QWERKY AI, INC.

GLOBAL PRIVACY POLICY

Effective Date: Jan 21, 2026

SINGLE POINT OF CONTACT FOR ALL PRIVACY MATTERS WORLDWIDE:

This email address serves as the sole contact for all privacy inquiries, data subject requests, complaints, and EU/UK representative matters globally.

1. INTRODUCTION AND SCOPE

QWERKY AI, Inc. (“QWERKY AI,” “Company,” “we,” “us,” or “our”) is a Delaware corporation headquartered in Columbia, South Carolina, USA. We provide artificial intelligence consulting services, trained AI model products, and AI model hosting services (collectively, the “Services”).

This Global Privacy Policy (“Policy”) explains how we collect, use, disclose, retain, and protect personal information. This Policy applies globally to all individuals who interact with our Services, websites, APIs, or communications.

We are committed to transparency, privacy-by-design principles, and compliance with applicable data protection laws worldwide. We do not sell your personal information for monetary consideration.

2. INFORMATION WE COLLECT

2.1 Information You Provide Directly

• Account Information: Name, email address, phone number, company name, job title, billing/payment information.

• Service Data: Data, files, prompts, queries, inputs, outputs, and specifications you submit to our Services or during consulting engagements.

• Communications: Messages, support requests, feedback, and correspondence.

• Feedback: Ratings, thumbs up/down, comments, and other explicit feedback you provide about our Services.

We do not intentionally collect Sensitive Personal Information through our Service. "Sensitive Personal Information" includes, but is not limited to: health or medical information, financial account details, government-issued identification numbers, precise geolocation data, racial or ethnic origin, religious beliefs, sexual orientation, and biometric data.

Please do not submit Sensitive Personal Information when using our Service, including through any AI models, communication channels, or other features we provide. We are not designed to process or store such information, and you assume all risk associated with any voluntary disclosure of Sensitive Personal Information.

2.2 Information Collected Automatically

• Usage Data: Interactions with our AI systems, including queries, responses, session duration, feature usage.

• Technical Data: IP address, device type, browser type, operating system, referring URLs, access times, time zone.

• Log Data: API calls, error logs, performance metrics, system events, security logs.

• Cookies and Similar Technologies: Session identifiers, preferences, analytics data. See Section 10 for details.

2.3 Information from Third Parties

We may receive information from: publicly available sources; business partners and resellers; identity verification services; analytics providers; cloud infrastructure providers.

3. HOW WE USE YOUR INFORMATION

• Provide Services: Operate, maintain, personalize, and deliver our consulting, AI model, and hosting services.

• Improve Services: Analyze usage patterns, conduct research, debug issues, and develop new features.

• AI Development: Train, develop, fine-tune, and improve AI models using de-identified data (see Section 4).

• Safety and Security: Detect, prevent, and address fraud, abuse, security incidents, harmful content, and policy violations.

• Communications: Send service-related notices, respond to inquiries, and (with consent where required) marketing communications.

• Legal Compliance: Comply with applicable laws, respond to legal requests, enforce agreements, protect rights.

• Aggregation and Analytics: Create aggregated, anonymized, or de-identified data for analytics, benchmarking, and research.

4. AI MODEL TRAINING AND DATA HANDLING

This section explains how we handle data for artificial intelligence development. Understanding this section is critical to understanding your privacy rights.

4.1 Commercial Services (Enterprise/API Customers)

For Commercial Customers using enterprise consulting services, custom model development, or API access under our Commercial Terms:

• By default, we do NOT use your inputs, outputs, or content to train our general AI models.

• Your data is processed solely to provide the contracted Services.

• Any use of your data for model training requires explicit written agreement.

• We maintain agreements with third-party model providers (where applicable) ensuring your data is not used for their model training.

• Zero Data Retention (ZDR) options may be available for API customers upon request.

4.2 Consumer/Individual Services

For individual users of consumer-facing services (if offered):

• Data you provide may be used to improve our AI models after de-identification.

• You may opt out of model training by emailing privacy@qwerky.ai with subject “Opt-Out of AI Training.”

• If you opt out, we will not use new data for future model training.

• Data already de-identified and incorporated into trained models cannot be extracted.

• Deleted conversations will not be used for future model training.

4.3 De-Identification Before Training

Before using any data for AI model training, fine-tuning, or improvement, we apply de-identification processes designed to remove or transform personal identifiers:

• Removing direct identifiers (names, email addresses, phone numbers, account numbers, addresses)

• Applying tokenization, generalization, perturbation, and pseudonymization techniques

• Aggregating data to prevent individual identification

• Filtering sensitive categories of information

• Delinking data from user accounts before training use

4.4 Technical Reality of AI Training

Once data is used to train an AI model, it becomes embedded in the model’s parameters (weights) in ways that make it technically impractical to extract or delete specific data points from the trained model. This is an inherent characteristic of machine learning technology, not a policy choice. By de-identifying data before training:

• Our AI models do not “learn” your personal information in identifiable form

• Models learn patterns and relationships from de-identified data, not individual identities

• De-identified data is not “personal data” under applicable privacy laws

4.5 Output Filtering and Safety

We implement output filtering, content moderation, and monitoring systems designed to:

• Prevent AI models from generating outputs containing personal information

• Detect and block attempts to extract training data

• Ensure outputs comply with safety, privacy, and ethical guidelines

• Our AI systems include privacy-respecting principles in their design and training

4.6 Feedback Data

If you provide explicit feedback (such as ratings, thumbs up/down, or comments), this feedback and associated context may be used to improve our Services even if you have opted out of general training. You may withdraw this by contacting privacy@qwerky.ai.

5. HOW WE SHARE INFORMATION

• Service Providers: Cloud hosting, payment processing, analytics, customer support, security, and other vendors who process data on our behalf under appropriate data processing agreements.

• AI Model Providers: Where we use third-party AI models, we maintain agreements ensuring your data is not used for their model training.

• Business Partners: Partners with whom we collaborate to deliver services, subject to confidentiality obligations.

• Affiliates: Parent companies, subsidiaries, and related entities under common ownership.

• Professional Advisors: Lawyers, accountants, auditors, and consultants as necessary.

• Legal Requirements: Government authorities, law enforcement, courts, and regulators when required by law, legal process, or to protect rights, safety, or property.

• Business Transfers: In connection with mergers, acquisitions, financing, bankruptcy, or sale of assets (with notice to you where required).

• With Your Consent: Where you direct us to share information.

• De-Identified Data: We may share anonymized, de-identified, or aggregated data with any third party for any purpose, as such data does not identify you.

We do not sell your personal information for monetary consideration.

6. DATA RETENTION

We retain personal information for as long as necessary for the purposes described in this Policy:

• Account Data: Duration of your account plus 7 years for legal/tax compliance.

• Service Data: Duration of service relationship plus any legally required retention period.

• Usage and Log Data: Generally 2 years, unless required longer for security or legal purposes.

• Safety-Flagged Content: Up to 7 years for content flagged for potential policy violations, abuse, or security concerns.

• Feedback: Up to 5 years for explicit feedback you provide to us.

• De-Identified Data: Indefinitely, as it is no longer personal data.

When personal information is no longer needed, we securely delete or de-identify it. Deleted data may remain in backups for a limited period before complete removal.

7. DATA SECURITY

We implement technical and organizational security measures designed to protect personal information:

• Encryption: Data encrypted in transit (TLS 1.2+) and at rest (AES-256)

• Access Controls: Role-based access, multi-factor authentication, least-privilege principles

• Infrastructure: Secure cloud infrastructure with industry-standard certifications

• Monitoring: Security monitoring, intrusion detection, and logging

• Assessments: Regular security assessments, penetration testing, and vulnerability scanning

• Training: Employee security and privacy training

• Incident Response: Documented incident response procedures

• Vendor Management: Security reviews of service providers

We maintain SOC 2 Type II compliance or are pursuing certification. No system is completely secure; we cannot guarantee absolute security.

8. INTERNATIONAL DATA TRANSFERS

We are headquartered in the United States. Your personal information may be transferred to, stored in, and processed in the United States and other countries where we or our service providers operate.

For transfers from the EU/EEA/UK/Switzerland to countries without adequate protection:

• Standard Contractual Clauses (SCCs) approved by the European Commission and/or UK ICO

• UK International Data Transfer Agreement (IDTA) or UK Addendum to EU SCCs

• EU-U.S. Data Privacy Framework certification (where applicable)

• Adequacy decisions

• Your explicit consent where appropriate

To request information about transfer mechanisms or obtain a copy of applicable SCCs: privacy@qwerky.ai

9. YOUR CHOICES AND CONTROLS

• Opt-Out of AI Training: Email privacy@qwerky.ai with subject “Opt-Out of AI Training”

• Delete Your Account: Email privacy@qwerky.ai with subject “Account Deletion Request”

• Access Your Data: Submit a data access request as described in the jurisdiction sections below

• Marketing Opt-Out: Unsubscribe link in emails or email privacy@qwerky.ai

• Cookie Preferences: Adjust browser settings or use our cookie preference tool (if available)

• Withdraw Consent: Where processing is based on consent, withdraw at any time

10. COOKIES AND TRACKING TECHNOLOGIES

We use cookies and similar technologies for:

• Essential: Authentication, security, session management (required for functionality)

• Analytics: Understanding how Services are used, performance monitoring

• Preferences: Remembering your settings and choices

We may use third-party analytics services (such as Google Analytics). You can control cookies through browser settings. Disabling essential cookies may affect functionality. For more information: privacy@qwerky.ai

11. CHILDREN’S PRIVACY

Our Services are not directed to children under 16 (or the applicable age of digital consent in your jurisdiction). We do not knowingly collect personal information from children without verified parental consent. If we learn we have collected information from a child without appropriate consent, we will promptly delete it. Report concerns to: privacy@qwerky.ai

12. EUROPEAN UNION / EUROPEAN ECONOMIC AREA (GDPR)

This section applies if you are located in the European Union or European Economic Area. The General Data Protection Regulation (EU) 2016/679 (“GDPR”) governs our processing of your personal data.

12.1 Data Controller

QWERKY AI, Inc. is the data controller. Contact: privacy@qwerky.ai

12.2 Legal Bases for Processing

• Contract (Art. 6(1)(b)): Processing necessary to perform a contract with you or take pre-contractual steps.

• Legitimate Interests (Art. 6(1)(f)): Processing for our legitimate interests (improving services, AI development, security, fraud prevention, marketing) where not overridden by your rights.

• Consent (Art. 6(1)(a)): Where you have given consent for specific processing activities.

• Legal Obligation (Art. 6(1)(c)): Processing necessary for legal compliance.

12.3 Your Rights Under GDPR

• Right of Access (Art. 15): Confirm whether we process your data and obtain a copy.

• Right to Rectification (Art. 16): Correct inaccurate or incomplete personal data.

• Right to Erasure (Art. 17): Request deletion where: data is no longer necessary; you withdraw consent; you object to processing; data was unlawfully processed; required by law. Does NOT apply to anonymized/de-identified data.

• Right to Restriction (Art. 18): Restrict processing in certain circumstances.

• Right to Data Portability (Art. 20): Receive your data in structured, machine-readable format.

• Right to Object (Art. 21): Object to processing based on legitimate interests or for direct marketing.

• Rights re Automated Decision-Making (Art. 22): Rights regarding solely automated decisions with legal/significant effects.

• Right to Withdraw Consent: At any time, without affecting prior processing.

• Right to Lodge Complaint: With your supervisory authority.

12.4 How to Exercise Your Rights

To Exercise Your Rights:

Email: privacy@qwerky.ai

Subject Line: GDPR Request - [Access/Deletion/Correction/Opt-Out/Other]

Required Verification Information:

Your request MUST include the following to be processed:

(1) Full legal name exactly as provided to QWERKY AI;

(2) Email address(es) associated with your account or communications;

(3) Account ID, customer number, or organization name (if applicable);

(4) Specific description of the data or processing activity at issue;

(5) Date range of relevant data or interactions (if known);

(6) Copy of government-issued identification (securely deleted after verification).

Request Limitations:

We process only specific, verifiable requests. The following will be denied or require clarification:

• Overbroad, vague, or non-specific requests

• Requests for “all data” or “everything about me” without specificity

• Requests that would require disclosure/deletion of other individuals' data

• Manifestly unfounded, excessive, or repetitive requests

• Requests from unverified sources or where identity cannot be confirmed

12.5 Response Time

We will respond within one (1) month, extendable by two (2) additional months for complex requests with notice.

QWERKY AI's Data Retention Rights:

Notwithstanding your deletion rights, we may retain personal data where:

(a) Required to comply with legal obligations, court orders, or regulatory requirements;

(b) Necessary to establish, exercise, or defend legal claims;

(d) The data has been properly anonymized or de-identified (no longer personal data under applicable law);

(e) Necessary to complete a transaction or provide services you requested;

(f) Necessary for security, fraud prevention, or abuse detection;

(g) Necessary for billing, accounting, or tax compliance;

(h) Other exceptions under applicable law permit retention.

IMPORTANT: Anonymized and de-identified data derived from your personal data is NOT personal data under applicable privacy laws and may be retained and used indefinitely for any lawful purpose, including AI model development, research, analytics, and product improvement.

Notice Regarding AI-Trained Models:

If personal data has been de-identified and incorporated into AI model training before your deletion request, the de-identified data embedded in model parameters cannot be extracted or deleted from the trained model. This is an inherent technical limitation of machine learning systems. However, because we de-identify data before training, no personal data (as defined by applicable law) exists within our trained models. We implement output filtering to prevent models from generating outputs containing personal information.

12.8 EU Representative

Our designated EU representative for GDPR purposes can be reached at: privacy@qwerky.ai (include “EU Representative Inquiry” in subject line). We use this centralized contact for all EU representative matters.

13. UNITED KINGDOM (UK GDPR)

This section applies if you are located in the United Kingdom. The UK General Data Protection Regulation and Data Protection Act 2018 govern our processing.

13.1 Your Rights

Your rights mirror EU GDPR: Access; Rectification; Erasure; Restriction; Portability; Object; Automated Decision-Making; Withdraw Consent. You may lodge complaints with the Information Commissioner’s Office (ICO).

13.2 How to Exercise Your Rights

To Exercise Your Rights:

Email: privacy@qwerky.ai

Subject Line: UK GDPR Request - [Access/Deletion/Correction/Opt-Out/Other]

Required Verification Information:

Your request MUST include the following to be processed:

(1) Full legal name exactly as provided to QWERKY AI;

(2) Email address(es) associated with your account or communications;

(3) Account ID, customer number, or organization name (if applicable);

(4) Specific description of the data or processing activity at issue;

(5) Date range of relevant data or interactions (if known);

(6) Copy of government-issued identification (securely deleted after verification).

Request Limitations:

We process only specific, verifiable requests. The following will be denied or require clarification:

• Overbroad, vague, or non-specific requests

• Requests for “all data” or “everything about me” without specificity

• Requests that would require disclosure/deletion of other individuals' data

• Manifestly unfounded, excessive, or repetitive requests

• Requests from unverified sources or where identity cannot be confirmed

13.3 Response Time

One (1) month, extendable by two (2) months for complex requests.

QWERKY AI's Data Retention Rights:

Notwithstanding your deletion rights, we may retain personal data where:

(a) Required to comply with legal obligations, court orders, or regulatory requirements;

(b) Necessary to establish, exercise, or defend legal claims;

(d) The data has been properly anonymized or de-identified (no longer personal data under applicable law);

(e) Necessary to complete a transaction or provide services you requested;

(f) Necessary for security, fraud prevention, or abuse detection;

(g) Necessary for billing, accounting, or tax compliance;

(h) Other exceptions under applicable law permit retention.

Notice Regarding AI-Trained Models:

13.6 UK Representative

Our UK representative can be reached at: privacy@qwerky.ai (include “UK Representative Inquiry” in subject line).

14. SWITZERLAND (FADP)

This section applies if you are located in Switzerland. The Federal Act on Data Protection (FADP, revised 2023) governs our processing.

14.1 Your Rights

Right to Information; Right to Rectification; Right to Erasure; Right to Data Portability; Right to Object to automated decisions; Right to Withdraw Consent.

14.2 How to Exercise Your Rights

To Exercise Your Rights:

Email: privacy@qwerky.ai

Subject Line: Switzerland FADP Request - [Access/Deletion/Correction/Opt-Out/Other]

Required Verification Information:

Your request MUST include the following to be processed:

(1) Full legal name exactly as provided to QWERKY AI;

(2) Email address(es) associated with your account or communications;

(3) Account ID, customer number, or organization name (if applicable);

(4) Specific description of the data or processing activity at issue;

(5) Date range of relevant data or interactions (if known);

(6) Copy of government-issued identification (securely deleted after verification).

Request Limitations:

We process only specific, verifiable requests. The following will be denied or require clarification:

• Overbroad, vague, or non-specific requests

• Requests for “all data” or “everything about me” without specificity

• Requests that would require disclosure/deletion of other individuals' data

• Manifestly unfounded, excessive, or repetitive requests

• Requests from unverified sources or where identity cannot be confirmed

14.3 Response Time

Thirty (30) days, extendable if necessary with notice.

QWERKY AI's Data Retention Rights:

Notwithstanding your deletion rights, we may retain personal data where:

(a) Required to comply with legal obligations, court orders, or regulatory requirements;

(b) Necessary to establish, exercise, or defend legal claims;

(d) The data has been properly anonymized or de-identified (no longer personal data under applicable law);

(e) Necessary to complete a transaction or provide services you requested;

(f) Necessary for security, fraud prevention, or abuse detection;

(g) Necessary for billing, accounting, or tax compliance;

(h) Other exceptions under applicable law permit retention.

15. CALIFORNIA, USA (CCPA/CPRA/AB 1008)

This section applies if you are a California resident. The California Consumer Privacy Act (CCPA), California Privacy Rights Act (CPRA), and Assembly Bill 1008 provide specific rights. For purposes of AB 1008, “personal information” includes information in AI systems capable of outputting personal information.

15.1 Categories of Personal Information Collected (Preceding 12 Months)

Identifiers; Commercial Information; Internet/Electronic Network Activity; Professional Information; Geolocation (derived from IP); Audio/Visual (if you use voice features); Inferences.

15.2 Your Rights

• Right to Know: Categories and specific pieces of personal information collected; sources; purposes; third parties.

• Right to Access: Obtain specific pieces of personal information.

• Right to Delete: Request deletion, subject to exceptions. Does NOT apply to de-identified data or data in trained AI models (which was de-identified before training).

• Right to Correct: Correct inaccurate personal information.

• Right to Opt-Out of Sale/Sharing: We do not sell personal information for monetary consideration. To opt out of “sharing” under CCPA, contact us.

• Right to Limit Sensitive Personal Information: Limit use to necessary purposes.

• Right to Non-Discrimination: No discrimination for exercising rights.

15.3 How to Exercise Your Rights

To Exercise Your Rights:

Email: privacy@qwerky.ai

Subject Line: California CCPA/CPRA Request - [Access/Deletion/Correction/Opt-Out/Other]

Authorized agents must provide written proof of authorization.

Required Verification Information:

Your request MUST include the following to be processed:

(1) Full legal name exactly as provided to QWERKY AI;

(2) Email address(es) associated with your account or communications;

(3) Account ID, customer number, or organization name (if applicable);

(4) Specific description of the data or processing activity at issue;

(5) Date range of relevant data or interactions (if known);

(6) Copy of government-issued identification (securely deleted after verification).

Request Limitations:

We process only specific, verifiable requests. The following will be denied or require clarification:

• Overbroad, vague, or non-specific requests

• Requests for “all data” or “everything about me” without specificity

• Requests that would require disclosure/deletion of other individuals' data

• Manifestly unfounded, excessive, or repetitive requests

• Requests from unverified sources or where identity cannot be confirmed

For specific pieces of personal information: We require a declaration under penalty of perjury that you are the consumer whose information is requested.

15.4 Response Time

Confirm receipt within ten (10) business days. Substantive response within forty-five (45) calendar days, extendable by forty-five (45) days with notice.

15.5 California “Shine the Light” (Civil Code § 1798.83)

California residents may request information about disclosure to third parties for direct marketing. Contact: privacy@qwerky.ai

15.6 Do Not Track

We do not currently respond to Do Not Track signals. Exercise opt-out rights as described above.

QWERKY AI's Data Retention Rights:

Notwithstanding your deletion rights, we may retain personal data where:

(a) Required to comply with legal obligations, court orders, or regulatory requirements;

(b) Necessary to establish, exercise, or defend legal claims;

(d) The data has been properly anonymized or de-identified (no longer personal data under applicable law);

(e) Necessary to complete a transaction or provide services you requested;

(f) Necessary for security, fraud prevention, or abuse detection;

(g) Necessary for billing, accounting, or tax compliance;

(h) Other exceptions under applicable law permit retention.

Notice Regarding AI-Trained Models:

16. OTHER U.S. STATE PRIVACY LAWS

This section applies if you are a resident of Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Delaware, Iowa, New Jersey, New Hampshire, Tennessee, Kentucky, Nebraska, Maryland, Minnesota, Indiana, Rhode Island, or other U.S. states with comprehensive consumer privacy laws.

16.1 Laws Covered

• Virginia Consumer Data Protection Act (VCDPA)

• Colorado Privacy Act (CPA)

• Connecticut Data Privacy Act (CTDPA)

• Utah Consumer Privacy Act (UCPA)

• Texas Data Privacy and Security Act (TDPSA)

• Oregon Consumer Privacy Act (OCPA)

• Montana Consumer Data Privacy Act (MTCDPA)

• Delaware Personal Data Privacy Act (DPDPA)

• Iowa Consumer Data Protection Act (ICDPA)

• Other state laws as enacted

16.2 Your General Rights

Most state laws provide: Right to Access/Confirm; Right to Correct (most states); Right to Delete; Right to Data Portability; Right to Opt-Out of targeted advertising, sale of personal data, or profiling with legal/significant effects.

16.3 How to Exercise Your Rights

To Exercise Your Rights:

Email: privacy@qwerky.ai

Subject Line: [State Name] Request - [Access/Deletion/Correction/Opt-Out/Other]

Please identify your state of residence and the specific law you are invoking.

Required Verification Information:

Your request MUST include the following to be processed:

(1) Full legal name exactly as provided to QWERKY AI;

(2) Email address(es) associated with your account or communications;

(3) Account ID, customer number, or organization name (if applicable);

(4) Specific description of the data or processing activity at issue;

(5) Date range of relevant data or interactions (if known);

(6) Copy of government-issued identification (securely deleted after verification).

Request Limitations:

We process only specific, verifiable requests. The following will be denied or require clarification:

• Overbroad, vague, or non-specific requests

• Requests for “all data” or “everything about me” without specificity

• Requests that would require disclosure/deletion of other individuals' data

• Manifestly unfounded, excessive, or repetitive requests

• Requests from unverified sources or where identity cannot be confirmed

16.4 Response Time

Generally forty-five (45) to ninety (90) days depending on your state. Montana: 45 days + 15 day extension. Iowa: 90 days.

16.5 Right to Appeal

Where applicable, appeal denied requests by emailing privacy@qwerky.ai with subject “[State] Privacy Appeal.” We will respond within the timeframe required by your state’s law (typically 45-60 days). If denied, you may contact your state’s Attorney General.

QWERKY AI's Data Retention Rights:

Notwithstanding your deletion rights, we may retain personal data where:

(a) Required to comply with legal obligations, court orders, or regulatory requirements;

(b) Necessary to establish, exercise, or defend legal claims;

(d) The data has been properly anonymized or de-identified (no longer personal data under applicable law);

(e) Necessary to complete a transaction or provide services you requested;

(f) Necessary for security, fraud prevention, or abuse detection;

(g) Necessary for billing, accounting, or tax compliance;

(h) Other exceptions under applicable law permit retention.

Notice Regarding AI-Trained Models:

17. CANADA (PIPEDA / QUEBEC LAW 25 / PROVINCIAL LAWS)

This section applies if you are located in Canada. PIPEDA and substantially similar provincial laws (Quebec Law 25, Alberta PIPA, BC PIPA) govern our handling of personal information.

17.1 Your Rights Under PIPEDA

• Right to Access: Access personal information we hold about you.

• Right to Correction: Correct inaccurate or incomplete information.

• Right to Withdraw Consent: Subject to legal or contractual restrictions.

• Right to Complain: To the Privacy Commissioner of Canada or applicable provincial commissioner.

17.2 Quebec Residents (Law 25)

Additional rights: Data portability; De-indexing (right to be forgotten); Information about automated decision-making and right to have automated decisions reviewed.

17.3 How to Exercise Your Rights

To Exercise Your Rights:

Email: privacy@qwerky.ai

Subject Line: Canada PIPEDA / Law 25 Request - [Access/Deletion/Correction/Opt-Out/Other]

Required Verification Information:

Your request MUST include the following to be processed:

(1) Full legal name exactly as provided to QWERKY AI;

(2) Email address(es) associated with your account or communications;

(3) Account ID, customer number, or organization name (if applicable);

(4) Specific description of the data or processing activity at issue;

(5) Date range of relevant data or interactions (if known);

(6) Copy of government-issued identification (securely deleted after verification).

Request Limitations:

We process only specific, verifiable requests. The following will be denied or require clarification:

• Overbroad, vague, or non-specific requests

• Requests for “all data” or “everything about me” without specificity

• Requests that would require disclosure/deletion of other individuals' data

• Manifestly unfounded, excessive, or repetitive requests

• Requests from unverified sources or where identity cannot be confirmed

17.4 Response Time

Thirty (30) days, extendable with notice.

QWERKY AI's Data Retention Rights:

Notwithstanding your deletion rights, we may retain personal data where:

(a) Required to comply with legal obligations, court orders, or regulatory requirements;

(b) Necessary to establish, exercise, or defend legal claims;

(d) The data has been properly anonymized or de-identified (no longer personal data under applicable law);

(e) Necessary to complete a transaction or provide services you requested;

(f) Necessary for security, fraud prevention, or abuse detection;

(g) Necessary for billing, accounting, or tax compliance;

(h) Other exceptions under applicable law permit retention.

Notice Regarding AI-Trained Models:

18. BRAZIL (LGPD)

This section applies if you are located in Brazil. The Lei Geral de Proteção de Dados (LGPD) governs our processing.

18.1 Legal Bases

Consent; Legal/regulatory obligation; Contract performance; Legitimate interests; Protection of life; Credit protection.

18.2 Your Rights

• Confirmation and Access; • Correction; • Anonymization, Blocking, or Deletion (for unnecessary/excessive/non-compliant data); • Portability; • Deletion (of data processed with consent); • Information about Sharing; • Information about Non-Consent consequences; • Withdraw Consent; • Review of Automated Decisions; • Object to processing violating LGPD.

18.3 How to Exercise Your Rights

To Exercise Your Rights:

Email: privacy@qwerky.ai

Subject Line: Brazil LGPD Request - [Access/Deletion/Correction/Opt-Out/Other]

Required Verification Information:

Your request MUST include the following to be processed:

(1) Full legal name exactly as provided to QWERKY AI;

(2) Email address(es) associated with your account or communications;

(3) Account ID, customer number, or organization name (if applicable);

(4) Specific description of the data or processing activity at issue;

(5) Date range of relevant data or interactions (if known);

(6) Copy of government-issued identification (securely deleted after verification).

Request Limitations:

We process only specific, verifiable requests. The following will be denied or require clarification:

• Overbroad, vague, or non-specific requests

• Requests for “all data” or “everything about me” without specificity

• Requests that would require disclosure/deletion of other individuals' data

• Manifestly unfounded, excessive, or repetitive requests

• Requests from unverified sources or where identity cannot be confirmed

18.4 Response Time

Immediate confirmation in simplified form. Detailed response within fifteen (15) days.

18.5 Data Protection Officer (Encarregado)

Contact: privacy@qwerky.ai

QWERKY AI's Data Retention Rights:

Notwithstanding your deletion rights, we may retain personal data where:

(a) Required to comply with legal obligations, court orders, or regulatory requirements;

(b) Necessary to establish, exercise, or defend legal claims;

(d) The data has been properly anonymized or de-identified (no longer personal data under applicable law);

(e) Necessary to complete a transaction or provide services you requested;

(f) Necessary for security, fraud prevention, or abuse detection;

(g) Necessary for billing, accounting, or tax compliance;

(h) Other exceptions under applicable law permit retention.

Notice Regarding AI-Trained Models:

19. JAPAN (APPI)

This section applies if you are located in Japan. The Act on the Protection of Personal Information (APPI) governs our handling.

19.1 Your Rights

• Disclosure: Request disclosure of retained personal data and usage information.

• Correction: Request correction of inaccurate data.

• Cessation of Use: Request cessation/deletion if acquired unlawfully, no longer needed, or following a data breach.

• Cessation of Third-Party Provision.

19.2 How to Exercise Your Rights

To Exercise Your Rights:

Email: privacy@qwerky.ai

Subject Line: Japan APPI Request - [Access/Deletion/Correction/Opt-Out/Other]

Required Verification Information:

Your request MUST include the following to be processed:

(1) Full legal name exactly as provided to QWERKY AI;

(2) Email address(es) associated with your account or communications;

(3) Account ID, customer number, or organization name (if applicable);

(4) Specific description of the data or processing activity at issue;

(5) Date range of relevant data or interactions (if known);

(6) Copy of government-issued identification (securely deleted after verification).

Request Limitations:

We process only specific, verifiable requests. The following will be denied or require clarification:

• Overbroad, vague, or non-specific requests

• Requests for “all data” or “everything about me” without specificity

• Requests that would require disclosure/deletion of other individuals' data

• Manifestly unfounded, excessive, or repetitive requests

• Requests from unverified sources or where identity cannot be confirmed

19.3 Response Time

Without delay, generally within two (2) weeks.

19.4 Anonymized Data

Under APPI, properly anonymized processed information (tokumei kako jouhou) is not subject to personal information requirements. Our de-identification practices are designed to meet this standard.

QWERKY AI's Data Retention Rights:

Notwithstanding your deletion rights, we may retain personal data where:

(a) Required to comply with legal obligations, court orders, or regulatory requirements;

(b) Necessary to establish, exercise, or defend legal claims;

(d) The data has been properly anonymized or de-identified (no longer personal data under applicable law);

(e) Necessary to complete a transaction or provide services you requested;

(f) Necessary for security, fraud prevention, or abuse detection;

(g) Necessary for billing, accounting, or tax compliance;

(h) Other exceptions under applicable law permit retention.

20. SOUTH KOREA (PIPA)

This section applies if you are located in South Korea. The Personal Information Protection Act (PIPA) governs our processing.

20.1 Your Rights

Access; Correction/Deletion; Suspend Processing; Withdraw Consent; Explanation of Automated Decisions.

20.2 How to Exercise Your Rights

To Exercise Your Rights:

Email: privacy@qwerky.ai

Subject Line: South Korea PIPA Request - [Access/Deletion/Correction/Opt-Out/Other]

Required Verification Information:

Your request MUST include the following to be processed:

(1) Full legal name exactly as provided to QWERKY AI;

(2) Email address(es) associated with your account or communications;

(3) Account ID, customer number, or organization name (if applicable);

(4) Specific description of the data or processing activity at issue;

(5) Date range of relevant data or interactions (if known);

(6) Copy of government-issued identification (securely deleted after verification).

Request Limitations:

We process only specific, verifiable requests. The following will be denied or require clarification:

• Overbroad, vague, or non-specific requests

• Requests for “all data” or “everything about me” without specificity

• Requests that would require disclosure/deletion of other individuals' data

• Manifestly unfounded, excessive, or repetitive requests

• Requests from unverified sources or where identity cannot be confirmed

20.3 Response Time

Ten (10) days.

QWERKY AI's Data Retention Rights:

Notwithstanding your deletion rights, we may retain personal data where:

(a) Required to comply with legal obligations, court orders, or regulatory requirements;

(b) Necessary to establish, exercise, or defend legal claims;

(d) The data has been properly anonymized or de-identified (no longer personal data under applicable law);

(e) Necessary to complete a transaction or provide services you requested;

(f) Necessary for security, fraud prevention, or abuse detection;

(g) Necessary for billing, accounting, or tax compliance;

(h) Other exceptions under applicable law permit retention.

21. AUSTRALIA (PRIVACY ACT)

This section applies if you are located in Australia. The Privacy Act 1988 and Australian Privacy Principles (APPs) govern our handling.

21.1 Your Rights

Access; Correction; Complaint to us or the OAIC; Anonymity/Pseudonymity where practicable.

21.2 How to Exercise Your Rights

To Exercise Your Rights:

Email: privacy@qwerky.ai

Subject Line: Australia Privacy Act Request - [Access/Deletion/Correction/Opt-Out/Other]

Required Verification Information:

Your request MUST include the following to be processed:

(1) Full legal name exactly as provided to QWERKY AI;

(2) Email address(es) associated with your account or communications;

(3) Account ID, customer number, or organization name (if applicable);

(4) Specific description of the data or processing activity at issue;

(5) Date range of relevant data or interactions (if known);

(6) Copy of government-issued identification (securely deleted after verification).

Request Limitations:

We process only specific, verifiable requests. The following will be denied or require clarification:

• Overbroad, vague, or non-specific requests

• Requests for “all data” or “everything about me” without specificity

• Requests that would require disclosure/deletion of other individuals' data

• Manifestly unfounded, excessive, or repetitive requests

• Requests from unverified sources or where identity cannot be confirmed

21.3 Response Time

Reasonable period, generally thirty (30) days.

QWERKY AI's Data Retention Rights:

Notwithstanding your deletion rights, we may retain personal data where:

(a) Required to comply with legal obligations, court orders, or regulatory requirements;

(b) Necessary to establish, exercise, or defend legal claims;

(d) The data has been properly anonymized or de-identified (no longer personal data under applicable law);

(e) Necessary to complete a transaction or provide services you requested;

(f) Necessary for security, fraud prevention, or abuse detection;

(g) Necessary for billing, accounting, or tax compliance;

(h) Other exceptions under applicable law permit retention.

22. NEW ZEALAND (PRIVACY ACT 2020)

This section applies if you are located in New Zealand.

22.1 Your Rights

Access; Correction; Complaint to the Privacy Commissioner.

22.2 How to Exercise Your Rights

To Exercise Your Rights:

Email: privacy@qwerky.ai

Subject Line: New Zealand Privacy Act Request - [Access/Deletion/Correction/Opt-Out/Other]

Required Verification Information:

Your request MUST include the following to be processed:

(1) Full legal name exactly as provided to QWERKY AI;

(2) Email address(es) associated with your account or communications;

(3) Account ID, customer number, or organization name (if applicable);

(4) Specific description of the data or processing activity at issue;

(5) Date range of relevant data or interactions (if known);

(6) Copy of government-issued identification (securely deleted after verification).

Request Limitations:

We process only specific, verifiable requests. The following will be denied or require clarification:

• Overbroad, vague, or non-specific requests

• Requests for “all data” or “everything about me” without specificity

• Requests that would require disclosure/deletion of other individuals' data

• Manifestly unfounded, excessive, or repetitive requests

• Requests from unverified sources or where identity cannot be confirmed

22.3 Response Time

Twenty (20) working days.

QWERKY AI's Data Retention Rights:

Notwithstanding your deletion rights, we may retain personal data where:

(a) Required to comply with legal obligations, court orders, or regulatory requirements;

(b) Necessary to establish, exercise, or defend legal claims;

(d) The data has been properly anonymized or de-identified (no longer personal data under applicable law);

(e) Necessary to complete a transaction or provide services you requested;

(f) Necessary for security, fraud prevention, or abuse detection;

(g) Necessary for billing, accounting, or tax compliance;

(h) Other exceptions under applicable law permit retention.

23. OTHER ASIA-PACIFIC JURISDICTIONS

23.1 Singapore (PDPA)

Rights: Access; Correction; Withdraw Consent; Data Portability. Response: 30 days.

23.2 Hong Kong (PDPO)

Rights: Access; Correction. Response: 40 days.

23.3 Taiwan (PDPA)

Rights: Access/Review; Copy; Correction; Cessation; Deletion. Response: 15 days + 15 day extension.

23.4 Thailand (PDPA)

Rights: Access; Portability; Correction; Deletion; Restrict; Object; Withdraw Consent; Complaint. Response: 30 days.

23.5 Malaysia (PDPA)

Rights: Access; Correction; Withdraw Consent; Prevent direct marketing. Response: 21 days.

23.6 Philippines (DPA)

Rights: Be Informed; Access; Correction; Erasure/Blocking; Portability; Object; Damages; Complaint. Response: 15 days (simple).

23.7 Indonesia (PDP Law)

Rights: Information; Access; Correction; Deletion; Withdraw Consent; Object to Automated Decisions; Portability; Complaint. Response: 3x24 hours (serious) / 14 days (other).

23.8 Vietnam (PDPD)

Rights: Be Informed; Consent; Access; Correction; Deletion; Restrict; Portability; Object; Complaint. Response: 72 hours (where required) / reasonable period.

23.9 India (DPDP Act)

Rights: Access; Correction and Erasure; Grievance Redressal; Nominate. Response: Per applicable rules.

23.10 China (PIPL)

Rights: Know and Decide; Access/Copy; Correction; Deletion; Portability; Withdraw Consent; Explanation; Refuse Automated Decisions. Response: 15 days. Cross-border transfers require appropriate safeguards.

23.11 How to Exercise Rights (All Asia-Pacific)

To Exercise Your Rights:

Email: privacy@qwerky.ai

Subject Line: [Jurisdiction] Privacy Law Request - [Access/Deletion/Correction/Opt-Out/Other]

Identify your jurisdiction and specific law in your request.

Required Verification Information:

Your request MUST include the following to be processed:

(1) Full legal name exactly as provided to QWERKY AI;

(2) Email address(es) associated with your account or communications;

(3) Account ID, customer number, or organization name (if applicable);

(4) Specific description of the data or processing activity at issue;

(5) Date range of relevant data or interactions (if known);

(6) Copy of government-issued identification (securely deleted after verification).

Request Limitations:

We process only specific, verifiable requests. The following will be denied or require clarification:

• Overbroad, vague, or non-specific requests

• Requests for “all data” or “everything about me” without specificity

• Requests that would require disclosure/deletion of other individuals' data

• Manifestly unfounded, excessive, or repetitive requests

• Requests from unverified sources or where identity cannot be confirmed

QWERKY AI's Data Retention Rights:

Notwithstanding your deletion rights, we may retain personal data where:

(a) Required to comply with legal obligations, court orders, or regulatory requirements;

(b) Necessary to establish, exercise, or defend legal claims;

(d) The data has been properly anonymized or de-identified (no longer personal data under applicable law);

(e) Necessary to complete a transaction or provide services you requested;

(f) Necessary for security, fraud prevention, or abuse detection;

(g) Necessary for billing, accounting, or tax compliance;

(h) Other exceptions under applicable law permit retention.

24. MIDDLE EAST AND AFRICA

24.1 United Arab Emirates (PDPL)

Rights: Access; Correction; Erasure; Restrict; Portability; Object; Withdraw Consent.

24.2 Saudi Arabia (PDPL)

Rights: Be Informed; Access; Correction; Destruction; Withdraw Consent.

24.3 South Africa (POPIA)

Rights: Be Notified; Access; Correction; Deletion; Object; Object to direct marketing; Not subject to automated decisions; Complain to Information Regulator.

24.4 Israel (Privacy Protection Law)

Rights: Access; Correction; Deletion. Response: 30 days.

24.5 Turkey (KVKK)

Rights: Learn if processed; Request information; Learn purpose; Know third parties; Correction; Deletion/destruction; Object; Damages. Response: 30 days.

24.6 How to Exercise Rights

To Exercise Your Rights:

Email: privacy@qwerky.ai

Subject Line: [Jurisdiction] Privacy Law Request - [Access/Deletion/Correction/Opt-Out/Other]

Required Verification Information:

Your request MUST include the following to be processed:

(1) Full legal name exactly as provided to QWERKY AI;

(2) Email address(es) associated with your account or communications;

(3) Account ID, customer number, or organization name (if applicable);

(4) Specific description of the data or processing activity at issue;

(5) Date range of relevant data or interactions (if known);

(6) Copy of government-issued identification (securely deleted after verification).

Request Limitations:

We process only specific, verifiable requests. The following will be denied or require clarification:

• Overbroad, vague, or non-specific requests

• Requests for “all data” or “everything about me” without specificity

• Requests that would require disclosure/deletion of other individuals' data

• Manifestly unfounded, excessive, or repetitive requests

• Requests from unverified sources or where identity cannot be confirmed

QWERKY AI's Data Retention Rights:

Notwithstanding your deletion rights, we may retain personal data where:

(a) Required to comply with legal obligations, court orders, or regulatory requirements;

(b) Necessary to establish, exercise, or defend legal claims;

(d) The data has been properly anonymized or de-identified (no longer personal data under applicable law);

(e) Necessary to complete a transaction or provide services you requested;

(f) Necessary for security, fraud prevention, or abuse detection;

(g) Necessary for billing, accounting, or tax compliance;

(h) Other exceptions under applicable law permit retention.

25. LATIN AMERICA

25.1 Argentina (PDPA - Law 25,326)

Rights: Access; Rectification/Update/Deletion; Confidentiality. Response: 10 business days.

25.2 Mexico (LFPDPPP)

ARCO Rights: Access; Rectification; Cancellation; Object. Include: name, contact, clear description, documents. Response: 20 business days.

25.3 Colombia (Law 1581)

Rights: Know/Update/Rectify/Delete; Access; Withdraw Consent; Complain to SIC. Response: 10 business days + 5 day extension.

25.4 Chile (Law 19,628)

Rights: Information; Modification; Deletion; Blocking. Response: 2 business days.

25.5 Peru (Law 29733)

Rights: Information; Access; Rectification; Cancellation; Opposition. Response: 8 business days.

25.6 How to Exercise Rights

To Exercise Your Rights:

Email: privacy@qwerky.ai

Subject Line: [Country] Privacy Law Request - [Access/Deletion/Correction/Opt-Out/Other]

Required Verification Information:

Your request MUST include the following to be processed:

(1) Full legal name exactly as provided to QWERKY AI;

(2) Email address(es) associated with your account or communications;

(3) Account ID, customer number, or organization name (if applicable);

(4) Specific description of the data or processing activity at issue;

(5) Date range of relevant data or interactions (if known);

(6) Copy of government-issued identification (securely deleted after verification).

Request Limitations:

We process only specific, verifiable requests. The following will be denied or require clarification:

• Overbroad, vague, or non-specific requests

• Requests for “all data” or “everything about me” without specificity

• Requests that would require disclosure/deletion of other individuals' data

• Manifestly unfounded, excessive, or repetitive requests

• Requests from unverified sources or where identity cannot be confirmed

QWERKY AI's Data Retention Rights:

Notwithstanding your deletion rights, we may retain personal data where:

(a) Required to comply with legal obligations, court orders, or regulatory requirements;

(b) Necessary to establish, exercise, or defend legal claims;

(d) The data has been properly anonymized or de-identified (no longer personal data under applicable law);

(e) Necessary to complete a transaction or provide services you requested;

(f) Necessary for security, fraud prevention, or abuse detection;

(g) Necessary for billing, accounting, or tax compliance;

(h) Other exceptions under applicable law permit retention.

26. GENERAL PROVISIONS

26.1 Authorized Agents

In jurisdictions where permitted, you may designate an authorized agent. Agents must provide: written proof of authorization or power of attorney; agent identity verification; consumer identity verification (we may contact you directly to confirm).

26.2 Complaints

Contact privacy@qwerky.ai first. If unsatisfied, you have the right to lodge a complaint with your local data protection authority.

26.3 Third-Party Links and Integrations

Our Services may contain links to or integrations with third-party websites, services, or AI models. We are not responsible for their privacy practices. When we use third-party AI models, we maintain agreements ensuring your data is not used for their training.

26.4 Changes to This Policy

We may update this Policy. Material changes will be posted with a new effective date. Where required by law, we will obtain consent or provide additional notice. Continued use after changes constitutes acceptance.

26.5 Conflict of Laws

Where requirements conflict, we endeavor to comply with the most restrictive applicable requirement. Mandatory legal requirements prevail.

26.6 Language

This Policy may be translated. In case of conflict, the English version prevails.

26.7 Severability

If any provision is held invalid, the remaining provisions remain in effect.

27. CONTACT INFORMATION

For ALL privacy inquiries, data subject requests, complaints, opt-outs, and representative matters worldwide:

Email: privacy@qwerky.ai

Include in your communication:

• The specific privacy law under which you are making your request

• Your full legal name and email address

• Sufficient detail to verify your identity and locate your data

• Clear description of your request

• Supporting documentation as applicable

This single contact point serves:

• Data subject access, deletion, correction, and portability requests

• Opt-out requests (AI training, marketing, sale/sharing)

• EU and UK representative inquiries

• Data Protection Officer inquiries

• DPA and contract inquiries

• Complaints and appeals

• General privacy questions