1. Who we are and what this policy covers
This policy explains what personal information TOURBAI INC, doing business as Tourbillon AI ("Tourbillon", "we", "us"), collects when you use the Platform — tourbillon.ai and all of its subdomains, including www.tourbillon.ai, platform.tourbillon.ai and api.tourbillon.ai — and our support channels (together, the "Services"), and what we do with it. It does not cover open-source software we publish, which runs on your own machines and sends us nothing.
If you use the Services on behalf of an organization, that organization is our customer and may have its own privacy practices for the data it stores with us. Section 5 explains how we treat data stored in TERSL/DB.
2. Information we collect
- Account information. When you create an account we collect your name, email address, a password (stored only as a hash), and, if you give one, your organization's name. If you add other people to your account, we collect their names and email addresses from you.
- Google sign-in. If you choose "Continue with Google", Google sends us your name, email address and profile picture. We use them only to create and sign you in to your account. Our use of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements.
- Billing information. Payments are processed by Stripe. Stripe collects your card details directly; we never see your full card number. We receive your name, email, billing address, the last four digits and brand of your card, and records of the transactions.
- Usage and log information. When you or your software use the Services we record the IP address, browser or client type, timestamps, the Access Key and Namespace involved, request sizes and counts, error codes and similar technical data ("Operational Metadata"). This does not include the content of the data you store.
- Analytics. Our website and the Platform use Google Analytics, which collects information about your visit — pages viewed, time on page, approximate location, device and browser type — through cookies described in section 6. Google states that Google Analytics 4 does not log or store IP addresses.
- Communications. If you email us or respond to a message from us, we keep the correspondence.
- Cookies. See section 6.
3. How we use information
We use the information in section 2 to: provide, operate and secure the Services; sign you in and verify your identity; bill you and keep financial records; answer support requests; detect, investigate and prevent abuse, fraud and security incidents; send you service messages such as receipts, security alerts, limit notices and changes to our terms; send occasional product updates, which you can opt out of with the link in the email; analyze how the Services are used so we can improve them; and comply with law.
We do not use personal information, or any data you store in the Services, to train or evaluate machine-learning or AI models.
4. Who we share it with
We share personal information only with:
- Microsoft Azure, which hosts the Services in the United States (currently the West US 3, Central US and East US regions).
- Stripe, which processes payments and stores your card details under its own privacy policy.
- Google, in three ways: Google sign-in, only if you choose it; Google Analytics, which receives the usage information described in sections 2 and 6; and Google Fonts, which serves our web fonts and receives your browser's request for them. Google handles this information under its privacy policy and, for Analytics, its description of how it uses data from sites that use its services (policies.google.com/technologies/partner-sites).
- Authorities and others when the law requires it, for example to respond to a subpoena or court order, to protect the rights, property or safety of Tourbillon, our customers or the public, or to enforce our Terms of Service.
- A successor if Tourbillon is involved in a merger, acquisition, financing or sale of assets; the successor will be bound by this policy for information collected before the transfer.
We do not sell personal information. We do not share it with third parties for their own marketing or for cross-context behavioral advertising, and we do not run third-party advertising on the Services.
5. Data you store in TERSL/DB
The data you and your software write to your Namespaces ("Customer Data") belongs to you. We store it so the Services work; we do not read it except to provide support you ask for, to investigate abuse or a security incident, or when the law requires it, and we do not use it for any purpose of our own. If Customer Data includes personal information about other people, you are responsible for having the right to store it and for answering those people's requests about it. If someone contacts us about data a customer has stored, we will refer them to that customer. Our Terms of Service set out how long Customer Data and its history are kept and how it is exported and deleted.
6. Cookies and Do Not Track
The Platform sets cookies that keep you signed in and protect forms against forgery. They are necessary for the Services to work and expire when your session ends or you sign out. Our website and the Platform also use Google Analytics, which sets its own cookies (such as _ga, kept for up to two years) to distinguish visitors and measure how the site is used. You can block analytics cookies in your browser settings or with Google's opt-out browser add-on at tools.google.com/dlpage/gaoptout. Because Google Analytics runs on many websites, Google may associate information it collects here with information it collects elsewhere, as its policies describe. We do not use advertising cookies, and we do not run third-party advertising on the Services.
We do not respond to browser Do Not Track signals, because there is no common standard for them.
7. How long we keep information
We keep account information while your account is open and delete it within 30 days after you close it, except that we keep billing and transaction records for seven years to meet tax and accounting rules, keep operational and security logs for up to one year, and keep correspondence and records we need to resolve a dispute or comply with law for as long as that need lasts. Customer Data is kept and deleted as the Terms of Service describe.
8. Security
We protect personal information with safeguards appropriate to its sensitivity: all traffic to the Services is encrypted in transit, Customer Data is encrypted at rest by our hosting provider, passwords and Access Keys are stored only as hashes, and two-factor authentication is available for every account. No system is perfectly secure; if we learn of a breach affecting your personal information we will notify you as California law requires. Keep your password and Access Keys confidential, and tell us at corporate@tourbillon.ai if you think they have been exposed.
9. Your choices and California rights
You can review and change your account information at any time on the Account page of the Platform, and you can close your account there. You can opt out of product-update emails with the link in any such email; we will still send service messages about your account. You can revoke Google sign-in from your Google account settings.
If you are a California resident, you may ask us what personal information we hold about you, ask us to correct or delete it, and ask us not to sell or share it (we do neither). Email corporate@tourbillon.ai; we will verify the request against your account email and respond within 45 days. We will not treat you differently for making a request. California's "Shine the Light" law lets residents ask whether a business has disclosed personal information to third parties for their direct marketing; we do not.
Requests about data that a customer has stored in TERSL/DB should go to that customer (section 5).
10. Children, and use from outside the United States
The Services are for adults and businesses. We do not knowingly collect personal information from anyone under 13, and we do not allow customers to store children's personal information in the Services without a written agreement. If you believe a child has given us personal information, email corporate@tourbillon.ai and we will delete it.
We are a United States company and operate the Services from the United States. If you use them from elsewhere, your information will be transferred to and processed in the United States, where privacy laws may differ from those of your country, and you agree to that transfer by using the Services. We do not currently offer terms tailored to laws outside the United States.
11. Changes to this policy
We may update this policy. We will post the new version at tourbillon.ai/privacy with its effective date, and for material changes we will email Account Owners or show a notice in the Platform before the change takes effect.
12. Contact
TOURBAI INC (doing business as Tourbillon AI)
2600 W Olive Ave, Burbank, CA 91505, United States
corporate@tourbillon.ai · +1 805-416-0415
Effective date: November 1, 2026.