BoreholeIQ Privacy Policy

Version: 1.0.0 Effective Date: June 16, 2026 Last Updated: June 16, 2026 Operator: Joticle, Inc., a Delaware corporation ("Joticle," "we," "us," "our") Service: BoreholeIQ, operated at boreholeiq.com (the "Service")

1. Introduction

This Privacy Policy explains how Joticle, Inc., through its BoreholeIQ service, collects, uses, discloses, and protects information in connection with the Service. BoreholeIQ is a field-to-report platform for geotechnical and environmental consulting firms. The Service is intended for business use by professional firms and their personnel; it is not directed to consumers or to children.

By accessing or using the Service, you agree to this Privacy Policy. If you do not agree, do not use the Service.

2. Who This Policy Covers

• Customer firms and their users — the geotechnical and environmental firms that subscribe to BoreholeIQ, and the individual users (engineers, technicians, administrators) who access it.
• Website visitors — anyone who visits boreholeiq.com.

This policy does not govern data that our customer firms collect from their own clients outside the Service. Where a customer firm enters project data into BoreholeIQ, that firm is the controller of that data and BoreholeIQ processes it on the firm's behalf.

3. Information We Collect

3.1 Information you provide

• Account and firm information — name, business email, firm name, job title, and credentials used to create and manage an account.
• Billing information — processed through our payment processor, Stripe. We do not store full payment card numbers on our systems; Stripe handles card data. We retain billing records such as subscription status, invoices, and transaction history.
• Project and technical data — the geotechnical and environmental data you enter or upload, including boring logs, soil classifications, sample records, chain-of-custody records, lab results, project and client identifiers, and report content.
• Support communications — information you provide when you contact us for support.

3.2 Information collected automatically

• Server and log data — IP address, browser type, device and operating system information, access timestamps, and pages or features accessed, collected through standard server logs for security, diagnostics, and service operation.
• Cookies and similar technologies — see Section 7.

3.3 AI-assisted features

Certain BoreholeIQ features use artificial intelligence to assist with soil classification and report-narrative generation. These features operate using generic, non-identifying prompts; they do not transmit your stored project data, boring-log records, or client identifiers to the AI provider. Where AI processing occurs, it is handled by Azure OpenAI (Microsoft) to generate the requested output.

4. How We Use Information

We use information to:

• Provide, operate, and maintain the Service;
• Authenticate users and secure accounts;
• Process subscriptions and billing;
• Generate the reports, logs, and AI-assisted outputs you request;
• Provide customer support;
• Monitor, diagnose, and improve the Service's performance and security;
• Communicate with you about your account, service changes, and support;
• Comply with legal obligations and enforce our terms.

We do not sell your personal information.

We send only transactional and account-related email (for example, account notices, billing receipts, service changes, and support replies), delivered via Resend. We do not currently send marketing or promotional email.

5. How We Share Information

We share information only as described here.

5.1 Service providers (sub-processors)

We use the following third-party providers to operate the Service. Each processes data only as needed to provide its function:

5.2 Legal and protective disclosures

We may disclose information if required by law, subpoena, or legal process, or where we believe disclosure is necessary to protect our rights, the safety of users, or the integrity of the Service.

5.3 Business transfers

If a BoreholeIQ holding or its assets are acquired, transferred, or sold, information may be transferred as part of that transaction, subject to this Privacy Policy or a successor policy with equivalent protections.

6. Data Retention

We retain information for as long as your account is active and as needed to provide the Service. After account termination, we retain data as required to comply with legal, tax, and audit obligations, and to maintain the integrity of records (including the immutable, tamper-evident boring-log and chain-of-custody records the Service is designed to preserve). We delete or de-identify data when it is no longer needed for these purposes.

Because the Service is designed to preserve certain records (such as chain-of-custody and finalized boring-log records) in an immutable, tamper-evident form, those records may be retained beyond account termination where their integrity or a legal obligation requires it.

7. Cookies and Similar Technologies

We use cookies and similar technologies that are strictly necessary to operate the Service — to authenticate users, maintain sessions, and preserve security.

We do not currently use third-party analytics, advertising, or marketing cookies.

Most browsers let you control cookies through their settings. Disabling strictly necessary cookies may prevent the Service from functioning.

8. Data Security

We use technical and organizational measures to protect information, including encryption of secrets via Azure Key Vault, access controls, and tamper-evident audit trails for chain-of-custody records. No system is perfectly secure, and we cannot guarantee absolute security. You are responsible for safeguarding your account credentials.

9. Your Rights and Choices

Depending on your jurisdiction, you may have rights to access, correct, delete, or port your personal information, or to object to or restrict certain processing.

9.1 California residents (CCPA/CPRA)

We do not sell or share personal information as those terms are defined under California law.

9.2 Exercising your rights

To exercise any right, contact us at info@joticle.com. We will respond as required by applicable law. We may need to verify your identity before acting on a request.

10. International Users

The Service is operated from the United States and intended for U.S.-based firms.

If you access the Service from outside the United States, you consent to processing in the United States.

11. Children's Privacy

The Service is not directed to individuals under 18, and we do not knowingly collect their personal information.

12. Changes to This Policy

We may update this Privacy Policy. Material changes will be reflected by an updated version number and Effective Date, and where appropriate we will notify account holders. Your continued use of the Service after an update constitutes acceptance.

13. Contact

Joticle, Inc. Email: info@joticle.com

14. Governing Law

This Privacy Policy is governed by the laws of the State of Delaware, without regard to conflict-of-laws principles.