Privacy Policy

ekx power systems is a product of Bremen Engineering Inc. ("Bremen", "we", "us"), based in Saskatoon, Saskatchewan, Canada. Bremen is responsible for the personal information collected through the Services.

By accessing or using the Services, you consent to the collection, use, and disclosure of your personal information as described in this Privacy Policy. If you do not agree with this policy, please do not use the Services.

This Privacy Policy applies to all personal information collected by Bremen through our website at joinekx.com and the ekx power systems cloud-based electrical engineering analysis platform and API (collectively, the "Services").

Account Information. You sign in with Google or Microsoft. We receive your name, email address, account identifier, and profile photo. From Microsoft we request only sign-in, email, basic profile, and permission to read your basic profile; we do not request access to your mailbox, files, or calendar, or ongoing access to your Microsoft or Google account. We do not receive or store your password.

Organization Information. We store the organizations you belong to, your role in each, and invitations you send or receive.

Payment Information. Stripe processes payments and collects your card details. We do not receive or store card numbers. We store your Stripe customer and subscription identifiers, plan, and subscription status.

Project Data. We store the electrical system data you enter, including one-line diagrams, equipment specifications, calculation parameters, and study results. This data is used solely to provide the Services.

Uploaded Files. We store manufacturer catalogue PDFs and time-current curve files you upload to the device catalogue, with the data extracted from them.

Usage and Device Information. Our servers record your IP address, browser type, the pages and API endpoints you use, and the studies you run. We use this for security, troubleshooting, and usage limits.

Error Reports. When an error occurs, a report is sent to Sentry. It can include your IP address, browser details, the page you were on, and details of the request that failed.

Support Reports. When you send a support report from the Services, we store your message and contact email, details of the page you were on, and, when you are working in a project, a copy of that project so we can reproduce the problem.

Cookies. We use cookies to keep you signed in and to protect sign-in and sign-up forms from automated abuse (Cloudflare Turnstile). We do not use advertising cookies.

We use your information to:

• Provide, maintain, and improve the Services
• Process transactions and send related information
• Send technical notices, updates, and security alerts
• Respond to your comments, questions, and support requests
• Monitor usage, enforce plan limits, and diagnose errors
• Detect, investigate, and prevent fraudulent transactions and other illegal activities

We do not sell your personal information to third parties.

Your Project Data is Private. Your electrical system models, one-line diagrams, and calculation results are visible only to you and the people you give access to through your organization or project settings. Bremen staff do not access customer project data except:

• When you request technical support or send a support report
• To investigate potential security incidents
• As required by law

Production Access. Access to the servers and database that run the Services is limited to Bremen's system administrator, using individual keys over a private network.

No Marketing Use. We do not use your project data for marketing purposes or share it with third parties for their marketing purposes.

Aggregated Data. We may use aggregated, anonymized data derived from usage patterns for product improvement and industry benchmarking, provided such data cannot identify you or any individual project.

When you upload a manufacturer catalogue PDF or time-current curve to the device catalogue, its content is sent to Anthropic, an AI provider, to extract device data and classify curves. This processing is subject to the following:

• Only the uploaded document and the request needed for that task are sent, not your project data
• Under its commercial terms, Anthropic does not use data we send it to train its models
• We keep the validated results and usage records for the import
• You can add devices to the catalogue by hand instead, without any AI processing

If your organization does not want its documents processed by an AI provider, contact us and we will disable AI-assisted features for your organization.

For more information about how Anthropic handles data, refer to its privacy policy.

We share your information only in the following circumstances:

Service Providers. These providers process information on our behalf to run the Services:

• DigitalOcean: hosts the application and database (United States)
• Cloudflare: website delivery, traffic filtering, bot protection, and storage of uploaded files and backups
• Stripe: payments and subscriptions
• Sentry: error monitoring (United States)
• Resend: delivers support reports you send to us by email
• Anthropic: AI-assisted catalogue import, described in Section 7
• Google and Microsoft: sign-in

These providers process personal information only to provide their services to us, under their contractual and confidentiality obligations. We will update this list before we add a provider that processes personal information.

Legal Requirements. We may disclose information if required by law, regulation, legal process, or governmental request.

Business Transfers. In connection with a merger, acquisition, or sale of assets, your information may be transferred to the successor entity.

With Your Consent. We may share information with third parties when you give us explicit consent to do so.

We implement technical and organizational measures to protect your personal information, including:

• Encryption of data in transit with TLS 1.2 or higher
• Storage of the database on encrypted storage volumes, which DigitalOcean encrypts at rest
• Encrypted database backups, copied off-site several times a day
• Server access only over a private network with individual keys
• Role-based access controls within organizations and projects, enforced in the database
• Code review and automated tests before each release

While we strive to protect your information, no method of transmission over the Internet or electronic storage is completely secure. We cannot guarantee absolute security.

Security Incidents. We follow a written incident response policy. If a security incident affects your personal information, we will notify affected customers without unreasonable delay, and within 72 hours of confirming it, and report it to the Office of the Privacy Commissioner of Canada where the law requires.

Reporting a Vulnerability. Report suspected security issues to [email protected].

We retain your personal information for as long as your account is active or as needed to provide the Services. We also retain information as necessary to comply with legal obligations, resolve disputes, and enforce agreements.

Projects. You can delete your own projects at any time. Deleted projects are removed from the live database immediately.

Account Deletion. To delete your account, email [email protected] from the address on your account. We will delete your account and project data within thirty (30) days of confirming the request. You may export your project data before deletion.

Retained Records. We keep billing and transaction records for as long as tax and accounting law requires.

Backups. Deleted data remains in encrypted backups until those backups expire, which takes at most thirteen (13) months. We do not restore deleted data from backups except to recover from data loss.

Uploaded Files. Files uploaded to catalogue imports that are never finished are deleted automatically after thirty (30) days.

Depending on your location, you may have the following rights regarding your personal information:

Access. Request a copy of the personal information we hold about you.

Correction. Request correction of inaccurate personal information.

Deletion. Request deletion of your personal information, as described in Section 10.

Export. Export your project data, including reports (PDF), equipment and cable schedules (Excel), and project files (JSON).

Opt-Out. Opt out of marketing communications at any time.

To exercise these rights, contact us at [email protected]. We will respond to your request within thirty (30) days.

Bremen is based in Canada. The application and database are hosted by DigitalOcean in the United States, and our service providers may process information in other countries. These countries may have different data protection laws than your country of residence, and information stored there may be accessible to their courts and authorities.

By using the Services, you consent to the transfer of your information to the United States, Canada, and other jurisdictions where our service providers operate. We protect transferred information through our contracts with these providers and the measures in Section 9.

The Services are not intended for individuals under the age of 18. We do not knowingly collect personal information from children. If we learn that we have collected personal information from a child under 18, we will take steps to delete such information.

We may update this Privacy Policy from time to time. We will notify you of material changes by:

• Posting the updated policy on our website
• Sending an email to the address associated with your account
• Displaying a notice within the Services

Changes become effective when posted. Your continued use of the Services after changes are posted constitutes acceptance of the updated policy.

If you have questions about this Privacy Policy or our privacy practices, please contact us at:

Email: [email protected]

Security issues: [email protected]

Mail:

Bremen Engineering Inc.

Saskatoon, Saskatchewan

Canada