Privacy policy

1. Scope and privacy roles

This policy covers Wafercad websites, WCS products, Cloud Campus, evaluations, support and related services provided by the Wafercad legal entity. It does not replace a customer’s own privacy notice or govern third-party services independently selected by a customer.

For website inquiries, commercial contacts and service administration, the Wafercad legal entity generally acts as a controller, business or data fiduciary. For personal data inside a customer or institution tenant, the customer generally acts as controller, business or data fiduciary and the Wafercad legal entity acts as processor or service provider under documented instructions. Exact roles depend on the activity, applicable law and signed DPA.

2. Information we collect

Depending on the service and configuration, we may process:

• account, contact and organization information, including role, institution, team and authentication identifiers;
• subscription, invoice and transaction records, while payment-card details may be handled by a payment provider;
• device, browser, network, security, audit and service-usage events;
• support requests, evaluation notes, training participation and communications;
• Customer Content such as designs, layouts, schematics, PDK references, verification and simulation results, comments and course materials;
• academic records such as enrollment, assignments, progress, assessment and completion data; and
• AI prompts, selected design context, retrieved references, outputs, citations, feedback and proposal decisions.

We collect information from users, customer administrators, institutions, authorized channel partners, configured identity providers, service operations and lawful integrations.

3. How information is used

We use personal data to provide and secure the service; authenticate users; enforce roles and entitlements; process transactions; operate support; deliver courses; route inquiries; detect misuse; maintain audit records; meet legal obligations; and improve reliability and usability.

Where applicable, the legal basis may be performance of a contract, legitimate interests, compliance with law, a public or educational function, or consent. The customer or institution determines the legal basis for tenant data it directs us to process. Product improvement using tenant data is limited to aggregated or de-identified information where permitted, unless a customer separately authorizes another use.

We do not sell personal data, share it for cross-context behavioral advertising, or use learner data for targeted advertising.

4. Enterprise and academic tenant data

Customer administrators configure access, collaboration, courses, retention and integrations for their tenant. We process tenant data only to provide the contracted service, follow documented customer instructions, protect the platform, or meet a legal obligation. A DPA should define processing details, confidentiality, subprocessors, assistance with rights, incident notice, return or deletion, audits and international transfers.

Customer-provided PDKs, rule decks, models, DRM materials and related technology files are confidential Customer Content. They are processed only within the authorized deployment and support boundary under the applicable NDA, service agreement and security schedule. Wafercad does not publish, redistribute or use this material for another customer.

Authorized Channel Partners may receive limited customer information for sales, deployment, training, billing or support when identified in the commercial arrangement. A partner’s independent processing must have its own lawful basis and notice. Partner access inside a tenant must be customer-approved, role-scoped and auditable.

5. Learners, education records and minors

Institutions are responsible for account eligibility, notices, permissions and lawful instructions for their learners. If the institutional agreement establishes Wafercad as a school official under FERPA, Wafercad uses education records only for the authorized institutional purpose, remains under the institution’s direct control for that use and does not redisclose records except as permitted.

For children covered by COPPA or similar law, school authorization may be used only where legally available and only for the educational service requested by the school, without a separate commercial purpose. Wafercad and the institution retain the responsibilities assigned to them by law and contract. Parent or learner requests concerning institution-controlled records should normally be directed through the institution.

6. AI-assisted features and model data

AI requests receive only the authorized context needed for the selected feature. Retrieval, prompts, responses, citations, feedback and approvals may be logged to secure, evaluate and audit the feature, subject to configured retention. AI providers, model location and data-handling options are deployment-specific and should be recorded in the Order Form or DPA.

We do not use Customer Content to train a model made available to other customers unless the customer expressly agrees in writing. AI does not receive broader tenant access merely because a user asks a question; current identity, tenant, resource and feature authorization still apply.

7. When information is shared

Information may be disclosed to vetted infrastructure, hosting, communications, identity, analytics, support and model providers acting under contract; to an Authorized Channel Partner for its approved role; to customer or institution administrators; to professional advisers; or when required to protect rights, safety or comply with law. Information may also transfer as part of a merger, financing or sale, subject to appropriate safeguards and notice where required.

A current subprocessor list and change-notification process should be made available to contracted customers. Service providers may use data only for the contracted purpose and applicable legal obligations.

8. International data transfers

Data may be processed in countries other than the user’s location. Deployment region, data residency and support access are selected in the commercial agreement where offered. When law requires a transfer mechanism, the parties may use an adequacy decision, approved standard contractual clauses, the UK transfer mechanism or another lawful safeguard, together with supplementary measures where appropriate.

9. Retention, export and deletion

We retain data for the service term and for the shortest additional period reasonably needed for security, billing, dispute resolution and legal obligations. Exact periods depend on data type, deployment and contract. Customers can export supported tenant data during the agreed term or retrieval window. Deletion from active systems and expiry from backups follow the DPA, retention schedule and technical constraints.

Security and audit records may be retained separately when necessary to demonstrate authorized activity or investigate incidents. Data subject to a legal hold is retained until the hold ends.

10. Choices and privacy rights

Depending on location, individuals may have rights to know or access, correct, delete, restrict or object to processing, receive portable data, withdraw consent, limit certain uses, opt out of sale or sharing, appeal a decision, or complain to a regulator. We will not discriminate against a person for exercising an applicable right.

For customer-controlled tenant data, submit the request to the relevant organization or institution; we assist it as required by contract and law. For data controlled by the Wafercad legal entity, use the contact route below. We may verify identity and authority before acting and may retain information where law permits or requires it.

11. Regional notices

European Economic Area and United Kingdom

Processing roles, Article 28 or UK-equivalent terms, legal bases, rights and transfer safeguards are documented in the DPA and regional addendum.

California and other U.S. states

Applicable rights may include access, correction, deletion, portability, and opting out of sale, sharing or targeted advertising. Wafercad does not sell personal data or share it for cross-context behavioral advertising.

India

Processing will follow the Digital Personal Data Protection Act, 2023 and applicable provisions of the Digital Personal Data Protection Rules, 2025 as they come into force, with notices, consent or other permitted uses and grievance handling adapted accordingly.

Other countries

A country addendum may identify the local contracting entity, representative, regulator, transfer terms, retention requirements and additional rights. Mandatory local law prevails where it cannot be varied by contract.

12. Security

Administrative, technical and organizational safeguards are described on the Security page and in applicable security schedules. No system can eliminate all risk, so customers also have responsibilities for identity, endpoint, role and integration security.

13. Contact and complaints

Start a privacy request or complaint through the Wafercad contact form and identify it as privacy-related. Contracted customers should also use the notice or privacy contact in their DPA. The final public policy will publish any legally required representative or data-protection contact for each launch region.