Data Protection & Privacy

1. Roles and responsibility

The customer acts as the data controller for all submitted datasets. Mathias Plus acts as a data processor, processing data strictly under customer instructions.

2. Data scope

The platform processes only datasets explicitly provided by the customer. No external enrichment, data merging, or hidden data sources are used.

3. Core processing principles

• Deterministic data processing (no randomness)
• No model training on customer data
• No reuse of datasets across customers
• No hidden learning or adaptive behaviour
• Full reproducibility under identical inputs

4. Data handling and retention

Data handling and retention depend on the selected plan. For plans without input persistence, submitted datasets are stored temporarily within the region associated with the selected plan and are automatically deleted within a maximum of 4 days after submission.

Eligible plans may provide persistent input storage to support historical analysis, cross-run comparison, and optional MSI Expertise Services. Persistence conditions are defined in the applicable plan specifications.

Generated analytical artifacts and expertise deliverables are stored separately from input datasets and remain available according to the conditions of the active subscription.

Plan-specific storage, retention, and usage limits are detailed in the Public Plans and Service Limits Specifications.

For MSI Expertise Services only, authorized Mathias Plus personnel, limited to the Director of Mathias Plus or a person specifically designated by the Director, may access the relevant persisted input datasets and analytical artifacts where such access is necessary to fulfill an expertise request submitted by the customer.

5. Traceability and audit

Each execution is associated with a unique Job ID, enabling full traceability between jobs and generated artifacts.

A cryptographic (SHA-based) hash of the input dataset is recorded to ensure data integrity and reproducibility of results.

Audit artifacts document processing parameters, execution context, and configuration.

6. Identity and access data

The service processes technical identity information required for authentication, authorization, access control, and auditability, including Microsoft Entra ID object identifiers (OID) and tenant identifiers.

In Standard Edition, the email address associated with the authenticated Microsoft identity is also stored in the service database and used to provide service notifications, including Studio access URL and support communications. Account and billing information may also be processed through Stripe where applicable.

7. Security and hosting

The platform is hosted on Microsoft Azure within controlled infrastructure environments. Logical isolation mechanisms ensure strict separation between customer datasets.

8. Subprocessors

The platform relies on Microsoft Azure as its primary infrastructure and cloud services provider. Standard Edition also uses Stripe for subscription, payment, and billing processing.

Additional subprocessors, where applicable, are used subject to appropriate data protection and security safeguards.

9. Customer responsibilities

Customers are responsible for ensuring that submitted datasets comply with applicable data protection regulations.

10. Contact and privacy requests

For any questions regarding data protection, privacy, or processing activities, customers may contact the publisher directly.

Requests related to data access, correction, or deletion will be handled in accordance with applicable regulations and contractual terms.