Privacy Policy of Iseer & Co.

3.1. Lawfulness, Fairness, and Transparency

All Processing of Personal Data shall be conducted lawfully, fairly, and in a transparent manner in relation to the Data Subject. We shall provide clear, accessible, and comprehensive information about our Processing activities.

3.2. Purpose Limitation

Personal Data shall be collected for specified, explicit, and legitimate purposes and not further Processed in a manner that is incompatible with those purposes. Any secondary use of data will only occur where legally permissible, such as for archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes, subject to appropriate safeguards.

3.3. Data Minimization

The Personal Data we collect and Process shall be adequate, relevant, and strictly limited to what is necessary in relation to the purposes for which they are Processed. The development of sophisticated AI Systems necessitates the use of large and diverse datasets to ensure model accuracy, safety, and the mitigation of bias. This operational requirement presents a direct tension with the principle of Data Minimization. The Company reconciles this tension by implementing a multi-faceted strategy: (a) utilizing Anonymised or Pseudonymised data for model training and development wherever technically and operationally feasible; (b) architecting our data collection mechanisms to limit the ingestion of direct personal identifiers not essential for the provision of the Services; (c) applying strict data retention schedules to raw data post-processing to ensure it is not held indefinitely; and (d) continuously researching and deploying privacy-enhancing technologies that reduce the data footprint required for model efficacy. This demonstrates a sophisticated and proactive approach to balancing technological necessity with fundamental data protection principles.

3.4. Accuracy

We shall take every reasonable step to ensure that Personal Data are accurate and, where necessary, kept up to date. Mechanisms will be provided for Data Subjects to rectify inaccurate data concerning them.

3.5. Storage Limitation

Personal Data shall be kept in a form which permits identification of Data Subjects for no longer than is necessary for the purposes for which the Personal Data are Processed. Retention periods are determined based on legal, regulatory, and legitimate business requirements, as detailed in Article X.

3.6. Integrity and Confidentiality (Security)

Personal Data shall be Processed in a manner that ensures appropriate security, including protection against unauthorized or unlawful Processing and against accidental loss, destruction, or damage, using appropriate technical and organizational measures.

3.7. Accountability

As the Data Controller, the Company is responsible for, and must be able to demonstrate compliance with, the principles enumerated in this Article. This is achieved through comprehensive documentation, regular audits, Data Protection Impact Assessments (DPIAs), and the governance structure outlined in this Policy.

4.1. Performance of a Contract (GDPR Article 6(1)(b))

A significant portion of our Processing is necessary for the performance of the contract to which the Data Subject is party, namely our Terms of Service. This includes, but is not limited to:

• Creating, authenticating, and maintaining user accounts.
• Processing payments and managing subscriptions for paid Services.
• Receiving and processing Inputs to generate and deliver Outputs as the core function of the Services.
• Providing customer support and responding to user inquiries.

4.2. Legitimate Interests (GDPR Article 6(1)(f))

We Process certain Personal Data based on our legitimate interests, provided that such interests are not overridden by the interests or fundamental rights and freedoms of the Data Subject. These activities include:

• Ensuring the security of our Services, networks, and information systems, including fraud detection, prevention of illegal activity, and mitigation of cybersecurity threats.
• Analyzing usage patterns to improve the user experience, functionality, and performance of our existing Services.
• Conducting business analytics and planning.
• Sending administrative communications regarding the Services, such as updates to our terms or policies.

4.3. Consent (GDPR Article 6(1)(a))

We rely on the Data Subject's explicit and informed Consent for certain Processing activities, including:

• The processing of Special Categories of Personal Data or Sensitive Personal Information that may be incidentally included in Inputs, where no other legal basis applies.
• The placement of non-essential cookies and similar tracking technologies on a User's device.
• Sending direct marketing communications via electronic means.
• As detailed in Section 4.5, for the use of Interaction Data for the purpose of model training and improvement.

4.4. Legal Obligation (GDPR Article 6(1)(c))

We may Process Personal Data where it is necessary for compliance with a legal obligation to which the Company is subject, such as responding to a lawful subpoena, court order, or request from a regulatory or law enforcement authority.

4.5. Lawful Basis for Model Training and Improvement

The use of Personal Data, specifically Interaction Data, for the purpose of training, fine-tuning, and improving our Synthetic Intelligence Systems represents a high-risk processing activity requiring a distinct and transparent lawful basis. The Company has adopted a bifurcated approach based on user choice and control, reflecting best practices in the AI industry. The primary lawful basis for this activity is the explicit, granular, and opt-in Consent of the Data Subject. By default, Interaction Data is not used for model improvement. Users are provided with a clear and unambiguous choice, typically via their account settings, to permit this specific use of their data. Where a User provides such Consent, they may withdraw it at any time, and such withdrawal will apply prospectively. In certain limited jurisdictions and for specific, narrowly defined improvement purposes (e.g., safety model enhancement), the Company may, in the alternative, rely on its Legitimate Interest, supported by a comprehensive LIA and subject to the Data Subject's absolute right to object.

5.1. Data Provided Directly by the Data Subject

This category comprises information that Users actively and voluntarily provide when interacting with our Services.

5.2. Data Collected Automatically

This category comprises information collected through automated technical means as a consequence of your interaction with our Services.

5.3. Data Obtained from Third-Party Sources

For the purpose of pre-training our foundational AI models, we may Process vast datasets obtained from third-party sources. This data consists primarily of information that is publicly available on the internet or licensed from data providers. We take contractual and technical steps to ensure that such data is sourced lawfully and ethically.

5.4. Inferred, Derived, and Generated Data

This category comprises data that is not directly collected from you but is generated by our systems through the Processing of other data.

5.5. Processing of Special Categories of Personal Data and Sensitive Personal Information

The Company does not intentionally collect or solicit Special Categories of Personal Data or Sensitive Personal Information. However, our AI Systems may Process such data if it is contained within the Inputs you provide. In such instances, the Processing is incidental to the provision of the Service. Where applicable law requires a specific legal basis for such Processing (e.g., explicit consent under GDPR), your provision of such data within an Input, coupled with your continued use of the Service, may be interpreted as such consent where no other basis applies. We implement heightened security measures for any such data we identify and advise you not to submit sensitive information you do not wish for us to Process.

7.1. Processors / Service Providers

We engage trusted third-party vendors and service providers to perform functions and provide services on our behalf. These may include cloud hosting providers, payment processors, content delivery networks, and customer support service providers. These entities act as our Processors and are contractually bound by Data Processing Agreements to Process Personal Data only upon our instructions and to implement robust security and confidentiality measures.

7.2. Legal and Regulatory Compliance

We may disclose Personal Data if we have a good-faith belief that access, use, preservation, or disclosure of the information is reasonably necessary to:

• Comply with any applicable law, regulation, legal process, or enforceable governmental request.
• Enforce our applicable Terms of Service, including investigation of potential violations.
• Detect, prevent, or otherwise address fraud, security, or technical issues.
• Protect against harm to the rights, property, or safety of the Company, our users, or the public as required or permitted by law.

7.3. Business Transfers

In the event that the Company is involved in a merger, acquisition, bankruptcy, reorganization, or sale of assets, your Personal Data may be sold or transferred as part of that transaction. We will provide notice to you before your Personal Data is transferred and becomes subject to a different privacy policy.

7.4. Corporate Affiliates

We may share Personal Data with our corporate affiliates (i.e., entities under common ownership or control) for purposes consistent with this Policy, such as for centralized administration and operational efficiency.

7.5. With Your Consent

We may share Personal Data with third parties for other purposes when we have your explicit Consent to do so.

11.1. The Right of Access

You have the right to obtain from us confirmation as to whether or not Personal Data concerning you is being Processed, and, where that is the case, to access the Personal Data and receive supplementary information about the Processing.

11.2. The Right to Rectification

You have the right to obtain the rectification of inaccurate Personal Data concerning you without undue delay.

11.3. The Right to Erasure ('Right to be Forgotten')

You have the right to obtain the erasure of Personal Data concerning you without undue delay where certain grounds apply, such as when the data is no longer necessary for the purposes for which it was collected or when you withdraw Consent.

11.4. The Right to Restrict Processing

You have the right to obtain a restriction of Processing where certain conditions apply, such as when the accuracy of the Personal Data is contested.

11.5. The Right to Data Portability

Where Processing is based on Consent or a contract and is carried out by automated means, you have the right to receive the Personal Data concerning you, which you have provided to us, in a structured, commonly used, and machine-readable format and have the right to transmit those data to another controller.

11.6. The Right to Object

You have the right to object, on grounds relating to your particular situation, at any time to the Processing of Personal Data concerning you which is based on our legitimate interests. We shall no longer Process the Personal Data unless we can demonstrate compelling legitimate grounds for the Processing which override your interests, rights, and freedoms. You have an absolute right to object to Processing for direct marketing purposes.

11.7. Rights Related to Automated Decision-Making and Profiling

You have the right not to be subject to a decision based solely on automated Processing, including Profiling, which produces legal or similarly significant effects concerning you. Our Services may involve automated Processing and Profiling to generate Outputs; however, we stipulate in our Terms of Service that these Outputs should not be used as the sole basis for making important decisions about individuals without appropriate human review. We are committed to providing meaningful information about the logic involved, as well as the significance and the envisaged consequences of such Processing.

12.1. Addendum for European Economic Area (EEA), Switzerland, and the United Kingdom

12.2. Addendum for California and other U.S. States

12.3. Addendum for Canada

For residents of Canada, our Processing of Personal Information is governed by the Personal Information Protection and Electronic Documents Act (PIPEDA). We adhere to PIPEDA's ten Fair Information Principles: (1) Accountability; (2) Identifying Purposes; (3) Consent; (4) Limiting Collection; (5) Limiting Use, Disclosure, and Retention; (6) Accuracy; (7) Safeguards; (8) Openness; (9) Individual Access; and (10) Challenging Compliance.

12.4. Addendum for Brazil

For residents of Brazil, our Processing of Personal Data is governed by the Lei Geral de Proteção de Dados (LGPD). You have rights under the LGPD including the right to: (1) Confirmation of the existence of the processing; (2) Access to the data; (3) Correction of incomplete, inaccurate or outdated data; (4) Anonymization, blocking or deletion of unnecessary or excessive data; (5) Portability of the data to another service or product provider; and (6) Information about public and private entities with which the controller has shared data.

12.5. Addendum for Australia

For residents of Australia, our handling of Personal Information is governed by the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). We are committed to complying with the APPs, which govern the open and transparent management of personal information, collection, use and disclosure, data quality and security, and the rights of individuals to access and correct their personal information.