Privacy Policy

1. Introduction

Timocéa is a product of MindtheGap Sàrl (CHE-398.557.351), a company incorporated in Geneva, Switzerland ("MindtheGap", "we", "us", or "our"), operating under the Timocéa brand. We are committed to protecting your privacy and handling your personal data transparently and responsibly. This Privacy Policy explains what data we collect, how we use it, and what rights you have.

This policy applies to all users of the Timocéa platform, website, and related services. By using our services, you acknowledge that you have read and understood this policy.

2. Data We Collect

We collect and process the following categories of personal data:

2.1 Account Information

When you create an account, we collect your email address and, optionally, your name and organization. This information is used for authentication, communication, and credit allocation.

2.2 Workflow and Governance Data

Data you submit when orchestrating AI workflows, configuring governance policies, or generating decision receipts is processed to deliver the Service. See Section 3 for details on how this processing works.

2.3 Decision Receipts and Reports

Sealed decision receipts and reports generated by the Service are stored on your behalf to provide auditability and continuity. You may export or delete them at any time, subject to legal retention requirements.

2.4 Payment Information

All payment processing is handled by our payment processor. We never see, access, or store your full credit card number, CVV, or banking details. We receive only a transaction confirmation, the last four digits of your card, and billing address for invoicing purposes.

2.5 Usage Analytics

If you consent to analytics cookies, we collect anonymized usage data such as pages visited, features used, and session duration. No personal data is collected through analytics. You can opt out at any time via the cookie settings in the footer.

3. How We Process Your Data

Your privacy during governance and orchestration is a priority. Here is how data processing works:

• Human-in-command controls: Governed actions keep a human in the decision loop. Every intervention is captured with a timestamp, user identity, and rationale as part of the decision receipt.
• AI features: When you use an AI feature, the workflow and governance text it needs is processed by AI services that run in Switzerland and the European Union.
• Sealed decision receipts: Receipts are tamper-evident and stored to provide a durable audit trail. Governance metadata is retained for the lifetime of your account unless you request deletion.

4. Third-Party Services

We use the following third-party services to operate Timocéa:

Each third-party service operates under its own privacy policy and data processing agreements. We select partners that meet our standards for data protection and, where applicable, GDPR and Swiss FADP compliance. Our primary infrastructure is hosted in Zurich, Switzerland.

5. Data Storage and Location

MindtheGap Sàrl is incorporated in Switzerland, which is recognized by the European Commission as providing an adequate level of data protection.

• Backend infrastructure is hosted in Zurich, Switzerland.
• Authentication and session data is stored in our database on the same Swiss infrastructure.
• Payment data is processed and stored by our payment processor.
• AI processing takes place in Switzerland and the European Union.
• Governance data and decision receipts are stored server-side within the same Swiss infrastructure to provide a durable audit trail.

6. Your Rights Under GDPR and Swiss FADP

If you are located in the European Economic Area (EEA), the United Kingdom, or Switzerland, you have the following rights regarding your personal data under the EU General Data Protection Regulation (GDPR) and the Swiss Federal Act on Data Protection (FADP / nDSG):

• Right of access: You may request a copy of the personal data we hold about you.
• Right to rectification: You may request correction of inaccurate or incomplete personal data.
• Right to erasure: You may request deletion of your personal data. We will comply unless we are legally required to retain it (e.g., tax records).
• Right to data portability: You may request your data in a structured, commonly used, machine-readable format.
• Right to restriction: You may request that we limit the processing of your personal data in certain circumstances.
• Right to object: You may object to the processing of your personal data for certain purposes, including direct marketing.
• Right to withdraw consent: Where processing is based on your consent, you may withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, please contact us at support@odyssera.ai. We will respond to your request within 30 days.

You also have the right to lodge a complaint with a supervisory authority. For Switzerland, this is the Federal Data Protection and Information Commissioner (FDPIC / EDOEB). For the EU, contact your local Data Protection Authority.

Swiss FADP - Additional Information

As a Swiss company, we comply with the Swiss Federal Act on Data Protection (nDSG, in force since September 1, 2023). Under Swiss law:

• We process personal data based on legitimate interests, contractual necessity, or your explicit consent.
• In the event of a data breach that poses a high risk to your rights, we will notify the FDPIC without delay and inform affected individuals as required by Art. 24 nDSG.
• We do not engage in automated individual decision-making (profiling with legal effect) as defined under Art. 21 nDSG; Timocéa keeps a human in command of governed decisions.
• Data transfers to countries without adequate data protection are safeguarded by standard contractual clauses or equivalent guarantees.

7. Cookies

Timocéa uses only essential cookies by default. Analytics cookies are activated only with your explicit consent. We do not use any marketing or advertising cookies or trackers.

8. Data Retention

• Governance data and decision receipts: Retained for the lifetime of your account to provide a durable audit trail, unless you request deletion.
• Account data: Retained for as long as your account is active. Upon account deletion request, all personal data is permanently removed within 30 days.
• Payment records: Transaction records are retained for 10 years as required by Swiss tax law (Swiss Code of Obligations, Art. 958f). These records contain only transaction metadata (amount, date, last four card digits), not full payment details.
• Error monitoring data: Diagnostic data (error type, user ID, endpoint) is retained per our error-monitoring provider's standard retention policy and does not include governance content.
• Analytics data: Anonymized usage statistics are retained for up to 24 months. Because this data is anonymized, it cannot be linked back to individual users.

9. Data Security

We implement appropriate technical and organizational measures to protect your personal data, and we collect only what is necessary to provide the service.

10. Children's Privacy

Timocéa is not directed at children under the age of 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us at support@odyssera.ai and we will promptly delete it.

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. When we make material changes, we will notify registered users by email at least 14 days before the changes take effect. The "Last updated" date at the top of this page indicates when the policy was last revised.

12. Contact

If you have any questions about this Privacy Policy or our data practices, please contact us:

MindtheGap Sàrl (operating as Timocéa)
Avenue Ernest-Hentsch 4
1207 Geneva, Switzerland
CHE-398.557.351
Email: support@odyssera.ai

For full details on the terms governing your use of the platform, see our Terms of Service.