Privacy Policy — easyAIQ

Effective date: October 24, 2026

1. Who we are and what this policy covers

Dandelion Development Inc., doing business as easyAIQ ("we", "us", "our") provides easyAIQ, a software-as-a-service platform that lets businesses upload documents and ask questions about them using artificial intelligence (the "Service"). Our principal business address is 25422 Trabuco Road, Suite 105-264, Lake Forest, California 92630.

This Privacy Policy explains how we handle personal information in connection with our websites, the Service, and our sales, support and marketing activities.

Our customers are businesses. The organization that signs up for the Service (the "Customer") decides who may use it and what content is uploaded. This affects our role:

Information	Our role	Who decides how it is used
Documents, files, prompts, questions and AI-generated answers in a Customer's workspace ("Customer Content")	Processor / service provider	The Customer, under our agreement and DPA
Account, billing, usage, support and marketing information	Controller / business	Us, as described in this policy

If you are an employee or contractor of a Customer, your employer controls Customer Content. Requests about that content (for example, to access or delete a document that mentions you) should go to that organization first. We will help them respond.

This policy does not cover third-party websites or services that the Service links to or integrates with.

2. Information we collect

Category	Examples	Source
Account information	Name, business email, job title, company name, role and permissions	You or your organization's administrator
Customer Content	Uploaded documents and files, extracted text, embeddings and indexes created from them, questions and prompts, AI-generated answers, citations, chat history, annotations	Users of the Service
Billing information	Billing contact, billing address, tax ID, purchase history. Card details are collected and stored by our payment processor, Stripe, not by us	Customer's billing contact
Usage and device information	Log data, IP address, browser and device type, pages and features used, timestamps, error reports, token or query counts	Collected automatically
Communications	Support tickets, emails, call notes, feedback, survey responses	You
Sales and marketing information	Contact details from demo requests, events, and newsletter sign-ups; interactions with our emails	You
Integration data	Files and metadata pulled from connected services (for example cloud storage) when a user enables an integration	Third-party services you connect

Customer Content may itself contain personal information about the Customer's employees, clients or other people. We process that information only on the Customer's behalf, as described in Section 3.

We do not knowingly ask for sensitive categories of personal information. Customers are responsible for deciding whether to upload such information and for having a lawful basis to do so.

3. How we use information

Customer Content is used only to provide the Service to the Customer and as the Customer instructs. That means:

storing, parsing, indexing and creating searchable representations (such as embeddings) of uploaded documents;
sending relevant portions of documents and the user's question to AI models to generate answers;
displaying answers, citations and history to authorized users in the Customer's workspace;
keeping the Service secure, preventing abuse, and fixing problems a Customer reports; and
complying with law.

We do not use Customer Content to train or fine-tune AI models, ours or anyone else's, and we do not sell it.

Our personnel access Customer Content only when needed to provide support the Customer requests, to investigate security incidents or abuse, or when required by law. Access is limited and subject to confidentiality obligations.

Other information (account, billing, usage, communications and marketing data) is used to:

create and administer accounts and authenticate users;
process payments and manage subscriptions;
provide customer support and send service and security notices;
monitor performance, measure usage, and improve the Service using aggregated or de-identified usage metrics (never the contents of documents or prompts);
detect and prevent fraud, security incidents and violations of our Terms of Service;
send marketing communications to business contacts, which you can opt out of at any time; and
meet legal, tax and accounting obligations and enforce our agreements.

4. How the AI features work

When a user asks a question, the Service handles Customer Content in these steps:

The uploaded document is stored in encrypted form and broken into sections.
Searchable representations (embeddings) of those sections are created and stored in the Customer's workspace.
The sections most relevant to the question are retrieved.
The question and the retrieved sections are sent to an AI model provider, which returns a generated answer.
The answer, with references to the source sections, is shown to the user and saved in the workspace history.

Third-party AI providers. We use Anthropic, OpenAI, Microsoft (Azure OpenAI), Google (Gemini) and Voyage AI to run AI models and create searchable representations of documents. These providers act as our subprocessors. They process the data we send them only to provide the requested functionality, and their terms do not permit them to use it to train their models. Some providers retain request data for a limited period, currently up to 30 days, solely for automated safety and abuse monitoring, after which their terms provide that the data is deleted. Retention may be longer where required by law or where content is flagged for a suspected policy violation. Provider personnel do not review this data in the ordinary course; under their terms, human review may occur where content is flagged for a suspected policy violation.

Accuracy. AI-generated answers can be incomplete or wrong, even when they cite a source. Users should check important answers against the original document. See our Terms of Service for more.

No automated decisions about individuals. The Service does not make decisions that produce legal or similarly significant effects on individuals. If a Customer uses outputs to make such decisions, the Customer is responsible for that use and for any human review the law requires.

Subprocessors. We keep a current list of subprocessors, with their purpose and location, at easyaiq.com/subprocessors. Customers can subscribe to be notified before we add a new subprocessor, as set out in the DPA.

5. Legal bases for processing (EEA, UK and Switzerland)

Where data protection law such as the GDPR or UK GDPR applies, we rely on these legal bases for information we control:

Purpose	Legal basis
Providing the Service, managing accounts, billing	Performance of a contract with the Customer, and our legitimate interest in serving users the Customer has authorized
Security, fraud prevention, service improvement using aggregated metrics	Legitimate interests
B2B marketing	Legitimate interests, or consent where required (for example, for certain electronic marketing)
Tax, accounting and legal requests	Legal obligation

For Customer Content, the Customer is the controller and determines the legal basis.

6. How we share information

We do not sell personal information or share it for cross-context behavioral advertising. We share it only with:

Subprocessors and service providers that host, secure, and operate the Service, run AI models, process payments, provide support tools, or send email, under written contracts that limit their use of the data.
The Customer. Workspace administrators can see account details and activity of users in their organization.
Integrations you enable. If a user connects a third-party service, we exchange data with it as the user directs.
Professional advisers such as lawyers, auditors and insurers, under confidentiality duties.
Authorities, when required by law or valid legal process. Where lawful, we will notify the Customer before disclosing Customer Content and will challenge overbroad requests.
A successor business, in a merger, acquisition, financing or sale of assets, subject to this policy's protections.
Others, with your direction or consent.

7. International transfers

We are based in the United States, and we store Customer Content and other personal information in the United States. When personal information moves from the EEA, UK or Switzerland to countries without an adequacy decision, we use safeguards such as the European Commission's Standard Contractual Clauses or the UK International Data Transfer Addendum.

8. Retention and deletion

Information	How long we keep it
Customer Content	Until the Customer or an authorized user deletes it, or until the subscription ends. After termination, we delete it within 30 days, and from backups within a further 35 days, unless the law requires us to keep it
Embeddings and indexes	Deleted together with the source document
Account information	For the life of the account, then up to 12 months for support and dispute purposes
Billing records	As long as tax and accounting law requires, typically 7 years
Logs and usage data	Up to 13 months, unless needed longer to investigate a security incident
Marketing contacts	Until you unsubscribe or the data is no longer relevant

Customers keep the original files they upload, so we do not provide a separate export after termination. We may keep aggregated or de-identified data that can no longer identify anyone.

9. Security

We protect information with administrative, technical and physical safeguards, including:

encryption in transit (TLS) and at rest;
passwordless sign-in that verifies each user's email address with a one-time link, and role-based access controls; and
notifying affected Customers without undue delay after becoming aware of a breach involving their data.

No system is perfectly secure. Customers are responsible for protecting their credentials and configuring user access appropriately.

10. Your privacy rights

Depending on where you live, you may have the right to:

know what personal information we hold about you and get a copy;
correct inaccurate information;
delete your information;
receive your information in a portable format;
object to or restrict certain processing, including direct marketing;
withdraw consent where we rely on it; and
not be discriminated against for exercising these rights.

EEA, UK and Switzerland. You may also complain to your local data protection authority.

California and other US states. Residents of California and other states with comprehensive privacy laws have the rights above, subject to exceptions in those laws. We do not sell or share personal information as those terms are defined, and we do not use sensitive personal information to infer characteristics about you. You may use an authorized agent; we will verify both your identity and the agent's authority.

How to make a request. Email legal@easyaiq.com. We will verify your identity and respond within the time the law requires (generally 30 days in the EEA/UK and 45 days in California). If your request concerns Customer Content, we will refer you to the relevant Customer or help them respond.

11. Cookies and similar technologies

We use cookies that are strictly necessary for login and security, and analytics cookies that show us how visitors use our websites. You can block or delete cookies through your browser settings. We honor Global Privacy Control signals where the law requires.

12. Children

The Service is for businesses and is not directed to anyone under 18. We do not knowingly collect personal information from children for our own purposes. If you believe a child has given us personal information, contact us and we will delete it.

13. Changes to this policy

We may update this policy from time to time. We will post the new version with a new effective date and, for material changes, notify Customer administrators by email or in the Service at least 30 days in advance.

14. Contact us

Dandelion Development Inc. (dba easyAIQ) 25422 Trabuco Road, Suite 105-264, Lake Forest, California 92630 Privacy questions: legal@easyaiq.com