1. Who operates TVAC
TVAC is operated by Astoval ApS, Denmark.
Contact: support@tvacai.com.
2. What data TVAC may process
TVAC may process information needed to provide the service, including email address, access or payment status, free-text case descriptions, structured assessment inputs, report language, assessment outputs, support requests, and limited technical or security logs.
Do not submit passwords, private keys, wallet seed phrases, identification documents, special-category personal data, regulated client records, or information you are not authorised to share. Use anonymised names, ranges, and placeholders where practical.
3. How case content is used
For standard self-service reports, the free-text case description and structured answers are used to generate and deliver the assessment requested by the user and for strictly necessary operation, security, and troubleshooting.
TVAC does not create or maintain a customer-derived training or fine-tuning dataset, use case content to benchmark other customers, build unrelated products, sell case data, or disclose it to partners, investors, or other customers.
4. Legal basis
Depending on the situation, processing may be based on performance of a contract or pre-contractual steps, legitimate interests in operating and securing the service, compliance with legal obligations, or consent where consent is specifically requested.
5. Service providers and AI processing
TVAC uses technical service providers where needed for hosting, access management, database functions, payment processing, AI processing, email delivery, monitoring, and support. Providers may include Render, Supabase, OpenAI, Stripe, Resend, Google Workspace, and related infrastructure providers.
Astoval ApS has disabled voluntary sharing of API inputs and outputs with OpenAI and has disabled ordinary API-call logging on the OpenAI Platform. OpenAI states that API data is not used to train or improve its models unless the API customer explicitly opts in. TVAC also sends production assessment requests with optional application-state storage disabled. Under OpenAI's standard data controls, API content and related metadata may nevertheless be retained in separate internal abuse-monitoring logs for up to 30 days.
Payment card details are handled by payment providers such as Stripe and are not intended to be stored directly by TVAC.
6. International processing
Because TVAC uses cloud, payment, email, and AI infrastructure providers, data may be processed in countries outside your own country or outside the European Economic Area. Where required, appropriate contractual or organisational safeguards should be used.
7. Retention of case content
For standard self-service reports, the submitted case input is processed transiently during the request and is not intentionally written to a persistent customer-case database or reusable account history.
The input and generated report remain in the active browser page's working memory while the page is open, so the user can review, localise, print, or save the report. TVAC does not write the standard case or report to browser local storage. They are normally cleared from the browser when the page is reloaded or the tab is closed. Any PDF saved by the user remains on the user's own device.
The generated assessment may remain in short-lived TVAC server-memory caches for no more than one hour to support report delivery, language preparation, and technical consistency. It is then deleted automatically, and a server restart clears it sooner. The current standard self-service flow does not retain a permanent server-side PDF copy.
OpenAI's separate internal abuse-monitoring logs may retain API content and related metadata for up to 30 days under its standard data controls, even though voluntary data sharing, ordinary API-call logging, and optional application-state storage are disabled.
If Scenario Lab is purchased from a completed report, a temporary baseline snapshot may be kept in that browser tab's session storage for up to two hours to restore the report after checkout. It is removed after successful restoration, expiry, or the end of the browser session.
Partner, API, white-label, or institutional workspaces may intentionally retain submitted inputs, assessment results, and report files to provide private report history, status tracking, and downloads. Those arrangements are separately governed and should not be treated as standard self-service use.
Account, payment, entitlement, support, security, and basic technical records may be retained for as long as reasonably necessary for the relevant purpose, legal obligations, dispute handling, or accounting.
8. Your rights
Depending on applicable law, you may have rights to request access, correction, deletion, restriction, portability, or objection to certain processing of your personal data, and you may have the right to lodge a complaint with a supervisory authority.
To make a privacy-related request, contact support@tvacai.com.
9. Security
TVAC uses reasonable technical and organisational measures to protect the service and the data processed through it. However, no online service can guarantee absolute security, and TVAC should not be used as a secure document repository.