Privacy Policy

This Privacy Policy explains how Assured Autonomy Inc. ("Assured Autonomy," "we," or "us") collects, uses, and protects information in connection with the Assured Autonomy software platform, including its applications, APIs, and related services (the "Services"). The Services are intended for authorized users of our Customers and are not offered to consumers for personal use.

When the Services are provided to an organization ("Customer"):

• the Customer is the Data Controller; and
• Assured Autonomy is a Data Processor or Service Provider, as defined in the agreement between us and the Customer (the "Enterprise Agreement").

We process personal data only on the Customer's documented instructions, as set out in the Enterprise Agreement and any Data Processing Addendum ("DPA"). If this Policy conflicts with the Enterprise Agreement or DPA, those documents control.

We process the information needed to provide, secure, and support the Services, including:

• account and registration information, such as name, email address, organizational role, permissions, and authentication credentials;
• Customer Data, meaning information submitted, uploaded, or generated through the Services by or for a Customer, including system data, configurations, policies, inputs, and outputs; and
• usage and technical data, such as logs, IP addresses, device and browser details, and security and performance metrics.

We use information only to:

• provide, operate, and support the Services;
• maintain their security, integrity, and availability;
• improve the Services using aggregated and de-identified data; and
• meet our legal obligations.

We do not sell personal information.

Some features of the Services use artificial intelligence or machine-learning technologies, which may include third-party providers. Customer Data is processed only in enterprise-grade environments and is not used to train foundational AI models. Output may be probabilistic, incomplete, or inaccurate, and users are responsible for reviewing and validating it before use.

We use a limited set of cookies and similar technologies for:

• authentication and session management;
• security and fraud prevention; and
• performance monitoring.

We do not use cookies for behavioral advertising or cross-site tracking within the Services.

We may share information with subprocessors that help us deliver the Services, including:

• cloud hosting providers;
• security and monitoring vendors; and
• third-party AI service providers.

Subprocessors are contractually required to protect information and to process it only as needed to provide the Services, consistent with the DPA.

We keep Customer Data for the term of the Customer's subscription and as needed to meet legal obligations, resolve disputes, and enforce our agreements. When the Enterprise Agreement ends, Customer Data is returned or deleted as the Enterprise Agreement and DPA provide.

Depending on applicable law, individuals may have the right to access, correct, or delete their personal data. Because we process personal data for our Customers, these requests should normally go to the Customer as Data Controller. We will help Customers respond to requests as the law requires.

We maintain commercially reasonable administrative, technical, and organizational safeguards, including:

• encryption in transit and at rest;
• access controls based on least privilege;
• monitoring and logging; and
• regular security testing.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

Customer Data may be processed in the United States or other countries where we or our subprocessors operate, subject to appropriate contractual safeguards, including the Enterprise Agreement where required.

We may update this Privacy Policy from time to time and will communicate material changes through the Services or other reasonable means. Continuing to use the Services after an update takes effect means you accept the updated Policy.

Assured Autonomy processes personal data in line with applicable data protection laws, including, where they apply, the EU General Data Protection Regulation (GDPR), the UK GDPR, and the California Consumer Privacy Act as amended by the CPRA (CCPA/CPRA). Where required, processing is governed by the Enterprise Agreement and DPA, which set out each party's obligations, safeguards, and the means for exercising individual rights.

For questions, please contact: