Algorithmic Transparency Policy

This policy sets Tanqory’s transparency, notice, explainability, and appeal standards for algorithmic and AI systems we build or deploy, aligned to global laws and frameworks (e.g., GDPR/UK GDPR Art.13–15/22, CPRA/US state privacy, EU AI Act, EU Digital Services Act (DSA) and Platform‑to‑Business Regulation (P2B), ISO/IEC 42001, NIST AI RMF). It commits us to clearly tell users when automation is at play, why they see certain results, how to challenge them, and what safeguards are in place. We maintain Model/Service Cards, ranking disclosures, and age‑appropriate notices; we explain key ranking factors, hold logs for appeals, and localize notices/rights where laws require. We treat vulnerable users and children with additional care, avoiding dark patterns and undue influence. For high‑impact decisions, we ensure human oversight and offer meaningful redress. We also map roles and obligations under emerging AI rules (e.g., EU AI Act Provider/Deployer) and online platform rules (DSA/P2B) to make sure merchants get reasons for demotion/removal and avenues to contest.

We regularly test for fairness, bias, robustness, and security (prompt injection, data poisoning) and publish mitigation steps. Where we use third‑party or foundation models, we review their safety cards, licenses, data rights, and provenance; we keep a Model BOM/SBOM and can swap or roll back providers if they change materially. We adopt content provenance/watermarking (e.g., C2PA) where feasible and disclose its coverage and limits. We monitor for drift, re‑classify risk when context changes, and rerun AIIA/FRIA/DPIA when moving into new markets or use cases. Transparency reporting will expand if legal thresholds are triggered (e.g., DSA VLOP/VLOSE); at minimum, we track takedowns, demotions, appeals, upheld appeals, and material model changes for audit and, where required, publication.

We respect cross‑border rules for notice and data transfer, honoring opt‑outs (e.g., GPC under CPRA) and providing “Do Not Sell/Share” links where behavioral advertising is involved. Notices and appeal flows are localized for language and accessibility (WCAG), with French where mandated (e.g., Quebec) and child‑appropriate messaging under UK AADC/online safety laws. We keep evidence of notices, consents, withdrawals, and appeal outcomes for the model lifecycle plus the legal/contractual period. If mandatory consumer protections require local forums or out‑of‑court settlement, we preserve those rights. Our governance cadence includes quarterly AI Ethics reviews and at least annual Board reporting; major changes are communicated via durable medium (email/dashboard) with effective dates and user/merchant rights spelled out. If any transparency requirement conflicts with another policy, the stricter or legally mandatory term applies, with safety, human rights, and lawful processing carrying the highest weight.

1) Scope and Application

This policy covers ranking/recommendation systems, automated decisions that affect rights (e.g., order rejection, account suspension, fraud/abuse detection), chatbots/assistants, and generative features that impact users or merchants. It applies to all Tanqory staff, contractors, suppliers, and partners who design, deploy, or maintain systems on the Tanqory platform. It must be read with Privacy Policy, DPA, Acceptable Use Policy, AI Ethics Framework, Data Classification/Retention, Incident Response/AI Incident Playbook, Terms of Service, and Terms of Sale. If there is a conflict, the more specific document (Order Form/Addendum or mandatory law) prevails. External/third‑party models (API/hosted/open source) require data rights, security, and risk assessments plus appropriate contracts before use. Systems in new markets must be reviewed for local transparency requirements before launch. Both production and sandbox environments are in scope; access is role‑based and segregated. Updates will be applied promptly when new AI/transparency rules take effect in any jurisdiction we serve.

2) Transparency and Fairness Principles

We inform users when outcomes are automated, ranked, or recommended by algorithms, and provide plain‑language reasons with links to Model/Service Cards that summarize purpose, limits, data sources, and known risks. Processing uses only necessary data, respects privacy rights, and is tested for bias/fairness before and after release. Metrics, mitigations, and guardrails are recorded. High‑impact use cases require human oversight and a practical appeal path. Systems must not mislead or unduly influence, especially with vulnerable groups or children. Guardrails and monitoring defend against prompt injection, data poisoning, and misuse. AI‑generated or AI‑assisted content is labeled so users can make informed choices. Model provenance (source, version) is logged. Where principles conflict, safety, human rights, and law take precedence over business utility.

3) Notices, Labels, and Ranking Disclosures

At every point of automated decision or ranking, we display a notice such as “This result is processed automatically” with a link to more detail. AI‑generated/AI‑assisted content is labeled visibly. For decisions with legal or significant effects (e.g., account suspension, transaction denial), we provide appeal rights and human review options. Ranking/recommendation surfaces summarize key factors (e.g., relevance, quality signals, freshness, popularity, policy compliance) and offer user controls to adjust or opt out where safety/law permit. We link to Model/Service Cards for technical limits and constraints. Where third‑party models/providers materially affect outcomes, we disclose them. Notices align with local law (e.g., EU AI Act transparency, CPRA “Do Not Sell/Share” for ad‑related tracking). For children/young users, notices use age‑appropriate language and avoid nudging. When models/providers change materially, we update notices via dashboard/email (durable medium). Evidence of notices, consents, and withdrawals is retained per legal/contractual requirements. Under EU DSA/P2B, merchants receive concise explanations of ranking parameters and any changes that demote/suspend listings, with a channel to contest.

4) Right to Explanation and Appeals

Users may request a high‑level explanation of the main logic used in automated decisions and their likely effects, and may appeal or request human review where the decision has legal/significant impact (GDPR/UK GDPR Art.22; CPRA rights). Standard SLA: acknowledge within 5 business days; resolve within published SLAs in Terms/Privacy/DPA. High‑risk AI uses defined Human‑in‑the‑Loop or Human‑on‑the‑Loop oversight with override criteria and logging. Complaints/appeals channels include dashboard and email (e.g., legal@tanqory.com or feature‑specific contacts). Logging is maintained at a level sufficient for audit/appeal while respecting data minimization and retention. Users can reduce or disable non‑essential recommendation/targeting if not required for safety or legal compliance. In EU/UK and US states with enhanced rights, notices and appeal flows are localized to meet local law. Fraud/abuse automation has named owners who respond to complaints; substantiated appeals feed back into model/business‑rule improvements. Under EU DSA/P2B, merchants are informed of reasons for suspension/demotion, available redress mechanisms, and internal complaint handling.

5) Documentation, Model Records, and Logging

Every covered system maintains a Service Card or Model Card with purpose, data scope, limits, key metrics, fairness tests, owners, human oversight, guardrails, model version, data sources, and prohibited uses. Model versions, feature stores, key parameters, and dependencies (Model BOM/SBOM) are recorded for provenance. Inference/decision logs are captured to enable audit/appeal while honoring privacy and retention rules. Update/rollback playbooks include pre‑production testing. Third‑party providers/APIs used in high‑impact systems are listed and reviewed periodically. If watermarking/content provenance is applied, evidence of metadata embedding is kept. Explainability tools and their limits/accuracy are documented. Red‑team/adversarial test results include action items and owners. Documentation must be accessible to governance, compliance, and contracted Enterprise customers as applicable. Update documentation whenever core model, purpose, data sources, or drift/bias materially change. Retention: keep Model/Service Cards, notices, consent records, appeals, and key logs for at least the model lifecycle plus applicable legal/contract periods; for DSA/P2B ranking notices and merchant actions, retain evidence consistent with local requirements.

6) Testing, Fairness, and Monitoring

We test bias/fairness with appropriate metrics (e.g., demographic parity, equalized odds) before and after deployment, set thresholds, and implement mitigations when thresholds are exceeded. Monitor drift and performance decay with defined SLOs (e.g., monthly for high‑risk, quarterly for limited‑risk) and log results. Red‑team and adversarial tests for generative/interactive systems target prompt injection, jailbreaks, and misuse; apply rate limits and abuse detection. When context or audience changes (e.g., new market, protected groups), re‑classify risk and rerun AIIA/FRIA. Record test outcomes with owners and deadlines; track to closure. Third‑party models are validated using provider safety/fairness materials plus our contextual tests. Improve models, business rules, or UX based on findings to reduce risk to users/merchants; report material results to the AI Ethics Committee or leadership per cadence. For DSA/P2B, significant ranking parameter changes are communicated to merchants with rationale, and demotions linked to policy violations are explained with guidance to remediate.

7) Incident Reporting and Material Changes

Material incidents (policy‑violating decisions, harm to vulnerable groups, inappropriate content, personal data inference) must be reported via incident channels within 24 hours of awareness. Incident Response and the AI Ethics Committee assess severity and decide pause/rollback per playbook SLAs. Where law requires (e.g., EU AI Act “serious incident” once effective), report to regulators without undue delay (current draft ≤15 days) and notify affected users if mandated; adjust SLAs/channels to match final rules. Communicate to impacted users/merchants via email/dashboard with cause, mitigation, and recovery timeline. Conduct post‑incident reviews with owners/deadlines; update Model Cards, AIIA, or business rules. Retain logs/evidence per legal/contractual terms; follow Data Breach Policy if personal data is implicated. Announce core model/provider changes with user impact in advance where reasonable. If overlapping incidents occur, credits/compensation (if any) follow SLA/Order Form caps and conditions. Primary contacts: security@tanqory.com, legal@tanqory.com, or contracted dashboard channels; playbooks are updated with new regulations and lessons learned.

8) Third‑Party Providers and Open Source Models

Third‑party models/APIs are used only after assessing data rights, security, bias/safety risk, and license/usage terms. Contracts include DPA/SCC or cross‑border addenda as required, and restrict reverse engineering or misuse. Licenses and rights for training data, weights, or samples must be verified to avoid copyright/contract breaches. Tanqory reserves audit/attestation rights for high‑impact or sensitive data systems and may require halting use if non‑conformant. Providers must support deletion/return of data upon termination or lawful request. If a provider changes T&Cs/models/data sources materially affecting users, Tanqory must be informed in advance; Tanqory will notify impacted users. For open‑source models, record BOM, licenses, and usage limits. Key providers/subprocessors for high‑impact systems are disclosed when required by law/contract and kept current in dashboards/appendices. Provider changes that affect user rights are announced via dashboard/email before taking effect, with fallback plans if service ceases or breaches contract.

9) Regional Specifics

We honor GDPR/UK GDPR (Art.13–15/22) and ePrivacy/PECR: notices, rights to appeal automated decisions, and readiness for EU AI Act obligations (transparency, serious incident reporting, technical documentation). Under EU DSA/P2B: (a) disclose main ranking parameters and their relative importance; (b) inform merchants of suspensions/demotions and provide an internal complaint channel and out‑of‑court options; (c) provide reasons for restriction/removal of content/listings; (d) adapt transparency reporting if user thresholds trigger VLOP/VLOSE status; (e) ensure recommender systems offer meaningful parameter explanations. In the US (CPRA/other state privacy laws), provide “Do Not Sell/Share” links and honor opt‑out signals (e.g., GPC) where ads/behavioral sharing are involved, and disclose key ranking factors where required. Canada: comply with PIPEDA/provincial laws on transparency and access rights. Singapore: comply with PDPA, consent/withdrawal, and consumer/ad rules. Australia: comply with Privacy Act and ACL transparency obligations. UK/US children/online safety (e.g., UK AADC, relevant US state codes): use age‑appropriate notices, restrict profiling/ads, and avoid non‑essential cookies without valid consent. Cross‑border data transfers use lawful mechanisms (SCC/Addendum/DPA) documented in AIIA/DPIA. Notices and appeals are localized for language and accessibility (WCAG). If new AI laws emerge, we will add supporting text and adjust notices/SLAs to conform. English is the controlling version if translations differ.

10) Governance, Communication, and Continuous Improvement

The AI Ethics Committee, with Data, Legal, Security, and Trust & Safety, governs algorithmic transparency and reviews at least quarterly. Material transparency, bias, and incident summaries are reported to senior leadership/Board at least annually and to Enterprise partners per SLA/contract. Major changes are communicated via email/dashboard (durable medium) with effective dates and user rights. Version history and changes are logged for audit. Staff and partners receive training on transparency, user rights, and AI regulation at least annually and before accessing high‑impact systems. Queries/complaints/appeals: legal@tanqory.com, support channels, or dashboard, with response SLAs as contracted. Feedback loops improve notices, labels, and Model Cards for clarity. If any part is invalid, the remainder stands; Order Form/SOW terms override conflicting general text. Appendices (Model Card, AIIA, Incident Playbook, Provenance Guide) are updated as systems/providers change. English is the legal reference if translations conflict. Transparency reporting cadence and scope will be expanded if statutory thresholds (e.g., DSA VLOP) are met; at minimum, we track counts of takedowns/demotions, appeals received/upheld, and material model changes, and publish summaries where law or contract requires.

---

Document Details

---

Appendix: Templates/Playbooks (indicative URLs)

• AIIA Template: https://trust.tanqory.com/
• Model Card Template: https://trust.tanqory.com/
• Incident Playbook (AI/Security): https://trust.tanqory.com/
• Content Provenance/Watermarking Guidance (C2PA): https://trust.tanqory.com/
  Note: If storage locations change, use the latest links announced in the dashboard/internal wiki.