Privacy Policy

1. Introduction, Scope, and Entity Identity

Deciphai Cognitive Solutions, LLC (along with its subsidiaries and corporate affiliates, collectively referred to herein as “Deciphai,” “we,” “us,” or “our”) is fundamentally committed to protecting the privacy, confidentiality, and security of personal data processed across our ecosystem.

This Comprehensive Privacy Policy ("Privacy Policy") governs the collection, storage, processing, transfer, and disclosure of Personal Information (as defined below) across all touchpoints of our digital operations, including:

• Our primary marketing and corporate web properties (including *.deciphai.com and *.decicore.dev and deci-core.com).
• The DeciCore Custom Development Environment, application programming interfaces (APIs), software engines, developer tools, and telemetry frameworks (collectively, our "PaaS" environment).
• Our pre-configured, turnkey, and standalone software applications, dashboards, workflows, and modules (collectively, our "SaaS" applications).
• Any corporate interactions, support tickets, sales channels, or administrative communications initiated with our team.

By interacting with the Platform, creating an account, deploying our infrastructure, or utilizing our turnkey software suites, you explicitly acknowledge the data practices described in this Privacy Policy.

2. The Critical Legal Nexus: Data Controller vs. Data Processor

To ensure proper allocation of regulatory liability under global privacy frameworks (including GDPR, CCPA/CPRA, and state-level data protection statutes), a strict legal distinction must be drawn between Deciphai's operational modalities:

Deciphai as a Data Controller

Deciphai acts as a Data Controller when we autonomously determine the purposes and means of processing personal data. This applies to information collected directly from business clients, registered developers, account purchasers, and website visitors. Crucially, automatically collected technical data, infrastructure logs, billing records, and API usage telemetry are processed by Deciphai as an independent Data Controller solely to execute consumption metering, validate billing cycles, prevent multi-tenant network abuse, and maintain overall platform infrastructure resilience.

Deciphai as a Data Processor / Service Provider

Deciphai acts strictly as a Data Processor (or Service Provider) when our clients utilize the DeciCore PaaS engine or our turnkey SaaS applications to collect, host, process, or transmit data belonging to their own customers or end-users (e.g., chat logs, database records, client telemetry, or routed SMS/Email payloads).

In these configurations, our client remains the Data Controller, and Deciphai processes such data strictly in accordance with the client’s documented instructions, our Terms of Service, and our mandatory Data Processing Agreement (DPA). This Privacy Policy does not apply to our clients' end-users; those individuals must consult the respective privacy policies of the organization controlling their applications.

3. Categories of Personal Information We Collect

We collect information that identifies, relates to, describes, or is reasonably capable of being associated with a particular individual ("Personal Information"). The categories of data we collect depend on the nature of your interaction with our Platform:

A. Information Voluntarily Provided by You

• Identifiers and Account Credentials: Full name, corporate email address, telephone number, account username, encrypted passwords, and multi-factor authentication (MFA) tokens.
• Commercial and Financial Information: Corporate billing address, tax identification numbers, partial payment card data (processed securely via PCI-compliant third-party gateways), purchase histories, wallet transactions, and subscription tier metrics.
• Professional and Employment Data: Job title, company name, industry sector, business size, and development preferences.
• Communication and Support Payloads: Transcripts from customer support chats, email exchanges, system bug reports, and any feedback or feature requests submitted to our engineering teams.

B. Information Automatically Collected via Platform Infrastructure

• Telemetry and Usage Metrics: Detailed logs of API requests, code execution metrics, system response speeds, server timeouts, database query volumes, and performance configurations within the DeciCore environment.
• Device and Network Identifiers: Internet Protocol (IP) addresses, MAC addresses, operating system types and versions, browser types, language settings, and unique device fingerprints.
• Behavioral Analytics: Navigation paths, clicked links, time spent on specific platform modules, and search queries within our documentation engines, captured via cookies, tracking pixels, web beacons, and local storage objects.

C. Information Sourced from External Third Parties

• Lead Generation and Marketing Partners: Professional contact details, corporate demographics, and intent-to-purchase data compiled from authorized marketing vendors, data brokers, and event organizers.
• Affiliate and Reseller Ecosystems: Account identifiers and referral data routed to us when an enterprise joins via a white-label partner or an affiliate network.
• Public and Social Repositories: Publicly viewable profiles from platforms such as GitHub, LinkedIn, or state corporate registration registries used to verify account authenticity and prevent fraud.

4. Comprehensive Purpose and Legal Basis for Processing

We process Personal Information under strictly defined operational directives and lawful foundations. Depending on your jurisdiction, we rely on Consent, Contractual Necessity, Legal Obligations, or our Legitimate Interests to execute the following processes:

Strict AI Training Exclusion Shield

Crucial Corporate Guarantee: Deciphai categorically does not utilize your proprietary data, customer data inputs, source code repositories, or customer prompts routed through our AI-driven PaaS or SaaS endpoints to train public, generalized, or multi-tenant machine learning models. All AI endpoints operate within secure, isolated runtime partitions.

5. Onward Transfer, Disclosure, and Third-Party Integrations

Deciphai does not sell, rent, or lease your Personal Information to external entities for financial gain. We only disclose your data under the following highly regulated contexts:

• Corporate Affiliates: We share data within our corporate ownership hierarchy to streamline billing, platform engineering, and administrative workflows.
• Vetted Service Providers (Subprocessors): We contract specialized vendors to manage cloud hosting infrastructure (e.g., AWS, Google Cloud), execute credit card payments, run customer support software, and process technical metrics. These entities are bound by strict DPAs and are legally prohibited from utilizing your data for any independent purpose.
• Ecosystem and Affiliate Partners: If you register an account through an authorized third-party reseller or affiliate referral link, we share minimal confirmation metrics (such as subscription tier status) with that specific partner to facilitate financial tracking.
• Requested Third-Party Integrations: If you explicitly instruct Deciphai to bind external software utilities (such as Google Workspace APIs, CRM bridges, or webhooks) to your environment, your data will flow into those systems and immediately become subject to those specific entities' respective privacy terms.
• Corporate Reconstruction: In the event of an asset sale, merger, consolidation, restructuring, or bankruptcy, Personal Information will be audited and transferred to successor entities as a primary corporate asset.
• Legal Compulsion and Public Safety: We will disclose detailed records to federal, state, or international authorities if compelled by a lawful subpoena, court order, or national security directive, or if we determine in good faith that disclosure is necessary to protect our multi-tenant infrastructure or prevent imminent fraud.
• Subprocessors: A complete, up-to-date list of our specific infrastructure subprocessors and financial processors (including Stripe and cloud providers) is maintained in our compliance center and available upon request.

Telecommunications Privacy Guardrail

SMS opt-in data, phone numbers collected for text message routing, and related consumer consent records are completely excluded from all third-party marketing or sharing agreements. This data is kept strictly isolated and used solely for routing infrastructure execution.

5.A. Specialized Processing for Custom Domain Registrations

If the Platform enables you to purchase, provision, or register custom web domains natively through our ecosystem, Deciphai processes your Personal Information to maintain your domain registration in cooperation with authorized third-party domain name registrars. You explicitly authorize Deciphai to transmit required data elements to the Internet Corporation for Assigned Names and Numbers (ICANN), designated registry operators, and ICANN-authorized escrow service providers to fulfill the Registrar Accreditation Agreement. You assume full liability for securing equivalent legal consents if you provide Personal Information relating to a third-party registrant.

6. Rigorous Data Security and Encryption Protocols

We maintain extensive administrative, logical, and physical security measures engineered to safeguard Personal Information against accidental destruction, unauthorized modification, or illicit data exfiltration.

• Encryption-in-Transit: All data entering or leaving the Platform is encrypted using Transport Layer Security (TLS 1.3 or equivalent industry standards).
• Encryption-at-Rest: All database records, structural schemas, backups, and configurations are protected by Advanced Encryption Standard (AES-256) algorithms.
• Infrastructure Isolation: Multi-tenancy on the DeciCore platform is maintained through rigorous logical network partitioning and continuous pen-testing to prevent cross-tenant exposure.
• Access Controls: Internal access to Deciphai production systems is governed by Principle of Least Privilege (PoLP) models, requiring multi-factor authentication and continuous zero-trust validation.
• Incident Response: In the event of a confirmed notifiable breach, customers will be notified within 72 hours.
• Your Responsibility: You are accounted to enable multi-factor authentication, to keep your account credentials strictly confidential, and to let us know if any of your information needs to be corrected or updated.
• Physical Infrastructure Security: Our platform infrastructure is hosted using enterprise-grade, third-party cloud service providers (such as Google Cloud Platform). All data is housed in state-of-the-art data centers certified under SOC 2 and ISO 27001 frameworks. Physical access to these servers is protected by rigorous perimeter controls, 24/7 security guards, biometric access logs, continuous CCTV monitoring, and industrial environmental safeguards (including redundant power backups and fire suppression infrastructure).
• Technical Safeguards: In addition to physical security, we protect data using industry-standard encryption protocols both in transit and at rest, alongside role-based internal access controls.

No digital architecture is flawlessly bulletproof. You hold exclusive liability for securing your administrative API keys, developer passwords, and authorization tokens.

7. Data Retention, Purging, and De-identification

We retain Personal Information only for the duration necessary to satisfy the specific operational purposes for which it was gathered, or as mandated by state, federal, or international record-retention statutes (such as tax laws or corporate financial regulations).

Upon project deletion, Decipher removes project data from active systems within 30 days and from backups within 90 days

Upon account closure, or after a maximum of ninety (90) days post-termination, Deciphai executes automated data purge sequences to irreversibly overwrite, overwrite-delete, or anonymize your data. Usage Data and de-identified analytics may be retained for an unlimited time.

De-identified Data Standard

When Deciphai transforms Personal Information into completely de-identified or aggregated metadata for statistical research and network optimization, we legally commit to maintaining and using that data exclusively in a non-identifiable format, and will never attempt to re-identify it.

Identifiers, analytics tokens, and behavioral telemetry derived from tracking cookies or web beacons are subjected to hard operational lifecycles and are automatically deleted or irreversibly anonymized within thirteen (13) months from the date of initial generation.

8. Your Global and Regional Privacy Rights

Depending on your geographic location or state residency, you possess explicit, legally enforceable rights regarding your Personal Information. Deciphai facilitates the seamless execution of these rights through our dedicated compliance intake.

A. European Economic Area (EEA), United Kingdom (UK), and Switzerland

Under the European GDPR, UK GDPR, and Swiss nFADP, you possess the following explicit data subject rights:

• Right of Access and Portability: Request a structured, machine-readable layout of all Personal Information we hold regarding you.
• Right to Rectification and Erasure: Command the instant correction of inaccurate data or the complete deletion of your records, subject to surviving legal retention overrides.
• Right to Object or Restrict Processing: Limit or completely halt our processing of your data based on legitimate interests or direct marketing directives.
• Right to Withdraw Consent: Revoke your previously given consent at any time without impacting past lawful processing.
• Regulatory Recourse: Lodge formal grievances directly with your local supervisory body (e.g., the UK Information Commissioner’s Office (ICO) or the French CNIL).

B. United States Comprehensive State Privacy Rights

Residents of states with active comprehensive privacy laws—including California (CCPA/CPRA), Texas (TDPSA), Florida (Digital Bill of Rights), Virginia (VCDPA), Colorado (CPA), and other modern state frameworks—hold the following statutory protections:

• Right to Know and Access: Request details regarding the specific categories of data collected, the business purposes for collection, and the identities of third parties with whom data was shared over the preceding twelve (12) months.
• Right to Opt-Out of Targeted Advertising / "Sharing": While we do not swap data for traditional fiat currency, passing tracking tokens to ad networks can be legally deemed a "sale" or "share." You may seamlessly opt out via our "Do Not Sell or Share My Info" framework on the platform.
• Right to Correct and Delete: Request modifications to broken records or systemic deletion of your administrative information.
• Right to Limit Sensitive Data: We strictly restrict the processing of sensitive data elements (such as billing details or system access tokens) exclusively to essential operational tasks. You have the right to enforce this limit.
• Non-Discrimination Assurance: We explicitly prohibit any degradation of platform access, throttling of APIs, or price inflation against any developer who exercises their statutory privacy rights.
• Appeals Framework: If we deny an access request, you may initiate a formal corporate appeal by contacting our general counsel. If the appeal is denied, you may report the outcome to your state’s Attorney General.

C. Canadian Privacy Frameworks

Under the Personal Information Protection and Electronic Documents Act (PIPEDA) and provincial laws (such as Quebec’s Law 25), Canadian users hold strict rights to access, copy, and challenge the accuracy of their Personal Information. All data requests are thoroughly vetted through identity verification and resolved within thirty (30) days.

9. International Data Transfers and Data Privacy Framework (DPF)

Deciphai operates as a U.S.-headquartered global entity. Personal Information may be securely routed, processed, and maintained on server networks located inside the United States, or managed by international subsidiaries or vendors in regions such as India. We enforce equivalent corporate security mandates on all overseas transfers.

• User-Initiated Transfer: By creating an account or utilizing our SaaS tools, users residing outside the United States—including within the European Economic Area (EEA), United Kingdom (UK), and Switzerland—explicitly acknowledge and direct that their Personal Information will be transferred to, stored, and processed in the United States. This cross-border transfer is fundamentally required to execute our Terms of Service and deliver our services to you.
• Data Privacy Framework Validation: To safeguard these international transfers, Deciphai Cognitive Solutions, LLC complies fully with the EU-U.S. Data Privacy Framework (EU-U.S. DPF)

Data Privacy Framework Certification

Deciphai Cognitive Solutions, LLC complies fully with the EU-U.S. Data Privacy Framework (EU-U.S. DPF), the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF) as set forth by the U.S. Department of Commerce.

We have certified to the U.S. Department of Commerce that we adhere to the Data Privacy Framework Principles regarding notice, choice, accountability for onward transfer, security, data integrity, purpose limitation, access, and recourse.

• Jurisdiction: The U.S. Federal Trade Commission (FTC) retains ultimate investigative and enforcement authority over our DPF compliance.
• Onward Transfer Liability: Deciphai remains strictly liable under the DPF Principles if our downstream third-party service providers process your Personal Information in a manner inconsistent with those principles, unless we prove we are completely blameless for the event giving rise to the damage.
• Dispute Recourse: For unresolved complaints under the DPF framework, you may escalate your inquiry to an independent alternative dispute resolution provider located in the United States (such as JAMS Mediation). Under specific conditions, you may invoke binding arbitration for unresolved elements.

10. Miscellaneous Provisions

A. Protection of Minors

Our Platform, developer tools, and SaaS architectures are engineered exclusively for adult corporate professionals, developers, and businesses. We do not intentionally track, market to, or collect data from individuals under sixteen (16) years of age. If we learn that a minor has bypassed safety checks and input personal data, we will immediately execute hard deletion protocols to wipe the data from our live databases.

B. "Do Not Track" and Global Privacy Control (GPC) Signals

While standard browser-based "Do Not Track" (DNT) toggles lack a uniform legal or engineering consensus, our Platform is engineered to automatically detect and honor Global Privacy Control (GPC) signal broadcasts. When your browser broadcasts a valid GPC signal, our systems automatically interpret it as a valid request to opt out of targeted advertising cookies.

C. Amendments to this Privacy Policy

We reserve the right to modify, adapt, or completely overhaul this Privacy Policy at our discretion at any time, provided we supply active subscribers with at least fifteen (15) days' advance notice via email or in-platform notification, to align with technological shifts, product expansions, or changing global statutes. Continued use of the Platform following published modifications constitutes your explicit acceptance of the updated Terms.

D. Technical Conduit Limitation for Pass-Through AI Gateways

Where our PaaS or SaaS tools act as an API gateway or proxy layer connecting your applications to third-party artificial intelligence engines (such as models connected via user-supplied API keys), your inputs, prompts, and system data are transmitted on a strict pass-through basis. Deciphai does not control the data-handling infrastructure of these external providers, and you retain exclusive responsibility for reviewing and establishing direct data protection compliance with those independent entities.

11. Corporate Contact and Compliance Information

To exercise your global data rights (such as submitting an access, correction, or deletion request), to appeal a denied request, or to submit questions regarding our privacy architecture, please route all formal inquiries to our corporate compliance division:

• Email Contact: privacy@deciphai.com
• Mailing Address:
  Deciphai Cognitive Solutions, LLC
  Attn: Privacy & Compliance Officer
  511 SE 5th Ave. #706
  Fort Lauderdale, FL 33301-2968