Privacy Policy

1. Who Is Responsible for Your Information

For account registration, website operations, billing administration, and our own customer communications, the responsible organization is:

Sodero Inc. Business address: [[REGISTERED_BUSINESS_ADDRESS]] Privacy inquiries: [[PRIVACY_CONTACT_EMAIL]] Privacy contact / responsible department: [[PRIVACY_OFFICER_OR_DEPARTMENT]]

For questions regarding data that your organization controls through a Workspace, you may need to contact your Workspace administrator first. We will assist customers with applicable data-protection obligations as required by law and agreement.

2. Personal Information We Collect

The categories we process depend on which features you use. The list below must be verified against our actual systems before this Policy is published.

We do not request a company name as a standard required field for every Free account. If a business or Enterprise customer enters company and billing details, the relevant form will explain which fields are required. Please avoid entering sensitive personal information in optional answers or support messages unless necessary.

Operational confirmation required: [[ACTUAL_LOGGING_DATA_FIELDS_AND_RETENTION]], [[ACTUAL_PAYMENT_DATA_FIELDS_AND_PROVIDER]].

3. How We Collect Information

We collect information directly from you when you register, update your profile, create or join a Workspace, contact us, or purchase services. We also receive information from sign-in providers you choose (such as Google) and from service providers supporting account, infrastructure, and billing operations. Technical information may be generated automatically by the systems involved in providing the Services.

4. How We Use Personal Information

We process personal information to:

1. Register and authenticate accounts, manage early-access enrollment, and provide the Services.
2. Manage Workspaces, Projects, permissions, invitations, and customer-requested collaboration.
3. Operate runtime resources, calculate usage, manage credits, and administer subscriptions and payments when available.
4. Respond to inquiries, deliver service notices, resolve problems, and provide customer support.
5. Detect misuse, prevent fraud, secure infrastructure, and investigate incidents.
6. Meet applicable legal, accounting, compliance, and recordkeeping obligations.
7. Improve reliability and product experience using information collected and handled on an appropriate legal basis.
8. Send optional marketing messages only where we have an appropriate legal basis, including consent when required; you may opt out of promotional emails.

Early-access registration may result in messages about account activation, invitations, service availability, and launch timing. We distinguish notices necessary to administer your requested early access from optional promotional marketing.

5. Legal Bases for Processing

Where the GDPR or similar laws apply, our legal bases depend on the specific activity and may include performance of a contract (such as operating your account), compliance with legal obligations (such as required financial records), legitimate interests where permitted and not overridden by your rights (such as security), and consent when required (such as certain optional tracking or marketing).

Where Korean law or other regional laws require a different or additional basis, we will comply with those requirements. We will not treat this statement as a substitute for collecting valid consent when one is needed.

6. Private Projects and Customer Content

Customer-created Projects are intended to be private by default, subject to the permissions assigned by authorized Workspace users. Workspace Owners and other authorized members may view or manage content according to their roles. A user who joins an organization-managed Workspace should understand that the organization's authorized personnel may administer that Workspace.

Sodero does not routinely browse or inspect private project files for marketing, research, or unrelated business purposes. Limited access by designated personnel may be necessary for support you request, system security, incident investigation, or legal compliance. Such access should be subject to authorization, minimum-necessary access, and appropriate records or controls.

We do not use your private Customer Content to train general-purpose AI models without your affirmative permission. This does not prevent ordinary technical processing needed to run simulations, store files, or execute the software you have requested.

Customer Content may contain personal information that you or your collaborators upload. When you decide what personal information goes into a Project, you are responsible for having an appropriate basis to collect, share, and process it. Organizational customers may have additional responsibilities and may request a data-processing agreement when required.

7. When We Share Information

We do not sell personal information. We disclose information only as reasonably needed for legitimate purposes, including:

• Service providers operating hosting, storage, authentication, email delivery, payment processing, analytics, or support systems under appropriate contractual and legal safeguards.
• Other authorized users when you invite them or share information within a Workspace or Project.
• Legal and safety requirements when disclosure is required by law or reasonably necessary to protect rights and security, subject to applicable requirements.
• Business changes, such as a reorganization or acquisition, subject to lawful notice and safeguards.

Before publication, the specific service-provider categories, recipients, purposes, data location, and other details required by applicable law must be completed. Known or planned providers include Amazon Web Services for infrastructure and Google for optional sign-in. A future payments provider has not yet been selected and must not be presented as already active.

Provider and processing inventory: [[APPROVED_SERVICE_PROVIDER_AND_RECIPIENT_LIST]].

8. International Transfers and Storage Locations

Sodero serves users in different countries. Depending on our infrastructure and your location, personal information may be stored or accessed outside your country. The actual AWS data-storage region and any support-access locations must be verified before publication: [[AWS_REGION_COUNTRY_AND_INTERNATIONAL_TRANSFER_DETAILS]].

Where cross-border transfers require safeguards, disclosures, consent, or an adequacy mechanism, we will apply the relevant requirements. We will provide additional information about recipient, destination, purpose, transferred items, and retention or other information when required by applicable law. If applicable EU or UK transfer mechanisms or local representatives are necessary, their details will be provided as required.

9. Retention, Account Closure, and Deletion

We retain personal information only for as long as needed for the relevant purpose, applicable contractual obligations, legitimate security requirements, and laws requiring records to be preserved. The precise retention periods for the following categories must be finalized against actual systems and legal requirements:

When you close an account, access may end immediately, while deletion from active systems and residual backups may take different periods. An individual leaving an organization-managed Workspace does not automatically require deletion of that organization's Projects. Data may also need to be retained for unresolved disputes, security investigations, or statutory obligations, with appropriate access restrictions. We will explain how to export or request deletion of account data through available controls and support processes.

10. Cookies, Analytics, and Similar Technologies

We may use strictly necessary technologies for sign-in, session management, security, and preferences. Additional analytics or similar technologies may be used only if enabled in our actual configuration and in accordance with applicable consent and notice requirements.

Our cookie inventory, analytics tools, retention periods, and consent mechanism must be confirmed before launch: [[COOKIE_AND_ANALYTICS_INVENTORY_AND_CONSENT_CONFIGURATION]]. Where applicable law requires consent for non-essential cookies, we will request it before activating those cookies and provide a way to change your choice. Browser settings may also allow you to block or remove cookies, although strictly necessary site functions may then be affected.

11. Information Security

We use administrative, organizational, and technical controls appropriate to the risks of operating a robotics development platform. These include access restrictions and security monitoring as implemented within our infrastructure. No Internet-based service can guarantee absolute security.

If we become aware of an incident involving personal information, we will evaluate it and provide notices to affected individuals and authorities as required by applicable law. Do not publicly claim specific certifications, end-to-end encryption, or full staff inaccessibility unless independently verified.

12. Your Rights and Choices

Depending on where you live and the circumstances, you may have rights to access, correct, erase, restrict, or obtain a copy of your personal information; object to certain processing; withdraw consent without affecting earlier lawful processing; and lodge a complaint with the relevant authority. Additional regional rights may apply.

You can update supported profile information through your account or contact [[PRIVACY_CONTACT_EMAIL]] to make a request. We may verify your identity before fulfilling a request and may retain information where the law permits or requires it. We will respond within legally required timeframes.

You may unsubscribe from optional marketing emails using the mechanism in those messages. Essential service and account notices may continue while you have an active account.

13. Minimum Age

Sodero accounts are intended for users aged 16 or older. We do not knowingly allow users younger than 16 to maintain accounts. Where the applicable law requires additional authorization for users who are not legal adults, that requirement also applies. If you believe a person under 16 has created an account, contact us so we can investigate and take appropriate action, including deletion where required.

14. Changes to This Privacy Policy

We may update this Policy to reflect changes in our Services, data practices, or law. We will publish the revised text with a current date and provide additional notices or obtain consent if required for material changes.

15. Contact

For privacy questions, requests to exercise your rights, or concerns about personal information, contact:

Sodero Inc. Privacy email: [[PRIVACY_CONTACT_EMAIL]] Responsible privacy department or officer: [[PRIVACY_OFFICER_OR_DEPARTMENT]] Business address: [[REGISTERED_BUSINESS_ADDRESS]]