Customer content and AI-assisted work.
Effective date 2026-10-16
Choose what you send
Do not place credentials, private keys, customer data, third-party confidential material, export-controlled material, or other restricted content into a feature unless you are authorized to do so and the feature is an approved channel for that content.
Content covered by this notice
Customer Content includes source and RTL files, architecture descriptions, project settings, prompts, attachments, logs, feedback, and outputs that you choose to provide to or create with an Altifigence product or service. Public emails and forms remain subject to the public submission terms.
Your content and the service permission
As between you and Altifigence, you retain your rights in Customer Content. You permit Altifigence to host, process, transmit, reproduce, and display that content only as reasonably needed to provide, secure, support, and maintain the feature you choose, comply with your instructions and applicable law, and enforce the applicable order and service terms.
Local and connected feature boundary
Downloading and installing the application does not by itself submit your design files to an AI provider. Local work, Cloud synchronization, remote compute and AI requests are separate actions. When you send an AI request, the conversation and project context selected or reviewed in that workflow may be transmitted; when you submit a Cloud job, its required inputs, results and operational records are processed remotely.
AI-assisted features
AI requests follow their connection path. Requests over a customer API-key connection or a local external-tool connection go to the provider and model selected in the product; company-provided AI requests go to the provider selected for each task, as described below. The three paths differ in billing and data handling. Cloudflare may transport API requests; Cloudflare or Google Cloud compute is not itself a claim that Altifigence hosts the selected language model.
This public notice does not grant Altifigence or a service provider a general right to use Customer Content to train a general-purpose model. Any training, provider reuse, or separate product-improvement use must have a separately disclosed basis or written agreement. Feature-specific and provider-specific terms control where they apply.
Company-provided AI
Company-provided AI is planned for Digital Design Studio web and desktop under the notice that is published and takes effect at October 16, 2026 at 10:00 KST. When it opens, it is for adults who meet the consent requirements. It is not open at launch to Korean residents aged 14–18; the minors’ conditions below apply only after it is separately opened for them. Company keys call Anthropic’s Claude API or the OpenAI API through Cloudflare; failover may send the same request to both. In the app it appears only as Agent, and its responses are marked as AI-generated without naming the provider or model; the models Agent uses are listed in the Agent models section below. The notice’s effective time alone does not activate app features or operational settings.
Before any transfer, review recipient-specific data, countries, timing, method, purposes, retention and refusal/withdrawal effects and provide separate consent. Request withdrawal, deletion or restriction in app settings or at contact@altifigence.com. Refusal/withdrawal restricts company AI; that choice alone does not restrict your account, local work or separate BYOK. Age/security restrictions are separate. The detailed notice covers later transfers after withdrawal, previously transferred data and retention: company-provided AI section of the Privacy Notice.
Prompts, selected materials, approved project-reading tool calls/results and generated responses are transferred and may be resent in later tool steps or failover. Dedicated user fields use hashes instead of original IDs, emails or IPs, but personal data in text can still be sent. HMAC cache identifiers and youth-safeguard status are included; linkable hashes/age information are protected as personal data. The company ledger keeps operational metadata without bodies; provider, guardian and safety-record periods/bases are distinguished in the Privacy Policy. Adult provider signals and legal-request/disclosure audit records follow the adult-signals section below and the privacy policy. On individual accounts (self-service plans such as Free, Plus and Pro), the user’s latest message in a provider-refused conversation and personal data in that message are additionally sent to an OpenAI screening model. This external classification does not apply to business or academic organization accounts or Enterprise contracts. When enabled, applicable saved instructions are included in the answer step; a separately confirmed public query and returned search evidence/citations belong to the isolated search flow described below. Separately, enabled account conversation storage saves new adult conversations for 30 days by default, with 7 days or off selectable and minors defaulting off; its content and deletion rules are in the account-history section.
Company-provided AI uses generative AI. In the apps, each company-AI answer has an “AI · Agent” mark below it. The message box provides a screen-reader notice that you are chatting with AI; provider and model names are not shown. Independently check factual claims and the correctness of designs/code before use, and check third-party/open-source licenses in generated code.
Company AI is subject to the dated Anthropic and OpenAI usage policies. On October 16, 2026, Anthropic’s September 15, 2025 version applies, distinct from the version scheduled for November 12, 2026. The OpenAI link is the version effective October 29, 2025. At launch, adult signals do not trigger automatic action; the owner acting as the privacy contact and staff granted the relevant management permissions personally review and decide warnings, suspensions and releases for very serious violations. These and minors’ answer blocks/manual measures follow the separate rules below. Restrictions on independent security or legal grounds include reasons and an appeal route, subject to urgent safety or legal exceptions. Explanations and review can be requested at contact@altifigence.com. Company accounts/API keys must not be transferred, and unauthorized raw API access must not be resold. Anthropic Usage Policy (effective 2025-09-15) · Anthropic Usage Policy (scheduled for 2026-11-12) · OpenAI Usage Policies (effective 2025-10-29).
Paid sales cover Paddle-supported countries excluding sanctioned countries/regions and countries unsupported for company AI. Company AI requires support by both providers and their applicable entity-location, ownership/control and other eligibility rules. These limits also apply to failover and OpenAI minors’ checks and must not be bypassed with a VPN or similar means. Minors must reside in Korea and meet age/guardian requirements; a Korean IP alone does not verify residence. Request correction of residence/access errors at contact@altifigence.com. Anthropic supported countries and regions · OpenAI supported countries and territories · Paddle-supported sales countries and territories.
Company AI supports work across the semiconductor lifecycle, including simulation, CAD, foundry simulation, physical and factory simulation, and semiconductor fabrication tasks. Available functions depend on the app/version. Generated results are assistance; design, safety and manufacturing suitability require independent verification. Provider usage policies apply, and Korean transfer consent alone does not satisfy all overseas privacy/reporting duties.
Submit others’ personal data only to the minimum extent supported by the necessary authority and lawful basis. Your consent does not replace another person’s consent or organizational authority. Do not enter sensitive information, identity-document numbers, credentials, export-controlled material, third-party secrets or other restricted content. Company AI is not an approved export-controlled transfer channel; this input guidance does not shift the company’s privacy duties to users.
Customer API-key connections (BYOK) remain separate from company-provided AI. Consent to company-provided AI does not authorize charges or data transfers through a BYOK connection, and using a BYOK connection is not consent to company-provided AI.
Minors
At launch, company AI is not open to Korean residents aged 14–18, and legal representatives cannot yet grant company-AI approval. This section describes the conditions that apply once it is separately opened.
Company AI for ages 14–18 is not open at launch. The following conditions apply only once it is separately opened. Adults must be at least 19 and legally adult at residence. Korean residents aged 14–18 must separately give necessary personal-data/transfer consent and obtain a legal representative’s company-AI approval. Use approval is not payment approval: purchases and paid trial conversions need separate representative consent specifying the product, total price, cycle and renewals. A minor or representative may cancel a contract lacking required consent. Minors elsewhere are unsupported until availability is expanded; under-14 users cannot register or use the service.
Company AI for ages 14–18 is not open at launch. The following conditions apply only once it is separately opened. Once opened, minor accounts receive routine input/output safety checks with OpenAI omni-moderation-latest, including Anthropic responses. Blocking covers sexual content involving children and self-harm instructions/intent; general self-harm references receive 109 guidance without blocking. Outages are retried once, then only that answer is withheld; unchecked answers are not displayed and outages are neither violations nor charged. There is no automatic suspension. Company databases/Worker logs do not store detailed categories, scores or checked text; only violation counts/dates for child-sexual-content input and separate help-guidance counts/dates are recorded. AI output blocks are not user violations. The owner acting as the privacy contact and staff granted the relevant management permissions handle manual warnings/suspensions and appeals. Warnings, suspensions and releases require management-write and administrator-management permissions. Only people on the allowlist may perform these operations. Warnings go to the app and user’s own email. Provider refusals on minor accounts are also counted separately from these check records and adult signals, without storing detailed categories, scores or text. Lawful bases for checks/records, human review, guardian information, payments, retention follow this policy: guardian information section of the Privacy Notice.
Adult provider signals
At launch, provider refusal and policy-violation signals are counted, including refusals later answered by a fallback model and Claude reasoning-extraction attempts. Minors’ provider refusals are also retained for 90 days from occurrence and deleted with that turn’s execution record; counts use the preceding 30-day rolling window, separate from adult records and without detailed categories. Adult general signals are divided into cyber, advanced-AI misuse, reasoning-extraction attempts, general harms, violent wrongdoing and unclassified. Biological (bio) signals are very serious weapons-of-mass-destruction signals, visible from the first occurrence. On individual accounts, including Free, only the user’s latest message in a provider-refused conversation is sent to an OpenAI screening model; child sexual content is counted as very serious child sexual exploitation, while violent wrongdoing (illicit/violent) is a general signal. Terrorism is not separately measured. Business and academic organization accounts and Enterprise contracts do not receive this external classification and require separate contractual arrangements. Other adult conversations receive no additional company screening. Adult records contain only an account-linked identifier, counts, dates and categories; each signal is deleted 90 days after occurrence with that turn’s execution record, and text, raw refusals and scores are not stored. Only accounts with at least one very serious or five general signals in total within the last 30 days are visible to the owner acting as the privacy contact and staff granted the relevant management permissions. The owner and these authorized staff personally review warnings, suspensions and releases for very serious adult violations; there is no automatic action. Signals/classifications do not establish unlawful conduct. Explanations, corrections and review can be requested at contact@altifigence.com. Company AI is closed to minors at launch; the minors’ processing and records above apply only after it is separately opened.
Adult safety signals and minors’ provider refusals are retained for 90 days from each occurrence and deleted with that turn’s execution record. Counts and account-level access thresholds use the preceding 30-day rolling window; older retained signals do not preserve a threshold. The privacy policy governs records, purposes, retention and access. The owner acting as the privacy contact reviews and approves the basis, authority and scope of outside authorities’ requests; only lawfully necessary minimum records held may be disclosed. This is separate from adult access thresholds, and owner approval alone is not a legal basis. Minimum request-case records are retained for three years after handling ends, without conversation text or full disclosed materials. Transparency totals that cannot identify individuals are retained permanently. Quarterly reports at altifigence.com/transparency cover minors’ checks/evaluations/provider refusals, adult signals and individual-account refusal classification, legal requests, policies and methods. Counts of 1–4 and related totals that allow differencing are suppressed; terrorism is marked “not measured separately” and external classification for business or academic organization accounts and Enterprise contracts is marked “not measured.” Account-level records and conversations are not published, and only reviewed quarters are posted. Company AI is closed to minors at launch; the minors’ processing and records above apply only after it is separately opened. Detailed rules: Privacy rules for adult signals, legal requests and transparency reports.
AI models used by Agent
In Digital Design Studio, company-provided AI appears only as Agent, without a model name. Each Agent request is sent to one of the following models, depending on the type of request and the effort you select (auto, low, medium, high, xhigh or max). When you turn on web search, its separate search step uses Claude Sonnet 5.5 (Anthropic) or GPT-6.1 Sol (OpenAI). Model names follow each provider’s official documentation.
Anthropic: Claude Opus 5.5, Claude Sonnet 5.5
OpenAI: GPT-6 Astra, GPT-6.1 Sol
During a provider outage, a request may be switched to a model of the same tier from the other company, but only before an answer has been produced. In that case, both companies may receive the same request. If a Claude model declines a request under Anthropic’s safety classifiers, Anthropic may answer the same request with another Claude model it designates for that case, which can be an earlier or less capable model, and later requests in that conversation may go directly to that model; this fallback stays within Anthropic. The safety-check and classification models described in the company-provided AI section do not write answers. With a customer API-key connection (BYOK), the provider and model you select process the request directly. See Your own AI connections.
The models used by Agent may change. Altifigence will update this section when they do. For personal information handled by AI providers, see the Privacy Notice.
AI settings, web search and account conversation storage
The following settings apply to company AI and customer API-key connections (BYOK) when these features open in Digital Design Studio. A feature that has not opened does not start searches, save new settings or upload conversations. Availability depends on the selected provider, model, host, age, consent and organization policy; an unsupported option is unavailable rather than silently ignored. This notice does not announce that these features are already active.
Web search is off by default on both company AI and BYOK. It is unavailable to minors aged 14–18 and people whose adult status is unconfirmed; an administrator cannot unlock it. Adults must also be adults under the law where they live. Existing eligibility and under-14 restrictions still apply. Supported search settings include domain allow/block lists, a per-user-message search limit and source display. These choices do not guarantee the accuracy or safety of websites.
Search requires a separate choice and consent covering the selected billing path, providers and search notice. Company-AI consent, an organization administrator’s permission or connecting your own API key does not turn search on. Refusing or withdrawing search consent stops new searches and search continuations while leaving eligible AI use without search available. It cannot recall data already sent. The search notice version is ai-web-search-20261012; a changed company-AI notice requires renewed company-AI consent, separately from search.
Before a search, review and confirm the public query separately. Altifigence sends that query through Cloudflare to the selected AI provider’s search service. Its search-only step receives the confirmed public query and fixed search instructions, without project text, earlier conversation or your saved instructions. The provider can form search terms from that query and retrieve public pages; we cannot inspect every provider-generated term in advance. Search terms, results and source URLs may contain personal data. Do not include private, confidential or export-controlled material in the public query. Search does not send a location setting. The answer step receives permitted context and search evidence without a web-search tool; turning search on is not permission to publish private context.
Organization administrators can restrict supported models, search, context, instruction transmission and spending, and shorten or disable account conversation retention; they cannot force retention on or override your off choice. Administration does not grant access to your personal instruction text. User and project settings cannot loosen age, consent, organization or provider restrictions. A saved tool-approval preference is not permission for arbitrary execution or external transmission: only the separately authorized scope and duration apply. Instructions and search results cannot override these limits.
Once account conversation storage opens, new conversations for adults are stored on Altifigence’s servers for 30 days by default, on both company AI and BYOK. You can choose 7 days or turn it off in AI settings. For minors aged 14–18 and people whose age is unconfirmed, the default is off. Organization policy can shorten the period or turn storage off. Existing conversations on a device are not automatically uploaded or deleted. This storage choice is separate from enabling web search.
Turning storage off stops future saves; it does not delete existing account history. Delete existing account records separately in the history controls, or request assistance at contact@altifigence.com. Expired or deleted items become unavailable for account-history access. The implementation target is to remove the active stored body within 24 hours after expiry or deletion; this is not a promise of immediate physical deletion from backups, devices or providers.
The 7/30-day choice applies only to account conversation history. Device records, saved settings/instructions, provider retention, existing 90-day operations/safety records and their 30-day counting windows, legal-request records, transaction evidence and backups retain their separate rules. History deletion and consent withdrawal do not erase every one of those records or recall previously transferred data. OpenAI response-storage settings and the company’s Gateway logging/cache controls are not switched on by account-history storage.
When web search is available and you enable it, company AI includes search-tool charges and token use in both the search and answer steps in shared weekly QUOTA, at the applicable AI serving-cost multiplier in the payment terms. A single message can require several provider requests. You can set a weekly Agent cap. Organization owners’ and admins’ caps apply to each member’s own use, with the lower of the personal and organization caps applying. The cap can restrict the existing allowance within the same 7-day window but does not add allowance; changing a plan or cap does not restart that window. BYOK search and both steps are charged under your provider contract and do not deduct company QUOTA. Exhaustion does not authorize an automatic purchase, purchased-Credit spend or switch to another billing path.
A BYOK daily cap estimates only the provider cost of requests you send through DDS in this organization, across all connections, resetting at 00:00 UTC. Organization BYOK caps also apply to each member’s own use, with the lower of the personal and organization caps applying. It is not a billing cap on the whole provider account and does not include requests outside DDS or guarantee the provider’s final invoice, discounts or exchange rate. Missing price/usage information can pause further requests when a cap is set. Source citations are provided for verification, not as an accuracy guarantee or a license to reuse third-party content; external sites have their own terms and privacy practices.
Settings, search-transfer and account-history details in the Privacy Policy.
Your own AI connections
Where available, API-key connections support OpenAI, Anthropic, xAI and Z.ai. An API key entered in the product connection settings is sent to the Altifigence Account service, stored encrypted and used by the server to authenticate the selected provider request. This is not a promise that BYOK data stays on your device. Removing the connection stops future use of that saved key; it does not revoke the key at the provider or erase records already held there.
Your provider charges for a customer API-key connection are governed by your contract with that provider. A separately connected local tool, such as Codex, follows its own account, subscription, permissions and data controls. A consumer chat subscription does not automatically include API credits. Selecting one connection does not authorize charges or data transfers through another connection.
Public policies checked October 11, 2026: Anthropic generally excludes commercial API content from training and describes normal deletion within 30 days, at least 30 days for some models, up to 2 years for violating inputs/outputs and 7 years for safety classifications, with legal exceptions. OpenAI API training requires opted-in sharing; Responses has normal 30-day abuse monitoring with exceptions, while Moderations lists no abuse-monitoring or state retention. Content also sent for generation follows generation rules. The Privacy Notice gives the contracts, settings and retention terms behind this summary and the dates they were checked. Storage-off differs from ZDR; BYOK follows the customer’s account, contract and settings. OpenAI API data controls · Anthropic API data retention · Anthropic organization data retention policy.
Review AI and engineering output
Outputs may be inaccurate, incomplete, insecure, non-unique, or unsuitable for a particular toolchain or device. Review source changes, licenses, synthesis and simulation results, timing, safety, security, and compliance evidence before relying on or deploying an output.
Your responsibilities
You are responsible for having the rights, permissions, and lawful basis needed to provide Customer Content and for configuring access to your account, organization, repositories, projects, and connected providers.
Do not use Altifigence output to misrepresent authorship or verification, bypass a license or access control, infringe rights, create malware, attack a system, or make a safety-critical or regulated decision without qualified human review and the validation required for that use.
Retention, export, and deletion
Canceling renewal, exhausting usage, deleting a Cloud project, removing an AI connection and deleting an account are different operations. None of these is a promise to erase all provider, transaction, security or backup records immediately. Local files remain under your control. Cloud data is subject to the selected feature’s retention and deletion rules; maintain your own export or backup. For an access or deletion request, contact contact@altifigence.com. See the Privacy Notice.
Support and public submissions
Content sent through ordinary email, a public form, a public issue, or a support route is not automatically accepted as confidential. Arrange a signed agreement and an approved channel before sending content that requires confidential treatment.
Content and AI questions
For a written processing boundary, confidential review route, or rights question, contact legal@altifigence.com.