TLC iQ — Privacy Policy

Controller: The Living Company ("TLC", "we", "us"), 2149 S Jupiter Rd, Garland, TX 75041
Contact: info@livingcompany.com

1. Scope

This Policy explains how TLC handles personal information in the TLC iQ platform and every application under the tlciq.app domain (Panorama, the customer portal, supply, install, and related APIs, reports, and communications — the "Platform"). It applies to TLC employees and contractors, authorized partners, and customers and their representatives who use the Platform.

It does not cover TLC's public websites or its general employment records, which have their own notices.

2. Information we collect

Account and identity

• Name, work email address, employer or organization, role, and the brands and data sources you are authorized to access. Provided by TLC or by you at invitation.
• Authentication data handled by our identity provider (sign-in events, session tokens, device and browser type, IP address). We do not store your password; sign-in may use single sign-on or passwordless methods.

Use of the Platform

• Questions you ask, filters you choose, reports you request, and the answers returned, including the database queries generated to answer them and the data sources used. We keep this record so answers can be audited and reproduced.
• Approvals, publishing actions, and administrative actions (including any "View As" session), with who performed them and when.
• Technical logs: IP address, timestamps, pages and API routes accessed, errors.

Business data that may include personal information

• Contact details of customer, vendor, and stakeholder representatives (name, business email, business phone, role) drawn from TLC's systems of record (CRM, ERP, order and project systems).
• Names of TLC staff associated with projects, orders, shipments, and approvals.

Communications

• If TLC sends you operational email or text messages through the Platform, we record the message type, recipient, delivery status, and whether a link was opened. We do not read your replies except where a reply is routed to a TLC approval or support process.

We do not intentionally collect government identifiers, payment-card numbers, health information, or precise location through the Platform.

3. How we use it

• To operate the Platform: authenticate you, enforce your role and data-access assignments, answer your questions, and deliver reports.
• To keep an audit trail: reproduce and verify answers, investigate incidents, and demonstrate controls.
• To secure the Platform: detect unauthorized access, abuse, or errors.
• To communicate with you about your account, reports, approvals, and alerts.
• To improve the Platform: measure which features are used and which questions the Platform cannot yet answer. We analyze usage in aggregate where practical.
• To meet legal and contractual obligations.

We do not sell personal information and do not use it for advertising.

4. AI processing

Some features use artificial-intelligence models provided by third parties acting as our service providers. When you use them:

• Your question, relevant catalog descriptions, and (for some features) query results are sent to the provider to interpret the question, generate a database query, or draft a response.
• Providers process this data under agreements that prohibit using it to train their models and that limit retention.
• Every AI-assisted answer records which provider and model produced it, so the processing is auditable.

Current AI providers are listed in Section 7.

5. How we share it

We share personal information only with:

• Service providers (subprocessors) that host, secure, or operate parts of the Platform on our behalf, listed in Section 7, bound by contract to use it only for that purpose.
• Within TLC and its affiliates, on a need-to-know basis consistent with your role.
• Customers, where the Platform delivers reports to them and the report includes names or contact details of representatives on their own projects. Customer-facing reports exclude internal TLC pricing, costs, vendor identities, and internal contacts.
• Authorized partners who help TLC operate specific applications, under written confidentiality obligations.
• Legal and safety: when required by law, legal process, or to protect the rights, property, or safety of TLC, its users, or others.
• Corporate transactions: in connection with a merger, acquisition, financing, or sale of assets, subject to confidentiality.

6. Security

• Access is limited by role, organization, and brand at the database level; users see only data they are assigned.
• Data is encrypted in transit and at rest by our hosting providers; databases are backed up with point-in-time recovery.
• Administrative actions and AI-generated queries are logged; queries run read-only under the requesting user's permissions with time and size limits.
• Customer-facing reports are built from a restricted data set and checked automatically for internal fields before release; links expire and can be revoked.
• We review credentials and access paths on a recurring schedule and rotate keys when they are exposed.

No system is perfectly secure. If you believe your account or data has been compromised, contact info@livingcompany.com.

7. Subprocessors

As of the effective date, TLC uses the following categories of providers, all located in the United States unless noted:

We will update this list when providers change.

8. Retention

• Account records: for the life of the account and 12 months after, then deleted or anonymized.
• Audit records (questions, generated queries, answers, approvals, administrative actions): retained for 7 years to support financial and operational auditability, or longer if legally required.
• Technical logs: 90 days unless retained for an investigation.
• Customer-facing reports: the delivered version is retained under the customer agreement; withdrawn reports are moved to a restricted archive and are not redistributed.
• Business data from systems of record: governed by those systems' own retention rules; the Platform's copies are refreshed from them and do not become the system of record.

9. Your choices and rights

• Access and correction: you can ask to see or correct your account information. Business contact details are corrected in the source system (for example, the CRM) and flow through to the Platform.
• Communications: you can opt out of text messages by replying STOP where available. Operational account emails cannot be opted out of while the account is active.
• California residents (CCPA): you may request to know what personal information we collect and how it is used and shared, request deletion subject to exceptions, and you will not be discriminated against for exercising these rights. We do not sell personal information.
• Rights under applicable law: depending on where you live, you may have rights to access, delete, or restrict processing of your personal information, or to object. Requests: info@livingcompany.com or by mail to 2149 S Jupiter Rd, Garland, TX 75041, United States. We will verify your identity and respond within the time the law requires. We do not discriminate against anyone for exercising these rights.
• Employees and contractors: TLC's internal privacy and HR notices also apply to you.

10. International users

The Platform is hosted in the United States. If you access it from elsewhere, your information will be transferred to and processed in the United States.

11. Children

The Platform is a business tool and is not directed to anyone under 18.

12. Cookies and similar technologies

The Platform uses cookies and local storage that are necessary to sign you in, keep your session, remember interface preferences, and protect against abuse. We do not use advertising cookies.

13. Changes

We may update this Policy. Material changes will be posted at legal.tlciq.app with a new effective date, and, where appropriate, notified through the Platform.

14. Contact

Privacy questions, requests, or security concerns: info@livingcompany.com
The Living Company, 2149 S Jupiter Rd, Garland, TX 75041, United States