Privacy Policy

1. Who We Are

Asphalyn is a cloud-based process safety platform operated by Muhammad Uzair, trading as Asphalyn (referred to as "Asphalyn", "we", "us", or "our"). We are designed for HAZOP Consultants, Process Safety Engineers, and other process safety professionals to manage HAZOP studies, LOPA analyses, incidents, actions, attachments, and related workflow data.

Registered address: House No. 7, Street no. 47, Near Rehmaniya Masjid, Chah Miran, Lahore 54900, Punjab, Pakistan

Data controller: Muhammad Uzair, trading as Asphalyn. We are the controller for the personal data we collect about users of our product and site.

Privacy contact: For any questions about this policy or your personal data, contact us at contact@asphalyn.com.

Security contact: To report a security issue, contact security@asphalyn.com.

2. POPIA Compliance (South Africa)

Asphalyn processes personal information in accordance with the Protection of Personal Information Act 4 of 2013 (POPIA). Our Information Officer is Muhammad Uzair, who can be contacted at contact@asphalyn.com. You have the right to lodge a complaint with the South African Information Regulator at inforegulator.org.za, or by emailing POPIAComplaints@inforegulator.org.za.

We process personal information under the following POPIA conditions:

• Accountability: We have appointed an Information Officer and maintain internal policies for lawful processing.
• Processing limitation: We collect only the personal information necessary to provide the Service. We do not collect excessive or irrelevant data.
• Purpose specification: We collect personal information for the specific purposes described in Section 4 of this policy.
• Further processing limitation: We do not process personal information for purposes incompatible with the purpose for which it was collected, unless we have your consent or are required by law.
• Information quality: We take reasonable steps to ensure that personal information we process is accurate, complete, and up to date. You can correct your account information at any time from your account settings.
• Openness: This policy, together with our Security page and Subprocessor List, describes our processing practices.
• Security safeguards: We implement technical and organisational measures to protect personal information, as described in Section 10 of this policy and on our Security page.
• Data subject participation: You may exercise your rights under POPIA by contacting our Information Officer at the address above.

Cross-border transfers under POPIA: Personal information collected in South Africa may be transferred to and processed in the countries where our subprocessors operate. We transfer personal information outside South Africa only where the recipient is subject to a law, binding agreement, or corporate rules that provide an adequate level of protection, or where you have consented to the transfer. Our subprocessors are bound by Standard Contractual Clauses or equivalent safeguards. See the Subprocessor List below for details.

3. Information We Do Not Collect

We do not collect or store full payment card numbers. All payment and billing data is collected and processed independently by Paddle, our merchant of record, who acts as a separate controller for that data.

We do not use analytics or advertising cookies on our marketing website. We do not sell, rent, or trade your personal information. We do not use your engineering data for advertising or to train machine learning models.

4. Personal Data We Collect and Why

We collect the following categories of personal data:

• Account data — name, email address, and organization information (if provided). Purpose: to create and manage your account and communicate with you.
• Authentication data — the Google account identifier used to sign in. We do not store passwords. Purpose: to verify your identity.
• Profile preferences — IANA time zone information (e.g. Asia/Karachi) used to display dates correctly. Purpose: to display dates in your local time zone.
• Workspace content — HAZOP studies, nodes, LOPA analyses, incidents, actions, comments, reports, attachments, and any other data you create within the platform. Purpose: to store, process, and display the data you create and generate reports and exports.
• Activity history — records of who created or edited a workspace record and when, where enabled by your plan. Purpose: to provide auditability and traceability within your workspace.
• Technical data — browser type, device information, IP address, and application logs collected automatically. Purpose: to maintain and improve platform performance, reliability, and security.

5. Legal Basis for Processing (GDPR & UK GDPR)

Where applicable data protection law requires a legal basis, we process personal information on the following bases:

• Performance of a contract — processing necessary to provide the Service to you, including account creation, authentication, and storage of your workspace content.
• Legitimate interests — processing necessary for our legitimate interests in operating, securing, and improving the platform, including fraud prevention, security monitoring, and product improvement.
• Legal obligation — processing necessary to comply with applicable legal obligations.
• Consent — where required, for example for optional communications. You may withdraw consent at any time.

6. Engineering Data

Data created within Asphalyn, including HAZOP studies, LOPA analyses, nodes, incidents, actions, attachments, comments, and reports, is stored to provide the platform's core functionality.

This data remains associated with your account or organization and is used only to operate the service and support your workflow. We do not use your engineering data for advertising purposes or sell it to third parties.

You are responsible for ensuring that any personal or confidential third-party information included in attachments or free-text fields (e.g. incident descriptions) is uploaded in accordance with your own organization's policies and applicable law.

7. Cookies and Similar Technologies

The Asphalyn marketing website (asphalyn.com) does not set any cookies. It does not use analytics cookies, advertising cookies, tracking pixels, or any other non-essential cookie. You do not need to consent to cookies to browse the marketing site.

The Asphalyn application (the workspace at app.asphalyn.com) sets the following strictly necessary cookies:

• Token cookie (HttpOnly, Secure in production) — stores the signed JWT session token. Set after Google OAuth exchange. Required to keep you signed in. Duration: 7 days, or until logout.
• Workspace selection cookie — stores the ID of your currently selected workspace so the application loads the correct workspace context on return visits.
• Google OAuth cookies (set by Google, not Asphalyn) — set by Google during the Sign in with Google flow. These are controlled by Google and subject to Google's privacy policy.

Because the marketing site uses no cookies and the application uses only strictly necessary cookies, we do not display a cookie consent banner. If we ever introduce analytics or advertising cookies, we will update this policy and implement a consent mechanism before doing so.

For a complete list of cookies and their purposes, see our Cookie Policy.

8. Subprocessors and Data Residency

Where your data is stored. Asphalyn stores customer data in the European Union and the United States. Application hosting (frontend and backend) is provided by Vercel Inc. with all serverless functions running in the EU Central region (Frankfurt, Germany — fra1). Database hosting is provided by Aiven Ltd, running on DigitalOcean infrastructure in Amsterdam, Netherlands (ams3). Aiven’s own backup storage is located in Bangalore, India (do-blr1). Attachment storage, and the storage for our nightly encrypted database and attachment backups, is provided by Backblaze, Inc. in the US East region (Reston, Virginia — us-east-005). The nightly backup job runs on GitHub Actions in the United States, so a copy of the database is transferred to the United States every night for backup purposes, and is encrypted before it is stored. We do not currently offer region selection.

We share personal data only with the subprocessors listed below. Each subprocessor is bound by a data processing agreement and, where applicable, Standard Contractual Clauses or an equivalent transfer mechanism. We do not sell access to your data and we do not share it with any party not listed here.

A standalone Subprocessor List is also available. We will notify workspace owners by email at least 30 days before adding a new subprocessor that processes personal data, giving you the opportunity to object.

9. International Data Transfers

Our infrastructure providers may store or process data in countries other than your own. Where we transfer personal information outside the UK or EEA, we rely on:

• EU-US Data Privacy Framework for subprocessors certified under the framework (including Vercel and Google).
• Standard Contractual Clauses approved by the European Commission for other subprocessors (including Aiven, DigitalOcean, Backblaze, and GitHub).
• UK adequacy regulations where the recipient is in the United Kingdom (including Paddle).

You can request a copy of the applicable transfer mechanism by contacting our privacy team at contact@asphalyn.com.

10. Data Security and Operator Access

We use reasonable technical and organizational safeguards to protect information against unauthorized access, misuse, loss, or disclosure. These measures include:

• Encryption of data in transit (TLS 1.2+) and at rest on our infrastructure providers.
• Workspace-level access isolation and role-based authorization.
• Administrative access controls and logging where the platform supports it.

10.1 Operator Access to Customer Content

Asphalyn is operated by a small team. The same individuals who build and operate the platform also have administrative access to the infrastructure that stores Customer Content. We want this to be explicit rather than implied.

What this means: Customer Content is stored on infrastructure that Asphalyn personnel can technically access. We do not use end-to-end encryption, and we do not currently offer customer-managed encryption keys, bring-your-own-key, or per-tenant database isolation. Customer Content is encrypted in transit (TLS) and at rest on our infrastructure providers, but the platform operator is a party to that data.

We will not access, read, copy, export, or examine the content of your workspace data except:

• when you ask us to (for example, a support request that requires us to look at a specific record);
• when required to investigate a security incident, abuse, or a violation of these Terms;
• when required to comply with a lawful request from a competent authority; or
• when performing routine infrastructure operations that cannot be isolated from Customer Content (such as database migrations or backup verification), which are performed with the objective of not reading customer content.

We do not use Customer Content to train models, to advertise, to build competing products, or to share with third parties. We do not sell access to workspace data. Operators, employees, and contractors, if any, are bound by confidentiality obligations.

If your organization requires stronger isolation than Asphalyn currently provides (for example, under an NDA with an operator that prohibits third-party operators from having technical access to client studies), please contact us at contact@asphalyn.com before uploading that data.

11. Data Retention

We keep personal data only for as long as needed to provide the Service, comply with legal obligations, resolve disputes, and enforce our agreements. Our retention periods are:

• Workspace content: Workspace data (studies, nodes, rows, actions, incidents, LOPA analyses) is deleted immediately from the live service when a workspace is deleted. There is no soft-delete or grace period at this time. Copies of that data remain in our backups until the backups expire (see Backups).
• Attachments: Attachment objects are deleted from Backblaze B2 when the parent entity (HAZOP study or node) is deleted, or when the attachment itself is deleted. Because our current deployment runs on Vercel serverless functions, deletion of B2 objects is fire-and-forget: if the function terminates before the deletion completes, an orphaned object may remain in the bucket. A queue-based fix is scaffolded but not active. We do not currently run a periodic orphan sweep.
• Import details: When you import actions or incidents from a spreadsheet, we store the details of each imported row, including its values and any validation errors, so that you can review the import, download an error report, and retry failed rows. Import details are kept for 90 days, then cleaned up automatically on your next activity in the workspace. Only the import summary (counts and status) is kept longer. The person who ran an import can delete its row details earlier at any time from Import History. Import details are stored with the rest of your workspace data, are processed only by the subprocessors listed in this policy, and are not shared with anyone else.
• Activity logs: Activity logs are retained for the lifetime of the workspace and are deleted with it. Activity logging is a Team-plan feature only.
• Billing records: Asphalyn does not store billing records or payment card data. All billing is handled by Paddle, our merchant of record. Paddle retains billing records according to its own policies and applicable tax law. You can view and download invoices from the Paddle customer portal.
• Server logs: Application and server logs are retained by our hosting providers according to their standard policies. Vercel retains function logs for a limited period depending on plan. Aiven retains database logs according to its service terms. We do not currently export or archive logs separately.
• Backups: We take a nightly backup of the database. A scheduled GitHub Actions job connects to the production database with a read-only role, takes a dump, encrypts it with an age public key, and uploads it to a private Backblaze B2 bucket in the United States (us-east-005). Before encryption the dump exists briefly as an unencrypted file on the temporary storage of the GitHub-hosted runner; the job deletes the unencrypted files as soon as encryption finishes, and the runner is discarded when the job ends. Daily backups are kept for 35 days and a monthly backup is kept for 3 months, after which they are removed automatically. The private decryption key is kept offline. Production attachments are also copied nightly to a separate private B2 bucket. That attachment copy has no expiry and is not cleaned up when you delete a file or a workspace, so deleted attachments can remain in it; contact us if you need a specific deleted file removed. We have documented and tested restoring the database from a backup. These are nightly snapshots, not point-in-time recovery: our Aiven free-tier (Hobbyist) PostgreSQL plan does not include automatic point-in-time recovery, so changes made since the last nightly backup cannot be recovered. We cannot guarantee recovery of any specific data, and you should maintain independent copies of any data you cannot afford to lose.

Cancellation, refund, or chargeback does not trigger immediate deletion of your workspace data. When a subscription ends — whether by manual cancellation at the end of the billing period, by a full refund, or by a chargeback — your workspace is moved to a restricted, read-only state and your data remains stored. This allows you to export your data at any time and allows us to resolve payment disputes and comply with legal obligations.

12. Your Rights

Depending on your location, you may have the following rights regarding your personal data:

• Access — request a copy of the personal data we hold about you.
• Rectification — request correction of inaccurate or incomplete data.
• Erasure — request deletion of your personal data.
• Restriction — request that we restrict processing of your data.
• Portability — request a copy of your data in a machine-readable format.
• Objection — object to processing based on legitimate interests.
• Consent withdrawal — withdraw consent where processing is based on consent.
• Lodge a complaint — with your local data protection authority. In South Africa, the Information Regulator at inforegulator.org.za. In the UK, the Information Commissioner's Office (ICO). In the EU, your national supervisory authority.

To exercise any of these rights, contact us at contact@asphalyn.com. We will respond within one month of receiving your request, extendible as allowed by law.

13. Children's Privacy

Asphalyn is intended for professional use by adults and is not directed at children. We do not knowingly collect personal information from children, and will delete any such information if we become aware of it.

14. Data Processing Agreement

A Data Processing Agreement (DPA) is available for customers who require one. Our DPA covers the roles of the parties, the scope and purpose of processing, security obligations, subprocessor terms, international transfer mechanisms, and data subject request assistance. You can view it at /dpa or request a countersigned copy by emailing contact@asphalyn.com.

15. Changes to This Policy

We may update this Privacy Policy as Asphalyn evolves or as required by applicable law. For material changes, we will provide reasonable notice before they take effect.

The latest version will always be available on this page with the effective date shown above.