the processing of their personal data or the exercise of their rights under the GDPR.

We may update this Privacy Policy to reflect changes in our practices or legal requirements. Material changes will be communicated via email or platform notification.