Privacy Policy

§ 01 — Controller

Who we are

LiquidSilicon is a product of Engineering Square LLC, a company based in Austin, Texas, United States (“we,” “us,” “LiquidSilicon”). For the personal data described here, Engineering Square LLC is the data controller. This policy explains what we collect when you use the LiquidSilicon platform and website, why, who processes it on our behalf, and the choices you have.

For business data you upload or generate inside a tenant workspace, you are the controller and we are your processor — we handle that data only to operate the service for you and under your instructions.

§ 02 — Data categories

Data we collect

• Account information — name, work email, organization name, hashed password (or your identity provider’s subject identifier), and role. Needed to create and secure your account.
• Tenant business data — the descriptions, entities, configurations, records, and documents you upload or generate inside your workspace so the platform can model and run your operation. This is your data; we process it on your behalf.
• Usage events — the append-only log of actions taken in the platform (proposals made, approvals granted, changes shipped, agent runs) that powers replay, audit, and the product itself. Includes timestamps and the acting user.
• AI prompts and outputs — the inputs sent to, and results returned from, the AI models that power the agents, processed via your chosen provider or your platform model allowance (see § 04).
• Billing information — plan, subscription status, and billing contact. Card details are collected and stored by Stripe, not by us.
• Basic technical data — IP address and request metadata in server logs, kept for security and abuse prevention. We do not build advertising or cross-site profiles.

§ 03 — Purposes

How we use data

• To provide, operate, and secure the platform and your account.
• To run the agent loop — observing, proposing, and, where you have granted it, applying changes you approve.
• To maintain the event log that makes past state replayable and every decision auditable.
• To process payments and manage your subscription.
• To send transactional email you would expect (security notices, account and billing messages).
• To detect, investigate, and prevent abuse, fraud, and security incidents.
• To meet legal obligations that apply to us.

We do not use your tenant business data, prompts, or outputs to train our own models, and we do not sell it or share it for advertising.

§ 04 — AI processing & BYOK

AI processing and your own keys

The agents rely on AI models to read signal and draft proposals. There are two ways that processing happens, and the difference matters for your data:

• Platform allowance — if you use the model capacity included with your plan, we send the necessary prompt context to our AI sub-processor (Anthropic) to generate the result, then return it to you. This traffic is governed by this policy and our agreement with that sub-processor.
• Bring your own key (BYOK) — if you configure your own model provider key, that inference traffic goes directly from the platform to your provider under your own agreement with them. Your provider’s terms and privacy commitments govern how they handle it; we do not sit in the middle of that traffic or retain its contents.

In both cases, the agents operate under the human approval gates you set — no consequential change is applied without a person approving it.

§ 05 — Sub-processors

Sub-processors

We use a small set of vetted service providers to run the platform. Each processes data only as needed to provide its service to us and under contractual data-protection terms.

If you use BYOK, your chosen AI provider acts under your agreement rather than as our sub-processor for that traffic. We will update this list before adding a new sub-processor that handles personal data.

§ 06 — Sharing

No sale, no ad trackers

We do not sell your personal data, and we do not “share” it for cross-context behavioral advertising as those terms are used under U.S. state privacy laws, including the Texas Data Privacy and Security Act (TDPSA). We run no advertising pixels, no third-party analytics cookies, and no data brokers.

We disclose data only to the sub-processors above, to comply with a valid legal obligation, to protect the rights and safety of users and the public, or as part of a merger or acquisition (in which case we would notify you). Aside from those cases, your data stays within LiquidSilicon.

§ 07 — Cookies

Cookies

We set a single first-party session authentication cookie so you stay logged in. It is marked Secure, HttpOnly, and SameSite=Lax. We do not use advertising or cross-site tracking cookies, so there is no consent banner to click through. Any product analytics we run are cookieless and aggregate.

§ 08 — Retention

Retention

We keep account and tenant data for as long as your account is active. When you delete your account, we delete or irreversibly anonymize the associated personal and tenant data within a reasonable period, except where we must retain limited records to meet legal, tax, or security obligations (for example, invoices). Server logs used for security are kept on a short rolling window. You can export your data before deletion (see our Terms).

§ 09 — Your rights

Your rights and GPC

Depending on where you live, you may have the right to access, correct, delete, or obtain a portable copy of your personal data, and to appeal a decision we make about a request. Under the Texas TDPSA these rights apply regardless of company size. To exercise any of them, email info@engineeringsquare.us. We respond within 45 days (extendable once by 45 days where the law allows, with notice).

We honor the Global Privacy Control (GPC) browser signal automatically and in real time as a valid opt-out. Because we do not sell or share personal data for advertising, there is no separate “Do Not Sell or Share” process to run — but the signal is respected all the same. We will not discriminate against you for exercising a privacy right.

§ 10 — Children

Children

LiquidSilicon is a business tool and is not directed to children under 13, who are not permitted to use it. We do not knowingly collect personal data from children under 13. If you believe a child has provided us data, contact us and we will delete it.

§ 11 — Security

Security

We protect data in transit with TLS and apply tenant isolation at the database level so one tenant cannot read another’s data. Provider keys you supply are encrypted at rest. Access to production systems is limited and logged. No system is perfectly secure, but we design for least privilege and an auditable trail on every consequential action.

§ 12 — Changes

Changes to this policy

If we make a material change, we will update the “Last updated” date above and, where appropriate, notify you by email or an in-product notice before the change takes effect. Continued use after an update means you accept the revised policy.

§ 13 — Contact

Contact