Privacy Policy

1. Who We Are

Vulkos Ltd (“Vulkos,” “we,” “our,” or “us”) is the data controller responsible for your personal data. If you have any questions about this Privacy Policy or how we handle your data, you can contact us at contact@vulkos.co.uk.

2. What Data We Collect

2.1 Account Data

When you register for an account, we collect your email address and display name. Authentication is managed through Supabase Auth.

2.2 Waitlist Data

When you join the waitlist, we collect your email address, the consent wording shown at signup, and the time you joined.

2.3 User Content

Code files, Verilog designs, configuration files, simulation outputs, and other materials you create or upload to the Service.

2.4 Usage Data

We may collect technical data such as your IP address, browser type, device information, and timestamps of interactions with the Service, collected automatically through server logs.

2.5 AI Interaction Data

If you use the AI chat assistant, the prompts you send and the responses generated are processed via a third-party API (see Section 5).

3. How We Use Your Data

We process your personal data for the following purposes:

Waitlist & Marketing Communications — we send waitlist confirmations, launch updates, product news, educational resources, marketing updates, and early access opportunities where you have consented to receive them. (Legal basis: consent)

• Providing the Service — authenticating your account, storing and running your projects, rendering simulation results. (Legal basis: contract)
• AI Features — sending your prompts to third-party LLM providers to generate responses. (Legal basis: contract)
• Security & Abuse Prevention — detecting and preventing misuse, fraud, or attacks on our infrastructure. (Legal basis: legitimate interest)
• Service Improvement — understanding how the platform is used to improve performance and features. (Legal basis: legitimate interest)
• Legal Compliance — where required to comply with applicable laws or regulations. (Legal basis: legal obligation)

4. Where Your Data Is Stored

Your data is processed and stored in the following locations:

• Supabase (Stockholm, Sweden 🇸🇪) — account data, user profiles, and database records. Sweden is an EU member state, fully within GDPR jurisdiction.
• Amazon Web Services S3 (United Kingdom 🇬🇧) — user-uploaded files, project source code, and job artefacts. The UK benefits from an EU adequacy decision, permitting data transfers between the UK and EEA.

All data remains within the UK and EEA. No personal data is transferred to countries without adequate data protection unless explicitly disclosed in this policy (see Section 5 regarding AI features).

5. Third-Party Processors

We use the following third-party services to operate Vulkos:

Resend is used to deliver waitlist confirmations and email communications to people who have consented to receive them.

• Supabase Inc. — authentication, database hosting, and real-time services. Data processed in Stockholm, Sweden.
• Amazon Web Services (AWS) — cloud file storage (S3) and compute (EC2) for running simulations. Data processed in the United Kingdom.
• OpenRouter / LLM Providers — AI chat functionality. When you use the AI assistant, your prompts are routed through our API to third-party large language model providers. These providers may process data outside the EEA. We do not send your account details or personal identifiers to these providers — only the content of your AI chat messages.

6. Cookies

Vulkos uses only strictly necessary cookies required for the Service to function:

• Authentication cookies — set by Supabase to maintain your login session.

We do not use any analytics, advertising, or tracking cookies. If this changes in the future, we will update this policy and obtain your consent where required.

7. Data Retention

7.1 Account Data

Your account data is retained for as long as your account remains active. If you delete your account, we will erase your personal data within 30 days, except where retention is required by law.

7.2 Waitlist Data

Waitlist data is retained until launch and for up to 12 months afterwards, unless you unsubscribe or ask us to delete it sooner. We may retain a minimal suppression record where needed to make sure we do not email you again after you unsubscribe.

7.3 User Content

Your uploaded files and project data are stored for as long as your account is active. We reserve the right to delete data from inactive accounts as described in our Terms and Conditions.

7.4 Server Logs

Technical server logs (containing IP addresses and request metadata) are retained for up to 90 days for security and debugging purposes, then automatically purged.

8. Your Rights

Under UK GDPR and EU GDPR, you have the following rights regarding your personal data:

• Right of Access — request a copy of the personal data we hold about you.
• Right to Rectification — request correction of inaccurate or incomplete data.
• Right to Erasure — request deletion of your personal data (“right to be forgotten”).
• Right to Restrict Processing — request that we limit how we use your data.
• Right to Data Portability — receive your data in a structured, machine-readable format.
• Right to Object — object to processing based on legitimate interest.
• Right to Withdraw Consent — where processing is based on consent, you may withdraw it at any time.

To exercise any of these rights, contact us at contact@vulkos.co.uk. You can withdraw consent for waitlist and marketing emails at any time by replying to one of our emails or contacting us. We will respond within 30 days.

9. Data Security

We implement appropriate technical and organisational measures to protect your personal data, including:

• Encryption of data in transit (TLS/HTTPS).
• Authentication and access controls on all infrastructure.
• Input validation and sanitisation across API routes.

No system is completely secure. While we take reasonable precautions, we cannot guarantee absolute security of your data.

10. Children's Privacy

The Service is not directed at individuals under the age of 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.

11. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by updating the “Last Updated” date at the top of this page. Your continued use of the Service after any changes constitutes acceptance of the updated policy.

12. Complaints

If you are unhappy with how we handle your personal data, you have the right to lodge a complaint with a supervisory authority. In the United Kingdom, this is the Information Commissioner's Office (ICO).

13. Governing Law

This Privacy Policy is governed by the laws of England and Wales, and the UK General Data Protection Regulation (UK GDPR). Where EU GDPR applies to our processing of your data (for example, if you are located in the EEA), we will comply with its requirements.