Privacy Policy
Effective date: 2026-02-22
Last updated: 2026-02-22
This Privacy Policy explains how Tuplar handles personal and operational data.
This document is intended for institutional users, teams, and allocators evaluating the service.
1. Data We Collect
Contact and onboarding data: name, email, company, role, jurisdiction, and declared operating model.
Operational telemetry: service events, audit records, and configuration metadata required for platform reliability and compliance.
2. How We Use Data
We process data to deliver, secure, and improve the service, including fraud prevention and policy enforcement.
We also use data for user support, issue response, and controlled product communications.
3. Lawful Basis and Purpose Limitation
Processing is limited to service delivery, legitimate security interests, contractual operation, and legal obligations where applicable.
Tuplar acts as controller for account, security, audit, billing, and platform operations data. Tuplar acts as processor only where agreed in a signed enterprise DPA.
We do not sell personal data.
4. Retention
Data is retained only as long as necessary for product operation, security, auditability, and legal compliance.
Default retention windows: account and operational records (active relationship + 24 months), security logs (12 to 24 months), support records (24 months), and custodial audit trails (up to 7 years where custodial mode applies).
5. Security Controls
We apply technical and organizational controls designed to reduce unauthorized access and data misuse risk.
No security program can guarantee absolute protection; users remain responsible for endpoint and credential hygiene.
6. Third Parties and Subprocessors
We may rely on infrastructure and service providers acting under contractual controls.
Where required, subprocessor details are documented in applicable contractual materials, including DPA workflows.
7. International Transfers
Cross-border processing may occur based on customer location, vendor topology, and legal requirements.
Where required, international transfers are performed using permitted legal mechanisms, including contractual safeguards and model clauses under applicable law.
Hosting provider and processing regions are documented in Tuplar security documentation and may be updated from time to time.
8. Data Subject Rights
Subject to applicable law, users may request access, correction, deletion, restriction, portability, or objection.
Requests can be submitted through the contact channel below and will be handled according to legal timelines. For Argentina Law 25.326 requests, Tuplar targets 10 calendar days for access requests and 5 business days for rectification, update, or deletion requests, where applicable.
9. Jurisdiction and Compliance Baseline
Service operations are based in Neuquén, Argentina. Contracting legal entity details (legal name, tax ID, and legal address) are provided in the applicable Order Form or Subscription before custodial activation.
Custodial mode is enabled only after applicable compliance onboarding and contractual acceptance for the customer jurisdiction.
10. Contact
For privacy requests and data protection inquiries, contact privacy@tuplar.net.