Privacy Policy

This Privacy Policy (this "Policy") describes how Hyrax AI, LLC d/b/a Hyrax, a subsidiary of Iru, Inc. ("Hyrax"), collects, uses, discloses, and protects information when you visit our website, create an account, purchase a subscription, or otherwise use our artificial intelligence products and services (collectively, the "Services").

The Services are offered on a subscription basis through various tiered plans. This Policy applies to all plan tiers unless otherwise stated.

By accessing or using the Services, you acknowledge that you have read and understood this Policy. If you do not agree with this Policy, please do not use the Services.

We want our practices to be easy to understand. In short:

• We do not run ads in the Services.
• We do not sell your personal information.
• You can delete your account at any time, which begins the process of removing your information from our systems (see Section 12).

If we ever introduce a feature that materially changes these commitments, we will notify you and, where appropriate, give you the opportunity to opt out before the change takes effect.

The Services are intended for, and offered only to, users located in the United States. We do not market, sell, or knowingly offer the Services to individuals located outside the United States.

If you access the Services from outside the United States, you do so on your own initiative and are responsible for compliance with any applicable local laws. We make no representation that the Services are appropriate or available for use in locations outside the United States.

We collect the following categories of information:

4.1 Information You Provide to Us

• Account Information. Name, email address, username, password, and company or organization name (for Team plans).
• Billing and Subscription Information. The plan tier you select (Free, Pro, or Team), billing contact details, and transaction history. Payment card details are handled by our payment processor and are described in Section 6.
• Inputs and Content. Text, prompts, files, documents, and other content you submit to the Services, along with the outputs the Services generate in response (collectively, "Customer Content").
• Communications. Information you provide when you contact us for support, respond to surveys, or otherwise communicate with us.

4.2 Information Collected Automatically

• Usage Data. Features accessed, actions taken, dates and times of access, and other interactions with the Services.
• Device and Connection Data. IP address, browser type, operating system, device identifiers, and general (city/region-level) location inferred from IP address.
• Cookies and Similar Technologies. Information collected through cookies, pixels, and similar technologies, as described in Section 9.

4.3 Information From Third Parties

We may receive information about you from third parties, such as our payment processor (confirmation of payment and subscription status), analytics providers, and identity or fraud-prevention services.

4.4 Sensitive Information

We do not request or require sensitive personal information (such as government identification numbers, financial account numbers, health information, or precise geolocation) to use the Services. Please do not submit sensitive personal information as Customer Content unless it is necessary for your use of the Services. Any sensitive information that does appear in Customer Content is processed only to provide the Services to you.

We use the information we collect to:

• Provide, operate, maintain, and secure the Services;
• Create and manage your account and authenticate users;
• Process subscriptions, payments, renewals, and refunds;
• Generate outputs in response to your inputs and deliver the core functionality of the Services;
• Provide customer support and respond to your inquiries;
• Monitor, analyze, and improve the performance, reliability, and usability of the Services;
• Detect, investigate, and prevent fraud, abuse, security incidents, and violations of our terms;
• Send administrative or service-related communications (such as billing notices, security alerts, and policy updates);
• Send marketing communications, where permitted, subject to your right to opt out; and
• Comply with legal obligations and enforce our agreements.

Subscription payments are processed by Stripe, Inc. ("Stripe"), a third-party payment processor. When you purchase a Pro or Team plan (or a Free plan where payment details are requested), you provide your payment card or other payment details directly to Stripe through its secure payment interface.

Hyrax does not collect, receive, or store your full payment card number, card expiration date, or card security code. We receive only limited information from Stripe necessary to manage your subscription, such as a payment confirmation, the last four digits of your card, the card brand, and your subscription status.

Stripe's processing of your payment information is governed by Stripe's own privacy policy, available at https://stripe.com/privacy. We encourage you to review it.

7.1 Use of Customer Content

We process Customer Content to operate the Services and deliver outputs to you. We treat Customer Content as confidential and access it only as needed to provide, maintain, and secure the Services, to provide support you request, to address security or technical issues, or as required by law.

7.2 Third-Party AI Providers

To deliver the Services, we use third-party AI model providers and infrastructure providers (such as large language model providers and cloud hosting providers) that process your inputs and the resulting outputs on our behalf.

These providers act as our service providers and processors. They may access Customer Content only as necessary to provide their services to us, and we select AI model providers whose applicable enterprise or developer terms provide that Customer Content submitted through their interfaces is not used to train or improve those providers' models.

7.3 Nature of AI Outputs

AI-generated outputs may be inaccurate, incomplete, or otherwise unsuitable for your purposes. Outputs are provided for your use subject to our Terms of Service, and you are responsible for reviewing outputs before relying on them.

We do not sell your personal information. We disclose information only in the following circumstances:

• Service Providers. With vendors and contractors that perform services on our behalf, such as cloud hosting, AI model providers, payment processing (Stripe), analytics, customer support, email delivery, and security. These providers may access information only to perform services for us and are bound by confidentiality obligations.
• Affiliates. With Iru, Inc. and other affiliated entities under common ownership or control, for purposes consistent with this Policy.
• Business Transfers. In connection with a merger, acquisition, financing, reorganization, or sale of all or part of our assets, information may be transferred as part of that transaction, subject to this Policy.
• Legal and Safety. When we believe disclosure is necessary to comply with applicable law, legal process, or a governmental request; to enforce our agreements; or to protect the rights, property, or safety of Hyrax, our users, or others.
• With Your Direction. When you ask us to share information or otherwise consent to its disclosure.
• Aggregated or De-Identified Data. We may disclose aggregated or de-identified information that cannot reasonably be used to identify you.

We and our service providers use cookies and similar technologies to operate and secure the Services, remember your preferences, authenticate sessions, and analyze how the Services are used.

Most web browsers allow you to control cookies through their settings. If you disable certain cookies, some features of the Services may not function properly. Where required, we will present a cookie banner or preference tool that lets you manage non-essential cookies.

We do not use your personal information for cross-context behavioral advertising.

We retain personal information and Customer Content for as long as your account is active or as needed to provide the Services, and thereafter as necessary to comply with our legal obligations, resolve disputes, enforce our agreements, and maintain business records.

When you delete Customer Content or close your account, we will delete or de-identify the associated information within a commercially reasonable period, except where retention is required by law or for legitimate business purposes such as backup, fraud prevention, or accounting. Residual copies may persist in backup systems for a limited time.

We maintain administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, disclosure, alteration, and destruction. These measures include encryption of data in transit and at rest, access controls, and ongoing monitoring.

No method of transmission or storage is completely secure. We cannot guarantee absolute security, and you provide information to us at your own risk. You are responsible for maintaining the confidentiality of your account credentials.

Please note: The Services store and process Customer Content on our servers in order to operate. The Services do not provide end-to-end or zero-access encryption, which means we are technically able to access Customer Content as needed to provide and secure the Services.

Data Breach Notification

In the event of a data breach affecting your personal information, we will notify affected users as required by applicable law. Notification will generally be sent to the email address associated with your account and will describe, to the extent known, the nature of the incident, the information involved, and the steps we have taken or recommend in response. Where applicable law requires notification to regulators or other authorities, we will provide that notice within the required timeframes.

You may delete your account at any time through your account settings or by contacting us. When you delete your account, we will delete or de-identify your personal information and associated Customer Content as described in Section 10.

You may also opt out of marketing communications at any time by using the unsubscribe link in those messages or by contacting us. We may still send you non-promotional, service-related communications (such as billing and security notices).

Depending on your state of residence, you may have some or all of the following rights with respect to your personal information:

• Right to Know / Access. To request the categories and specific pieces of personal information we have collected about you.
• Right to Correct. To request correction of inaccurate personal information.
• Right to Delete. To request deletion of personal information we have collected from you, subject to exceptions.
• Right to Portability. To request a copy of your personal information in a portable format.
• Right to Opt Out. To opt out of the "sale" or "sharing" of personal information and of targeted advertising, to the extent applicable. As noted above, we do not sell personal information or use it for cross-context behavioral advertising.
• Right to Non-Discrimination. To not receive discriminatory treatment for exercising your rights.

To exercise any of these rights, contact us at legal@hyrax.dev from the email address associated with your account. We will verify your request before responding, and we may ask for information to confirm your identity. You may authorize an agent to make a request on your behalf, subject to verification.

Because the Services process Customer Content, fulfilling certain requests (such as access or deletion) may require additional verification, and certain derived or aggregated data may not be technically feasible to delete in isolation.

If we deny your request, you may appeal our decision by contacting us at the same address. If you have an unresolved concern, you may contact your state attorney general.

Additional Notice for California Residents

If you are a California resident, the California Consumer Privacy Act, as amended ("CCPA"), provides the rights described above. In the preceding twelve (12) months, we have collected the categories of personal information described in Section 4, for the purposes described in Section 5, and disclosed personal information to the categories of recipients described in Section 8.

We do not sell personal information for monetary consideration, and we do not knowingly sell or share the personal information of individuals under 16 years of age.

California's "Shine the Light" law permits California residents to request information about disclosures of personal information to third parties for their direct marketing purposes. We do not disclose personal information to third parties for their own direct marketing purposes.

We process your personal information only when we have a valid basis to do so. Depending on the context, this may include:

• Performance of a Contract. Processing necessary to provide the Services and their features to you, including creating and administering your account, processing your inputs, generating outputs, and processing payments.
• Consent. Where you have given us consent for a specific purpose, such as opting in to a feature. You may withdraw consent at any time, which will not affect processing already carried out.
• Legal Obligations. Processing necessary to comply with applicable laws, regulations, and lawful requests.
• Legitimate Interests. Processing necessary for our legitimate interests, such as operating, securing, and improving the Services and preventing fraud and abuse, balanced against your rights and expectations.

The Services are intended for users who are at least 18 years of age. We do not knowingly collect personal information from anyone under 18. If we become aware that we have collected personal information from an individual under 18, we will take steps to delete it. If you are a parent or guardian and believe a person under 18 has provided us with personal information, please contact us at legal@hyrax.dev.

The Services may contain links to, or integrations with, third-party websites and services that we do not control. This Policy does not apply to those third parties. We encourage you to review the privacy policies of any third-party websites or services you access.

We may update this Policy from time to time. When we do, we will revise the "Effective Date" above and post the updated Policy on our website. If we make material changes, we will provide additional notice, such as by email or through the Services. Your continued use of the Services after the effective date of a revised Policy constitutes your acceptance of the changes.

If you have questions or concerns about this Policy or our privacy practices, please contact us: