TruOptim Industrial AI Gateway
Industrial Digital Twins

Privacy Policy

TRUOPTIM INDUSTRIAL AI GATEWAY

PRIVACY POLICY

Copyright © 2025-present TruOptim Solutions Ltd. All rights reserved.

Version: 1.3 Effective Date: 2 October 2026 Last Updated: 1 October 2026

1. INTRODUCTION

1.1 This Privacy Policy explains how TruOptim Solutions Ltd ("TruOptim," "we," "us," or "our") collects, uses, discloses, and protects information in connection with the TruOptim Industrial AI Gateway software (the "Software").

1.2 TruOptim Solutions Ltd is a company incorporated in England and Wales (Company Registration No. 16742261), with its registered office at 205 Regent Street, 4th Floor, London, England, W1B 4HB.

1.3 This Privacy Policy applies to:

  • Users of the Software ("Customers" or "you")
  • Visitors to our websites and marketing materials
  • Individuals whose personal data may be processed through the Software

2. KEY PRINCIPLES

2.1 Customer-Deployed Software. The TruOptim Industrial AI Gateway is deployed as an Azure Managed Application within your own Azure tenant. This architectural choice means:

(a) Industrial Data Plane: Industrial process data and OPC UA telemetry are processed by gateway resources in your Azure subscription. Service metadata and information deliberately submitted through support, feedback, trial, billing, email, or remote-log features may be sent to TruOptim and the recipients listed below.

(b) Limited TruOptim Access: TruOptim does not have routine interactive access to industrial process values. Administrators can choose to submit logs or support material that may contain usernames, endpoint identifiers, URLs, configuration context, or values included in an error message. Customers should review and redact support submissions where appropriate.

(c) You Are the Controller: For any personal data processed through the Software, you are the data controller responsible for compliance with applicable data protection laws.

2.2 Privacy by Design. The Software is designed with privacy and security principles embedded:

  • TLS for supported network connections; negotiated versions depend on the configured Azure and OPC UA endpoints
  • Role-Based Access Control (RBAC)
  • Comprehensive audit logging
  • Data minimization
  • Fail-closed authentication and least-privilege controls on supported customer deployment paths

3. INFORMATION WE COLLECT

3.1 Information You Provide

3.2 Information Collected Automatically

3.3 Information We Do NOT Collect

The standard service does not intentionally collect the following as routine control-plane data:

  • Industrial process values or sensor data
  • OPC UA node values or historical data
  • Bulk Customer Data processed through the Software, except when a Customer deliberately submits it for support or enables a separately documented integration
  • AI Agent conversations or queries (unless explicitly shared for support)
  • Proprietary business information about your operations

4. HOW WE USE INFORMATION

4.1 Lawful Bases. We process personal data based on:

4.2 Specific Purposes:

(a) Service Provision: Creating and managing your account, providing access to the Software, processing subscriptions.

(b) Billing and Payments: Reporting your plan's entitlement to Microsoft, which bills and collects the Subscription Fees through Azure Marketplace. Fees are based on the plan you choose, not on usage. TruOptim does not process payments and does not keep a billing ledger; your invoices are held by Microsoft.

(c) Support: Responding to support requests, troubleshooting issues, providing technical assistance.

(d) Product Improvement: Analyzing service and usage information to improve the Software. We minimise and aggregate this information where practicable; we do not describe all service metadata as anonymous.

(e) Communications: Sending service notifications, security alerts, product updates (transactional), and marketing communications (with consent).

(f) Security: Detecting and preventing fraud, unauthorized access, and other security incidents.

(g) Legal Compliance: Complying with applicable laws, regulations, and legal processes.

5. DATA SHARING

5.1 We Do NOT Sell Personal Data. TruOptim does not sell, rent, or trade personal information to third parties.

5.2 Limited Sharing. We may share information with:

5.3 Customer Data. We do not share Customer Data with any third party except:

  • At your explicit request (e.g., for support purposes)
  • As required by law
  • With your prior written consent

6. INTERNATIONAL TRANSFERS

6.1 UK Adequacy. As a UK company, we comply with UK data protection law. For transfers outside the UK:

(a) We rely on adequacy decisions where available (b) We use Standard Contractual Clauses (UK SCCs) where required (c) We implement supplementary measures as necessary

6.2 Azure Regions. When you deploy the Software, you select the Azure region. Your Customer Data remains in your chosen region within your Azure subscription.

7. DATA RETENTION

7.1 Retention. Retention depends on the deployment, contract, legal requirement and operational store. The periods below are operational categories, not a representation that every store currently deletes data automatically at a fixed boundary. Applicable pilot retention is confirmed in the Order Form or DPA schedule.

7.2 Customer Data. Customer Data is stored in your Azure subscription. TruOptim does not retain Customer Data. Upon termination, you are responsible for exporting your data before decommissioning the Software.

8. YOUR RIGHTS

8.1 Data Subject Rights. Under applicable data protection laws, you may have the right to:

8.2 Self-Service. The Software provides self-service tools for exercising your rights:

  • Data Export: GET /api/auth/gdpr/export
  • Account Deletion: POST /api/auth/gdpr/delete
  • API Keys Page: Download my data / Delete my account buttons

8.3 Contact. To exercise your rights, contact:

  • Post: Data Protection, TruOptim Solutions Ltd, 205 Regent Street, 4th Floor, London, W1B 4HB

8.4 Complaints. You have the right to lodge a complaint with a supervisory authority. In the UK, this is the Information Commissioner's Office (ICO): https://ico.org.uk

9. SECURITY

9.1 Technical Measures. We implement appropriate technical measures to protect personal data:

  • TLS for supported network connections, subject to endpoint and customer configuration
  • Encryption at rest (AES-256-GCM)
  • Role-Based Access Control
  • Request rate limiting on supported application routes
  • Dependency, source and container scanning in the production release pipeline
  • Documented vulnerability reporting and incident escalation processes

9.2 Organizational Measures. We maintain organizational security practices:

  • Employee security training
  • Access on need-to-know basis
  • Confidentiality obligations
  • Vendor security assessments
  • Business continuity planning

9.3 Security References. TruOptim uses the following publications as engineering references. This is not a claim that TruOptim or the Software is certified against them, that every control is implemented, or that they apply to every Customer deployment:

  • IEC 62443-4-1 (Secure Development Lifecycle)
  • NIST SP 800-218 (Secure Software Development Framework)
  • OWASP ASVS (Application Security Verification Standard)

10. COOKIES AND TRACKING

10.1 Limited Use. The Software's web interface uses only essential cookies:

10.2 No Tracking. We do not use:

  • Third-party analytics tracking
  • Advertising cookies
  • Social media tracking pixels
  • Behavioral profiling cookies

10.3 Marketing Website. Our marketing website at truoptim.com may use analytics cookies with your consent. See our Cookie Policy for details.

11. CHILDREN'S PRIVACY

The Software is intended for business use by organizations and is not directed at individuals under 18 years of age. We do not knowingly collect personal data from children.

12. ROI CALCULATOR AND DEMO SANDBOX (ADR 070, ADR 083)

12.1 ROI Calculator Data

When you use the ROI Calculator feature, we collect:

This data is used to:

  • Configure your trial with industry-appropriate demo servers
  • Calculate estimated pricing and ROI projections
  • Personalise your evaluation experience

12.2 Demo Sandbox Data

When you use the Demo Sandbox feature, we collect:

Important: Demo Sandbox OPC UA servers generate synthetic, simulated data only. This simulated data:

  • Remains in your Azure tenant
  • Is NOT transmitted to TruOptim
  • Does NOT represent real industrial processes
  • Is for evaluation and training purposes only

13. AI CONCIERGE SUPPORT DATA (ADR 090)

13.1 Feedback Submissions

When you submit feedback via the support_submit_feedback MCP tool:

13.2 Automatic Privacy Sanitization (ADR 090)

Important: All feedback submissions are automatically sanitized before transmission to TruOptim. The following sensitive data patterns are automatically redacted:

This automatic sanitization ensures:

  • No accidental data leakage: Even if you inadvertently include sensitive data in your feedback, it will be redacted before reaching TruOptim
  • Compliance protection: Helps satisfy DLP (Data Loss Prevention) policies
  • Privacy by design: Aligns with IEC 62443 secure-by-default principles

You cannot disable this sanitization. This is by design to protect your proprietary industrial data.

13.4 Feedback Accessibility

The support_submit_feedback tool is accessible to all users (not just administrators). Privacy protection is achieved through automatic sanitization rather than access restriction, enabling meaningful support access while preventing data leakage.

13.5 Feedback Responses

When TruOptim responds to your feedback:

  • Responses are stored locally in your gateway deployment
  • Accessible via the support_view_my_feedback MCP tool
  • TruOptim retains a copy for quality assurance and pattern analysis
  • No industrial data or Customer Data is included in responses

13.6 Proactive Notifications

The support_get_notifications tool generates suggestions based on:

Important: Proactive notifications are generated locally from aggregated metrics. No industrial process values or Customer Data are transmitted for this purpose.

13.7 Recovery Email and Transactional Communications (ADR 191, ADR 230, ADR 237)

During deployment, you provide a recovery email address. This email is used exclusively for transactional service communications:

Email Provider: Transactional emails are sent via Google Workspace SMTP (smtp.gmail.com). Google processes email addresses solely for delivery purposes under their Data Processing Agreement.

Important:

  • These are transactional service emails, not marketing
  • You cannot unsubscribe from critical service notifications (password reset, welcome)
  • Usage warnings help you avoid service interruption
  • No industrial data or Customer Data is included in these emails

13.8 In-Product Notifications

In addition to email, trial and usage notifications are also delivered through:

These in-product notifications do NOT require your email address and are generated locally from aggregated metrics.

14. THIRD-PARTY AI AGENTS

14.1 AI Agent Privacy. When you connect AI Agents (such as Claude, Microsoft Copilot, or ChatGPT) to the Software, those AI Agents may process your data according to their own privacy policies:

14.2 No TruOptim Responsibility. TruOptim is not responsible for the data processing practices of third-party AI Agents. You should review their privacy policies before connecting them to the Software.

14.3 Data Shared with AI Agents. When an AI Agent makes MCP tool calls through the Software, the following may be shared with the AI Agent:

  • Industrial data values you request
  • Metadata about your data sources
  • Results of operations you authorize

You control what data AI Agents can access through RBAC configuration.

15. CHANGES TO THIS POLICY

15.1 Updates. We may update this Privacy Policy from time to time. We will notify you of material changes by:

  • Posting a notice in the Software
  • Sending an email to the address associated with your account
  • Updating the "Last Updated" date above

15.2 Continued Use. Your continued use of the Software after changes become effective constitutes acceptance of the updated Privacy Policy.

16. CONTACT US

16.1 Privacy Questions. For questions about this Privacy Policy or our data practices:

Email: privacy@truoptim.com

Post: Data Protection Officer TruOptim Solutions Ltd 205 Regent Street, 4th Floor London, England, W1B 4HB United Kingdom

16.2 Response Time. We aim to respond to privacy inquiries within 30 days.

17. DATA PROTECTION OFFICER

TruOptim has designated a Data Protection Officer who can be contacted at:

Email: dpo@truoptim.com

Post: Data Protection Officer TruOptim Solutions Ltd 205 Regent Street, 4th Floor London, England, W1B 4HB United Kingdom

18. LEGAL BASIS SUMMARY (GDPR/UK GDPR)

Copyright © 2025-present TruOptim Solutions Ltd. All rights reserved.

This Privacy Policy is effective as of the Effective Date stated above.