Enterprise Privacy & Data Governance Policy
Last Updated: October 2026 • Strict B2B Data Sovereign Standards
1. Information We Collect
TOLGA.SI collects only the corporate information strictly required to authenticate enterprise accounts, configure data-to-video rendering templates, and deliver certified video briefings:
- Business Account Data: Authorized representative name, corporate email address, company name, contact telephone, and billing records.
- Client-Supplied Data Files: Spreadsheets (CSV, XLSX), operational reports, PDF briefs, and brand assets (logos, typography, color codes) provided to compile video dispatches.
- System Telemetry & Logs: Ingestion timestamps, job queue IDs, render performance metrics, and worker node completion receipts.
2. Zero Public Model Training Guarantee
We operate under an absolute non-training covenant:
Under no circumstances is any client data, business metric, spreadsheet, financial performance record, or generated motion graphic briefing ever used to train, retrain, fine-tune, or benchmark public machine learning models, foundation models, or third-party datasets.
Your data is utilized solely within isolated deterministic rendering processes to produce your company's specific video reports.
3. Encryption & Sovereign Storage Standards
We implement bank-grade enterprise security controls across our software infrastructure:
- Encryption in Transit: All web requests, file uploads, and API calls are secured via TLS 1.3 encryption.
- Encryption at Rest: Stored documents, assets, and rendered video files are protected using industry-standard AES-256 encryption.
- Worker Node Security: Rendering jobs executed on our private Debian rendering fleet communicate over dedicated mutual HMAC authentication with dynamic IP whitelisting.
- Multi-Tenant Quarantining: Client datasets are segregated logically and physically to guarantee that no cross-account data leakage can occur.
4. Third-Party Service Providers
We share data only with essential, vetted enterprise infrastructure partners required to deliver our commercial services:
- Payment Processing (Polar.sh): Payment processing and billing are managed by Polar.sh. We do not store raw credit card numbers or banking secrets on our servers.
- Transactional Communications: Automated job delivery notifications and authentication codes are transmitted via encrypted SMTP/transactional delivery partners.
5. Data Retention, Deletion & GDPR / CCPA Rights
Client organizations retain full ownership of their data at all times. Administrators may request immediate and permanent purging of their raw data files, customer briefs, and rendered video archives directly from the account console or by contacting our data protection team.
Upon account closure, all associated raw files are securely scrubbed from our storage servers within 30 calendar days.
6. Data Protection Officer & Compliance Inquiries
For data access requests, deletion requests, or underwriting compliance documentation, contact our compliance officers: