PRIVACY POLICY FOR COMPOSITE MECHANICS & FAILURE SOLVER

Last Updated: August 10, 2026

INNX ("we," "us," or "our") is committed to protecting the privacy and security of your personal data and proprietary engineering inputs. This Privacy Policy describes how we collect, use, process, and protect your information when you use our website, APIs, or command-line interfaces (collectively, the "Service").

Please read this policy carefully. If you do not agree with the terms of this Privacy Policy, please do not access or use the Service.

1. COMPUTE ARCHITECTURE & DATA ISOLATION (CRITICAL)

Because our Software is used to design proprietary composite laminates (often subject to non-disclosure agreements, patent processes, or trade-secret protections), we have designed our architecture to prioritize client data isolation.

1.1 Current Architecture: All Computations Are Server-Side

No Local/Client-Side Execution Available Today: A client-side WebAssembly (WASM) engine that would process laminate stacking sequences, load vectors, and material data entirely in your browser is on our roadmap but has not been built or released on any tier, including Tier 2 and Tier 4, as of the date of this policy.
No ITAR/EAR Compliance Basis From Local Processing: Because no such local-execution engine exists, we do not claim that use of the Service satisfies ITAR, EAR, or other export-control/classification requirements on the basis of client-side, local processing. Do not submit ITAR-controlled or otherwise export-restricted technical data to the Service on the assumption that it stays on your device — it does not; see Section 1.2.

1.2 Server-Side FastAPI Computations

Data Processed In-Memory: All calculations, on every subscription tier, are transmitted to and executed by our server-side API endpoints (/analyze, /optimize, /weibull/fit, and other analysis endpoints). The input JSON payload containing material parameters (e.g., E_1, E_2, \nu_{12}, G_{12}, strengths, and ply layouts) is processed in-memory on our secure cloud nodes.
Analysis Audit Log: For traceability and reproducibility of engineering results, we record each analysis request (the input JSON payload, a content hash, a summary of the output, timestamp, and account tier) to an internal audit log. This lets a result be traced back to its exact inputs at a later date. Audit log entries are retained for as long as your account is active and are deleted upon account closure or upon a specific deletion request to support@innx.org, subject to the statutory tax/accounting retention requirements described in Section 6.
Voluntary Custom Databases: If you subscribe to our Enterprise Tier (Tier 4) and opt for hosted material database storage, your custom material databases are stored in encrypted, isolated database schemas within our MariaDB cluster.

2. INFORMATION WE COLLECT

We collect personal data and operational metadata to manage subscriptions, verify API access, and improve performance.

2.1 Information You Provide to Us

Account Data: When you sign up, we collect your email address, name, organization name, and password (securely salted and hashed).
Billing Information: Payment transactions are handled entirely by our third-party payment processor, Stripe. We do not store or see your raw credit card numbers or billing credentials. Stripe provides us with tokenized confirmation of payment, billing country, subscription status, and billing cycle events.
Support Queries: If you contact us for support (e.g., to rotate an API key or resolve a solver error), we collect the text of your email and any accompanying files.

2.2 Automatically Collected Metadata

API Usage Statistics: To enforce subscription tier feature limits (e.g., maximum ply count) and for operational/security monitoring, we log:

API Key identity (matched via SHA-256 hash).
API endpoints accessed (e.g., POST /optimize).
IP address and request timestamps.
Note: as of this policy's date, we do not meter or bill based on the number of plies or Monte Carlo/optimization iterations run — usage on paid tiers is not currently capped by a compute-credit system.

Cookies & Session Tokens: We use secure session cookies to keep you logged in to the dashboard. We do not use cross-site tracking or advertising cookies.

3. HOW WE USE YOUR INFORMATION

We use your data strictly for the following purposes:

1. To Provide and Maintain the Service: Processing server-side computations, generating optimization reports, and tracking subscription usage.

2. Billing & Licensing Verification: Validating API keys against active Stripe subscriptions and managing billing cycles.

3. Account Security: Storing secure cryptographic hashes (SHA-256) of API keys to prevent unauthorized access.

4. Customer Support: Diagnosing mathematical or system issues with your permission.

5. Legal Compliance: Preventing fraudulent use of resources and complying with tax/accounting laws.

4. SHARING AND DISCLOSURE OF DATA

We do not sell, rent, or trade your personal data, material properties, or composite stack designs. We share data only with the following sub-processors necessary to run the Service:

Payment Infrastructure (Stripe): To process subscriptions, manage invoicing, and track billing states.
Cloud Hosting Providers: To run our secure containerized FastAPI nodes and MariaDB databases (e.g., AWS, GCP, or similar ISO-certified providers).
Email Services: To transmit password resets, API key generation emails, and billing alerts.

All sub-processors are contractually bound to maintain strict confidentiality and follow data security standards consistent with this policy.

5. DATA SECURITY & ENCRYPTION

We implement robust administrative, technical, and physical security measures:

In-Transit Encryption: All API requests and dashboard traffic are encrypted using TLS 1.3.
At-Rest Encryption: Hosted databases and configuration secrets are encrypted at rest.
One-Way API Hashing: API keys are stored solely as cryptographically secure SHA-256 hashes. In the event of a database compromise, your raw API keys cannot be recovered or reverse-engineered.
Access Control: Access to database systems and Stripe management consoles is restricted to authorized operations personnel with multi-factor authentication (MFA).

6. GDPR & CCPA COMPLIANCE (USER RIGHTS)

Depending on your jurisdiction, you may have specific rights regarding your personal data, including:

Right to Access: Request a copy of the personal data we hold about you.
Right to Rectification: Request correction of inaccurate personal data.
Right to Erasure ("Right to be Forgotten"): Request deletion of your account and associated personal logs, subject to statutory tax retention requirements.
Right to Data Portability: Request transfer of your account data in a structured, machine-readable format.
Right to Object: Object to the processing of your data.

To exercise these rights, please email support@innx.org.

7. CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email or via a prominent notification on our website before the changes take effect.

8. CONTACT INFORMATION

For questions or data requests regarding this Privacy Policy, please contact:

INNX Privacy Office

Email: support@innx.org

Website: https://innx.org