This Privacy Policy explains how Inspirae Corp. ("NoNarcissAI", "we", "us", or "our") collects, uses, stores and shares ("processes") your personal information when you use our services (the "Services"), including when you:

• Visit our website at nonarciss.ai or any website of ours that links to this Policy.

• Download, access, or use the NoNarcissAI App.

• Contact us or otherwise interact with us (support, communications, etc.).

If you do not agree with this Policy, please do not use the Services.

Questions or concerns? Reading this Policy will help you understand your privacy rights and the options available to you. We are responsible for making decisions about how your personal information is processed. Should you still have doubts or require further information, feel free to reach out to us at data@nonarciss.ai.

1. Information We Collect

A. Information You Provide

We collect personal information that you voluntarily provide to us when you register on the Services, express an interest in obtaining information about us or our products and Services, when you participate in activities on the Services, or otherwise when you contact us.

• Account & Profile: Email address, name or alias, date of birth, gender, country of residence. Authentication is handled by Firebase; we do not store or have access to your password.

• User Content: Your chats with our conversational agent Nini, your cases, and any files you upload (audio, images, videos, documents), including audio recordings and the transcripts generated by third-party speech-to-text ("STT") services (e.g., Whisper). We currently do not extract or store metadata such as EXIF or duration unless operationally necessary.

• Sensitive Information: When provided by you voluntarily through conversations with our chatbot, or as otherwise permitted by applicable law, we may use the following categories of sensitive information: (i) health data, including without limitation mental health data; and (ii) any other information you choose to share on the App.

• Communications: Information you provide via any of the means of communications we maintain with you, including messages sent to support, including privacy requests.

• Application Data: If you use the NoNarcissAI App, we also may collect the following information if you agree to provide us with access or permission:

  • Mobile Device Access: We may request access or permission to certain features from your mobile device, including your mobile device's microphone, calendar, reminders, and other features. If you wish to change our access or permissions, you may do so in your device's settings.

  • Mobile Device Data: We automatically gather details about your device, such as its ID, model, manufacturer, operating system, version data, and system configuration. This includes device and app identifiers, browser type and version, hardware model, Internet service provider or mobile carrier, and your Internet Protocol (IP) address or proxy. We may also obtain information related to the phone network linked to your mobile device, the device's operating system or platform, the specific type of mobile device you use, its unique identifier, and details about which features of our application(s) you interacted with.

  • Push Notifications: We might ask for permission to send you push notifications related to your account or specific features of our application(s). If you prefer not to receive these messages, you can disable them at any time through your device settings.

This information is primarily needed to maintain the security and operation of our application(s), for troubleshooting, and for our internal analytics and reporting purposes.

All personal information that you provide to us must be true, complete, and accurate, and you must notify us of any changes to such personal information.

B. Information Collected Automatically

We automatically collect certain information when you visit, use, or navigate the Services. This information does not reveal your specific identity (like your name or contact information) but may include device and usage information, such as your IP address, browser and device characteristics, operating system, language preferences, referring URLs, device name, country, location, information about how and when you use our Services, and other technical information. This information is primarily needed to maintain the security and operation of our Services, and for our internal analytics and reporting purposes.

This information we collect includes:

• Device & Usage Data: Device identifiers, operating system and version, language, time zone, app version, feature usage events, crash logs, and similar telemetry.

• Device & Usage Data: Device identifiers, operating system and version, language, time zone, app version, feature usage events, crash logs, and similar telemetry.

C. Information Not Collected

We do not collect or store payment card numbers or bank details. Purchases are handled by Apple App Store and Google Play. Your purchases are subject to the respective app store's terms and privacy notices.

We do not collect your passwords. You are solely responsible for maintaining the confidentiality of your Account password and username (if any), and any other security information related to your Account at all times. NoNarcissAI will not be liable for any loss that you incur as a result of someone else accessing and using your Account, either with or without your knowledge.

D. Categories of Personal Data We Collect

We and our Vendors have collected the following categories of personal information in the past twelve (12) months:

2. How We Use Personal Information

We process your personal information for a variety of reasons, depending on how you interact with our Services, including:

• To provide the Services: We may process your information in order to operate Nini, store and display your cases and uploads, deliver personal metrics, and include cases in the community feed when chosen.

• To support the creation and verification of accounts and to manage user profiles: We may process your information to enable you to register, access your account, and ensure it remains properly maintained.

• To secure the Services: We may process your information in order to troubleshoot, prevent fraud/abuse, measure performance and stability (analytics, crash logs), enforce geoblocking where required, and maintain safety features (see "Safety Processing & Risk Signals" below).

• To improve the Services using User Content: We may process your information, including the User Content (chats/cases/audio) to maintain, refine, and improve our artificial intelligence models, features, and heuristics. In order to improve the Services, we may analyze the content of conversations to understand opportunities for new features, model training, fine-tuning, data modelling and evaluate the performance of our existing Services. As part of these activities, we may use aggregated, de-identified, or other anonymized data from the personal information we collect. We make personal information into anonymized data by removing information that makes the data personally identifiable to you. We may also share that anonymized data and the result of our analysis and data modelling with third parties for business or commercial purposes.

• To request feedback: We may process your information when necessary to request feedback and to contact you about your use of our Services.

• Due to legal reasons: We may process your information in order to comply with law, enforce our Terms, and protect rights, safety, and property.

3. Legal Bases

We only process your personal information when we believe it is necessary and we have a valid legal reason (i.e., legal basis) to do so under applicable law, like with your consent, to comply with laws, to provide you with services to enter into or fulfill our contractual obligations, to protect your rights, or to fulfill our legitimate business interests.

The categories of third parties we may share personal information with are as follows:

• Infrastructure & Hosting: Google Cloud Platform (GCP) – us-central1 (Iowa, USA)

• Data Storage Service Providers: Amazon Web Services

• Authentication & App Services: Firebase (authentication, realtime database, push notifications)

• Speech-to-Text (STT): Whisper (and/or other STT providers as we may add)

• LLM/AI Inference: Providers such as OpenAI, Anthropic, Microsoft Azure AI, Google Cloud (list is illustrative, non-exhaustive)

• Analytics & Monitoring: Singular (MMP), Google Cloud Monitoring, Cloud Logging, Sentry and Firebase Crashlytics

• Communication & Collaboration Tools: Slack, Notion

• AI Service Providers: OpenAI, Anthropic

• Product Engineering & Design Tools

• Regulatory authorities having jurisdiction over NoNarcissAI

We require third parties to use personal information only under our instructions and for permitted purposes, and to implement appropriate security measures.

We may also disclose information: (i) to comply with law, legal process, or lawful requests; (ii) to protect rights, safety, and property (ours, yours, or others); (iii) in connection with, or during negotiations of, any merger, sale of company assets, financing, or acquisition of all or a portion of our business to another company; or (iv) with your consent.

5. International Transfers

Our systems are hosted in the United States (Google Cloud). If you are accessing our Services from outside the United States, please be aware that your information may be transferred to, stored by, and processed by us in our facilities and in the facilities of the third parties with whom we may share your personal information (see "Sharing and Disclosures" above), in the United States and other countries.

Certain countries or regions maintain data protection frameworks that provide for more stringent or comprehensive obligations than those in the United States or other jurisdictions in which data processing may occur. Where you reside in a jurisdiction whose applicable laws require enhanced protections for cross-border data transfers, we will implement all measures required to ensure that such transfers are carried out in compliance with those laws and with this Policy.

Legal Bases and Safeguards for International Data Transfers

To ensure an adequate level of protection for personal data transferred internationally, we rely on one or more of the following lawful transfer mechanisms, as applicable:

• Standard Contractual Clauses (SCCs) issued or approved by the competent regulatory authority;

• Data Privacy Framework participation mechanisms or equivalent frameworks, where applicable;

• Contractual, technical, and organizational safeguards designed to ensure that the transferred data receives a level of protection consistent with the requirements of the relevant data protection laws; and

• Any additional or alternative transfer mechanisms recognized under the laws of your country of residence.

These safeguards contractually oblige all recipients of your personal information to handle such data in accordance with the standards and obligations required under the applicable data protection laws. Further information of the safeguards implemented for international data transfers may be provided upon written request, subject to applicable confidentiality obligations.

6. Our Artificial Intelligence-Based Products

As part of our Services, we offer products, features, or tools powered by artificial intelligence, machine learning, or similar technologies (collectively, "AI Products"). These tools are designed to enhance your experience and provide you with innovative solutions. The terms in this Privacy Notice govern your use of the AI Products within our Services.

We provide the AI Products through proprietary artificial intelligence and third-party service providers ("AI Service Providers"), including, among others, OpenAI, Anthropic and other AI Service Providers we may include in the future. As outlined in this Privacy Notice, your input, output, and personal information will be shared with and processed by these AI Service Providers to enable your use of our AI Products for purposes outlined in Section 2 above. You must not use the AI Products in any way that violates the terms or policies of any AI Service Provider. Therefore, we recommend that you review the terms and policies of the foregoing AI Service Providers before using the Services.

Our AI Products are designed to function as a voice- and text-based AI chatbot. All personal information processed using our AI Products is handled in line with our Privacy Notice and our agreement with third parties. This ensures high security and safeguards your personal information throughout the process, giving you peace of mind about your data's safety.

How We Use Your Data Using AI

• Use of Personal Information for AI Training: We may collect and use personal information that you provide to us during your interaction with our services, including but not limited to, conversation and other communication data, preferences, feedback, and other information. This data may be used to improve and train the performance of our artificial intelligence models, ensuring that they are more accurate, efficient, and responsive.

• Data Anonymization: In our efforts to safeguard your privacy, we strive to anonymize and aggregate any personal information before it is used for training AI models. We take appropriate steps to remove identifiable data to the best extent possible, minimizing the risks associated with the use of personal information.

• Consent to Use of Data for AI Training: By using our Services, you consent to the collection, use and disclosure of your personal information as outlined in this Privacy Policy, including for the purpose of training and improving AI models.

• Data Security: We implement industry-standard security measures to protect the personal information you share with us. However, please be aware that no method of data transmission over the Internet is completely secure. While we strive to protect your personal data, we cannot guarantee its absolute security.

• Your Rights: You have the right to access, correct, or delete any personal information we hold about you. However, notwithstanding this right, we can continue to use personal information used in reliance on your original consent. For example, if we have refined our AI software using your personal information, we cannot undo that prior use made in reliance on your earlier consent despite your decision to revoke your consent going forward.

7. Safety Processing & Risk Signals

We operate best-effort measures (including automated prompts and limited post-message checks) to detect imminent risk (self-harm or harm to others). If risk signals are detected, we may temporarily block use and display crisis resources. These measures do not create a duty to monitor or to intervene and are not a substitute for professional help or emergency services.

8. Data Retention

We keep your personal information only for as long as we need it to carry out the purposes described in this Policy, unless the law requires or allows us to keep it for a longer period (for example, for tax, accounting, or other legal obligations). None of the purposes in this Policy require us to keep your personal information longer than the time you maintain an account with us.

When we no longer have a valid business reason to keep processing your personal information, we will delete it or anonymize it. If deleting or anonymizing your information is not possible at that moment (for example, because it's stored in secure backup systems), we will keep it safely stored and prevent it from being used for any other purpose until deletion becomes possible.

9. Security

We implement reasonable technical and organizational measures designed to protect any personal information we process.

• Encryption: Data is encrypted in transit (TLS) and at rest.

• Incidents: If we learn of an incident affecting personal information, we will take steps to investigate and will notify you and/or regulators as required by law.

While we use safeguards and take reasonable steps to protect your information, no method of transmitting data over the Internet or storing information can ever be completely secure. This means we cannot guarantee that hackers, cybercriminals, or other unauthorized third parties will never be able to bypass our security measures and improperly access, steal, or alter your information. We will continue to do our best to safeguard your personal data, but any transmission of information to or from our Services is done at your own risk. You should only access the Services from a secure environment.

10. Your Privacy Rights

Depending on your location, you may have rights to request access, correction, deletion, portability, restriction, or objection to certain processing; to opt out of targeted advertising or "sales/sharing" under certain U.S. state laws; and to not be subject to decisions based solely on automated processing that produce legal or similarly significant effects.

Your Rights

You have rights under certain U.S. Privacy Laws. However, these rights are not absolute, and in certain cases, we may decline your request as permitted by law. These rights include:

• Right to know whether or not we are processing your personal data

• Right to access your personal data

• Right to correct inaccuracies in your personal data

• Right to request the deletion of your personal data

• Right to obtain a copy of the personal data you previously shared with us

• Right to non-discrimination for exercising your rights

• Right to opt out of the processing of your personal data if it is used for targeted advertising, the sale of personal data, or profiling in furtherance of decisions that produce legal or similarly significant effects ("profiling")

How to Exercise Your Rights

• How to submit a request: Use the in-app settings or email data@nonarciss.ai. Please specify the right(s) you wish to exercise and provide information sufficient to verify your identity.

• Verification: We verify requests via your in-app authenticated session and/or email verification. If we cannot verify your identity, we may request additional information.

• Timing: We will respond as required by law (e.g., 45 days under certain U.S. state laws, subject to lawful extensions).

• Appeals (U.S. states): If we deny your request, you may appeal by contacting data@nonarciss.ai. If your appeal is denied, you may contact your state regulator as allowed by law.

• Fees: We do not charge fees unless a request is manifestly unfounded or excessive.

• Non-Discrimination: We will not discriminate against you for exercising your rights.

Withdrawing Your Consent

If we are relying on your consent to process your personal information, which may be express and/or implied consent depending on the applicable law, you have the right to withdraw your consent at any time. You can withdraw your consent at any time by contacting us by using the contact details provided in the section "Contact Us" below or updating your preferences.

However, please note that this will not affect the lawfulness of the processing before its withdrawal nor, when applicable law allows, will it affect the processing of your personal information conducted in reliance on lawful processing grounds other than consent.

Account Information

If you would at any time like to review or change the information in your account or terminate your account, you can log in to your account settings and update your user account.

Upon your request to terminate your account, we will deactivate or delete your account and information from our active databases. However, we may retain some information in our files to prevent fraud, troubleshoot problems, assist with any investigations, enforce our legal terms and/or comply with applicable legal requirements.

11. Children's Privacy

The Services are intended only for individuals 18+. We do not knowingly collect personal information from children under 18. If you believe a minor has provided personal information, contact us at data@nonarciss.ai and we will take appropriate steps to delete it.

12. Cookies & Tracking Technologies

The mobile app may use SDKs and similar technologies (e.g., Singular, Firebase, Sentry, Firebase Crashlytics, Google Cloud Monitoring/Logging) to support analytics, attribution, crash reporting, and performance. You can adjust certain permissions (e.g., notifications) in your device settings.

13. International Users

Our Services are hosted in the United States and are not currently offered in the EU/EEA, UK, Switzerland, the Russian Federation and the People's Republic of China, and/or any other jurisdictions NoNarcissAI may choose to refrain from providing Services in. If you access the Services from outside the United States, you understand your information will be transferred to and processed in the United States and other countries where our providers operate.

14. Changes to This Policy

We may update this Policy from time to time. The "Last updated" date will be revised accordingly. If we make material changes, we will notify you via in-app notice or email.

15. Contact Us

You may contact us via email at:

Inspirae Corp.

108 Lakeland Ave.

Dover, Kent, Delaware 19901

United States

Email: data@nonarciss.ai

Controller: Inspirae Corp., 108 Lakeland Ave., Dover, Kent, Delaware 19901, United States.