AI Data Usage Policy

Binding Language: English (this version prevails if there is any conflict)

1) Introduction and scope

This policy covers collection, use, disclosure, storage, transfer, and deletion of data used to develop/test/tune/deliver AI systems (internal and third-party), including AI features customers use on the platform.
Read with the Privacy Policy, DPA, Terms of Service, Acceptable Use Policy, EU AI Act Annex, and Billing/Usage Policies; if conflicts arise, the stricter/more specific document prevails (Order Form/SOW > this policy > Terms).
Applies to all Tanqory users (merchants, end customers of merchants, staff, partners, vendors) and data processed in/out of Singapore when linked to the services.
Grounded on transparency, necessity/proportionality, fairness, and data minimization per GDPR/PDPA/NIST AI RMF/ISO 42001.
Covers current and expected AI rules (EU AI Act, UK/EU/US/SG) and will be updated when new laws take effect.
Binding details must match the dashboard/product notices or Order Form; this document sets the policy control framework.
Continuing to use AI services means acceptance of this policy and announced updates (immediate effect only for safety/legal emergencies).
Appendix A summarizes data types/purposes; Appendix B summarizes rights and contacts.
Questions on data/AI ethics: dpo@tanqory.com or ai-ethics@tanqory.com.
Disputes/law follow the header unless a specific contract states otherwise.

2) Principles and governance

Complies with GDPR/UK GDPR (legal bases, DPIA/ROPA, Art. 9/10 for special/criminal data), PDPA SG (consent/contract/legitimate interests), CCPA/CPRA (no sale/share unless noticed/right to opt-out), and EU AI Act (risk, transparency, post-market).
Uses NIST AI RMF (Govern/Map/Measure/Manage) and ISO/IEC 42001/23894 for AI management and risk.
Principles: necessity/proportionality, accuracy, security by design, fairness/non-discrimination, transparency/explainability, accountability/traceability.
Automated decisions with legal/significant effects include human review/rights to object/request explanation per GDPR Art.22 and ICO/EDPB guidance.
Generative/chatbot/deepfake outputs will be disclosed as AI-generated, with watermark/provenance where feasible, and not used to deceive/manipulate.
No AI use to discriminate on protected characteristics; conduct regular bias testing/mitigation using suitable datasets/quality criteria per EU AI Act Art.10.
Conduct DPIA/AI risk assessments for high-risk cases (profiling, ADM, biometrics, credit/fraud scoring) and maintain ROPA.
Appoint AI governance owner/committee with escalation paths for incidents/complaints.
Audit/log programs retain traceability per AI Act Art.12/18 proportional to risk.
Update this policy when harmonized standards or new laws (e.g., US AI rules, SG AIVC) come into force.

3) Data types and sources

Personal data: names/emails/merchant accounts, transaction and behavioral data, chat/support records, technical data (IP/device/browser), and user-submitted model inputs (prompts).
Sensitive data: not processed unless required by law or with explicit consent (e.g., biometric/health/belief/race/criminal); avoid national IDs/passports unless mandated; encrypt/restrict access.
Training/validation/test data: may use synthetic/de-identified/public datasets under license; if customer data is used, it follows the DPA/contract and will not be mixed across tenants without rights.
AI feature telemetry to improve quality/safety collects only necessary data and is deleted/de-identified when no longer needed.
Third-party sources (models/datasets) are assessed for usage rights, licenses, and transfer limits.
No sale/rent of personal data for advertising; sharing for processing uses appropriate legal bases and contracts.
Prompts/outputs containing personal data are used only for clear purposes and retained as needed under Section 5.
Children/minors: service not designed for children; if children’s data is found, it will be limited/deleted and parental consent obtained per local law.
Customer data from one customer is not used to train/improve models for others unless explicitly authorized or de-identified.
Security/fraud data use relies on legitimate interest and clear safety purposes.

4) Purposes and legal bases

Develop/improve AI models (recommendation, search, fraud detection, risk scoring, support bot, content safety) under contract/legitimate interests, or consent when required for sensitive/marketing use.
Provide AI services to users (content generation, chatbot, translation, classification) under contract/contextual consent, with disclosures of limits/risks.
Detect/prevent fraud/security/spam/AUP violations under legitimate interests and system safety.
Service analytics/telemetry to improve UX/performance using minimized data; provide opt-out where required (e.g., CCPA/CPRA).
Legal/regulatory compliance (logging, lawful requests, sanctions/AML screening) using only necessary data.
Test/QA/bias/safety checks per EU AI Act Art.10 and NIST/ISO guidance.
Enterprise fine-tuning/training uses only the scoped data in the Order Form and is not reused for other customers unless de-identified/authorized.
Direct marketing only with consent/soft opt-in where permitted, with clear opt-out.
Supports data subject/consumer rights (access/rectify/erase/restrict/opt-out) per applicable law.
Sensitive data use requires explicit consent or vital interest/legal obligation only.

5) Retention and deletion

Retain data as needed for purposes/contract and legal tax/accounting/regulatory limits; main retention table is in the Data Retention Schedule and adapted for AI context.
Identifiable training data: kept only as needed for development/verification and deleted/de-identified when unnecessary or after valid erasure requests.
Prompt/output logs: short default retention for debugging/security/quality; rotated/deleted per internal SLA.
De-identified/synthetic training data may be kept longer when not reasonably re-identifiable.
Erasure/objection requests: if they break core services, features may be disabled or contracts terminated; impacts will be communicated before action.
Backups are purged per cycle and not restored for normal processing except for security/legal needs.
High-risk system logging/traceability follows AI Act/NIST requirements and is deleted when no longer needed.
Retention may be extended narrowly to defend/establish legal claims and access restricted.
Enterprise customers may set custom retention/deletion in Order Form/SOW.
Deletion confirmations will be provided when completed, as allowed by law/contract.

6) Security and risk mitigation

Encrypt at rest/in transit; fine-grained access control; MFA; network segmentation; secure key management; zero-trust approach.
Secure SDLC, code review, dependency scanning, authorized pentest, and separated Dev/Test/Prod.
Sensitive/unique identifiers are restricted, encrypted, and avoided in training unless legally required/consented.
Bias/fairness testing, adversarial testing, and red-teaming for AI features proportional to risk.
Audit/log for high-risk systems per AI Act Art.12/18; retain only as necessary.
Content safety/filtering for outputs; defend against prompt injection/abuse where feasible.
AI incident response playbook: detect → contain → analyze → notify → mitigate → improve.
Contracts/DTIA/SCC/IDTA/BCR with processors/recipients to ensure equivalent safeguards and sufficient TOMS.
Restrict access to training data/models by role and review access periodically.
If a breach risks rights/freedoms, assess notification duties (e.g., GDPR 72h, PDPA SG 3 days for notifiable breach).

7) Data subject rights and channels

Core rights: access/copy, rectify, erase, object, restrict, portability, withdraw consent, right not to be subject to solely automated decisions with legal/significant effects, right to opt-out of sale/share (CCPA) and of marketing/profiling.
Submit requests to dpo@tanqory.com or via dashboard form; identity will be verified.
Target SLA: intake within 2 Business Days; progress updates at least every 10 Business Days; target response/closure within 30 days (notify if more time/complex).
Rights limitations/exemptions follow applicable law (e.g., security/investigation/others’ rights).
Erasure may limit some AI features; impacts will be communicated before action.
Portability provided in common/machine-readable format where feasible.
Regulator channels: PDPC (SG), ICO (UK), relevant EU DPAs, and applicable US consumer/data authorities.
Rights are free unless manifestly unfounded/excessive, in which case permitted fees may apply.
If data is in non-identifiable models/logs, extraction may be impossible; alternatives/impacts will be explained.
Enterprise-related requests will follow the contract and SLA in the Order Form.

8) Sharing and cross-border transfers

Shared with processors/AI providers/cloud under DPA/SCC/IDTA or equivalent mechanisms with technical/organizational measures.
If transferring to non-adequate countries, use SCC/IDTA/BCR or informed consent, with notice of potential impacts.
EU AI Act: where required, appoint an authorized EU/EEA representative for external providers.
Limit access to identifiable data in training/tuning; may use clean rooms/de-identification before transfer.
No sale of personal data; processor contracts prohibit out-of-scope use.
Follow export/sanctions rules; no service in prohibited regions (UN/EU/OFAC/UK/HK/SG, etc.).
For US/EU models, conduct DTIA/TRA per EDPB/ICO guidance and add supplementary measures if needed.
Enterprise customers may specify preferred regions/providers in Order Form (subject to technical/legal feasibility).
Cross-region transfers for DR/HA follow contract and prior notice.
Transfer activities are recorded in ROPA/AI records for audit.

9) Third-party AI and contracts

When using external AI (e.g., LLM APIs), contracts define data scope/confidentiality/no reuse for training, and deletion on termination.
Vendors are assessed (security, privacy, bias, uptime, SLA) and monitored for performance/risk.
If vendors improve their models, only de-identified data or explicitly consented/authorized data may be used.
Customers will be informed when key AI features rely on third parties and what data/purposes/protections apply.
Co-processing roles (controller/processor) are defined per applicable data law.
External API requirements: do not send sensitive/child/prohibited data unless contracted and adequately protected.
Vendors may not use data for advertising or price discrimination.
Enterprise may request the current subprocessor/AI provider list and advance notice per DPA.
If key providers change, notice and options/termination will be provided per contract.
Dataset/model licensing is checked for IP compliance.

The current AI processors are listed in the Subprocessor List (data-protection/subprocessor-list.md) and include: OpenAI and Anthropic (LLM inference, training opted out); Google Gemini and Apple Foundation Models (the latter on-device only); DeepSeek (opt-in only, with cross-border transfer to the PRC); CopilotKit, Inc. (a managed in-product AI copilot framework operated via CopilotKit Cloud — the underlying inference is performed by the LLM providers listed above); and, in the mobile app, PhotoRoom SAS (AI image background removal / product-image editing), to which user-supplied images are transmitted for processing (not processed solely on-device). Where any of these providers processes personal data on Tanqory's behalf, it does so under a data processing agreement with SCC/IDTA or equivalent transfer safeguards.

10) Children, minors, and vulnerable groups

Not designed for children; if children’s data is collected unintentionally, it will be deleted/limited and parental consent obtained per local law.
Age thresholds: e.g., KR <14, US COPPA <13, EU/UK 13‑16 depending on country; stricter thresholds observed.
Avoid using youth/vulnerable data in training unless necessary with bias/impact safeguards.
Models will not target or discriminate against vulnerable groups unlawfully.
If a customer product involves youth, configure collection/consent/rights per applicable law and age checks where required.
If AI impacts significant youth rights, conduct DPIA/FRIA and provide objection/human review rights.
Do not send child/minor data to external APIs that cannot meet legal requirements.
Usage limits for youth will be clearly shown in UI/docs if features are not available to them.
For education/youth services collaborations, add contracts/measures required by local law.
Assess ethical impact when using vulnerable group data and mitigate before launch.

11) Incident handling and notifications

Playbook for data/security/AI incidents: detect → contain → analyze → notify → remediate → improve with clear ownership.
Notify regulators/data subjects per applicable law (e.g., GDPR 72h, PDPA SG 3 days for notifiable breach) when risk is high.
Notify customers/affected users with data types, expected impact, and mitigation guidance when required.
Serious AI incidents (e.g., harmful malfunctions/law breaches) will be reported as required (e.g., EU AI Act Art.62).
Record incidents and fixes for reference and process improvement.
Review logging/telemetry settings to avoid excess collection after incidents.
Conduct post-incident reviews and improve controls/training.
Report issues to security@tanqory.com or ai-ethics@tanqory.com with necessary details.
Incidents involving subprocessors will be escalated/coordinated and notified per contract timelines.
For legal/safety events, features may be paused immediately to prevent harm; notice will follow promptly.

12) Transparency and communications

Provide UI/docs notices when AI is used materially (e.g., chatbot, generative, risk scoring) and indicate if third-party AI is used.
State known model limitations/risks (bias, uncertainty, hallucination risk) with safe-use guidance.
Offer opt-out/disable for some AI features where feasible; impacts on function/price will be communicated before decision.
Label outputs as AI-generated and use watermark/provenance where feasible for high-misuse-risk content.
Document data processing/model/standards as far as possible without harming security/trade secrets.
Provide channels for data/AI ethics questions/complaints (ai-ethics@tanqory.com, dpo@tanqory.com) with SLA per Section 7.
Enterprise customers receive dedicated runbooks/FAQ/playbooks and backup channels per Order Form.
Update policy/FAQ/docs for material changes with effective dates.
When using data tagging/feedback from customers, explain purpose and impact and offer opt-out where feasible.
Notices will be plain-language for consumers in supported languages; durable-medium notices (email/dashboard) used when required by consumer law (EU/UK).

Appendix A: Data types and purposes (summary)

• Account/contact data: service delivery/contact/security (contract/legitimate interests).
• Transaction/behavioral data: analytics/improvement/fraud prevention (contract/legitimate interests; some analytics opt-out per law).
• AI prompts/outputs: service delivery/quality/safety (contract; central model improvement only after de-identification or explicit rights).
• Telemetry/system logs: security/debug/legal compliance (legitimate interests/legal obligation).
• Sensitive data: avoided by default; only with clear basis (explicit consent/legal obligation/vital interests) and encrypted/restricted.
• Children/vulnerable data: not intended; if discovered, delete/limit and comply with local law.
• Sharing: processors/providers under DPA/SCC/IDTA/BCR; no sale of personal data.

Appendix B: Rights channels and SLA

• Submit rights requests to dpo@tanqory.com or via the designated dashboard/form.
• SLA: intake ≤2 Business Days, updates every 10 Business Days, target closure 30 days (notify if longer).
• Identity verification required; additional info may be requested.
• Regulator channels: PDPC (SG), ICO (UK), relevant EU DPAs, and applicable US state consumer/data authorities.
• If a request affects service delivery, impacts/options will be explained before action.

Change history