Privacy Policy

1. Introduction

This Privacy Policy explains how Srikrishnas Ventures LLC, d/b/a IACGenius ("we", "us", "our") collects, uses and stores personal data when you use the IaC Genius application (the "Service"). We process personal data as described below. Privacy rights depend on your location and the laws that apply to the processing.

2. Data controller

Srikrishnas Ventures LLC, d/b/a IACGenius, a Texas limited liability company, is the controller. Contact: privacy@iacgenius.com. General support: support@iacgenius.com.

3. What we collect

• Account data: your name, email address, password hash if you use password sign-in, sessions, organisation and membership records, and your role. Social sign-in also uses provider account identifiers and may store authentication tokens. Optional two-factor authentication adds security and recovery records.
• Mission content: the requests you describe, intake answers, the generated code, the decision ledger and validation evidence. This is stored with your missions in our workflow database and job artifacts.
• Standards and knowledge: any organisation standards you upload.
• Billing records: plan, subscription and generation-usage records.
• Delivery references: identifiers for delivery targets and GitHub installations. Delivery connection records hold identifiers; the short-lived installation tokens used for delivery are separate from social sign-in records.
• Acceptance records: who accepted which policy version, for audit.
• Operational data: service logs carrying organisation and mission identifiers, and usage metrics. When configured, error monitoring can receive request metadata, including IP addresses and headers.

For this code-generation service:

• we do not ask for access credentials to your cloud accounts; do not put secrets in requests or uploaded files;
• GitHub delivery installation tokens are minted for delivery rather than stored in delivery connection rows;
• usage metrics and quota tables do not intentionally include prompt text; and
• payment card details are handled by the payment provider when checkout is available.

4. How we use it

• To provide the Service (contract): create and manage your account, run and store missions, generate and validate code, deliver it, and provide support.
• To run and improve the Service (legitimate interest): operate the service, fix faults, understand usage, and prevent abuse and fraud.
• To meet legal obligations (legal obligation): accounting, tax and lawful requests.
• To contact you (contract or consent): transactional email such as verification and password reset. We do not run marketing campaigns today.

5. AI processing

The Service calls Microsoft Azure OpenAI to plan and generate code. The text of your request, and the context assembled for planning, is sent to that provider. We do not intentionally include account authentication secrets in model requests. Content you submit may itself contain personal or confidential information, so do not include credentials. AI output is not error-free and must be reviewed before use (see the Terms of Service).

Not verified: what Microsoft Azure OpenAI retains beyond the API call is not something we can confirm from our own systems, and it is recorded as an open item for review rather than asserted here.

6. Where data is stored, and who processes it

Our application functions are configured in the United States (Vercel iad1), and our V2 account and workflow databases are in the United States (Neon us-east-1). The generation engine and its job artifacts use Amazon Web Services in Germany (eu-central-1). This is a mixed US and EU service, not an exclusive data-residency commitment. Other providers may process data in additional locations.

• Vercel — application hosting and logs; Vercel Bot ID on the sign-up and sign-in routes.
• Neon — managed Postgres holding accounts, sessions, organisations, missions, checkpoints, billing and delivery rows.
• Amazon Web Services — S3 artifacts (`iacgenius-terraform-eu`) and the owner-operated EC2 host that runs the generator and validators.
• Microsoft Azure OpenAI — the planning and worker model calls.
• Resend — verification and password-reset email (recipient address and links).
• GitHub — social sign-in when you choose it, and code delivery through the separate IaC Genius GitHub App when you connect a repository.
• Sentry — error and performance telemetry when configured, which can include request metadata. This is data processing even without advertising cookies.
• Stripe — payment and subscription processing when paid checkout is enabled and you use it. Paid-plan availability is shown on the pricing page.

We do not sell personal data. Each provider's own terms and data-processing terms apply; obtaining and reviewing those documents is an open item for legal review and they are not summarised as compliant here. Delivered code that you push to your own GitHub repository lives under your visibility rules, not ours.

7. International transfers

IaC Genius is operated by a US company and uses infrastructure in the United States and Europe. Provider processing locations, deployment types and contractual transfer safeguards require review before any region-specific assurance is offered. A US company address does not mean all processing occurs in the United States.

8. Retention

Current reality: we keep mission history, checkpoints, job rows and S3 artifacts indefinitely. No retention, expiry or deletion job exists yet, and no retention period is implemented. A deletion request today is handled manually by us, with no automated dry run.

We are working on a retention policy and an organisation-scoped delete-my-data path; until that ships, deletion requests are manual. Billing and plan rows are financial records and are intended to be kept longer than mission content once a policy exists.

Delivered code already committed to your own repository is out of our control and is never rewritten by us. Provider-managed backups are outside our control too.

9. Cookies and local storage

The V2 application uses cookies for sign-in, sign-in security and interface preferences, plus browser local storage. Details and how to manage them are in the Cookie Policy. The separate marketing website may use different services and has its own notice.

10. Your rights

Depending on applicable law, your rights may include the ability to:

• access a copy of your personal data;
• rectify inaccurate or incomplete data;
• request deletion of your data, subject to applicable exceptions;
• restrict processing;
• data portability;
• object to processing based on legitimate interests;
• withdraw consent; and
• appeal a decision on your request or complain to the relevant regulator.

Contact privacy@iacgenius.com to make a request, or to ask us to review a decision on your request. We may need to verify your identity and authority over an organisation's data. Applicable response deadlines and exceptions depend on the relevant law; this draft does not waive mandatory rights. Retention in section 8 describes the current system, not an exemption from deletion obligations.

11. Security

We use encrypted connections and access controls to protect service data. No service can guarantee absolute security. Keep credentials out of uploaded content and contact us if you believe an account or uploaded file has been exposed.

Not verified: encryption-at-rest specifics for Neon and S3 are provider-managed and not verifiable from our repository; we state that rather than claim a standard we cannot see.

12. Children

The Service is not intended for anyone under 18, and we do not knowingly collect data from children.

13. Changes

We may update this Privacy Policy. We will notify registered users of material changes and update the date at the top of this page.

14. Contact

Srikrishnas Ventures LLC, d/b/a IACGenius (Texas limited liability company). Privacy: privacy@iacgenius.com.