Privacy Policy

1. Introduction

AI Ethos Live is an AI governance platform operated by PrasanthiBallada Enterprises LLC ("AI Ethos Live," "we," "us," or "our"), a Texas limited liability company headquartered in Austin, Texas, United States. This Privacy Policy explains how we collect, use, disclose, and protect personal information when you access or use our website at aiethoslive.com, our application, and related services (collectively, the "Services").

We built AI Ethos Live to help regulated-industry organizations govern their use of artificial intelligence responsibly. Protecting the information entrusted to us is foundational to that mission. This policy describes our practices in plain language and outlines the rights available to you under applicable laws, including the European Union General Data Protection Regulation (GDPR), the United Kingdom General Data Protection Regulation (UK GDPR), the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA), the Health Insurance Portability and Accountability Act (HIPAA) where relevant, and the Canadian Personal Information Protection and Electronic Documents Act (PIPEDA).

By using the Services, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with our practices, please do not use the Services.

2. Who We Are and How to Contact Us

We aim to respond to privacy inquiries within 30 days, or sooner where required by applicable law.

3. Scope of This Policy

This Privacy Policy applies to personal information we collect through the Services. It does not apply to third-party websites, applications, or services that may be linked from our Services or that integrate with our Services under their own privacy terms. We encourage you to review the privacy practices of any third party before providing them with your information.

For customers in regulated industries (pharmaceutical, oil and gas, manufacturing, and similar sectors), this policy works alongside any separately executed Data Processing Agreement (DPA), Business Associate Agreement (BAA) where applicable under HIPAA, or Master Services Agreement (MSA) between your organization and AI Ethos Live. In the event of a conflict between this policy and a signed agreement, the signed agreement governs the relationship with that customer.

4. Information We Collect

We collect information in three ways: information you provide directly, information collected automatically through your use of the Services, and information received from third parties.

4.1 Information You Provide Directly

• Account Information: name, email address, job title, company name, and authentication identifiers when you create an account or sign in using Google Sign-In.
• Profile and Preferences: information you add to your profile, including role, industry, and communication preferences.
• Governance Content: AI model inventories, risk assessments, policies, compliance documentation, and related materials you upload or generate within the platform.
• Support and Communications: information you share when you contact us for support, feedback, or business inquiries, including email content and attachments.
• Payment Information: where applicable, billing contact details. Payment card information is processed by our payment processor and is not stored on our systems.

4.2 Information Collected Automatically

• Usage Data: pages viewed, features used, actions taken, timestamps, and session duration.
• Device and Technical Data: IP address, browser type and version, operating system, device identifiers, language settings, and referring URLs.
• Cookies and Similar Technologies: see Section 9 for details.
• Log Data: server logs that record access times, errors, and system performance information, retained for security and reliability purposes.

4.3 Information from Third Parties

• Authentication Providers: when you sign in with Google, we receive your name, email address, profile picture, and a unique identifier from Google, subject to the permissions you grant during sign-in.
• Business Sources: publicly available business information, such as company details, used to enrich your account for enterprise and federal contracting contexts.
• Integrations You Authorize: where you connect third-party systems to AI Ethos Live, we receive the data you or your administrator explicitly authorize for that integration.

4.4 Sensitive Categories of Data

AI Ethos Live is not designed to collect or process special categories of personal data as defined under GDPR (including racial or ethnic origin, political opinions, religious beliefs, trade union membership, genetic data, biometric data, health data, or data concerning sexual orientation) or sensitive personal information under the CCPA/CPRA. Customers are contractually responsible for ensuring that content they upload into the Services does not include such categories unless a separate agreement (for example, a HIPAA Business Associate Agreement) is in place and clearly authorizes it.

5. How We Use Your Information

We use personal information for the following purposes, each of which corresponds to a lawful basis under GDPR and UK GDPR as noted:

• Providing the Services (Contract): creating and maintaining accounts, authenticating users, delivering features, and responding to requests.
• Improving the Services (Legitimate Interests): analyzing usage patterns, diagnosing issues, and developing new features.
• Security and Fraud Prevention (Legitimate Interests, Legal Obligation): detecting, preventing, and responding to suspicious activity, misuse, and security incidents.
• Customer Support (Contract, Legitimate Interests): responding to your inquiries and providing assistance.
• Business Communications (Legitimate Interests, Consent where required): sending service announcements, onboarding messages, and, where permitted, relevant marketing communications. You may opt out of marketing messages at any time.
• Legal and Regulatory Compliance (Legal Obligation): complying with laws, responding to valid legal requests, and enforcing our terms.
• Federal and Regulated Industry Due Diligence (Legitimate Interests, Legal Obligation): fulfilling vendor due diligence obligations where our customers operate in federal, pharmaceutical, oil and gas, manufacturing, or other regulated contexts.

We do not use personal information for automated decision-making that produces legal or similarly significant effects on you without appropriate safeguards and, where required, your explicit consent.

6. Legal Bases for Processing (EU, UK, and EEA Residents)

Under GDPR and UK GDPR, we rely on the following legal bases depending on the purpose of processing:

• Performance of a contract with you or your organization.
• Compliance with a legal obligation to which we are subject.
• Our legitimate interests, provided these are not overridden by your rights and freedoms.
• Your consent, where required by law (for example, for certain marketing communications or non-essential cookies).

You have the right to withdraw consent at any time where processing is based on consent. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

7. How We Share Your Information

We do not sell personal information. We do not share personal information for cross-context behavioral advertising as defined under the CCPA/CPRA. We share information only in the following circumstances:

7.1 Service Providers and Processors

We work with trusted vendors that help us operate the Services, including cloud hosting (Google Cloud Platform, Firebase), authentication (Google Identity), analytics, customer support tools, and email delivery. These providers act as processors under GDPR and service providers under CCPA/CPRA. They are contractually bound to process personal information only as instructed by us and to implement appropriate security measures.

7.2 Business Transfers

If we are involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets, personal information may be transferred as part of that transaction. We will provide notice through the Services or by email of any change in control or use of your personal information.

7.3 Legal Requirements

We may disclose personal information when we believe in good faith that disclosure is necessary to comply with a legal obligation, respond to valid legal process, protect our rights or property, protect the safety of users or the public, or enforce our terms.

7.4 With Your Direction

We share information with third parties when you or your administrator direct us to do so, such as through authorized integrations or collaboration features.

7.5 Aggregated and De-Identified Information

We may share aggregated or de-identified information that cannot reasonably be used to identify you. Where we de-identify personal information, we commit to maintaining it in de-identified form and not attempting to re-identify it, except to test our de-identification processes.

8. International Data Transfers

AI Ethos Live is based in the United States and we may process personal information in the United States or other countries where we or our service providers operate. When we transfer personal information out of the European Economic Area, the United Kingdom, Switzerland, or Canada, we rely on appropriate safeguards, including:

• Standard Contractual Clauses approved by the European Commission and the UK Information Commissioner.
• Adequacy decisions issued by the European Commission or UK Government where applicable.
• Supplementary technical, contractual, and organizational measures where required based on our transfer impact assessments.

You may request a copy of the safeguards we apply to international transfers by contacting us at prasanthi@prasanthiballada.com.

9. Cookies and Similar Technologies

We use cookies and similar technologies to operate the Services, remember your preferences, analyze usage, and improve performance. The categories of cookies we use include:

• Strictly Necessary: required for the Services to function, including authentication and security.
• Functional: remember your preferences and settings.
• Analytics: help us understand how users interact with the Services so we can improve them.
• Marketing: where used, support relevant outreach. We do not use marketing cookies for cross-context behavioral advertising.

You can manage cookie preferences through your browser settings and, where applicable, through our cookie consent banner. Disabling certain cookies may affect the functionality of the Services.

10. Data Retention

We retain personal information only as long as necessary to fulfill the purposes described in this policy, unless a longer retention period is required or permitted by law. Retention periods depend on the type of information and the context:

• Account Data: retained for the life of your account and for a reasonable period afterward to support reactivation, respond to inquiries, and comply with legal obligations.
• Governance Content: retained per the customer agreement; upon termination, content is deleted or returned in accordance with that agreement.
• Log and Security Data: retained for a limited period sufficient to support security investigations and regulatory requirements.
• Billing and Tax Records: retained for the period required by applicable tax and accounting laws.

When we no longer need personal information, we securely delete, anonymize, or otherwise dispose of it.

11. Security

We implement administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, disclosure, alteration, and destruction. These include encryption in transit and at rest where appropriate, access controls based on least-privilege principles, logging and monitoring, secure development practices, and incident response procedures.

AI Ethos Live is pursuing SOC 2 Type II readiness and applies controls consistent with the SOC 2 Trust Services Criteria (Security, Availability, Confidentiality, and Privacy) as part of our ongoing information security program. While we strive to protect personal information, no system is completely secure. We encourage you to protect your account credentials and contact us immediately if you suspect any unauthorized access.

12. HIPAA Notice for Covered Entities and Business Associates

AI Ethos Live is not, by default, a HIPAA Business Associate. We do not intentionally collect Protected Health Information (PHI) through the Services. Customers in the pharmaceutical or healthcare sectors that intend to process PHI through AI Ethos Live must enter into a separate Business Associate Agreement (BAA) with us before uploading any PHI. Absent an executed BAA, customers agree not to upload PHI into the Services.

13. Your Privacy Rights

13.1 Rights Under GDPR and UK GDPR

If you are located in the European Economic Area, the United Kingdom, or Switzerland, you have the following rights, subject to applicable exceptions:

• Access: request a copy of the personal information we hold about you.
• Rectification: request correction of inaccurate or incomplete information.
• Erasure: request deletion of your personal information where no overriding legal basis applies.
• Restriction: request that we limit how we process your information.
• Portability: receive your information in a structured, commonly used, machine-readable format.
• Objection: object to processing based on legitimate interests or direct marketing.
• Withdrawal of Consent: withdraw consent where processing is based on consent.
• Lodge a Complaint: file a complaint with your local data protection authority.

13.2 Rights Under CCPA and CPRA (California Residents)

California residents have the right to:

• Know what categories and specific pieces of personal information we collect, use, disclose, and (if applicable) sell or share.
• Delete personal information we have collected, subject to exceptions.
• Correct inaccurate personal information.
• Opt out of the sale or sharing of personal information. AI Ethos Live does not sell personal information or share it for cross-context behavioral advertising.
• Limit the use and disclosure of sensitive personal information. AI Ethos Live does not use sensitive personal information for purposes that would require an opt-out.
• Non-discrimination for exercising your rights.

To designate an authorized agent to act on your behalf, please include documentation of the authorization in your request.

13.3 Rights Under PIPEDA (Canadian Residents)

Canadian residents have the right to access their personal information, request correction of inaccurate information, and file a complaint with the Office of the Privacy Commissioner of Canada. We collect and use personal information with your knowledge and consent, except where otherwise permitted by law.

13.4 How to Exercise Your Rights

To exercise any of these rights, contact us at prasanthi@prasanthiballada.com. We will verify your identity before fulfilling the request, which may involve confirming information you previously provided. We respond to verified requests within the timeframes required by applicable law.

14. Children's Privacy

The Services are intended for business use and are not directed to children under the age of 16. We do not knowingly collect personal information from children under 16. If you believe a child has provided us with personal information, please contact us so we can delete it.

15. Third-Party Links and Services

The Services may contain links to third-party websites or services that are not operated by AI Ethos Live. We are not responsible for the content or privacy practices of those third parties. We encourage you to review the privacy policies of any third-party services you use.

16. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or business operations. When we make material changes, we will update the Effective Date at the top of this policy and, where appropriate, provide additional notice through the Services or by email. Your continued use of the Services after a revised policy becomes effective constitutes acceptance of the changes.

17. Jurisdiction-Specific Contact Information

17.1 EU and UK Representative

Where required under GDPR Article 27 or UK GDPR, AI Ethos Live will appoint a representative in the European Union and the United Kingdom and publish contact details in this section. Until a representative is appointed, EU and UK residents may contact us directly at prasanthi@prasanthiballada.com.

17.2 Data Protection Authorities

• EEA residents: your local supervisory authority. A full list is available at edpb.europa.eu.
• UK residents: Information Commissioner's Office (ICO) at ico.org.uk.
• California residents: California Privacy Protection Agency at cppa.ca.gov.
• Canadian residents: Office of the Privacy Commissioner of Canada at priv.gc.ca.

18. Contact Us

Governance for AI. Before AI Governs You.