Privacy Policy

1. Overview

KYCIS Inc. (“KYCIS”, “we”, “us”) operates the website at kycis.com and provides engineering software products and online services, including DPCloud and associated REST APIs, and PvtLabOnline at online.kycis.com. We are committed to handling the limited data we receive with care and transparency. This policy explains what information we collect, why, and how it is used.

KYCIS is incorporated in Alberta, Canada. This policy is governed by the laws of Alberta and the applicable federal privacy legislation of Canada (PIPEDA).

2. Information We Collect

We collect only the information necessary to operate our websites and deliver our services:

• Contact form submissions: When you use the contact form on kycis.com, we collect your name and email address solely to respond to your inquiry. This information is not shared with third parties and is not used for marketing without your explicit consent.
• PvtLabOnline accounts: When you register for PvtLabOnline, we collect your email address and a password that you choose. Passwords are stored only in hashed form. We also maintain account status information needed to operate the service (for example email verification status, suspension or deletion state, sample-slot and daily calculation allowances, and administrator role assignments where applicable).
• PvtLabOnline session and security data: After you sign in, we use first-party session cookies and related security tokens (including CSRF protection) so you can stay signed in, verify your email, and reset your password. These cookies are required to operate the authenticated service and are not used for advertising.
• PvtLabOnline workspace content: Signed-in users may create and save engineering samples and related workspace data, including fluid compositions, calculation settings, characterization parameters, PT flash / phase-envelope inputs, experimental reference points, and calculation results. This is engineering process data that you choose to store in your account. Administrators do not have access to other users’ sample contents or detailed calculation results through the admin tools.
• API usage data: Users of the DPCloud API submit fluid composition parameters (component fractions, temperature, pressure values) as part of calculation requests. This is engineering process data — it does not constitute personally identifiable information by itself. API requests may be logged for diagnostic purposes and retained for a maximum of 90 days.
• Website and service analytics: On kycis.com and on the production PvtLabOnline site, we may use Google Analytics 4 (GA4) to collect aggregated usage statistics such as pages or screens viewed, approximate geographic region, browser/device type, and referral source. We configure analytics so that it is used to understand site usage and improve our services; we do not send sample compositions, calculation results, passwords, or authentication tokens to Google Analytics. Local development builds of PvtLabOnline do not load analytics by default. Separately, the DPCloud interactive demo on kycis.com uses PostHog as described in Section 10.
• Operational diagnostics: Our servers may record technical logs needed to operate and secure the services (for example request identifiers, error categories, timestamps, and service health metrics). We design these logs so they do not include sample compositions, calculation result bodies, plaintext passwords, or mail tokens.
• API keys: If you are issued a DPCloud API key, we associate it with your contact information. API key usage is logged for rate-limiting, billing, and abuse prevention purposes.

3. What We Do Not Collect

KYCIS does not collect, store, or process:

• Financial account numbers, payment card data, or banking information through PvtLabOnline at this time (paid plans, if offered later, are expected to be processed by a payment provider such as Stripe; card details would be handled by that provider, not stored by KYCIS as full card numbers)
• Government-issued identification numbers
• Health or medical information
• Sensitive personal attributes (race, religion, political views, etc.)
• Plaintext passwords (account passwords are stored only as secure hashes)

Our engineering products operate on process and thermodynamic data. PvtLabOnline requires an email address and password only to create and secure your account; field users of calculation modules are not asked for unrelated personal profiles.

4. How We Use Your Information

• To respond to inquiries submitted through our contact form
• To create and maintain PvtLabOnline accounts, verify email addresses, authenticate sessions, and provide password reset and account-invitation mail
• To provide the thermodynamics workspace, including saving samples, running calculations, and restoring your last explicitly saved state
• To enforce account limits (such as sample slots and daily calculation submissions), prevent abuse, and operate administrative controls for authorized staff
• To provision and maintain DPCloud API access for authorized users
• To diagnose technical issues, monitor system performance, and improve our websites and services using the analytics described in this policy
• To comply with legal obligations

We do not sell, rent, or trade your personal information to third parties. We do not use your information for advertising or behavioural profiling across the web. Analytics tools described here are used to understand aggregate usage of our own sites and demos, not to build advertising profiles about you for third parties.

5. Data Retention

Contact form inquiries are retained for a period sufficient to resolve the relevant matter, typically no longer than two years. DPCloud API logs are retained for up to 90 days. API key records are retained for the duration of the business relationship and for a reasonable period thereafter as required by law.

For PvtLabOnline:

• Active account data, saved samples, and saved calculation results are retained for as long as the account remains active and you keep that content, subject to applicable service limits.
• If an account is deleted, associated account materials (including samples and saved results) are retained for 180 days so that an authorized administrator may restore the account if appropriate. After that retention period, the account is permanently purged or de-identified and the workspace contents are removed from active systems.
• Unsaved workspace drafts and temporary calculation state are discarded when you leave without saving or when a session ends according to the product rules; late-arriving calculation jobs cannot revive discarded drafts.

Google Analytics event data is retained according to our GA4 property settings and Google’s product terms. Demo analytics retention is described in Section 10.

6. Security

We implement appropriate technical and organizational measures to protect the information we hold. Website and PvtLabOnline communications are encrypted in transit (TLS). Account passwords are stored as irreversible hashes. Access to stored data is restricted to authorized KYCIS personnel, and administrative tools are designed so that operators cannot read other users’ sample contents or detailed calculation results. However, no internet transmission or electronic storage system is completely secure, and we cannot guarantee absolute security.

7. Your Rights

If you are a Canadian resident, you have the right under PIPEDA to request access to personal information we hold about you, to request corrections, and to withdraw consent for use of your personal information in circumstances where consent is the legal basis for processing. To exercise these rights, contact us at the address below.

If you are located in the European Economic Area, the United Kingdom, California, or another jurisdiction granting similar rights, you may have additional rights under applicable law. Please contact us to discuss your specific situation. For PvtLabOnline account deletion and the 180-day retention window described above, you may also use the account or support channels we provide.

8. Scope & Third-Party Links

This Privacy Policy applies to kycis.com and to PvtLabOnline at online.kycis.com, including the account, workspace, and administration features of that service.

Our sites may contain links to external resources (for example documentation portals or Google Analytics resources). When you follow an external link, the privacy practices of that third party apply. We encourage you to review the privacy policies of any third-party sites you visit.

9. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the Effective Date at the top of this page. We encourage you to review this page periodically. Continued use of our website or services after any change constitutes your acceptance of the updated policy.

10. Google Analytics 4

On the production kycis.com site and the production PvtLabOnline site, we may load Google’s gtag / Google Analytics 4 scripts using Measurement ID G-GGCGSSWXJK (the same property used for KYCIS web properties). This helps us understand which pages are used and how visitors move through the sites.

• What may be collected: page or screen views, basic device/browser information, approximate location derived from IP address by Google, and similar standard GA4 usage metrics.
• What we do not send to GA4: sample compositions, calculation inputs or results, email addresses from account forms, passwords, CSRF or session tokens, or mail verification / reset codes.
• Who processes the data: Google LLC (and affiliated Google entities) act as a processor/service provider for analytics measurement. Analytics traffic is sent to Google domains such as googletagmanager.com and google-analytics.com when the scripts are loaded.
• Local / non-production builds: Development and local Docker builds of PvtLabOnline do not inject the Measurement ID by default, so those environments do not load GA4 unless explicitly enabled for testing.

You can limit analytics collection through common browser controls (for example blocking third-party scripts, using privacy extensions, or Google’s available opt-out mechanisms for Analytics). PvtLabOnline does not currently show a separate cookie-consent banner for GA4.

11. Analytics & Interactive Demo (PostHog)

When you visit the DPCloud interactive demo hosted on kycis.com (for example on the Products or Demo pages), we use a privacy-preserving analytics tool called PostHog so we can understand which parts of the demo visitors find useful and improve them over time. This section describes exactly what is collected during the demo, why, and how to opt out.

11.1   What we collect on the demo

• Page views and approximate time on page.
• Clicks on specific interactive elements — pipeline nodes, preset buttons, guided-tour steps, Integrate CTAs, and Copy buttons in the API examples.
• Browser family, device type, and coarse (city-level) geolocation derived from your IP address.
• A randomly generated pseudonymous session identifier, stored only in your browser’s memory for the duration of your visit and discarded when you close the tab.

We do not collect or store your name, email address, full IP address, or any API key you paste into the demo. We do not set third-party tracking cookies for analytics. The demo uses a small number of first-party localStorage entries to remember your UI preferences (panel split sizes, whether you have seen the onboarding tour, and your analytics opt-out choice). These entries never leave your browser.

11.2   Legal basis & opt-out

For visitors in the European Economic Area and the United Kingdom, our legal basis for processing this analytics data is our legitimate interest in operating and improving the DPCloud demo (GDPR Article 6(1)(f)). Because the processing is limited, first-party, and cookieless, we consider it to have a minimal impact on your privacy — but you may object at any time.

To opt out, click Opt out in the analytics notice bar shown at the bottom of the demo page on your first visit. Your choice is remembered in localStorage on that browser; no further events will be captured, and if the analytics SDK has already loaded we call its opt_out_capturing() method to stop in-page tracking immediately. You can reverse the decision by clearing site data for kycis.com in your browser and reloading the demo page.

11.3   Who processes this data

We have a Data Processing Addendum in place with PostHog Inc. that incorporates the EU Standard Contractual Clauses for international transfers. Demo analytics traffic is routed through a same-origin reverse proxy on kycis.com before reaching PostHog, so your browser never contacts a third-party analytics domain directly.

11.4   Retention

Event-level analytics data is retained for up to 12 months and then deleted or aggregated into non-identifying summary statistics. Aggregated, non-identifying usage statistics may be retained indefinitely.

11.5   Your rights regarding demo analytics

If you are in the European Economic Area, the United Kingdom, California, or another jurisdiction granting similar rights, you may request access to, correction of, or deletion of any data that identifies you personally. Because we do not associate demo analytics data with a persistent identifier or any personal detail you provide, we cannot in most cases link events back to a specific individual — but if you believe an event can be tied to you, write to api@kycis.com and we will investigate and delete any matching records.

12. Contact Us