1. Who We Are

Analytico ("Analytico," "we," "our," or "us") is a desktop analytics copilot that helps data professionals explore and visualize data locally while optionally publishing interactive reports to the cloud. This Privacy Policy explains how we collect, use, disclose, and safeguard personal information when you use our website (https://www.analytico.io) and the Analytico desktop application (together, the "Services").

2. Scope

This Policy applies to any person who visits our website or installs and uses the Analytico application. It does not apply to information processed entirely on your own infrastructure that never leaves your device.

3. Information We Collect

No cookies: Analytico is an Electron desktop app and does not set browser cookies or third-party pixels. Website analytics use Google Analytics cookies solely on analytico.io.

4. How We Use Information

• Provide, operate, and maintain the Services
• Authenticate users and secure accounts
• Process payments and manage subscriptions
• Diagnose and fix bugs or performance issues
• Improve and develop new features, including AI models
• Send service-related notices (e.g., critical updates, billing alerts)
• Comply with legal obligations

5. AI Processing Details

6. How We Share Information

We share information only with the subprocessors necessary to run Analytico:

Each subprocessor is bound by a Data Processing Agreement (DPA) and Standard Contractual Clauses (SCCs) or Data Privacy Framework participation where applicable.

7. Data Location & International Transfers

Most data stays on your local machine. If you publish content or interact with cloud features, data may be transferred to the European Union or the United States. We rely on SCCs, the EU-US Data Privacy Framework, or other recognized safeguards for such transfers.

8. Security

• TLS encryption for all in-transit data leaving your device
• Encryption-at-rest for any cloud-stored secrets and published content
• Secrets (e.g., API keys, passwords) stored in OS-level secure keychains
• Access to production systems limited to a small, vetted Analytico team on a least-privilege basis
• Continuous monitoring and automated alerts via Sentry

9. Retention

• Local project data: stays until you delete the project folder
• Published content: deleted within 30 days of your unpublish request
• Account records and logs: retained until you request deletion, then erased within 30 days unless a longer period is required by law

10. Your Rights

Depending on your jurisdiction, you may have the right to:

How to exercise:

• Local data: delete the project folder or use in-app data management tools
• Published or account data: email privacy@analytico.io from your registered address

We will respond within 30 days.

11. Children

Analytico is not directed to children under 16, and we do not knowingly collect data from minors. If you believe a minor has provided personal data, please contact us and we will delete it.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be announced in-app or via email at least 14 days before they take effect. Continued use of the Services after the effective date constitutes acceptance of the revised Policy.

13. Contact Us

1. Definitions

2. Subject Matter and Duration

• 2.1 This Agreement governs Analytico's Processing of Personal Data on behalf of Customer in the course of providing the Services.
• 2.2 This Agreement remains in force for the term of the underlying Services agreement and until all Personal Data has been deleted or returned to Customer.

3. Purpose and Nature of Processing

Analytico Processes Personal Data solely to provide, secure, and improve the Services, including:

• Local analytics copilot functions within the desktop app
• Optional cloud publication of notebooks, dashboards, or reports
• Error monitoring, usage analytics, and product development
• Automated AI-powered analysis using third-party model providers (see Annex III)

4. Categories of Data and Data Subjects

Full details appear in Annex I.

5. Obligations of Controller

Customer will:

6. Obligations of Processor

Analytico shall:

• 6.1 Process only on documented instructions – including those set out in the Agreement, unless otherwise required by EU or Member State law.
• 6.2 Confidentiality – ensure all personnel authorised to Process Personal Data are subject to confidentiality obligations.
• 6.3 Security – implement the technical and organisational measures in Annex II and maintain them throughout the term.
• 6.4 Sub-processors – engage only the sub-processors listed in Annex III and notify Customer of any intended additions or replacements, giving Customer an opportunity to object on reasonable grounds.
• 6.5 Data Subject Rights – taking into account the nature of the Processing, assist Customer by appropriate technical and organisational measures to respond to requests for exercising data-subject rights.
• 6.6 Data Protection Impact Assessments – provide reasonable assistance to Customer with DPIAs and prior consultations with supervisory authorities where required.
• 6.7 Breach Notification – notify Customer without undue delay after becoming aware of a Personal Data Breach and provide information necessary for Customer to comply with its legal obligations.
• 6.8 Return or Deletion – at termination, delete or return Personal Data at Customer's choice, except to the extent EU or Member State law requires retention.

7. International Transfers

• 7.1 Where Analytico or its sub-processors transfer Personal Data outside the EEA or UK to a country that has not received an adequacy decision, such transfer shall be governed by the Standard Contractual Clauses incorporated by reference.
• 7.2 For transfers to the United States, Analytico or the relevant sub-processor will rely on either the Data Privacy Framework certification or the SCCs.

8. Audits

Analytico will make available all information necessary to demonstrate compliance with this Agreement and allow, at Customer's reasonable request and expense, audits by an independent third party bound to confidentiality. Audits may occur once per year and after any material Personal Data Breach.

9. Liability and Indemnity

Each party is liable for the damages it causes by any Processing that infringes Applicable Data Protection Law. Liability limitations in the main Services agreement apply to this Agreement to the maximum extent permitted by law.

10. Precedence

In the event of conflict, the provisions of the Standard Contractual Clauses prevail, followed by this Agreement, followed by the main Services agreement.

11. Governing Law

This Agreement is governed by the same law and jurisdiction as the main Services agreement, unless the SCCs require otherwise.

Annex I – Details of Processing

Annex II – Technical and Organisational Security Measures

Encryption

• TLS 1.2+ for all data in transit leaving the user's device
• AES-256 or stronger encryption for secrets stored in the cloud

Access Control

• Role based access with least-privilege principle
• Multi-factor authentication for privileged accounts

Physical Security

• Cloud infrastructure hosted in ISO 27001 certified data centres (AWS)

System Security

• Separation of production and development environments
• Automated dependency vulnerability scanning
• Regular penetration testing

Monitoring and Logging

• Centralised logging with tamper protection
• Real-time alerting via Sentry for anomalous events

Business Continuity

• Encrypted backups of published content
• Disaster recovery plan tested at least annually

Personnel Security

• Background checks for employees with production access
• Mandatory security awareness training

Incident Response

• Documented procedure defining roles, escalation paths, and customer communication timelines

Annex III – Approved Sub-processors