Privacy Policy

This Privacy Policy describes how Optiarms Inc., an Ohio corporation doing business as SpaltX Industries (“SpaltX”, “we”, “us”) collects, uses, shares and protects personal data when you visit this site, hold an account, send us a project inquiry, open a support ticket, or apply for a job (together, the “Platform”). SpaltX is the data controller for the personal data described here.

There is nothing to buy on this site. What we hold is an account and the record of work you asked us about.

Personal data inside the files you send us so we can do the work is a separate matter, and Section 5 covers it. Section 8 covers our own design tooling and the one part of it a client ever sees.

Three kinds: what you type, what the Platform records while you use it, and what a provider acting for us hands back.

We ask you not to put health data, government identifiers or anything similarly sensitive into a form here, and nothing on the Platform asks for it. There are no advertising pixels, no third-party analytics, no session replay and no social trackers on any page.

Only for these purposes:

• Running your account. Signing you in, keeping the session alive, enforcing the role you hold, and letting you export or delete what we have.
• Scoping and quoting work. Reading your inquiry, asking questions on the thread, writing a proposal, and recording what you decided about it.
• Answering you. Support tickets, contact messages, job applications and privacy requests, each answered by a person.
• Keeping the Platform intact. Rate limiting, spotting credential stuffing, investigating access that should not have happened, and holding an audit trail an administrator cannot edit.
• Telling you what happened. Service mail about your account, your inquiry, a proposal waiting for you, and security events on your account. We send no marketing mail at all. If that changes it will be opt-in with a working unsubscribe.
• Meeting a legal obligation. Accounting records, export and sanctions screening where it applies, and answering a lawful demand as Section 6 describes.
• Deciding what to build. Counts and totals with nobody's name on them. We do not profile you.

Section 14 maps each of these onto a legal basis for readers who need one.

The Platform sets a small set of first-party cookies: the ones that keep you signed in, and a preference belonging to the staff console. No advertiser and no analytics vendor sets anything here. A few other things sit in your browser storage and never reach our servers at all.

The Cookie Policy names every one of them with its purpose and lifetime, and tells you what blocking each costs you.

A drawing, a data set, a spreadsheet or a code base you attach to an inquiry can contain personal data about people who are not you: your staff, your customers, your suppliers. Where that happens you are the controller of it and we handle it for you, under the engagement rather than under this notice.

• We use it for your project and nothing else. Not to train a model, not to build a data set, and not for another client.
• Send us the minimum. A test data set with the names stripped out usually proves the same thing as the real one. Where you can pseudonymize before you send, do.
• Who reads it. The people working on your project, and those keeping the Platform running. Section 10 describes what stops anyone else.
• It leaves when the work does. Tell us to return or destroy it at the end of an engagement and we will, subject to Section 9.

If your own regulator needs a written processing agreement with us before you can send something, ask for one before you attach it. The confidentiality terms in the Terms of Service already bind us either way.

Only with the recipients below, only for what is stated, and never for their own marketing:

We do not sell personal data and we do not share it for cross-context behavioral advertising. Neither has ever happened here. Our machine-learning work trains on imagery data sets we own, never on your correspondence or your files.

On row six, the long form is short enough to state here: we produce user data to a government only against valid legal process that identifies the account, and we tell you before we comply unless a court order forbids it.

• Security events. A sign-in from a browser we have not seen, a password change, a second factor added or removed: each writes an entry holding your account, what happened, the time, and the IP address and user agent behind it. Most of them also send you an email, because the point of the record is that you see it too.
• Audit log. Sensitive actions, mostly staff ones such as changing a role or deciding an inquiry, are appended to a log that nobody can edit or delete through the application, including us. An entry can carry the acting person's email address, and for a handful of customer-facing actions, your account identifier.

Both are readable only by the roles that need them, enforced in the database rather than in application code. Section 10 describes how.

The mechanical team models in software we wrote and run ourselves. It sits behind a staff check and none of it is offered to anyone. It appears in a privacy notice for two reasons: our own staff are people with rights over their data too, and one part of it is visible to a client.

• What a client sees. A read-only share link, which is how we show you a model. Opening one is counted against the link's view cap and nothing about you is recorded. We do not know who opened it, and the link stops resolving the moment it is revoked or expires.
• What staff work in. Projects, parts, drawings, revision history and the branch structure behind them, each revision stamped with the account that wrote it.
• The staff override. A workspace someone does not belong to can still be reached by staff, which is how a request gets answered and how an abuse report gets investigated. Creating, moving, sharing or deleting a project that way writes an audit entry. An edit made inside the studio does not.
• Design-engine prompts. The text typed into the engine, what it returned, which engine ran, and how long it took.

None of this trains a model. Not the geometry, not the prompts, not a client file that arrived as part of an engagement.

We hold personal data for as long as it serves what it was collected for, then delete or anonymize it.

The layers are independent, so a failure in one does not open the others:

• Transport and storage. Everything travels over TLS. Databases and backups are encrypted at rest by our infrastructure providers. Passwords are salted hashes and nobody here can read one.
• Server-side authorization. Every page and every action that touches your data checks your session and your role on the server before it runs.
• Row-level security in the database. Policies keyed to the acting account decide which rows exist for that account. You reach your own inquiries, your own proposals and your own tickets, and nobody else's. Password hashes and session tokens answer only to the service context. The audit log is append-only for everyone. These hold even when application code has a bug, and we prove the whole matrix against a throwaway database on every change.
• Abuse controls. Sign-in, registration, the forms that reach a person, and administrative writes are all rate limited, and the sensitive ones are audited.

No system is perfectly secure. If a breach affects your personal data we will tell you and the relevant authority without undue delay, and say what happened, what was involved and what we are doing.

SpaltX operates from the United States and our providers hold data primarily in the United States. Using the Platform from anywhere else means your personal data is transferred here and processed here.

Where transfer law requires safeguards, for a visitor from the EEA, the UK or Switzerland, we rely on the Standard Contractual Clauses in our agreements with the providers named in Section 6. Write to us and we will tell you which safeguard covers your data.

These are yours wherever you live, not only where a statute grants them:

• Access and export. A copy of what we hold about you, in a format a machine can read.
• Correction. Fix account data that is wrong. Name and email you can change yourself.
• Deletion. Close the account and take the personal data with it. We keep only what Section 9 says we must.
• Objection and restriction. Object to processing we run on legitimate interests, or ask us to pause it, and we stop unless we have compelling grounds not to.

Three ways to use them:

• Yourself, now. Signed in, you can download everything and start a deletion from Account, Privacy without waiting on anybody.
• By form. With an account or without one, ask through Your Privacy Choices and get a tracking code back.
• By email. Write to support@spaltx.com with PRIVACY REQUEST in the subject, from the address on your account.

We verify against the account email and may ask about recent activity. No notarization, no identity documents. We answer within 30 days, extend once at most and tell you why if we do, and charge nothing unless a request is plainly excessive. An authorized agent can act for you with proof, and we will still confirm with the account email.

Exercising a right never costs you anything here: the same service, on the same terms, afterward.

Residents of California, and of the other states with comprehensive privacy laws in force, hold specific statutory rights. Section 12 already extends the substance of them to everybody. In addition:

• Right to know. Section 2 is the list of categories we collect and Section 6 the list of who receives them. We collect no sensitive personal information as those laws define it.
• Sale and sharing. Neither happens. There is still a Your Privacy Choices page to put a formal opt-out on the record, and where a law reads a Global Privacy Control signal as an opt-out we honor it. We do not run targeted advertising or profiling with legal effects.
• Appeals. If we refuse a request we explain why, and you can appeal by replying with APPEAL in the subject. We answer an appeal within 45 days. A failed appeal leaves you free to go to your state attorney general.
• California Shine the Light. We disclose nothing to third parties for their direct marketing, so there is nothing to report under Civil Code Section 1798.83.

Under the GDPR and the UK GDPR, SpaltX is the controller for the data in Section 2, and a processor for personal data inside the files covered by Section 5. Our legal bases:

On top of Section 12 you can:

• Take your data elsewhere in a structured, commonly used, machine-readable format, for what we process by automated means on contract or consent.
• Complain to your supervisory authority. We would rather you came to us first, and you are under no obligation to.

No automated decision produces legal effects about you here, and we build no profiles. Account and inquiry data is contractually necessary: without it there is no way to scope work or send you a proposal.

The Platform is not for children. You must be 18 to hold an account or send us an inquiry, and we do not knowingly collect personal data from anyone under 13, or under the higher age your jurisdiction sets for online consent. If you think a child gave us data, write to support@spaltx.com and we will delete it.

Both signals ask a site to stop following you around the web. Nothing here follows you in the first place, so what they ask for is already how this site works. Where a law treats Global Privacy Control as a formal opt-out we honor it, and honoring it changes nothing, because there is no sale and no sharing to switch off.

We update this when our practices change or the law makes us, and the effective date at the top moves when we do. A material change, a new category of data or a new kind of recipient, gets advance notice on the Platform or by email before it takes effect. Earlier versions are available on request.

Privacy questions, requests and complaints all go to support@spaltx.com with PRIVACY REQUEST in the subject line. We answer privacy mail within ten business days and finish verified requests on the timeline in Section 12.