Privacy Policy & Security Practices

1. Our Role: Data Processor for Partner Showrooms

Cyan Logic LLC provides the Surface Logic and Clad Studio visualization platform to partner stone fabricators, slab galleries, and design studios (“Partner Studios”). When a Partner Studio or homeowner enters project details or uploads room photos during a consultation, the Partner Studio acts as the Data Controller and Cyan Logic acts as the Service Provider / Data Processor.

We Never Sell Personal Information: Cyan Logic does not sell, rent, or broker homeowner names, email addresses, phone numbers, or room photographs to third-party advertisers or lead aggregators.

2. Information Collected in the Platform

• Showroom Staff Roster: Consultant names, optional work emails, role tiers (Admin, Manager, Sales Rep), and 4-digit showroom kiosk PINs.
• Customer Consultation Records: Project/client name, optional phone number and email address, return-visit share code, room names, surface selections, and consultation notes entered by the showroom consultant.
• Room & Slab Photographs: Photos uploaded directly or beamed via the 2-Second QR Photo Bridge solely for generating surface visualizations and printable selection sheets.
• Telemetry & Quality Assurance Logs: Render credit usage, latency metrics, and voluntary “Flag Issue” diagnostic snapshots submitted by showroom staff.

3. Public Share Links (`/p/[shareCode]`) & PII Redaction

When a customer scans or opens a Take-Home Share Link (e.g., /p/CTS-XXXXX), our server automatically strips the customer's phone number, email address, and internal consultant notes before transmitting the page payload. Only the visual Before/After comparison, project title, and selected stone/surface specifications are displayed.

4. Infrastructure Security & Sub-Processors

All data is transmitted over encrypted HTTPS (`TLS 1.3`) and stored at rest using `AES-256` encryption across enterprise cloud infrastructure:

• Vercel Inc. (USA): Application hosting, edge TLS encryption, and serverless API execution.
• Supabase Inc. / AWS (USA): Managed PostgreSQL database with strict server-only `service_role` Row-Level Security (RLS) isolation—direct anonymous browser queries to database tables are blocked.
• Fal AI & Google Cloud Vertex / Gemini API: Ephemeral visual analysis and 2K surface rendering. Customer room photos are not used to train public foundation models.
• Stripe Inc.: PCI-DSS Level 1 subscription billing. Cyan Logic never receives or stores raw credit card numbers.

5. Data Retention & Right to Deletion

Studio Admins and project owners can permanently delete any customer consultation record directly inside the Showroom workspace at any time. Homeowners or Partner Studios may also request complete deletion or export of their records by contacting their showroom or emailing privacy@cyanlogicstudio.com. Verified deletion requests are completed within 15 business days.