# Privacy policy: where you run it decides what we hold

The privacy policy of Tileward, Inc., a company incorporated in the United States. It covers this website, the hosted service at api.tileward.com and app.tileward.com, and software you run yourself, and says what Tileward holds in each deployment mode and for how long.

Page: https://tileward.com/privacy/

## What reaches Tileward

| How you run it | What reaches Tileward | Our role |
|---|---|---|
| Hosted API | Prompts, completions, whatever Context has stored for you, and the audit record of each guard decision. | Processor for that content; controller for your account and billing data. |
| Your VPC | Nothing of the content. On committed-use billing, an aggregate usage count (seats, tokens, tiles active, no content). | Controller for account and licensing data only. |
| On-prem, air-gapped | Nothing. There is no network path from the deployment to us. | Controller for account and licensing data only. |

## What we hold on the hosted service

- Account data: your name, work email, company and API keys. Tileward is the controller.
- Content you send: prompts and completions through `/v1`, the conversation turns and documents Context stores for you, and the text of each message the guard classifies. You are the controller and we act on your instructions.
- Audit records: one per guard decision, allowed or refused, holding no message text.
- Card details are entered on Stripe's own pages; we keep the card brand and last four digits.

## Retention and training

- Audit records are kept for 7 days on a pay-as-you-go account, and locally, by you, on Enterprise self-hosted ([retention table](https://tileward.com/privacy/#retention-table)). They age out on that window whether the account is open or closed.
- Stored context stays until you delete it or close the account.
- Captured guard text is kept separately from the audit record for 90 days on every account, so a refusal can be shown with what it refused.
- Apart from the guard text, we keep no separate log of raw requests and responses.
- We do not use your prompts, stored context, documents or audit records to train, fine-tune or evaluate a model, ours or anyone else's, with no carve-out for aggregate or de-identified use.

## Sharing, security and transfers

- Service providers are listed on the [sub-processor page](https://tileward.com/subprocessors/). We do not sell personal data or share it for advertising.
- SOC 2 Type II and ISO 27001: in progress. The SOC 2 work is monitored by Comp AI ([certifications](https://tileward.com/security/#certifications)).
- Tileward, Inc. is based in the United States only, and no server outside the US hosts the service or holds customer data, on any account.

## Your rights

- Access, correction, deletion: write to [hello@tileward.com](mailto:hello@tileward.com) and we reply within 5 business days. Portability: a copy of what Context holds for you is provided as JSON-LD.
- [Account deletion](https://tileward.com/privacy/#account-deletion) takes effect immediately, with no grace period: API keys revoked, private tiles, captured guard text and everything Tileward Context holds for the account deleted, along with the Context account itself. None of it is recoverable. A conversation last used before your audit window has no usage record left to find it by, so email us and we remove it by hand. Prepaid credit is forfeited on closing.

## This website

- tileward.com sets no cookies and loads no third-party analytics script. Button clicks are recorded on its own server with nothing that identifies you, and age out after 90 days.
- The feedback bubble sends nothing unless you write something and press send; we keep it until you ask us to delete it.

The full text is at https://tileward.com/privacy/.

## Related

- [Retention table](https://tileward.com/privacy/#retention-table): audit record retention
- [Security](https://tileward.com/security/): audit retention, export and certifications
- [Sub-processors](https://tileward.com/subprocessors/): each service provider and what it is for
- [Data processing addendum](https://tileward.com/dpa/): the processor terms for the hosted API
- [Terms of service](https://tileward.com/terms/): the agreement, in plain words