Privacy Policy

What we collect

• Account data: name, business email, password hash, role, and the workspace you belong to
• Billing data: billing contact, address, and payment metadata. Card numbers are handled by our payment processor and never reach our systems
• Usage data: pages and features used, actions taken, timestamps, approximate location derived from IP, browser and device type
• Content you submit: brands, prompts, competitors, connected account data, and anything else you put into the product
• Enquiry data: what you send us when you book a demo, request a report, or contact support

Why we use it, and our lawful basis

• To provide the Service and support you, which is necessary to perform our contract with you
• To bill you and keep accounting records, which is contract performance and a legal obligation
• To secure the Service, prevent abuse and debug faults, which is our legitimate interest in running a safe product
• To measure how the website is used so we can improve it, which is our legitimate interest, using the analytics described in our Cookie Policy
• To train our own internal models on aggregated and de-identified data so the product's judgements get more accurate, which is our legitimate interest in maintaining a working service. Because the data is de-identified before training, this processing does not operate on personal data
• To send service messages you cannot opt out of, such as billing and security notices, and marketing emails you can opt out of at any time

What we do not do

We do not sell personal data. We do not share it with advertising networks. We have not enabled advertising features or Google Signals on our analytics. We do not use customer content to train third-party foundation models, and we do not let any third party train on it.

We do train our own internal models, and we would rather say so here than bury it. They are trained on aggregated and de-identified data, never on identifiable customer content or personal data. De-identification happens before the data reaches any training process, we do not attempt to reverse it, and no model output surfaces one customer's content or identity to another. Enterprise customers can opt out of contributing in their order form. This is described in full in section 5.1 of the Master Subscription Agreement.

Who we share it with

We share personal data with the sub-processors listed in our Data Processing Agreement, each engaged to perform a specific function on our behalf and bound by contract. We may also disclose data where required by law, to enforce our agreements, or to a successor in a merger or acquisition, in which case we will give notice before your data becomes subject to a different policy.

International transfers

We are based in the United States and our sub-processors are located there. Where we receive personal data from the European Economic Area, the United Kingdom or Switzerland, we rely on the European Commission's Standard Contractual Clauses, with the UK Addendum where applicable.

How long we keep it

Account and content data is kept while your account is active, and deleted or de-identified within ninety days of termination, except where we must keep records for legal or accounting purposes. Website analytics data is retained for up to fourteen months. Support correspondence is kept for up to three years.

Your rights

Depending on where you live, you may have the right to access the personal data we hold about you, correct it, delete it, restrict or object to processing, receive it in a portable format, and withdraw consent where processing is based on consent. If you are in the EEA or UK you may also complain to your supervisory authority.

If you are a California resident, you have the rights to know, delete, correct and opt out of sale or sharing under the CCPA as amended. We do not sell or share personal information as those terms are defined, and we will not discriminate against you for exercising a right.

To exercise any of these, write to privacy@airankly.io. We will respond within the period required by the applicable law, which is one month under the GDPR and forty five days under the CCPA. If your request concerns data we process on behalf of one of our customers, we will refer you to that customer.

Children

The Service is a business product and is not directed at children. We do not knowingly collect personal data from anyone under sixteen.

Changes and contact

We will post any change to this policy on this page and update the date above. For material changes affecting account holders we will also give notice by email or in-product.

Hoozi Enterprises LLC, 1021 E Lincolnway, Suite 7103, Cheyenne, WY 82001. Privacy enquiries: privacy@airankly.io.