Privacy Policy.
Last updated: October 12, 2026
This Privacy Policy explains how Dviz Technologies Inc. ("Dviz", "we", "us" or "our") handles personal data in connection with our website at dviz.tech, our products Sorgi (cloud.sorgi.app) and SorgiQ (qa.sorgi.app), and our AI professional services. It replaces the separate privacy notices previously published on dviz.tech and sorgi.app.
Dviz acts in two different roles depending on why personal data is processed. Section 2 sets out our role, purpose and legal basis for each category of processing. Please read it first.
1. Who we are and what this policy covers
Dviz Technologies Inc. is a Delaware corporation (Delaware, file number 6433509) with its registered address at 16192 Coastal Highway, Lewes, Delaware, USA. You can contact us about privacy at info@dviz.tech using the subject line "Privacy Request".
"Personal data" means any information relating to an identified or identifiable individual, and includes "personal information" and "personally identifiable information" as defined in applicable data protection laws. "Customer" means a business or organization that has an agreement with Dviz for the Services. "Customer Data" means the data, content and materials that a Customer, or someone acting on its behalf, submits to, connects to or generates in the Services or makes available to Dviz during a professional services engagement.
This policy does not apply to the practices of third parties we do not own or control, including the third-party tools a Customer chooses to connect to Sorgi or SorgiQ.
2. Our role for each category of processing
Under the EU and UK General Data Protection Regulation (GDPR) and similar laws, a controller decides why and how personal data is processed, and a processor processes personal data on a controller's behalf and on its documented instructions. U.S. state privacy laws use similar concepts (a business or controller, and a service provider, contractor or processor).
2.1 Where Dviz is a processor (Customer Data)
When we process Customer Data to provide Sorgi, SorgiQ or our professional services, we do so on the Customer's documented instructions, as its processor (or, under U.S. state laws, as its service provider or contractor). The Customer is the controller and decides what data enters the Services and why. This includes:
- content from tools and systems the Customer connects to Sorgi, such as documents, emails, messages, calendar entries, files, records and their metadata;
- prompts, instructions, agent and AI assistant inputs and outputs, workflow and routine configurations, and execution logs that contain Customer Data;
- test data, test results, application responses and reports processed in SorgiQ;
- data we access or handle during an engagement (for example Stage 1 to Stage 4 delivery or Operations) to build, test, run or support agents and workflows for the Customer.
This processing is governed by our Data Processing Agreement (DPA) with the Customer, not by Sections 3 to 5 of this policy. We do not use Customer Data for our own purposes, and we do not use it to train or fine-tune AI models. If your personal data is contained in Customer Data (for example because you are an employee or customer of one of our Customers), please contact that Customer to exercise your rights. If you contact us, we will forward your request to the Customer and assist it as set out in the DPA.
2.2 Where Dviz is a controller (our own purposes)
We are the controller for the following processing, which we carry out for our own independent purposes:
| Category of processing | Personal data | Purpose | Legal basis (GDPR) |
|---|---|---|---|
| Website visitors | IP address, device and browser information, pages visited, essential cookies | Operate, secure and maintain the website; prevent abuse | Legitimate interests (Art. 6(1)(f)) in running a secure website |
| Website analytics | Pages visited, referring site, device and browser type, approximate location, and a pseudonymous cookie identifier (Google Analytics) | Understand how the website is used and improve it | Consent (Art. 6(1)(a)), given in our cookie banner. You can withdraw it at any time through "Cookie settings" in the website footer |
| Enquiries and contact form | Name, work email, organization, role, industry, your message | Respond to your enquiry and discuss our services with you | Legitimate interests (Art. 6(1)(f)) in responding to business enquiries; steps prior to a contract at your request (Art. 6(1)(b)) |
| Business marketing | Name, work email, organization, role, interaction history | Send you information about Dviz, our products and events | Legitimate interests (Art. 6(1)(f)) for business contacts; consent (Art. 6(1)(a)) where required by law. You can opt out at any time |
| Job applicants | CV, contact details, employment and education history, interview notes, anything you choose to send | Assess your application and run our hiring process | Steps prior to entering into a contract (Art. 6(1)(b)); legitimate interests (Art. 6(1)(f)) in recruiting; consent (Art. 6(1)(a)) if we keep your details for future roles |
| Customer accounts, contracts and billing | Names and contact details of account administrators, users and business contacts; login credentials; plan, invoices and payment records | Create and manage accounts, authenticate users, deliver and support the Services, invoice and collect fees | Performance of a contract (Art. 6(1)(b)); legal obligation (Art. 6(1)(c)) for tax and accounting records; legitimate interests (Art. 6(1)(f)) for contacts at Customer organizations |
| Service usage and security data | Account and device identifiers, IP address, log-in events, feature usage, performance and error metrics (not the content of Customer Data) | Secure the Services, detect and prevent fraud and abuse, debug, measure capacity and plan the product | Legitimate interests (Art. 6(1)(f)) in keeping the Services secure, reliable and working as intended |
| Product and AI improvement | Service usage data, aggregated or de-identified so that it no longer identifies any individual or Customer | Improve the Services, including the models and algorithms that power them | Legitimate interests (Art. 6(1)(f)) in improving our products. Customer Data content is never used for this purpose unless the Customer agrees in writing |
| Support and correspondence | Name, contact details, ticket contents, call or meeting notes | Answer questions and resolve support requests | Performance of a contract (Art. 6(1)(b)); legitimate interests (Art. 6(1)(f)) |
| Legal and compliance | Any of the above, as necessary | Comply with law, respond to lawful requests, enforce our agreements, establish or defend legal claims | Legal obligation (Art. 6(1)(c)); legitimate interests (Art. 6(1)(f)) in protecting our rights |
Where we rely on legitimate interests, we have balanced our interests against your rights and freedoms. You can ask us for more information about this balancing, and you can object at any time (see Section 9). Where we rely on consent, you can withdraw it at any time without affecting the lawfulness of processing before withdrawal.
3. Where we get personal data from
- From you, when you fill in our contact form, email us, apply for a job, create an account, use the Services or speak with us.
- Automatically, when you visit our website or use the Services (for example log data and essential cookies).
- From your organization, when it creates an account for you, invites you to the Services or names you as a contact.
- From service providers that help us run our business, such as hosting, email and analytics providers, acting on our behalf.
Customer Data reaches us from our Customers and from the tools they choose to connect. As explained in Section 2.1, we process it only as a processor.
5. AI services and your data
- We do not use Customer Data, including prompts, connected content and agent or AI assistant inputs and outputs, to train or fine-tune AI models, unless the Customer agrees in writing.
- When you use AI assistants, agents or workflows, Customer Data is processed to generate responses and carry out tasks, on the Customer's instructions. This may involve temporary caching to provide performance and accuracy.
- Agents and assistants may use context from within the Customer's own workspace to give better answers. This context is not shared with other Customers.
- We may use aggregated or de-identified service usage data, which does not identify any individual or Customer, to improve our products, including our models and algorithms, as described in Section 2.2.
6. International transfers
Dviz is based in the United States, and we and our service providers may process personal data in the United States and other countries. Where Sorgi is deployed in a Customer's own cloud environment, Customer Data stays in the region the Customer selects.
When personal data subject to the GDPR, the UK GDPR or the Swiss Federal Act on Data Protection is transferred to a country that has not been recognized as providing an adequate level of protection, we rely on the following transfer mechanisms. We do not rely on your consent as the basis for these transfers.
- Adequacy decisions, where the receiving country (or, for the United States, a recipient certified under the EU-U.S. Data Privacy Framework and its UK and Swiss extensions) has been recognized as adequate.
- The Standard Contractual Clauses approved by the European Commission in Implementing Decision (EU) 2021/914 (the EU SCCs), including, for Customer Data, Module Two (controller to processor) or Module Three (processor to processor) as incorporated in our DPA.
- For transfers from the United Kingdom, the International Data Transfer Addendum to the EU SCCs issued by the UK Information Commissioner.
- For transfers from Switzerland, the EU SCCs with the amendments required by the Swiss Federal Data Protection and Information Commissioner.
We apply the same mechanisms when we transfer personal data onward to our sub-processors, and we use supplementary measures such as encryption in transit and at rest and strict access controls. You can request a copy of the relevant safeguards by contacting us (commercial terms may be redacted).
7. How long we keep personal data
We keep personal data for which we are controller only for as long as necessary for the purpose we collected it for, and then delete or anonymize it:
- Enquiries: for as long as needed to respond and follow up on the conversation, and then for a limited period in case you contact us again.
- Job applications: for the duration of the hiring process, and afterwards only as long as needed to handle any questions or claims, or for longer if you consent to us keeping your details for future roles.
- Account, contract and billing records: for the life of the account, and afterwards as required by tax, accounting and other legal obligations.
- Usage and security logs: for the period needed for security, troubleshooting and analysis, after which they are deleted or aggregated.
Customer Data is kept and deleted in line with the Customer's instructions and our DPA.
8. Security
We protect personal data with technical and organizational measures appropriate to the risk, including:
- encryption of data in transit and at rest;
- secret management that keeps credentials out of plaintext, and token-based (OAuth) access to connected systems;
- access controls that limit access to personal data to people who need it;
- guardrails that can block restricted data from being sent to AI models;
- logging and audit trails of actions taken in the Services;
- regular security reviews and vulnerability assessments, and security training for our team.
More detail on our security program and policies is available in our Trust Center. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.
9. Your rights (EU, UK and Switzerland)
If the GDPR, the UK GDPR or the Swiss Federal Act on Data Protection applies to our processing of your personal data as a controller, you have the right to:
- access your personal data and receive a copy of it;
- have inaccurate or incomplete personal data corrected;
- have your personal data erased in certain circumstances;
- restrict our processing in certain circumstances;
- receive personal data you provided to us in a structured, machine-readable format and have it transmitted to another controller (portability);
- object at any time to processing based on our legitimate interests, and to direct marketing, including any profiling for direct marketing;
- withdraw consent at any time, where we rely on consent;
- lodge a complaint with a supervisory authority, in particular in the country where you live or work or where the alleged infringement took place.
These rights apply to processing for which Dviz is the controller (Section 2.2). For Customer Data, where Dviz is a processor, please contact the relevant Customer. We will support the Customer in responding, as required by our DPA.
10. Your rights (United States)
Depending on where you live, including California, Virginia, Colorado, Connecticut and other states with comparable laws, you may have the right to:
- know what personal data we have collected about you, the categories of sources, our purposes, and the categories of third parties we disclose it to, and receive a copy of the specific pieces of personal data;
- delete personal data we have collected from you, subject to legal exceptions;
- correct inaccurate personal data;
- opt out of the sale or sharing of personal data, targeted advertising and certain profiling. We do not sell or share personal data and do not engage in targeted advertising or such profiling;
- limit the use of sensitive personal information. We use sensitive personal information only to provide the Services and for other purposes permitted by law;
- appeal our decision on your request, where your state law provides this right.
We will not discriminate against you for exercising these rights. You may use an authorized agent, and we may ask the agent for proof of authorization and ask you to verify your identity. California residents may also ask about disclosures to third parties for their direct marketing purposes; we do not make such disclosures. Where we process your personal data as a service provider or processor for a Customer, please contact that Customer first.
11. How to exercise your rights
Email info@dviz.tech with the subject line "Privacy Request", or contact us through the support channel in Sorgi or SorgiQ. Please tell us which right you want to exercise and give us enough information to verify your identity and understand your request. We will respond within the time required by applicable law, normally within one month (GDPR) or 45 days (U.S. state laws), which may be extended where the law allows.
13. Children
Our website and Services are intended for businesses and are not directed at children. We do not knowingly collect personal data from children under 16. If you believe a child has provided us with personal data, please contact us at info@dviz.tech and we will delete it.
14. Changes to this policy
We may update this policy from time to time. We will post the updated version on this page with a new "Last updated" date and, where changes are material, we will notify Customers and account holders by email or through the Services before the changes take effect.
15. Contact us
Dviz Technologies Inc., 16192 Coastal Highway, Lewes, Delaware, USA. Email: info@dviz.tech (subject line "Privacy Request"). Applicants can also reach us at hiring@dviz.tech.
Related documents