Data retention policy
We retain personal information only for as long as necessary for our stated purposes, after which it is deleted or anonymized unless required for compliance or legal purposes.
Data archiving and removal policy
Tuist will remove Customer Data upon contract termination. Customer may request either (a) return of all Customer Personal Data followed by deletion, or (b) complete deletion with certification. For switching requests, a 2-month notice period applies, followed by a 30-day transitional period for data migration and a 30-day retrieval period. Full erasure of all exportable data occurs after the retrieval period expires. Exportable data categories include: user/account data (profiles, authentication, permissions, API keys) and project data (configurations, cache binaries, runs). Data may be retained beyond termination only where required by applicable law. Requests should be submitted via contact@tuist.dev with explicit scope and responsible contact person specified
Data storage policy
Customer Data is stored securely for the duration of the service agreement. All data is protected using industry-standard technical and organizational security measures, including encryption and access controls. Data transfers outside the EEA are governed by Standard Contractual Clauses to ensure GDPR compliance. Sub-processors may be used for data processing, with Customer notification of any changes. Customer Data categories stored include: user/account data (profiles, authentication details, permissions, API keys, third-party integration configurations) and project data (configurations, feature artifacts, cache binaries). Access to Customer Data is restricted to authorized personnel on a need-to-know basis for service delivery purposes only.
App/service has sub-processors
yes
Guidelines for sub-processors
App/service uses large language models (LLM)
no