Total Water Design Suite Privacy Policy

Version 1.0

Total Water Design LLC, a Michigan limited liability company ("Company," "we," "us"), operates the Total Water Design Suite ("Suite"). This Policy explains how we handle personal information when you visit the Suite, create an account, use an app, contact us, or buy access. The User Agreement and, where applicable, the Data Processing Addendum ("DPA") also apply. Mandatory privacy rights are unaffected by the Agreement's Michigan governing-law terms.

Our privacy contact is admin@totalrodesign.com. Legal notices may be sent to Total Water Design LLC, Attn: Jerry Ross, 3901 Florman, Waterford, Michigan 48329, USA.

1. Our role and the information we collect

We are generally the controller of account, security, billing-status, support, and Suite usage information. When a business customer submits personal information in files or project inputs for the Suite to process on its behalf, the customer is generally the controller and we act as its processor under the DPA. The customer's own privacy notice and instructions govern its collection of that information. If you seek rights concerning information your organization uploaded, contact that organization as well as us.

We collect these categories as relevant to your use:

Licensed reference material is used internally by the Suite.

2. Why we use information and our legal bases

We use account, content, and operational information to provide the Suite, authenticate users, perform calculations and AI-assisted features, deliver Outputs, provide support, administer trials and purchases, and send service notices. Where the EU or UK GDPR applies to information we control, the main basis is performance of a contract or steps requested before a contract. We also process information to meet legal obligations, including tax, accounting, fraud prevention, and valid legal process.

We use security and limited Usage Data to detect abuse, protect accounts, diagnose defects, measure performance and capacity, and improve the Suite. Where applicable, we rely on our legitimate interests in providing a safe, reliable engineering service and improving it, after considering the effect on individuals. Agreement Sections 7.7–7.11 describe the Company's contractual data-use rights and limits. They do not remove a person's mandatory privacy rights.

The Agreement permits analysis of User Content, Outputs, and Usage Data for Suite improvement, including developing, testing, training, evaluating, and validating Suite models. We do not sell User Content or personal information. We do not disclose identifiable User Content or Outputs to other customers, except as the Agreement permits for service providers, law, enforcement, or succession. We do not use personal information in User Content to train a model that can reproduce that information. Where customer content contains personal information that we process as a processor, we use it for improvement only after it is de-identified so that it can no longer reasonably identify a person, or as the DPA otherwise permits. Current aggregate telemetry exports for analysis or training omit direct identifiers, free text, customer files, project text, calculation contents, and Outputs; they suppress groups with fewer than five distinct accounts. We may use genuinely de-identified data and resulting insights after an account ends.

Right to object. If we rely on legitimate interests for processing your personal information, including improvement or de-identified model-training preparation, you may object by emailing admin@totalrodesign.com. Tell us the account email and processing at issue. We will assess and honor a valid objection under applicable law, including Article 21 of the EU or UK GDPR. We may continue processing only where the law permits, such as compelling grounds or legal claims; necessary service, security, and accounting processing may have a separate legal basis. A statutory objection does not require a separate Company-signed exception under Agreement Section 7.11.

We do not make a decision that has legal or similarly significant effects on you solely through automated processing as part of the Suite's account administration. Engineering Outputs require your independent professional review under the Agreement.

3. Sharing and service providers

We share information only as needed to operate the Suite, fulfill the Agreement, comply with law, respond to valid requests, protect rights and safety, or complete a corporate transaction subject to appropriate safeguards. Our principal providers are:

Staff and contractors who need access for support, security, and improvement are bound by confidentiality duties. We may disclose information to regulators, courts, law enforcement, rights holders, or a successor where the Agreement and law permit. We do not publish customer uploads through public share links.

4. Retention

We retain personal information only for the purposes above, considering the account relationship, legal and accounting duties, security, disputes, preservation holds, and the time needed to investigate incidents. For eligible closed Total RO Design accounts, account access ends immediately and the current retention process schedules in-scope project content for purge 30 days after closure, unless a legal hold or other documented block applies. Other app content must have a reviewed deletion process before that app is released. You should export anything needed and keep original files and Outputs outside the Suite. Protected backups expire under their operational rotation and may not be immediately editable.

Acceptance records, certificates, and related legal evidence are retained for at least ten years after account closure. Billing, tax, security, and dispute records are kept for the periods required by applicable law or reasonably needed for claims. When information is no longer needed, we delete or de-identify it, subject to preservation duties.

5. International transfers

The Suite is operated from the United States. Information from other countries may be accessed or processed in the United States and in countries where the providers listed above operate. For restricted transfers from the EU or UK, we use an adequacy decision or appropriate safeguards, such as the European Commission's Standard Contractual Clauses and, for UK transfers, the UK International Data Transfer Addendum, where required. The DPA describes transfers of customer-controlled personal information. You may request information about applicable safeguards at admin@totalrodesign.com. No contractual choice of Michigan law removes mandatory transfer protections.

6. Your choices and rights

You may review and update account information in the Suite or request help at admin@totalrodesign.com. We may verify your identity before acting. Rights vary by location and can be limited by law, the rights of others, and legal preservation duties:

- EU and UK: access, correction, erasure, restriction, portability where applicable, objection to legitimate-interest processing, and withdrawal of consent where processing actually relies on consent. You may complain to your local data-protection authority.

- Canada, including Québec: access and correction, information about our handling of personal information, and complaints under applicable federal or provincial law. Québec residents may also request cessation of dissemination, de-indexing, or portability where the law provides those rights, and may complain to the Commission d'accès à l'information.

- Chile: access, rectification, cancellation or deletion, and opposition under applicable Chilean law, with additional rights as Law No. 21.719 enters into force. You may complain to the competent Chilean authority where available.

- Australia: access, correction, and a privacy complaint to us, followed by a complaint to the Office of the Australian Information Commissioner where applicable.

- United States: access, correction, deletion, and opt-out rights where a state privacy law applies. We do not sell personal information or use it for targeted advertising. You may appeal a denied request where applicable law provides an appeal.

If we act as a processor for your organization's data, we will refer a request to that organization or assist it under the DPA. Send requests or objections to admin@totalrodesign.com. We will respond within the time required by applicable law.

7. Cookies and security

The Suite uses necessary first-party session and optional remember-me cookies to keep you signed in and protect account access. Browser settings can limit cookies, but disabling necessary cookies may prevent sign-in. We do not use the Suite's account data for targeted advertising. We use administrative, technical, and physical safeguards, including encrypted connections, MFA, access controls, encrypted storage volumes, and upload screening. No system is completely secure; report suspected account compromise to admin@totalrodesign.com.

8. Children, changes, and contact

The Suite is for adults aged 18 or older acting in a professional capacity. We do not knowingly offer accounts to children. If you believe a child provided information, contact us so we can investigate and delete it where appropriate.

We may update this Policy. We will post a new version and date, and provide additional notice when required by law or the User Agreement. Material changes to the Agreement follow its notice and re-acceptance process. Contact admin@totalrodesign.com or write to Total Water Design LLC, Attn: Jerry Ross, 3901 Florman, Waterford, Michigan 48329, USA.