Artificial Intelligence Policy (AI Policy)

1) Scope, Principles, and Roles

Covers AI/ML systems that Tanqory develops, procures, or operates, including features that rely on external models and AI-enabled processing on our platform.
Applies to employees, contractors, partners, app/theme developers, merchants, and users interacting with Tanqory AI.
Principles: human-centric, transparent, fair, accountable, privacy-respecting, secure, sustainable, and legally compliant.
Roles: Tanqory as provider/deployer must comply with applicable laws (e.g., EU AI Act) and the standards listed.
Merchants/developers using our APIs/apps must follow this policy and the Acceptable Use Policy and conduct DPIA/FRIA for high-risk use cases.
We will give advance notice via durable medium (email/dashboard) for material changes (e.g., user rights/data use/new AI features).
This policy does not transfer IP ownership in models/data; all rights reserved by Tanqory or relevant providers.
If local law is stricter or has added limits (e.g., AI ad warnings, biometric bans), local law prevails.
Read together with Privacy Policy, DPA, AI Developer Guidelines, App Privacy Requirements, Acceptable Use Policy, Data Classification/Retention Policy.
Conflicts are resolved in favor of the stricter document or binding local law.

2) Permitted and Prohibited AI Uses

Permitted (examples): fraud detection, content moderation, recommendations, AI assistant/chatbot, smart descriptions, forecasting/analytics, security anomaly detection with risk-appropriate guardrails.
Prohibited (aligned with EU AI Act/global norms): social scoring for discrimination; real-time biometric ID in public; predictive policing; emotion recognition in sensitive contexts; manipulating minors/vulnerable groups; generating/hosting illegal content (e.g., CSAM, hate, violence).
No AI use to evade sanctions/export controls or for illegal/unethical products/services.
Do not use AI data/outputs to deny rights/services on discriminatory bases (race, sex, religion, political opinion, gender identity, etc.).
AI-generated commercial content must be reviewed before publication and disclosed as AI-generated where law or guidance requires.
Merchants/app developers must not use our APIs/models to create deepfakes for financial/fraudulent identity purposes.
Generative models that interface with consumers must offer a path to a human when requests are significant.
Use of external models requires data/rights/security terms and compliance with that provider’s restrictions.
Training/fine-tuning on user data requires a lawful basis or clear consent and an opt-out per personal data rules.

3) Risk Classification and Controls

Use EU AI Act + NIST AI RMF: Unacceptable (banned), High Risk (DPIA/FRIA/AI Impact Assessment required), Limited (notice/label), Minimal (general practices).
High Risk systems (e.g., fraud detection, account suspension, content moderation, credit/eligibility scoring): require Human-in-the-Loop, AI Impact Assessment, Data/Model Card, post-market monitoring, logging/traceability, incident/serious-incident reporting.
Generative/Conversational AI: label “AI,” disclose AI-generated outputs, provide human access when outcomes are significant, test prompt injection/abuse, filter harmful content.
Decision/log retention for high-risk systems: at least 6 years or longer if mandated.
Re-assess risk at least annually or when models/data/context materially change.
If deploying in jurisdictions with special rules (e.g., biometrics/credit), add required controls.
Assign an owner/DPTO (AI product owner) accountable for oversight/approvals.
Do not release AI features publicly before required risk assessment and approvals.
Test fairness/bias and robustness before/after release using test sets that reflect supported user contexts; document results.
Store evaluation evidence in technical documentation for audit.

4) Data Governance and Model Training

Data principles: minimization, lawful basis/consent, purpose limitation, retention per Data Retention Policy, accuracy/quality, security by design (encryption at rest/in transit).
Training: use anonymized/pseudonymized data when possible; if personal data is used, document lawful basis in RoPA/DPIA/FRIA.
Check data quality/representativeness and document bias-mitigation per EU AI Act Art.10 (data governance).
Do not use data that infringes copyright/rights or breaches data/model provider terms.
Users can opt out of model improvement via Dashboard or designated email; honor “no-train” contract terms.
Delete data when no longer necessary or upon user request (subject to lawful exceptions) and record deletion evidence.
For cross-border transfers, conduct TIA and use SCC/IDTA/Addendum or adequacy mechanisms as required.
Segregate environments (prod/non-prod); do not use real data in dev/test unless properly anonymized.
Restrict access to data/models by role (RBAC) and keep access logs for at least 1 year or longer if required.
Processors/model suppliers must sign DPA/SCC with supplementary measures and pass security assessments.

5) Transparency and User Rights

Notify users when AI is used that interacts or affects rights (chatbots, moderation, fraud/eligibility) with clear multilingual notices as needed.
Key rights: know AI is used; request explanation; object/opt-out where legally provided; request human review/appeal; request copies of data/assessments per data protection law.
Channels: Dashboard > Privacy/AI Preferences; email ai-ethics@tanqory.com; ai-rights-request form. Acknowledge within 2 business days; typical closure within 30 days; appeals within 15 business days.
Appeals of significant AI decisions receive human review with authority to override and transparent reasoning.
Publish AI usage in Help Center and Transparency Report (systems, request/appeal stats, bias test results).
AI-generated content is clearly labeled; users may export/delete generated content per applicable rules.
AI conversation logging: inform users of recording/use for model improvement/service; offer opt-out where required.
Respect rights against solely automated decisions where mandated (e.g., GDPR/UK GDPR) and provide human review before effect.
Send key notices via durable medium (email/dashboard) for changes to data/model use or opt-in/opt-out requirements.
Offer explanations/support in major local languages where user volume warrants (e.g., English/Thai/Japanese/Korean/Spanish).

6) Human Oversight and Accountability

Implement Human-in-the-Loop/on-the-Loop for high-risk/legal/economic-impact systems; assign duty officers per shift.
Account suspensions, fraud/credit denials, content/review removal, or KYC denial require human verification before enforcement, unless urgent harm—then post-review within SLA.
Log rationale and human interventions for audit/appeal.
Maintain runbooks for Trust & Safety/Support to handle disputes/appeals and easy human access.
Train teams on fairness, bias, user communications, and model limitations.
Appeal SLA for significant AI outcomes: acknowledge within 2 business days; decision within 15 business days (update and seek extensions for complex cases).
Assign accountable owner per AI system with backups.
Model/parameter changes affecting user rights require AI Ethics Committee or delegated approval.
For third-party models, ensure human review/override is available to meet our obligations.
Periodically review oversight effectiveness and improve tools/dashboards for informed decisions.

7) Security, Resilience, and Testing

Security by design: TLS ≥1.2, encryption at rest, RBAC/least privilege, network segmentation, secret management, audit logging, patch management.
Test bias/fairness, adversarial attacks, prompt injection, jailbreak, model inversion, data exfiltration pre-release and periodically (at least quarterly for high-risk/generative).
For generative AI: content filtering, watermark/provenance (where supported), dangerous prompt limits.
Red-team/penetration test key AI endpoints; remediate per risk SLA (Critical ≤7 days, High ≤30 days).
Monitor drift/quality (accuracy/FP/FN) with alert thresholds.
Incident/serious-incident playbook: detect–contain–mitigate–communicate–remediate–root-cause review.
Keep testing evidence and remediation results in technical documentation for compliance checks.
Limit access/misuse via rate limits, abuse/anomaly detection on AI APIs/features.
For payment data: never store CVV/track/PIN; comply with PCI DSS; avoid training/processing unencrypted card data.
Allow users to disable certain AI features in the dashboard where risk or preference warrants.

8) Incidents, Notifications, and Complaints

Serious incident definition: harm to life/health/rights; material legal breach; large-scale erroneous decisions; or AI security issues posing harm.
Timeline: detect/intake immediately; assess impact within 24h; notify stakeholders and update within 72h; if legally required (AI Act/PDPA/GDPR, etc.), notify regulators per jurisdictional deadlines.
Channels: ai-report@tanqory.com, dashboard form, or security@tanqory.com for urgent issues; acknowledge within 1 business day.
Personal data breaches follow the Incident Response/Privacy Breach Playbook and data protection laws (e.g., notify DPA/users within 72h if required).
Maintain incident register and post-incident reviews with prevention plans; share lessons with relevant teams.
Users may complain/appeal AI outcomes; respond per SLAs in Sections 5/6; unresolved complaints may be escalated to local authorities (DPA/PDPC, etc.).
If an external AI provider is at fault, coordinate with that provider and mitigate/replace as needed.
Prioritize incidents involving minors/vulnerable groups.
For harmful/illegal content, block/remove and notify authorities as required.
Track incident/serious-incident stats and summarize in the annual transparency report.

9) Documentation, Ownership, and Records

Maintain technical documentation for AI systems, especially high-risk: model/data cards, design docs, training data lineage, evaluation, intended use/limitations, risk controls, logging/traceability.
Keep RoPA/DPIA/FRIA/AI Impact Assessments for systems with personal data or high risk; update when context or models/data change.
Retain decision/access/inference logs for high-risk systems per legal timelines (at least 6 years or longer if required).
Protect IP in models/code/data per contract and law; avoid using data that infringes others’ IP.
Contracts with model providers/suppliers must set usage rights, data limits, warranties, and appropriate liability/indemnities.
Label internal tools with environment (dev/test/prod) and data use permissions.
Backup data/models; maintain safe rollback for failed/low-quality deployments.
Assign document owners and review cycles (at least annually).
This version is binding; changes recorded in version history and notified via durable medium.
Provide regulators/auditors access to relevant documents per law/contract.

10) Governance, Organization, and Training

Establish AI Ethics Committee (CTO, Chief Legal, DPO, Head of AI/ML, Head of Trust & Safety) to oversee policy, approve high-risk systems, and review major incidents/complaints.
Board role: endorse AI ethics/risk framework and review annual reports; hold at least one in-camera session yearly on AI/data risk.
Operational teams (AI/Legal/Security/Privacy/Support) execute this policy and report to the committee.
Mandatory annual training for personnel involved (e-learning + quiz ≥80%) and onboarding within 30 days.
Specialized AI developer/engineer training: secure coding, bias testing, data governance, prompt safety, incident response.
Set AI risk/safety/quality KPIs/OKRs and review quarterly.
Provide consult/approval channels (ai-ethics@tanqory.com, intake form) before new AI projects or material changes.
Vendor risk management for model/tool providers, including DPA/SCC/TIA and security posture reviews.
This policy links to Acceptable Use Policy/Developer Guidelines to enforce on merchants/developers.
Publish practices/FAQ in the Help Center; update for new regulations or incident learnings.

11) Regional and Cross-Border Requirements

EU/EEA/UK: comply with AI Act/UK guidance (AI labels, generative disclosure, DPIA/FRIA for high risk, technical docs, logging, serious-incident reporting); use SCC/IDTA/Addendum + TIA for transfers.
United States: comply with FTC/state AI/consumer laws; avoid deceptive AI claims; for health/finance data, comply with HIPAA/GLBA where applicable.
Singapore: comply with PDPA + Model AI Governance; disclose AI use affecting consumers; follow IMDA/PDPC guidance.
Japan/Korea/Australia/Canada/UAE: comply with local data protection and advertising/consumer rules; honor specific biometrics/AI prohibitions.
Cross-border transfers require lawful basis/contract and adequate technical/organizational measures; notify users per data protection laws.
No AI services to sanctioned countries/persons under UN/EU/OFAC/UK/SG/HK and company lists.
AI notices/labels adapt to local rules (language/format/warnings) on relevant product/checkout/chat pages.
Where markets require deletion/disablement of AI results on request, provide dashboard or Support channels.
Use of government/public-sector data must follow each country’s terms and permitted purposes.
Monitor AI/data protection law changes quarterly and update policy/user notices as needed.

12) Policy Changes and Notifications

Material changes (rights/data use/new AI features/new sharing) will be notified at least 30 days in advance via email/dashboard (durable medium), except for urgent legal/safety reasons.
Publish latest version at https://legal.tanqory.com and retain prior versions per the Retention Policy.
Continued use after the effective date signifies acceptance unless new consent is required by law.
Enterprise/Order Form terms prevail over conflicting general text.
Provide opt-out/feature-disable paths if changes increase user burden or risk.
Offer short explanations/FAQ for significant changes.
Review/update at least annually or sooner for new laws/incidents.
Record version/date in Version History and communicate changes.
Localize notices/format per local rules when communicating with users in that region.
Questions: ai-ethics@tanqory.com.

13) Implementation Assurance (Operational)

• Evidence and auditability: maintain model/data cards, bias/robustness/fairness and prompt-injection/red-team test results, drift/quality metrics, and incident logs for all in-scope systems (especially high-risk) to satisfy EU AI Act technical documentation and audit expectations.
• Live UI/UX notices: ensure AI labels, human-escalation prompts, and data-use/opt-out notices are live in product surfaces (chat, moderation decisions, checkout/AI features) with durable confirmations and evidence (screenshots/versioned copies).
• Opt-out/no-train plumbing: verify dashboard toggles for “no-train” and feature disablement propagate to data/model pipelines; record in RoPA/DPIA/FRIA and technical change logs; enforce exclusion from training jobs.
• Appeals workflow: track SLA (ack ≤2 business days; decision ≤15 business days) with audit trails of human reviewers and outcomes; align support runbooks and tooling to these timelines.
• Localization: deploy legally required labels/notices in mandated languages/formats (e.g., EU AI Act/DSA transparency, UK/ASA guidance, JP/KR consumer notices); keep evidence of localized text and placements.
• High-risk/sensitive domains: if biometrics, credit, hiring, eligibility, or sanctions-screening are used, register as high risk, apply HITL, lawful basis/consent, bans where applicable (e.g., no real-time remote biometrics in public), and jurisdiction-specific controls.
• Vendors/third-party models: execute DPA/SCC/TIA plus provider usage-term enforcement (e.g., no medical/credit if disallowed) both contractually and technically; monitor access and usage logs for compliance.
• Security/incident drills: rehearse incident playbooks; remediate Critical ≤7 days/High ≤30 days; serious-incident notifications within legal timelines (e.g., ≤72h where required); keep drill/response records.
• Transparency reporting: publish AI transparency reports (systems in use, request/appeal stats, bias/robustness summaries, incident stats) per commitments; retain prior reports for audit.
• Technical controls: enforce rate limits/abuse detection on AI endpoints; require approval gates before production deploys; block storage/training on sensitive data (e.g., CVV/PCI, special-category data) unless explicitly allowed by law and contract.

14) Detailed Operational Narrative (Implementation Walkthrough)

To meet global platform standards and satisfy legal frameworks such as the EU AI Act, GDPR/UK GDPR, Singapore PDPA, CCPA/CPRA, and applicable consumer and advertising rules, Tanqory runs a full AI governance lifecycle from design through post-market monitoring. Each AI system is registered with an owner, risk-classified (unacceptable/high/limited/minimal), and linked to a dossier that includes a model card, data card, design spec, intended use/limitations, and a log of approvals. For high-risk use cases (fraud/abuse detection, account suspension, content moderation, eligibility/credit-like scoring, sanctions-screening, or any system affecting legal or economic rights), we require a DPIA/FRIA/AI Impact Assessment, human-in-the-loop or human-on-the-loop controls, and pre-production red-team tests (bias/fairness, robustness, prompt injection/jailbreak, adversarial attacks). Evidence from these tests—metrics, confusion matrices, subgroup analysis, drift monitors, adversarial findings, and remediation tickets—is stored with time-stamped versions for audit and regulator access.

Data governance is enforced via purpose limitation, lawful basis/consent capture, minimization, retention per the Data Retention Policy, and secure-by-design controls (TLS ≥1.2, encryption at rest, RBAC/least privilege, network segmentation, secret management). Training or fine-tuning on personal data is documented in RoPA/DPIA/FRIA with lawful basis; “no-train” and opt-out flags propagate through data pipelines to exclude affected records from training/improvement jobs. Non-production environments are segregated; real data in dev/test is avoided unless anonymized/pseudonymized with documented safeguards. Cross-border transfers use SCC/IDTA/Addendum with TIAs and supplemental measures where required. For third-party or foundation models, we execute DPA/SCC/TIA, enforce provider usage terms (e.g., bans on medical/credit or biometric uses if disallowed), and log access to monitor compliance.

Transparency and user rights are implemented in UI surfaces: AI labels on chat/conversational flows, decision notices on moderation/fraud/eligibility outcomes, data-use/opt-out notices on AI features, and human-escalation prompts where outcomes are significant. Notices are localized per regional rules (e.g., EU AI Act/DSA transparency, UK ASA/Online Safety guidance, JP/KR consumer notices) and delivered via durable medium (email/dashboard) for material changes. Users can exercise rights to explanation, objection/opt-out where provided by law, and request human review; appeals follow SLA (acknowledge within 2 business days, decision within 15 business days) with logged reviewers and outcomes.

Security and resilience rely on rate limits, abuse/anomaly detection, audit logging, and red/blue teaming. Critical vulnerabilities are remediated within 7 days; high within 30 days. Serious incidents—harm to life/health/rights, material legal breach, large-scale erroneous decisions, or AI security issues—trigger the incident playbook: detect/intake immediately, impact assessment within 24h, notifications/updates within 72h where legally required (e.g., AI Act/GDPR/PDPA), containment/mitigation, root-cause analysis, and preventive actions. Personal data breaches follow the Privacy Breach Playbook and statutory timelines. Drills are conducted and documented; incident registers and lessons learned feed model and control updates.

Human oversight is mandatory for high-risk actions: account suspension, fraud/credit denials, content removal, KYC denial require human verification before enforcement unless urgent harm, with post-review inside defined SLA. Runbooks guide Trust & Safety and Support; each AI system has an accountable owner and backup. Model or parameter changes that affect user rights require AI Ethics Committee or delegated approval. We maintain appeal channels and ensure humans can override AI outcomes. Logs of interventions and rationales are retained for audit and dispute resolution.

Localization and accessibility are integral: legally mandated labels and notices are deployed in required languages and formats; key notices are translated for major user bases (e.g., English/Thai/Japanese/Korean/Spanish) where volume warrants. Where law requires disabling or deleting AI outputs on request, dashboard or Support channels are provided.

Transparency reporting: Tanqory will publish AI transparency reports summarizing systems in production, request/appeal volumes, bias/robustness test highlights, and incident statistics. Prior reports are retained for audit. Technical controls include deployment gates, segregation of environments, prohibitions on storing/training on PCI CVV/track/PIN or special-category data unless explicitly permitted by law and contract, and monitoring for misuse (e.g., deepfakes for fraud, discriminatory uses).

Governance and accountability are overseen by the AI Ethics Committee (CTO, Chief Legal, DPO, Head of AI/ML, Head of Trust & Safety), with board oversight via annual AI/data-risk review. Mandatory annual training (plus onboarding) covers secure coding, bias testing, data governance, prompt safety, and incident response; passing score ≥80%. KPIs/OKRs for AI risk/safety/quality are reviewed quarterly. Vendor risk management is integrated, requiring security posture review and contractual safeguards for model/tool providers. This policy links to the Acceptable Use Policy and Developer Guidelines to enforce on merchants/developers. All changes are communicated via durable medium, versioned, and localized as required.

Appendix A: AI Systems and Key Controls (snapshot)

• Fraud/Abuse Detection (High Risk): human review before suspension; AI Impact Assessment; 6-year logging; bias/robustness tests; serious-incident detect ≤24h/notify ≤72h where required.
• Account Suspension (High Risk): Human-in-the-Loop; appeal SLA 15 business days; audit log; DPIA/FRIA.
• Content Moderation (High Risk): transparency report; appeal channel; AI decision labels; bias/robustness tests.
• Recommendation/Personalization (Limited): AI label (if UI-impact); opt-out; drift monitoring.
• Generative AI (chat/content/image) (Limited/High by context): AI labeling; human fallback; prompt safety; content filters; watermark/provenance if available; abuse detection.
• Predictive Analytics/Forecasting (Minimal): standard data governance; no direct legal effects.
• New systems/risk-level changes will be updated on dashboard/transparency reports and notified via durable medium.

Appendix B: Sample Notices

• Chatbot/Conversational: “You are interacting with an AI system; you can request a human at any time.”
• AI-Generated Content: “This content was generated by AI; please review before use/publication.”
• Decision Notice (High Risk): “This decision used an automated system. You may object/request an explanation/request human review at …”
• Data Use: “We use de-identified data to improve models. You can opt out at …”

Version History