Global Privacy Policy

Document Reference: AUC-LEG-PRIV-001
Version: 3.2.0
Effective Date: October 24, 2026
Last Updated: October 24, 2026
Classification: Public / Legal
Regulatory Baselines: Regulation (EU) 2016/679 (GDPR) | UK GDPR | California Consumer Privacy Act as amended (CPRA) | Swiss FADP | Canadian PIPEDA

Executive Summary (ISO 24495-1 Plain-Language Overview)

[!IMPORTANT] Legal Precedence Notice: This plain-language summary is provided solely for reader convenience and compliance audit navigation pursuant to ISO 24495-1:2023. It does not constitute binding legal terms, covenants, or warranties. In the event of any ambiguity, conflict, or inconsistency between this summary and the operative articles below, the operative articles strictly govern and control.

• Scope & Demarcation: This Policy governs personal data Auctoric collects as an independent Data Controller (website visitors, platform account holders, direct business contacts). Enterprise customer inputs, prompts, and outputs processed via platform APIs are governed separately by our Data Processing Addendum (DPA) and AI DPA & Model Non-Retention Addendum.
• Strict Zero-Sale & Non-Retention Commitment: Auctoric does not sell personal data, does not share personal data for cross-context behavioral advertising, and never trains or fine-tunes foundation AI models on customer inputs.
• Global Statutory Alignment: Full harmonization with EU/UK GDPR, California CPRA, Swiss FADP, and Canadian PIPEDA, including standard statutory legal bases (contract performance, legal obligations, and legitimate interest).
• Individual Rights & SLA: Data subjects can exercise rights to access, rectify, delete, restrict, port, or object to personal data processing within 30 statutory days by contacting privacy@auctoric.ai.
• Security & Infrastructure Safeguards: All personal data is protected by TLS 1.3 in transit, KMS envelope encryption at rest, mandatory MFA, and continuous SOC 2 Type II and ISO 27001:2022 audited controls.

High-Intent Privacy FAQ (AEO Direct Answers)

Does Auctoric sell personal data or share it for targeted advertising?

No. Under Section 7.6 of this Policy, Auctoric does not sell personal information or share personal data with third parties for cross-context behavioral advertising as defined under the California Consumer Privacy Act (CPRA).

How does Auctoric distinguish between Controller and Processor roles?

Auctoric acts as a Controller only for direct account data, billing, telemetry, and website interactions. For all customer data, prompts, documents, and API inputs processed through our AI platform, the Customer is the Data Controller and Auctoric acts strictly as a Data Processor under our Data Processing Addendum.

How can data subjects submit GDPR or CPRA Data Subject Requests (DSRs)?

Data subjects may submit formal access, correction, or deletion requests by emailing privacy@auctoric.ai or accessing our Data Privacy Portal at https://trust.auctoric.ai/privacy/requests. Auctoric verifies identity and responds within thirty (30) calendar days.

1. Introduction & Scope

Auctoric, LLC (“Auctoric”, “we”, “us”, or “our”) provides an enterprise-grade Governed AI-as-a-System platform. We are committed to upholding data protection, transparency, and individual privacy rights.

This Global Privacy Policy (“Policy”) explains how we collect, use, disclose, and protect personal data across our websites, cloud platform, developer consoles, APIs, and client-facing AI governance solutions. It applies to:

• Visitors to our websites (https://auctoric.ai);
• Registered users, administrators, and developers utilizing our platform;
• Individuals whose contact information is collected through sales and marketing initiatives.

[!NOTE] When our enterprise customers process personal data within their own prompts, datasets, or inputs through the Auctoric platform, Customer is the Data Controller and Auctoric is the Data Processor (or Service Provider). In those scenarios, data processing is governed by our Data Processing Addendum (DPA) and AI DPA & Model Non-Retention Addendum.

2. Categories of Personal Data We Collect

3. How We Use Personal Data

We use personal data strictly for legitimate operational purposes, including:

1. Providing, hosting, securing, and maintaining the Auctoric Platform;
2. Authenticating user identity, enforcing role-based access control (RBAC), and detecting unauthorized access;
3. Metering API usage, calculating billable tokens, and processing subscription invoices;
4. Enforcing our Acceptable Use Policy and mitigating cybersecurity threats (e.g., prompt injection, DDoS);
5. Complying with applicable laws under GDPR, CCPA, HIPAA, CJIS, and the EU AI Act.

[!IMPORTANT] Zero Customer Data Retention for Base Model Training: Auctoric does NOT sell personal data, nor do we use Customer Content (prompts, inputs, vector embeddings, outputs) to train or improve public foundational models.

4. Subprocessors and Data Disclosures

Auctoric shares personal data only with trusted third-party service providers (“Subprocessors”) who are contractually bound by confidentiality and data protection obligations:

• Cloud Infrastructure Providers: Enterprise hyperscalers hosting compute, container orchestration, and isolated VPC storage (as cataloged in the Sub-processor Schedule);
• Payment Gateways: PCI-DSS Level 1 certified processors (e.g., Stripe);
• Security & Monitoring Providers: Managed threat detection, telemetry aggregation, and WAF providers.

An updated list of authorized Subprocessors is cataloged in our Sub-processor Schedule and maintained online at https://trust.auctoric.ai/sub-processors.

5. International Data Transfers

When transferring personal data from the European Economic Area (EEA), the United Kingdom, or Switzerland to countries without an adequacy decision, Auctoric executes:

• Standard Contractual Clauses (SCCs) approved by the European Commission (Implementing Decision (EU) 2021/914);
• The UK International Data Transfer Addendum to the EU SCCs (or UK International Data Transfer Agreement where applicable);
• Supplementary technical measures including AES-256 encryption in transit (TLS 1.3) and at rest, isolated VPC execution enclaves, and strict cryptographic access management.

6. Retention of Personal Data

We retain personal data only as long as necessary to fulfill the purposes for which it was collected:

• Account Records: Kept for the duration of the active subscription plus required financial retention periods (typically 7 years for tax/accounting).
• System Logs & Audit Traces: Retained for 365 days for operational security forensics and compliance alignment, then automatically purged.
• Customer Inference Ephemeral Enclave: Real-time inference data in volatile memory is not persisted post-response generation, unless Customer explicitly configures asynchronous logging or custom retention buckets.

7. Individual Data Subject Rights

Depending on your jurisdiction (e.g., GDPR, CCPA/CPRA, LGPD), you possess specific legal rights regarding your personal data:

1. Right of Access & Portability: Request a copy of your personal data in a structured, machine-readable format.
2. Right to Rectification: Correct inaccurate or incomplete information.
3. Right to Erasure (“Right to be Forgotten”): Request deletion of personal data where statutory retention grounds no longer apply.
4. Right to Restrict or Object to Processing: Object to processing based on legitimate interests or direct marketing.
5. Rights Regarding Automated Decision-Making & Profiling: Understand the logic involved in automated systems and request human intervention. See our Automated Decision-Making Notice.
6. Right to Opt-Out of Sale / Sharing (California CPRA): Auctoric does not sell or share personal information for cross-context behavioral advertising.

To exercise these rights, email privacy@auctoric.ai or submit a request via our Data Privacy Portal at https://trust.auctoric.ai/privacy/requests.

8. Security Measures

Auctoric implements technical and organizational safeguards engineered to comply with ISO/IEC 27001:2022, ISO/IEC 42001:2023, and SOC 2 Type II control criteria:

• Mutual TLS 1.3 encryption across all internal microservice communication and external endpoints;
• KMS key management with envelope encryption;
• Role-based access control (RBAC), multi-factor authentication (MFA), and least-privilege administrative access;
• Continuous automated vulnerability scanning and independent penetration testing.

9. Contact and Data Protection Officer (DPO)

For inquiries, concerns, or formal privacy requests, please contact our Data Protection Officer:

• Data Protection Officer: Office of the Data Protection Officer
• Email: dpo@auctoric.ai or privacy@auctoric.ai
• Corporate Address: Auctoric, LLC, Attn: Privacy Office, 2740 SW Martin Downs Blvd., Suite 130, Palm City, FL 34990
• EU Representative (GDPR Art. 27): Auctoric EU Compliance (dpo@auctoric.ai)
• UK Representative (UK GDPR): Auctoric UK Compliance (dpo@auctoric.ai)