Privacy Policy

This Privacy Policy applies to:

• End users, administrators, and other authorized users of the Service ("Users").
• Customer representatives who interact with us through the Marketplace, sales, onboarding, support, or account management.

This Privacy Policy does not apply to:

• Microsoft's processing of Personal Data as an independent controller (see Microsoft's privacy statement).
• Customer's own processing practices within their organization.

• "Personal Data" means information that identifies or can reasonably be linked to an individual (directly or indirectly).
• "Customer Data" means data and content that Customers or Users submit to the Service, including text, files, images, and other inputs, and outputs generated from such inputs.
• "Customer" means the entity (e.g., company/hospital/clinic) that purchases, subscribes to, or deploys the Service.

Depending on how the Service is used:

• Customer as Controller / SplineAI as Processor: Where the Customer provides Customer Data to the Service (e.g., uploads content, configures integrations, submits end-user inputs), the Customer is typically the controller and SplineAI acts as a processor on the Customer's behalf.
• SplineAI as Controller: We act as controller for account/admin information, billing/contact details, Marketplace lead information, and Service telemetry/security logs that we process for our own legitimate business purposes.

If you require a Data Processing Addendum (DPA) or similar contractual terms, contact us at mabdur@spline.ai.

We collect Personal Data from (a) Customers/Users, (b) Marketplace/Microsoft systems (as applicable), and (c) automatically from devices/browsers when you use the Service.

We use Personal Data for the following purposes:

1. 1. Provide and operate the Service - Provision and configure the Service, authenticate users, deliver core functionality, generate outputs from inputs.
2. 2. Security, integrity, and fraud prevention - Monitor, detect, prevent, and respond to security incidents, abuse, and suspicious activity.
3. 3. Service improvement and analytics - Diagnose problems, perform performance analysis, improve usability and reliability.
4. 4. Support and customer success - Respond to inquiries, provide technical support, manage onboarding, and fulfill service requests.
5. 5. Commercial and administrative purposes - Account management, subscription administration, compliance, audits, billing support, and recordkeeping.
6. 6. Legal compliance - Meet applicable legal obligations and enforce our terms.

Where GDPR/UK GDPR or similar laws apply, we rely on:

• Contract necessity (to provide the Service and support)
• Legitimate interests (security, service improvement, communications with business customers)
• Compliance with legal obligations
• Consent (where required, e.g., optional marketing communications or certain cookies)

We share Personal Data only as needed and consistent with this Privacy Policy:

Your Personal Data may be processed in countries other than where you reside, depending on your deployment and our vendors' locations. Where required, we implement appropriate safeguards (such as contractual protections) for international transfers.

We retain Personal Data only as long as necessary for the purposes described above, including:

• Customer Data: retained for the duration of the Customer subscription/contract and as configured by the Customer, then deleted or returned per contract and technical feasibility.
• Telemetry and security logs: retained for 30–180 days unless needed longer for security investigations or legal compliance.
• Support records: retained for 24 months or as needed to resolve issues and meet legal obligations.
• Commercial records: retained as required by applicable accounting/tax laws.

We implement administrative, technical, and organizational measures designed to protect Personal Data, such as:

• Encryption in transit (TLS) and encryption at rest where supported
• Role-based access control and least-privilege access
• Logging and monitoring for security events
• Secure development and vulnerability management practices

No method of transmission or storage is 100% secure; however, we work to maintain safeguards appropriate to the risk.

Depending on your location, you may have rights such as:

• Access, correction, deletion, portability
• Restriction or objection to certain processing
• Withdrawal of consent (where processing is based on consent)
• Lodging a complaint with a supervisory authority

If the Service includes a web interface, we may use cookies/local storage and similar technologies:

• Strictly necessary: authentication, session management
• Functional: preferences and settings
• Analytics: usage measurement to improve performance (optional where required)

You can control cookies via browser settings.

The Service is intended for business/enterprise use and is not directed to children. We do not knowingly collect Personal Data from children under the age of 16 (or the minimum age required by local law).

The Service may connect to third-party services or Customer-managed systems (e.g., identity providers, storage, EHR/clinical systems, analytics). This Privacy Policy does not cover those third parties' practices. Customers are responsible for configuring integrations and ensuring lawful data sharing.

We may update this Privacy Policy from time to time. The "Last updated" date above indicates when changes were made. If changes are material, we will provide notice through the Service or other appropriate means.