Privacy Policy

This Privacy Policy explains how ZETICai, Inc. ("ZETIC", "we", "us") handles personal information when you use Ixian: the Ixian app for macOS (the "App"), the Ixian service and API (the "Service") and our websites. It is written for everyone who uses Ixian: people who use it for an organization, and individuals who sign up and buy on their own.

The models and other material your organization brings to Ixian are covered by Customer Model Handling, not by this policy; we ask customers not to put personal information in them.

A Korean version of this policy (개인정보 처리방침) applies to people in the Republic of Korea. [To be prepared from this draft by counsel, following the Personal Information Protection Act's required items, not as a plain translation.]

1. Who is responsible

ZETICai, Inc., a [Delaware] corporation at [address] ("ZETIC"), is the company you contract with for Ixian and is responsible for your personal information (the "controller").

Our affiliate [FULL LEGAL NAME OF THE KOREAN COMPANY, in Korean and English: to be confirmed; internal materials say 주식회사 제틱에이아이], a company in [Seoul], Republic of Korea ("ZETIC Korea"), provides engineering, operations and support for Ixian. It processes personal information only on ZETIC's instructions, under a written processing (entrustment, 처리위탁) agreement, as described below.

Privacy officer (개인정보 보호책임자): [TO FILL, by the Service owner: the privacy officer's full name and title], support@zetic.ai, [phone].

2. What we collect, why, and for how long

We collect this information from you, from your organization when it adds you to a workspace (your email address and role), from the sign-in provider you choose (Google, Hugging Face or your organization's single sign-on: your name and verified email address), and from our payment processor (payment status).

Signing in with Google. When you sign in with Google, Google gives us:

• your name;
• your email address, and whether Google has verified it;
• for a Google Workspace account, your organization's domain (Google's "hosted domain"). When there is one, we store it with your sign-in, both in Amazon Cognito (as custom:hd) and in our own database.

We use these only to sign you in and to link your sign-ins to one account. A zetic.ai domain also marks the account as ZETIC staff (section 7). We ask Google for nothing else: not your Drive, Gmail, Calendar or contacts. We do not use Google user data for advertising, and we share it only as section 3 describes. Our use of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements.

Signing in with Hugging Face. When you sign in with Hugging Face, it gives us your name, your email address and whether it is verified, and your Hugging Face account identifier. We use them only to sign you in and to link your sign-ins to one account.

What we do not collect. We do not receive or store payment card numbers (they go to Stripe), the sign-in or API key of the AI agent you use with the App (Claude Code, Codex or another), or sensitive information such as health or biometric data. We do not use cookies or advertising trackers in the App or on the pages the Service serves. [Confirm for the marketing website before publishing.]

Improving Ixian. We improve Ixian with run-derived knowledge that identifies neither you nor your organization, such as kernel timings by operator shape and robot computer (Terms of Service, section 6), and with the problems support conversations and fault reports bring to light. We do not use your personal information to train AI models, and we do not build profiles of you.

On your Mac. The App keeps your conversations, settings and packages on your Mac. In Demo mode nothing is sent to the Service. When you use your agent, what you type is sent by your agent to its provider under that provider's terms, not to us.

3. Who we share it with

We do not sell personal information and do not share it for targeted advertising. We share it only with service providers that process it for us under contract (in Korean law, 처리위탁), with our affiliate, when the law requires it, or in a merger or acquisition under confidentiality.

4. Transfers to other countries

The Service runs in the United States. If you use Ixian from outside the United States, your personal information is transferred there, and our affiliate's staff may access it from the Republic of Korea to operate and support Ixian.

For people in Korea, the transfer is necessary to perform our contract and is disclosed here as the Personal Information Protection Act allows (article 28-8(1)(3)):

• Recipients and countries: the providers and affiliate in section 3, in the countries listed there.
• What is transferred: the information in section 2.
• When and how: as you use Ixian, over encrypted network connections.
• Purpose and retention: as in section 2.
• How to refuse: you can decline by not creating an account, or close your account at any time by writing to us. Without the transfer we cannot provide the Service; the App's Demo mode keeps working without it.

European Union, European Economic Area and United Kingdom. Ixian is marketed to customers in the United States, and anyone may sign up. [Counsel: whether sign-ups from the European Union, the European Economic Area or the United Kingdom mean ZETIC must appoint representatives under article 27 of the GDPR and the UK GDPR and rely on the European Commission's standard contractual clauses or another lawful mechanism for transfers; this paragraph changes with the answer.]

5. How we delete it

When the retention period ends or the purpose is fulfilled, we delete personal information in a way that cannot be restored, or keep it only in a form that no longer identifies you. Information we must keep under another law is kept apart from other data and used only for that purpose. Backups are overwritten within [35] days. When you close your account we delete your sign-in identities and memberships and blank your name and email address on the records we must keep, such as billing and acceptance records. We keep a SHA-256 hash of your email address, which lets us recognise the address if it is used to sign up again, so that the free starter credits are given once per person. Anyone who already knows or guesses your address could match it against the hash, so we treat it as personal information and keep it only for that.

6. Your rights

You can ask to access, correct or delete your personal information, to stop or restrict its processing, to receive a copy in a portable format, and to withdraw any consent you gave. You can also object to processing based on our legitimate interests. Write to support@zetic.ai from the email address on your account. We reply within [10] days for requests under Korean law and within one month otherwise, and we may need to verify that the request is yours. If we cannot do what you ask, for example because a law requires us to keep the information, we tell you why.

You can also complain to a supervisory authority: in Korea, the Personal Information Protection Commission or the Korea Internet & Security Agency's privacy call centre (118).

If you live in California or another US state with a privacy law. These laws give residents rights over their personal information, for example the California Consumer Privacy Act as amended by the CPRA. [The thresholds that make them apply to us may not be met yet. We honour the rights below for every US resident anyway.]

• What we collect (the sources, purposes and retention periods are in section 2):
  • identifiers (name, email address, postal address, sign-in identifiers, IP address);
  • commercial information (plans, purchases, credits, runs, refunds);
  • internet activity on our Service (security logs);
  • coarse location (your country);
  • professional information (the workspaces you belong to and your role).
• Sharing. We disclose personal information only to the service providers and affiliate in section 3, for the purposes there.
• No selling. We do not sell personal information. We do not share it for cross-context behavioural advertising. We do not collect sensitive personal information as those laws define it.
• Your rights:
  • to know what we hold about you and get a copy;
  • to have it deleted;
  • to have it corrected;
  • to opt out of selling or sharing, though we do neither;
  • not to be treated differently for using these rights.
• How to ask. Write to support@zetic.ai. You may use an authorised agent, in which case we may ask you to confirm the request. We verify each request against the account it concerns, and answer within 45 days (extendable once by another 45 days, telling you why).

If you live in the Republic of Korea. This policy's Korean version (above) gives the items the Personal Information Protection Act requires, whether you use Ixian for an organization or on your own. Ixian is not for anyone under 18 (section 8). We will ask for separate consent before any optional use, such as marketing, and declining it never limits the Service.

If your organization's workspace admin added you, some requests (for example removing you from a workspace) are best made to them.

7. Who at ZETIC can see it, and how we protect it

ZETIC staff can see customer workspace data. Everyone at ZETIC with a zetic.ai Google Workspace account, ZETIC Korea's staff included, can view the data of every customer workspace in our Admin console:

• workspaces: their names, plans, credits and ledger;
• the people in them: their email addresses and sign-in details (how and when they last signed in);
• runs;
• campaigns and their steps, with the Customer Results they produce: metrics, accuracy, telemetry and the last part of each job's log;
• the audit log;
• chip-request notes;
• workspaces' billing email addresses.

The Admin console does not show the model files you bring; Customer Model Handling says who can reach those.

• Staff sign in to the Admin console only through ZETIC's Google Workspace.
• Each time staff read a customer workspace's data, the read is recorded in our audit log. [In place once the staff audit log is deployed.]
• When a person leaves ZETIC or ZETIC Korea, their access ends when we remove their zetic.ai Workspace account and sign them out of Ixian, which we do within [24 hours] of their leaving.
• Staff are bound by confidentiality obligations.

How we protect it.

• We encrypt data in transit and at rest, keep the database in a private network, keep access and change logs, and review our providers' security.
• [Staff Google Workspace accounts require 2-Step Verification. To be enforced for the zetic.ai domain before this policy is final.]
• Sign-in codes and tokens are never stored in plain text. No system is perfectly secure; if a breach affects your personal information we will tell you and the authorities as the law requires (in Korea, within 72 hours of learning of it).

8. Children

Ixian is not for anyone under 18 (Terms of Service, section 1), and we do not knowingly collect personal information from anyone under 18. If we learn that we have, we delete it and close the account.

9. Automated decisions

We do not make decisions about you that have legal or similarly significant effects based solely on automated processing.

10. Changes

We will post any change here with a new version date. For a change that reduces your rights or adds new purposes, we tell you in the App or by email at least [30] days before it takes effect and, where the law requires, ask for your consent again.

11. Contact

support@zetic.ai · ZETICai, Inc., [address]