Privacy Policy
Last Updated: September 2026
Solveaux is an Organizational Intelligence platform designed exclusively for engineering teams, software architects, and AI agents. We capture, connect, and operationalize institutional engineering memory — including Architectural Decision Records (ADRs), system dependency graphs, technical research benchmarks, and AI guardrails via the Model Context Protocol (MCP).
Strict Enterprise Isolation by Default
All organization workspaces, projects, ADRs, tasks, and knowledge graphs on Solveaux are strictly private and confidential. Unlike social builder feeds or public wikis, Solveaux enforces database-level tenant isolation (Row-Level Security) so that proprietary engineering decisions are never exposed to search crawlers, external users, or unauthorized third parties.
Multi-tenancy is enforced directly at the PostgreSQL database engine level. Organization assets are physically unreadable by users outside your organization.
Your proprietary decisions, architecture graphs, and benchmarks remain 100% owned by your organization. We never train public AI models on your private data.
No third-party ad networks, trackers, or marketing pixels. Browser storage is strictly functional for authentication sessions and workspace routing.
1. Information We Collect
To provide our Organizational Intelligence platform, Solveaux collects and processes specific data categories across Account Infrastructure, Multi-Project Workspaces, and AI Integrations:
| Category | Data Points & Schema Scope | Purpose of Processing | GDPR Legal Basis | Retention Period |
|---|---|---|---|---|
| Account Auth | Email address, username, hashed password (if email auth), GitHub/Google OAuth metadata and identifier tokens | Secure authentication, session validation, user identification, and workspace membership management. | Art. 6(1)(b) (Contract Performance) | Until account closure |
| User Profile | Display name, email, avatar URL, preferences | Author attribution on ADRs, audit logs, and internal team membership lists. | Art. 6(1)(b) (Contract Performance) | Until account closure or profile update |
| Organizations & Projects | Organization name, domain, slug, API keys, project names, descriptions, deadlines (organizations, org_projects) | Creating private isolated enterprise multi-project workspaces to house engineering assets and microservices. | Art. 6(1)(b) (Contract Performance) | Until organization or project deletion |
| Decisions (ADRs) | ADR titles, context, decision made, status, accepted trade-offs, rejected alternatives, deciders (org_decisions) | Maintaining permanent Architectural Decision Records and auditable decision history for technical leadership and teams. | Art. 6(1)(b) (Contract Performance) | Permanent institutional record; deleted upon organization dissolution |
| Technical Research | Research titles, categories, benchmark test data, key insights, technical notes (org_research) | Capturing private exploratory technical spikes, benchmark evaluations, and architectural trade-offs. | Art. 6(1)(b) (Contract Performance) | Until research deletion or project removal |
| Tasks & Sprint Kanban | Task titles, descriptions, status, priority, assignee ID, linked ADR IDs (org_tasks) | Powering in-progress sprint task boards linked directly to architectural decisions and constraints. | Art. 6(1)(b) (Contract Performance) | Until task deletion or project removal |
| Validation Experiments | Validation titles, hypotheses, target metrics, test status, empirical results (org_experiments) | Tracking empirical tests and system health checks to prevent architectural drift across codebase lifecycles. | Art. 6(1)(b) (Contract Performance) | Until validation deletion or project removal |
| AI MCP Integration | API access tokens, authorized agent identifiers, tool query audit logs (org_api_keys) | Authorizing Model Context Protocol (MCP) clients (Cursor, Claude, Windsurf) to query accepted architectural rules. | Art. 6(1)(b) (Contract Performance) | Until API key revocation or org deletion |
| Team Governance & RBAC | Member user IDs, assigned roles (Admin, Author, Viewer), invite tokens, invite emails (organization_members, organization_invites) | Enforcing role-based access permissions, team invites, and workspace governance. | Art. 6(1)(b) (Contract Performance) | Until membership termination (soft-delete applies to preserve authorship) |
| Feedback Desk | Name, email, message text, user ID, offline database cache | Troubleshooting enterprise customer issues and resolving product support requests. | Art. 6(1)(f) (Legitimate Interest) | Up to 2 years following ticket resolution |
2. Cookies & Browser Storage Disclosures
Solveaux does not run third-party advertising cookies, ad trackers, or marketing fingerprint scripts. We only save cookies and local storage parameters strictly necessary for security, workspace navigation, and application state:
- Authentication & Session Management: Cookies prefixed with
sb-*(managed by Supabase) authenticate user logins, validate JWT tokens, and maintain active sessions across page transitions. - Active Workspace Routing: The keys
solveaux_last_org_idandsolveaux_last_org_slugare stored locally to route you directly to your team’s active workspace upon login. - Theme Preference: The key
themeremembers your preferred light or dark mode setting. - Support Desk Offline Fallback: The key
feedback_offline_cachetemporarily retains ticket text in the event of an unexpected network interruption.
You can clear or inspect these storage entries at any time through your browser developer tools. Clearing storage will simply require you to re-authenticate on your next visit.
3. How We Use Data
We use collected information solely for operating, securing, and maintaining the Organizational Intelligence platform. In accordance with data minimization principles, your data is processed to:
- Provide enterprise user authentication, session security, and workspace isolation.
- Operate private multi-project workspaces to house microservices, frontend applications, and infrastructure repositories.
- Maintain immutable Architectural Decision Records (ADRs), preserving technical context, accepted trade-offs, and decider consensus permanently.
- Compile and render the interactive Brain Map knowledge graph to trace dependencies and evaluate system refactoring impacts.
- Authorize Model Context Protocol (MCP) server requests from coding assistants (Cursor, Claude, Windsurf), providing AI agents with real-time architectural constraints without exposing private code.
- Manage team memberships and enforce role-based access control (Admin, Author, Viewer) across organizational resources.
- Apply soft-delete safeguards to maintain the integrity of collaborative organizational memory when team members transition or depart.
- Defend against malicious activities, cross-tenant intrusion attempts, and unauthorized data extraction.
We never sell, rent, or trade your organization’s decisions, benchmarks, or codebase metadata to third-party advertisers or data brokers. Your organization retains complete sovereignty over its data at all times.
4. Third-Party Subprocessors
To deliver our service reliably, we engage trusted external subprocessors. All subprocessors are bound by strict data protection agreements (DPAs) and confidentiality obligations:
Encrypted PostgreSQL database hosting, user authentication, and Row-Level Security policy enforcement.
Authenticates developer identity via GitHub Single Sign-On and validates OAuth authorization tokens.
Authenticates enterprise identity via Google Workspace Single Sign-On and validates authorization tokens.
5. GDPR & CCPA Rights
Depending on your jurisdiction (such as the European Economic Area under GDPR or California under CCPA/CPRA), you are entitled to exercise the following statutory rights:
Request a machine-readable export of personal data held about your account, including profile metadata and team memberships.
Request corrections to inaccurate, incomplete, or outdated personal information associated with your profile.
Request permanent deletion of your user account credentials and personal identifiers from active production databases.
Request restriction of data processing while a dispute or verification request is under active review.
To exercise your rights or submit a data inquiry, email us at solveaux@gmail.com. We verify requester identities and respond within 30 calendar days.
6. Security & Data Retention
We employ comprehensive technical and operational safeguards — including TLS 1.3 in-transit encryption, AES-256 database encryption at rest, PostgreSQL Row-Level Security (RLS), and API token validation — to ensure proprietary engineering data cannot leak across tenant boundaries.
Organization Tenant Isolation: Every query against organizational resources requires an authenticated JWT verified against the organization membership roster. No cross-tenant visibility is permitted at any software layer.
Soft-Delete & Institutional Memory Safeguards: When an engineer departs an organization, our soft-delete mechanism preserves collaborative ADRs and research documentation while anonymizing personal contributor metadata. This guarantees that team architecture history is never corrupted by employee transitions.
Backup Retention: Production database snapshots are securely archived with encryption and automatically purged on a rolling 30-day schedule.
7. Contact & Support
For data inquiries, privacy questions, or GDPR/CCPA requests, contact our engineering and compliance team: