Master Privacy Policy
01Executive Commitment & The Sovereign Air-Gap Guarantee
Resvanta Group is an enterprise infrastructure software organization built on the foundational principle of Data Sovereignty. Unlike consumer software and public cloud AI aggregators, Resvanta operates under an unconditional contractual pledge:
1. Zero Public Model Training: Your organizational data, uploaded files, proprietary econometric models, questionnaire scripts, and respondent answers are never used to train, fine-tune, or align public or third-party AI models (such as OpenAI, Anthropic, or Google foundation models).
2. Tenant-Isolated Cryptographic Enclaves: All customer data is partitioned using multi-tenant row-level security (RLS) and strict cryptographic isolation keys.
3. No Monetization of Personal Information: We do not sell, rent, monetize, or trade customer data, business intelligence, or respondent data under any circumstances.
02Information We Collect Across the Ecosystem
2.1 Direct Account & Operational Business Data (Clients & Administrators)
• Account Identification: Name, business email address ([email protected]), job title, corporate organization, and encrypted authentication credentials.
• Commercial & Billing Information: Billing address, VAT/Tax identification number, and payment transaction metadata (processed via our PCI-DSS Level 1 compliant gateway, Stripe; we do not store full credit card numbers).
• Communications: Inquiries, support requests, and executive briefing submissions sent to [email protected] or via our scheduling engine (Cal.com).
2.2 System & Usage Telemetry
Standard server logs, IP addresses, browser user-agent strings, referring URLs, and timestamps collected strictly for infrastructure load-balancing, cybersecurity defense, and SLA uptime auditing.
2.3 Product-Specific Analytical & Research Data
Specialized data categories processed per product, as itemized in Section 5 below.
03How We Process and Use Information
We process personal and organizational information strictly under the following lawful bases:
- Contractual Necessity (GDPR Art. 6(1)(b)): To provision platform workspaces, compile surveys via AISP, execute econometric causal inference via RAIL, and deliver verified respondent bundles.
- Legitimate Interests (GDPR Art. 6(1)(f)): To safeguard our infrastructure against distributed denial-of-service (DDoS) attacks, bot networks, and commercial survey fraud.
- Legal Compliance (GDPR Art. 6(1)(c)): To maintain statutory financial records, tax accounting, and regulatory audit ledgers.
04Universal Security & Infrastructure Controls
All external and intra-service communication is encrypted using TLS 1.3 with modern cipher suites and HSTS enforcement.
Databases (PostgreSQL via Neon) and storage volumes are encrypted using AES-256 with key rotation.
Access to production requires multi-factor authentication (2FA/MFA), hardware security keys, and strict Role-Based Access Control.
05Product-Specific Privacy & Data Processing Schedules
A. Survey Respondent Data & AISP Ingestion
When respondents participate in surveys hosted by Resvanta Research Engine on behalf of our enterprise clients, we act as a Data Processor (Service Provider), and our enterprise client acts as the Data Controller. Respondent answers are processed solely to compile research datasets, cross-tabulations, and deliverable reports for the commissioning client.
B. Resvanta AirLock™ Anti-Fraud Telemetry & Passive Biometrics Disclosure
To protect enterprise research budgets and ensure that our clients and sample suppliers are never charged for fraudulent bot activity, click farms, or artificial responses, incoming respondents pass through the Resvanta AirLock™ Threat Gate prior to Question 1:
• Passive Hardware Biometrics (Non-PII): Evaluates Canvas 2D rasterization, WebGL GPU context strings, non-audible Web Audio context curves, and CPU thread concurrency to identify headless automation tools (Puppeteer, Selenium, Playwright).
• Irreversible Cryptographic Hashing: Signals are salted and hashed into a one-way SHA-256 string (AirLock™ Device Hash). AirLock™ does NOT capture facial biometrics, voice recordings, keystrokes, or physical bodily measurements.
• Network Threat Intelligence: Inspects IP Autonomous System Numbers (ASNs) to block commercial datacenter proxy farms (AWS, GCP, Azure, DigitalOcean, OVH) and Tor exit nodes, and cross-references timezone offsets.
• Purpose & Retention: Signatures calculate a real-time Threat Score (0–100) and gate entry. Records are retained strictly for the duration necessary to prevent duplicate survey taking within a study's cooling-off window (24–90 days), then securely purged.
• Input Datasets: Enterprise clients upload historical tabular datasets, pricing figures, and customer churn metrics.
• Processing Scope: The RAIL engine executes deterministic econometric routines (Rosenbaum Bounds sensitivity Γ*, Propensity Score Matching, McFadden Conjoint Multinomial Logit, Kaplan-Meier survival curves).
• Isolation Guarantee: Client datasets are isolated in memory during execution. Statistical model weights and causal coefficients derived from your company are never commingled with other organizations.
• AI Gateway & Firewall Telemetry: Sentinel Trust OS acts as an enterprise cryptographic proxy between client business applications and foundation model APIs.
• PII Masking & Tokenization: Prompts are evaluated in real time for PII (names, Social Security numbers, credit cards, healthcare records), redacted or pseudonymized before forwarding.
• Cryptographic Merkle Audit Logs: Sentinel stores immutable SHA-256 audit proofs of prompt-completion pairs to satisfy compliance mandates (EU AI Act, DORA, SOC 2, ISO 42001). Audit dossiers are accessible exclusively by authorized tenant compliance administrators.
06Sister Entity Disclosure: CodeArchaeologist by Paae.ai
CodeArchaeologist is an autonomous legacy codebase modernization engine operated by Resvanta Group on its dedicated developer domain: paae.ai.
CodeArchaeologist operates under its own developer-focused privacy terms governing Abstract Syntax Tree (AST) source code parsing and IP non-infringement. For specific terms governing codebase ingestion, please review the Paae.ai Developer Privacy Policy.
07Cookies and Passive Tracking Technologies
We deploy minimal essential operation cookies and AirLock™ security tokens. We do not load third-party ad retargeting pixels (such as Meta Pixel or TikTok) on our authenticated platform interfaces. For complete disclosures, see our dedicated Master Cookie & Tracking Policy.
08International Data Transfers & Sovereign Storage
Resvanta infrastructure is hosted in secure, SOC 2 audited data centers located in the United States. For clients operating within the European Economic Area (EEA), United Kingdom, or Switzerland:
- We execute Standard Contractual Clauses (SCCs) approved by the European Commission as part of our Data Processing Addendum (DPA).
- Enterprise clients with statutory data sovereignty requirements may opt for our Sovereign Air-Gapped Appliance deployment within their own Virtual Private Cloud (AWS/GCP/Azure) or on-premise infrastructure.
09Data Subject Rights (GDPR & CCPA/CPRA)
To exercise any statutory data rights, email our Data Protection Office directly at [email protected].
Official Contact & Regulatory Escalation
For questions, inquiries, or formal legal notices regarding our privacy practices or data sovereignty guarantees:
Data Protection Officer desk for DPAs and Model Risk compliance.