Ailoot Privacy Policy

Revision dated 2026-10-17.

The Ailoot Privacy Policy (the Policy) and the Ailoot Offer and License Agreement (the Offer), together with their appendices, constitute the complete set of Ailoot documents.

Appendices to the Policy:

1. Ailoot Cookies Policy.
2. Ailoot Data Settings.
3. Deletion of Ailoot Account and Data.
4. Terms for Processing Organizations’ Data.
5. Consent to Personal Data Processing — a standalone document included here for ease of reference.
6. Infringement of Intellectual Property Rights — Appendix 7 to the Offer, included here for ease of reference.

References in the form “Appendix N to the Offer” refer to the appendices to the Ailoot Offer and License Agreement; references to the “main text of the Policy” refer to sections 1–12 below.

This Policy applies from the date of its publication on ailoot.ai and operates together with the Offer and its appendices, including Appendix 4 to the Offer (“Ailoot Acceptable Use Rules”) and Appendix 3 to the Offer (“Refunds and Payment Disputes”), as well as appendices 1 (“Ailoot Cookies Policy”) and 2 (“Ailoot Data Settings”) to this Policy. A corporate order under which the ailoot.ai service processes personal data on the documented instructions of a client organization is also governed by a separate data processing agreement or appendix; the general rules for that layer are described in appendix 4 to this Policy (“Terms for Processing Organizations’ Data”).

1. Who is responsible for processing and what the Policy covers

The personal data operator for purposes that Ailoot determines independently is the ailoot.ai service. For matters concerning personal data, deletion, security and the exercise of rights, you may contact support@ailoot.ai.

Ailoot is an API router. A client with an API key sends requests through OpenAI-, Anthropic- and Gemini-compatible interfaces to https://api.ailoot.ai/v1 and receives responses from models of several suppliers (for example, Anthropic Claude, OpenAI GPT, Google Gemini, xAI Grok, Alibaba Qwen, MiniMax and models hosted by NVIDIA): text, images, video, music, speech synthesis and transcription. The client dashboard on ailoot.ai is used to manage the account, API keys, balance and usage history. The service manages accounts, access, request routing, its own processing logic, usage records, balance and support. Using Ailoot does not create an account, contract or payment relationship between the user and a model supplier merely because that model is available in Ailoot. The payment provider identified on the payment page, model supplier, routing service or other contractor processes data within its own role, applicable contract and legislation.

The Policy covers data processed when visiting ailoot.ai, registering for and using the client dashboard, using the API, contacting support, topping up the balance or enabling an optional feature. It does not replace the privacy policy of a third-party website, application, payment method or model supplier.

Availability of the Service in a particular country depends on applicable law, the selected model, the technological route and the payment method. The language of a page does not in itself mean that the service is offered in every country or that the same set of rights applies in all countries.

In this Policy:

• account means the user’s Ailoot account, managed through the client dashboard on ailoot.ai;

• API key means an access key issued in Ailoot that the client uses to send requests to the API;

• request materials means the request text, context, file, media, parameter, response, tool result and other data necessary to perform a particular function;

• model supplier means the organization whose model or technological tool is actually used for the selected route;

• “Model and Supplier Terms” means Appendix 5 to the Offer, a reference document linking to the published terms of models and technological suppliers; it is not a list of the actual recipients of a particular user’s data;

• personal data means information relating to a directly or indirectly identifiable natural person within the meaning of applicable law.

If an organization uses Ailoot for data relating to its employees, clients or other individuals, it may determine the purposes and essential means of that processing. In that case, the ailoot.ai service may act as a processor on the organization’s documented instructions within the scope of a separate B2B order and data processing agreement. The ailoot.ai service nevertheless remains an independent operator for its own mandatory purposes: account and contract administration, payments and accounting, prevention of abuse, security, compliance with the law and protection of claims. The role is determined by the actual flow and contract, rather than the name of the feature.

2. What data we may obtain and from where

We apply the principle of necessity: we do not request or use data that is not needed for the stated purpose. Users must not send support a full card number, CVV, PIN, password, full API key, one-time banking code or other access secret. Balance top-ups are processed by the payment provider identified on the payment page: that provider receives the payment details, while Ailoot receives only the payment information needed to credit the balance, record the payment, resolve an error, refund or dispute, without full card details.

If a particular feature requires the processing of special-category, sensitive or biometric data, Ailoot does not consider ordinary acceptance of this Policy a sufficient basis: before the feature is launched, the purpose, data, recipient, available safeguards and legally required consent or other legal mechanism must be disclosed.

The user is responsible for having the lawful basis, rights and consents needed to upload materials concerning another person. This does not relieve the ailoot.ai service of its own obligations under applicable law, or its security and data processing obligations within its role.

3. Why we process data and on what basis

Processing purposes are determined in advance and must not be incompatible with the purpose for which the data was obtained. Where applicable law uses the concept of a legal basis, we rely on one or more of the bases below. Consent does not replace a contract, legal obligation or legitimate interest and is not concealed within a mandatory top-up checkbox.

The content of requests, attachments and results is used to provide, protect and support Ailoot. The ailoot.ai service does not use it to train its own general-purpose models or for optional advertising merely because the user accepted this Policy. If Ailoot ever offers separate research, training or other secondary use, the specific purpose, data categories, period, recipients, consequences of refusing and the necessary consent and withdrawal mechanism will be disclosed before it is enabled.

4. Models, routing and files

4.1. Selected model and supplier

Ailoot sends the necessary request materials to the supplier of the selected model or the tool through which the request is actually executed. This may include the request text, relevant context, a file, technical parameters and part of the response if needed to perform the function, ensure security or check the result. The model supplier serving the request may be located outside the client’s country. We transmit no more than is necessary for the particular request.

Before using a model, the user can review its name, methods and price in the model catalog in the client dashboard, and the applicable terms in Appendix 5 to the Offer (“Model and Supplier Terms”). Requests are subject to the relevant suppliers’ usage rules (for example, the usage rules of Anthropic, OpenAI and Google). This appendix helps users find the published terms of technological suppliers. It is a reference to external terms, rather than confirmation that every listed supplier is included in an Ailoot route or receives user data. Information material to a particular request, including the recipient, data restrictions and available settings, is disclosed in the model catalog, settings or relevant order before processing, to the extent required by law and the contract. For corporate processing, the recipients and international transfers are determined by the actual processing appendix.

Model suppliers may have different rules for retention, logging, security checks, training and deletion. Each route is governed by the terms stated in the model catalog and the applicable supplier rules. “Zero retention,” no training, a fixed processing country or a particular deletion period applies only where expressly stated for the selected route. If automatic switching to another route materially changes the terms for processing materials, Ailoot discloses this before use and obtains a separate user choice where required by law or the product setting. Circumvention of applicable geographic, export or security restrictions is prohibited.

4.2. Files, cache, history and generated media

A file submitted with a request may be processed only to the extent necessary to execute that request, including checks of its format, security and applicable rules. Generated images, video, music and audio are stored for the client to download. If Ailoot offers separate file storage, history, cache or another retained object, before it is enabled the interface must explain exactly what is saved, where it is visible in the account, how to delete the object and what retention criteria apply. Not every submitted material becomes a permanently saved object, and not every temporary cache is user history.

A technical cache may be used for request execution, performance, duplicate prevention or security for as long as necessary. It does not confer a right to use the content for independent purposes. After a user object is deleted, residual copies may temporarily remain in backup or protected technical systems until their normal cycle; they are not returned to ordinary use after deletion, except where necessary for recovery on a lawful basis or an unresolved incident.

Do not upload a password, secret key, complete payment details or another secret to Ailoot unless it is needed for the selected function. Before uploading data about another person or medical, biometric, financial or other sensitive data, ensure that you have the right to do so and that the selected route permits such processing. This warning does not replace separate requirements of the law, the contract with the organization or the supplier’s terms.

4.3. Feedback

Rating a response, reporting a problem or suggesting an improvement is voluntary. If the user submits feedback, Ailoot may use the feedback itself and the related context the user expressly supplies to investigate, correct or improve the relevant feature. We do not treat the entire account or all past requests as feedback merely because the user left one rating.

4.4. Organizations and B2B orders

If an organization and the ailoot.ai service have entered into a B2B order, administrator access, export, deletion, instructions and data subject requests are additionally governed by that order and the data processing agreement. Ailoot does not disclose more to an administrator than the role, contract, settings and law permit.

5. To whom and in what circumstances we disclose data

We do not sell requests, files or results as a commodity and do not grant a third party the right to sell them merely because the user accepted this Policy. Any disclosure is limited by its purpose and the recipient’s legal role.

Data may be transmitted to the following categories of recipients:

1. Model and route suppliers. They receive materials needed for the selected model or tool and may be located outside the client’s country. Their separate rules and material features are available in Appendix 5 to the Offer (“Model and Supplier Terms”).

2. Technical contractors. Hosting, storage, authentication, notification delivery, diagnostics, support, security and other suppliers may receive the minimum data necessary for their function. We engage them under applicable contracts and law; their specific role depends on the actual service.

3. Payment participants. The payment provider identified on the payment page and the banks and payment systems involved in the transaction receive information needed to process a top-up, reconciliation, refund or dispute. The terms of the particular payment channel apply to that transaction.

4. The organization and its administrators. Within a B2B order, to the extent of their lawful authority, role, settings and contract with Ailoot.

5. Successors. Only in connection with a reorganization, transfer of the service or its assets, financing, bankruptcy or a similar transaction, and subject to applicable notification, confidentiality and data protection obligations.

6. Public authorities, courts, law enforcement agencies and other lawful recipients. Where disclosure is required by mandatory law or an enforceable request, or is necessary to protect rights and security and prevent serious harm. Where the law permits, we assess the request and notify the affected person or organization when this does not create a risk, violate the law or impede an investigation.

7. Recipients of anonymized or aggregated information. Only if the data has actually been processed so that it is not used for ordinary identification of an individual, and the disclosure complies with the law and the stated purpose.

The reference list of supplier terms does not replace information about actual data recipients. Information about the recipient for a particular request is disclosed through the model catalog, settings and contractual documents; additional information may be requested at support@ailoot.ai. The scope of disclosure is determined by applicable transparency obligations, confidentiality and security.

6. International processing and transfers

Data may be processed in the countries where the model suppliers, technical contractors or user-selected recipients actually involved in processing are located, including outside the client’s country. The country of the interface or the language of the document does not determine all processing locations.

Before an international transfer, Ailoot applies the mechanism required by applicable legislation: it assesses the parties’ roles and the purpose of the transfer, uses contractual, organizational or other permitted safeguards, and provides a separate disclosure or obtains consent if necessary. A general statement about international processing is not consent to every future transfer and does not replace consent that must be specific.

For corporate clients, the cross-border transfer mechanism, including a contractual appendix for the EEA, the United Kingdom or Switzerland where required, is recorded in the individual B2B agreement after the exporter, importer, data categories, countries, actual recipients and applicable legal mechanism have been identified. Data localization or processing only in a particular region applies only to a route whose catalog entry and contract expressly state it.

7. How long data is retained

We do not use one common period for all data. The period is determined by the purpose, feature setting, contract, need to provide access and usage history, legal requirements, security, accounting, disputes and the ability to separate the data from an individual’s identity. Once the purpose no longer exists, data is deleted, anonymized or isolated if further retention is not required by law or is not permitted by law.

A model supplier or external service may have its own retention period after materials are lawfully transferred to it. Ailoot cannot declare a common period on their behalf. Information in Appendix 5 to the Offer (“Model and Supplier Terms”) and that recipient’s terms apply to the selected route. If the user wishes to delete data held by a third-party service, a separate request to it may be needed; Ailoot provides reasonable assistance within its role and contract where applicable.

Confirmed account deletion does not eliminate data that must be retained on a limited basis for payments and accounting, the law, abuse prevention, security, an unresolved claim, debt arising from a disputed payment or protection of rights. Such data is not used for ordinary personalization, marketing or new performance of the service without an independent basis.

8. Security, incidents and automated checks

We apply legal, organizational and technical measures proportionate to the risk: we limit access on a need-to-know basis, manage access to accounts and systems, separate functions and environments to the extent necessary, maintain necessary technical records, assess incidents, check contractors and train authorized persons in applicable data handling procedures. A certificate, particular encryption algorithm, data center country or response time is an Ailoot commitment only where expressly stated in the applicable contract, model catalog or other published term.

No method of transmission or storage guarantees absolute security. Users must protect their password, API keys and device, must not disclose credentials or API keys to others, must use official channels and must promptly report a suspected compromise of their account or API key to support@ailoot.ai.

If we discover an incident that may affect personal data, we assess its nature and consequences, take containment and investigation measures, record available information and notify the affected organization, individual or supervisory authority where required by applicable law or the contract. For corporate client data, notification and assistance procedures are governed by the applicable B2B agreement; the notification period is calculated under applicable law, the contract and the available confirmed circumstances of the incident.

Protection against fraud, spam, malicious code, circumvention of restrictions and rule violations may use automated signals and limited human review. Such checks serve security and compliance with the terms rather than making a legally significant decision about an individual. Where provided for by applicable law, the user may request human reconsideration of a material account restriction; legal requirements, security and third-party rights may limit the information disclosed.

9. Rights and ways to manage data

Rights depend on the country of residence, the user’s role, the nature of the data and applicable law. Where applicable, the user may request:

• confirmation of processing, access to data and information about categories, sources, purposes and recipients;

• correction of incomplete, inaccurate or outdated data;

• deletion, anonymization or cessation of processing where there is no continuing lawful basis;

• restriction of processing or objection to processing based on a legitimate interest, including objection to direct marketing;

• portability of available data in an applicable and technically feasible format;

• withdrawal of consent to optional processing without affecting the lawfulness of processing already carried out;

• information about cross-border transfers to the extent required by law;

• reconsideration of a refusal of a request and recourse to a competent data protection authority or court where that right is provided by law.

To exercise a right, write to support@ailoot.ai with the subject “Ailoot Data”. Identify the account or another safe way to locate the record, the action requested and a convenient response channel. Do not send a full card number, CVV, password, full API key or banking code. We may request proportionate verification of identity and authority to avoid disclosing data to another person. An authorized representative must provide sufficient evidence of authority where required by law and where this does not create an excessive barrier to exercising the right.

We respond within the period prescribed by applicable law. If a request is complex, repetitive or affects the rights of others, protected commercial information, lawful retention, security or an organization’s materials, we may lawfully limit the response, request clarification or extend the period, stating the reason where required. A refusal must not be arbitrary; the user may request reconsideration through the same contact. Exercising lawful data protection rights is not a basis for discrimination or degradation of the core service, except where the processing is objectively necessary for the selected feature or the law permits a different outcome.

Regional supplements

EEA, United Kingdom and Switzerland. If the GDPR, UK GDPR, Swiss law or similar rules apply to processing, the user may have rights of access, rectification, erasure, restriction, objection, portability and complaint to a competent authority. The bases on which Ailoot relies are listed in section 3 of this Policy. Requests are considered within the period prescribed by those rules; an extension is possible only in the cases they provide for and with notification. If a representative, DPO or additional regional disclosure is required, Ailoot publishes it before starting the relevant activity.

United States. A person covered by applicable state law may have rights to know and access, correct, delete and port data, act through an authorized agent, appeal a refusal and opt out of sale, sharing or targeted advertising within the meaning of that law. Applicability of a particular regime is determined by state law and actual processing. Ailoot does not use requests and attachments for third-party behavioral advertising. Where a particular regime requires a separate link, form or handling of a global privacy control signal, Ailoot provides that mechanism for the relevant practice.

Republic of Korea. Where applicable Korean law covers the processing, the user may have rights of access, correction, deletion, suspension of processing, withdrawal of consent and information about overseas transfers to the extent prescribed by law. Required local contact details and separate recipient disclosures are published if they become mandatory for Ailoot’s actual activities.

10. Children and age restrictions

The minimum age for using Ailoot is determined by the Offer and applicable law; the selected model, country or feature may require a higher age. Where a higher threshold applies to a particular route, it takes precedence, and access to that route is provided after the relevant condition is met. The Ailoot service is not intended for persons below the minimum age without a lawful basis provided for by law and a feature that actually supports it.

If the user has not yet reached the age at which they may independently accept the terms or give the applicable consent, a parent or legal representative must be involved. We do not ask a child to circumvent an age restriction. A parent, representative or other person who believes a child has provided data without the required basis may contact support@ailoot.ai; we will verify their authority and consider restriction or deletion in accordance with the law, security and existing obligations.

11. Cookies, local storage and data settings

The ailoot.ai website and client dashboard may use necessary technologies for sign-in, session protection and basic settings where required by the interface actually enabled. Optional analytics, advertising, personalization and similar technologies are governed by appendix 1 to this Policy (“Ailoot Cookies Policy”). That appendix also describes the categories, register of technologies actually enabled, ways to accept, reject or change a choice, and local storage rules.

Settings for history, export, deletion, feedback and data use are explained in appendix 2 to this Policy (“Ailoot Data Settings”). The existence of that appendix does not mean that every named feature is already available: only the interface and description of the feature actually enabled determine its specific control.

12. Changes, version and contacting us

We update the Policy when the service, routes, actual processing practices, legal requirements or user rights change. A new revision is published with its date and version. We notify users of a material change in purposes, categories, recipients, rights or processing methods in the manner prescribed by law and the contract before the change takes effect, unless an urgent change is caused by the law, security or abuse prevention. A new purpose requiring separate consent does not arise merely from publication of a new revision.

Available language versions of the Policy are identified on ailoot.ai. The language versions convey the same level of protection; neither a translation nor a technical link reduces the user’s mandatory rights. For questions about data, security, the relevant model, international transfers, deletion or rights, contact support@ailoot.ai.

Appendix 1. Ailoot Cookies Policy

This appendix applies to ailoot.ai, the client dashboard and other Ailoot interfaces that use cookies, local storage, SDKs, pixels, device identifiers, session logs or comparable technologies. It does not cover cookies and SDKs on third-party websites that the user opens outside Ailoot.

1. What these technologies are and why they are needed

Cookies are small files or records that a website saves in a browser. Local storage, session storage, SDKs, device identifiers, pixels, web beacons and similar mechanisms may perform a similar task on the web or in an application. Depending on their settings, they help to:

• maintain sign-in and a secure session, and prevent repeated authentication;

• save language, basic accessibility settings and technical preferences;

• remember the user’s cookie choice and avoid displaying the same notice repeatedly;

• ensure security and detect abuse, an error or a duplicate request;

• when separately enabled, measure interface performance, improve a feature or display an optional informational message.

A technology does not automatically obtain more data than its particular task requires. For example, a record of cookie consent does not become permission to read request content, and a language record does not become permission for advertising. Ailoot does not use requests, attachments or results for third-party behavioral advertising.

2. Categories and activation rule

The register contains only technologies, advertising networks, SDKs and periods actually in use. An optional technology begins to be used after its inclusion in the verified register and completion of the disclosure and user choice required by law or this appendix.

3. Register of technologies actually in use

For each technology actually active, including a necessary setting, Ailoot publishes the following in this appendix or a linked register widget:

1. the name of the technology or SDK and the recipient;

2. the category and exact purpose;

3. which data or identifiers are processed;

4. the lifetime of the record or the criterion for determining it;

5. whether the recipient is an independent operator, processor or third-party service within the applicable meaning;

6. the country or international transfer mechanism, if that information is mandatory;

7. a link to settings, an opt-out or the recipient’s policy, if needed;

8. the date the entry was last checked.

The register must reflect the actual website, client dashboard and SDKs in use, rather than planned architecture. If a technology is removed, its entry is marked inactive or removed from the active list, together with a check that the code, tag or SDK no longer runs. The user may request information about a register entry at support@ailoot.ai.

Current register entries

Register entries are published in the following format:

As of the date of this revision, entries for technologies on ailoot.ai and in the client dashboard are added to the register as each technology actually in use is checked. Optional technologies are not used before their register entries are published.

4. User choice

Where consent is required for an optional category, the banner or settings screen must provide clear actions before that category is enabled:

• “Accept selected optional categories”;

• “Reject optional”;

• “Customize”, with categories and an explanation of the purpose;

• “Save choice”;

• the ability to change the decision later through a link or setting available on ailoot.ai or in the client dashboard.

Refusing is as easy as consenting. The interface does not preselect optional categories, combine marketing with acceptance of the Offer or use refusal as a basis for degrading the core service. Consent covers the processing described in the register; adding a new supplier, purpose or material type of tracking is accompanied by a new assessment and, where needed, a new choice.

Withdrawal of consent stops further use of the relevant optional technology to the extent technically possible and permitted by law. It does not make processing lawfully completed before withdrawal unlawful, or automatically delete data another party has already received on an independent lawful basis. If applicable law requires a global privacy signal or a similar opt-out mechanism to be honored, Ailoot implements it for the category actually applicable after checking the relevant technical flow.

5. Browser, device and third-party elements

The user may delete or restrict cookies through the browser, reset an advertising identifier or change permissions in device settings. Such actions are not always equivalent to withdrawing consent in the Ailoot interface: the browser may delete the choice record, while the website or dashboard may continue to use necessary local data for sign-in and security. For optional categories, it is therefore preferable to use both Ailoot settings and device controls.

Disabling all cookies or local storage may disrupt sign-in, security, language retention or certain features. This does not mean that Ailoot may enable optional analytics or advertising without a basis. If an external widget, link, payment page (for example, the page of the payment provider identified on the payment page), embedded document or connected service belongs to a third party, its technologies are governed by its policy. Before following the link or connecting, the user must review that policy; Ailoot does not control such technologies outside its own interfaces.

6. Retention periods and security

Session records usually expire when the session ends or after the necessary security period elapses. Persistent records are retained only for as long as their purpose requires, until the user deletes them through an available tool or until the lawful retention criterion changes. The specific period for each active entry is published in the register. Information about cookie choices and necessary protection may be retained longer than the technical identifier itself if needed to confirm the choice, ensure security or fulfill a legal obligation.

Access to information collected through Ailoot technologies is limited to the purpose for which it was obtained. We apply measures proportionate to the risk but do not guarantee absolute security of the user’s network or device. Do not enter a password, full API key, full card number, CVV, banking code or other secret in fields not intended for that purpose.

7. Relationship with other data settings

Cookies do not automatically determine whether request materials are retained or a file is transmitted to a model supplier. Those matters are governed by the main text of the Policy, appendix 2 to it (“Ailoot Data Settings”), the setting of the particular feature and Appendix 5 to the Offer (“Model and Supplier Terms”). For example, disabling an analytics cookie does not cancel the necessary transmission of a request to the selected supplier to execute it, and consent to a functional cookie does not authorize use of materials for training.

8. Changes and contacts

We update this appendix when a technology is introduced, changed or removed, or when a recipient, purpose, period or legal requirement changes. A material change to optional processing does not apply retroactively to an existing choice: before enabling it, Ailoot publishes the updated register and obtains a new user action where required. Cookie questions and requests may be sent to support@ailoot.ai.

Appendix 2. Ailoot Data Settings

This appendix explains the distinctions between history, saved results, files, feedback, training, API keys and data deletion in Ailoot.

The appendix describes data management rules for settings available in the client dashboard, API, model and country. Available controls are displayed in the interface before the feature is enabled. If a setting is not offered, the data is governed by the main text of the Policy and the rule for the feature actually enabled.

1. Basic principle: different data, different settings

The same request may simultaneously produce request materials, technical records, a model selection, a usage record, a reserve and a debit from the balance, and generated media. Deleting one object does not necessarily mean deleting all the others: for example, deleting a generated file does not cancel the usage record or debit for a request already executed. Ailoot therefore shows the control alongside what it affects and explains the consequences before the action is confirmed.

2. History, saved objects and cache

History is a user object that makes a past request, response or usage record available in the interface if that feature is enabled. A cache is a technical mechanism for execution, prevention of a repeated operation, stability or security. These concepts are not interchangeable.

Separate corresponding actions apply to deletion of history, a file or an account.

3. Model training, service improvement and feedback

As a basic rule, Ailoot uses requests, attachments and results to provide, protect and support its own service. The ailoot.ai service does not include them in training its own general-purpose models, does not transmit them for third-party behavioral advertising and does not silently change this rule through updates to the interface or terms.

The selected model supplier may nevertheless have its own retention, security-checking, feedback, training or improvement arrangements. Requests are subject to the relevant suppliers’ usage rules (for example, the usage rules of Anthropic, OpenAI and Google). Before sending a request, the user may review the applicable terms in Appendix 5 to the Offer (“Model and Supplier Terms”) and the model description in the model catalog in the client dashboard. If the user selects a route with a different data regime, Ailoot discloses that difference before execution. If the law or setting requires separate consent, the request is not sent until that action is taken. General consent to the Offer, history or cookies is not equivalent to consent to model training.

Feedback is different from an ordinary request. The user may voluntarily submit a rating or error report. Ailoot may then use the comment itself and the context the user knowingly attached to correct the error, check security or improve the relevant feature. If feedback contains personal data, the main text of the Policy and the data subject’s rights apply. Rating one response does not create a right to use all account materials for another purpose.

A separate research, evaluation or training program, if offered, is accompanied before launch by a separate disclosure of its purpose, data categories, recipients, period, withdrawal method, effect on access to the core service and restrictions of the selected model. Consent to that program is obtained separately from this appendix and the Offer.

4. Files, media and sensitive data

Before submitting a file in a request, the user decides whether it is needed for the task. Ailoot may use the file, its technical properties and necessary context for request execution, compatibility, security and support. Generated images, video, music and audio are stored for the client to download; if the feature offers persistent file storage or a library, it shows how to find and delete the object. If that feature is absent, the submitted file relates to the particular request and does not create a separate saved object.

An image, voice, video, health document, identity document, financial document or other sensitive material may contain data about the user or a third party. The user must have the right and, where needed, consent to use it. A feature requiring special-category, biometric or high-risk processing is launched only after separate disclosure of the actual recipient, purpose, legal basis and choice required by law. Ordinary media upload does not give Ailoot general permission for identification, identity cloning, biometric analysis or retention of such data.

Technical file checks may be applied to the extent necessary to combat malicious code and rule violations, ensure security or comply with the law. Such a check must not be understood as a guarantee that no risk exists, moderation of all materials or a replacement for the user’s responsibility for the lawfulness of uploaded content.

5. Model suppliers and route selection

The user can manage data through account settings and the choice of model and method in an API request. The reference Appendix 5 to the Offer (“Model and Supplier Terms”) helps users find published supplier terms but does not list all actual Ailoot routes. For the selected feature, necessary request materials, material terms for data retention and use, security checks, available settings and applicable restrictions are disclosed separately. The model supplier serving the request may be located outside the client’s country.

A model name does not in itself determine the data regime. The route depends on availability, country, technical compatibility, the selected feature and supplier restrictions. For automatic routing, its criterion and data implications are stated in the model catalog or setting. If switching changes material data terms, the user receives an additional disclosure and makes a choice where required. If an agreed condition cannot be ensured, Ailoot rejects the request or offers a permitted alternative; materials are not sent to an unagreed route.

The user may request information about the selected route, but Ailoot will not disclose others’ secrets, vulnerabilities, access keys or information whose disclosure violates third-party rights, security or the law. This restriction does not remove the obligation to provide the user with mandatory transparency about their data.

6. Corporate data

A user working under an organization’s B2B order must direct some requests concerning organizational content to their administrator; Ailoot does not disclose other participants’ data to that user or circumvent the organization’s lawful authority. Information about where the ailoot.ai service acts as an independent operator and where it acts as a processor on the organization’s instructions is provided in appendix 4 to this Policy (“Terms for Processing Organizations’ Data”).

7. Export, correction and deletion

The right to export depends on applicable law and the feature actually available. Where the user has that right, Ailoot provides an available format or considers the request under the procedure in section 9 of the main text of the Policy. An export must not contain others’ data, system secrets, security information or data to which the user has no right. Export of organization data may require the involvement of an administrator or the organization.

The user may correct some data in account settings in the client dashboard. For other data, including personal information in request materials or an erroneous result, they may contact support@ailoot.ai. Correction does not mean that the Ailoot service can rewrite a third-party model’s knowledge or remove a fact from a result already created and held by a recipient; we consider the available original object and undertake not to mislead the user about technical feasibility.

Deletion of a file or account is described in appendix 3 to this Policy (“Deletion of Ailoot Account and Data”). Before deleting the account, the user must, where possible, check the remaining balance and unfinished requests whose reserves have not yet been released, download needed generated media, consider any necessary export and check the connection to an organization. Deleting an account does not entail a refund of the unused balance: it is not paid out in money except where a refund is mandatory under applicable legislation. Deletion does not waive a lawful refund; these matters are governed by Appendix 3 to the Offer (“Refunds and Payment Disputes”).

8. Marketing, cookies and rights requests

Marketing messages, optional analytics and advertising technologies are not combined with acceptance of the Offer or the necessary processing to execute a request. If Ailoot offers marketing communications, consent or another applicable mechanism is stated separately, and each message must contain a clear way to unsubscribe. Service notifications about the account, security, balance, top-ups, suspension of access or material changes to the terms are not advertising communications.

Settings for cookies and similar technologies are described in appendix 1 to this Policy (“Ailoot Cookies Policy”). Cookie choice does not replace training choice. To request the exercise of rights, opt out of applicable targeted advertising, data sale or sharing, withdraw consent or submit a complaint, contact support@ailoot.ai; we will apply the identity verification and process described in section 9 of the main text of the Policy.

9. Changes to settings

Ailoot does not conceal a new processing purpose behind an existing setting. If arrangements for history, route selection, training, cookies or retention periods change, the interface and this appendix are updated to the extent necessary before the change is enabled. A material change requiring new consent or another separate choice does not apply to the user merely because they continue using the service. Questions about data settings may be sent to support@ailoot.ai.

Appendix 3. Deletion of Ailoot Account and Data

This appendix establishes the procedure for closing a personal Ailoot account and the associated deletion or anonymization of data.

Account deletion is a separate action with consequences for sign-in, API keys, usage history, generated files and available features. It does not entail a refund or payout of the remaining balance, does not waive a legally mandatory refund and is not a way to circumvent payment, security or legal obligations.

1. What can be deleted

The user may request deletion of their personal account and associated personal data that the ailoot.ai service processes for Ailoot’s ordinary operation. The request covers, as applicable:

• the profile, account email address, sign-in methods, active sessions and personal settings;

• the account’s API keys;

• generated media files stored for downloading, if they belong to that account and the feature supports their deletion;

• usage and payment records to the extent that they are not subject to limited retention (section 6 of this appendix);

• data subject to deletion or anonymization in response to a lawful request under applicable law.

Deletion does not guarantee destruction of objects belonging to an organization, another participant, an external service or a model supplier. Request content (prompts and files) is transmitted to the model supplier serving the request and may be processed outside the User’s country. For such objects, Ailoot determines its role and the available means of assistance but cannot control data beyond its rights, contract and the law.

2. What to do before submitting a request

Before deleting an account, it is recommended to:

1. download generated media files and save usage and payment information the user needs through the available dashboard functions or a separate rights request;
2. stop sending requests with the account’s API keys from their applications and integrations, and wait for requests in progress to finish;
3. check whether the account is used by an organization and whether the user is the only person managing its access;
4. disable automatic operations, if enabled, through the available interface or support;
5. if necessary, separately submit an application for a refund or transaction correction under Appendix 3 to the Offer (“Refunds and Payment Disputes”).

Stopping use and deleting an account are different actions. Stopping use stops new debits from the balance but preserves account access. Deletion ends account access after the request is processed, but does not replace the rules of the payment provider or another party managing a particular payment.

3. How to submit a request

Use the deletion function in the dashboard, if available, or write from the email address linked to the account to support@ailoot.ai with the subject “Delete Ailoot Account”. In the message, provide:

• the email address or a safe account identifier;

• what is required: delete the account, delete a particular object, disable an API key or obtain status information;

• if the account is linked to an organization, its name or identifier and your role, if known;

• a convenient way to receive confirmation.

Do not send a full card number, CVV, PIN, password, full API key, banking code, another person’s document or other secret to verify identity. If the user cannot access the account email, they may write from another address and explain the situation. We will offer a proportionate and secure way to verify entitlement to the account without turning the deletion procedure into the collection of unnecessary data.

After receiving a request, Ailoot acknowledges receipt where possible and checks account ownership, the representative’s authority, the impact on the organization, active transactions, open reserves and the existence of a mandatory basis for limited retention. If the request is ambiguous, we ask for clarification before an irreversible action. Deletion confirmed by the user and carried out by Ailoot may be irreversible to the extent that the relevant data has already been deleted or anonymized.

4. Identity verification and representatives

We verify identity only to the extent necessary to protect against deletion of another person’s account or unlawful disclosure of data. The method depends on the risk: confirmation from the linked account may be sufficient for an ordinary request; a sensitive operation, corporate environment or representative may require additional verification of authority. A representative must show a lawful basis to act on the user’s behalf to the extent required by applicable law.

We may refuse or limit an action if we cannot reasonably verify authority, if execution would disclose others’ data, violate the law, create a security threat or affect an active dispute or mandatory retention. In that case, we will explain the reason and available reconsideration route where possible. Verification must not require payment secrets, unnecessary biometric data or information unrelated to the request.

5. What happens after confirmation

After confirmed deletion, Ailoot ends ordinary account access, closes active sessions, disables the account’s API keys and begins deleting or anonymizing data in active systems within the applicable process, provided this does not conflict with the law, security, performance of an unfinished obligation or the organization’s rights.

Depending on the features actually enabled, the following may be affected:

The retention criteria in section 7 of the main text of the Policy apply to deletion: active data is deleted or anonymized after the request is processed, while isolated backup copies are cleared according to the normal cycle and are not returned to ordinary use. A model supplier or payment provider may have its own deletion process for data already transmitted to it; where necessary, we will direct the user to the relevant recipient or provide reasonable assistance within our role.

6. What may be retained on a limited basis

Even after account deletion, the ailoot.ai service may retain the minimum data if necessary for:

• compliance with the law, payments and accounting, tax or financial accounting, or responding to a mandatory request;

• confirming a payment, refund or adjustment, verifying a request’s outcome, preventing repeated compensation or resolving a payment dispute, including accounting for debt arising from a disputed payment;

• investigating a violation, protecting systems, preventing fraud and ensuring security;

• establishing, exercising or defending legal claims;

• performing a contract with an organization where the data relates to it and the user is not the sole decision-maker.

Such records are isolated from ordinary account use and are not used for personalization, marketing, model training or restoring personal access without an independent lawful basis. If the law requires longer retention or prohibits disclosure of the fact that a particular action occurred, Ailoot complies with that requirement to the extent necessary.

7. Organizations and corporate accounts

Deletion of a personal account must not unexpectedly destroy an organization’s data or deprive its sole administrator of access. If the user acts on behalf of an organization, Ailoot checks who controls the organization’s access and what actions the participant may take. The organization may retain its materials, logs and lawful records independently of deletion of a participant’s personal profile, provided this complies with its contract and the law.

If the organization determines the purposes of processing its users’ data, a participant’s request to delete corporate content may require the involvement of an administrator or the organization as the controlling party. Ailoot does not ignore the request: we determine which data relates to the ailoot.ai service’s own purposes and which relates to the organization’s instructions, and route the request through the applicable channel. More details are provided in appendix 4 to this Policy (“Terms for Processing Organizations’ Data”).

8. Payments, balance and refunds

Account deletion does not entail a refund of a top-up or payout of the unused balance: the balance is not paid out in money except where a refund is mandatory under applicable legislation. Deletion does not remove mandatory rights to a lawful refund. If the user wishes to dispute a payment, correct an erroneous or duplicate debit, obtain a refund for a service not provided or exercise a mandatory consumer right, this must be stated separately in a request under Appendix 3 to the Offer (“Refunds and Payment Disputes”).

A payment through the payment provider identified on the payment page may require a separate request to that provider. Ailoot does not control cancellation or refunds where that authority belongs to the payment provider or another payment participant. However, we do not use account deletion as a basis to refuse a mandatory refund, error correction or lawful consideration of an inquiry. Debt arising from a disputed payment is not discharged by account deletion.

9. Status, time frames and reconsideration

We consider a verified request within the period required by applicable law and communicate the result or the lawful reason why some data is retained. Technical processing of deletion, clearing of backups and a response from an external recipient may involve different stages; this does not provide a basis to restore data to ordinary access after confirmed deletion.

If the user believes that deletion, restriction or refusal was handled incorrectly, they may request reconsideration by writing to support@ailoot.ai and use other remedies in accordance with the procedure established by applicable legislation. Additional rights and time frames apply to the extent stated in the main text of the Policy and applicable legislation.

Questions about the deletion procedure may be sent to support@ailoot.ai.

Appendix 4. Terms for Processing Organizations’ Data

This appendix establishes the general B2B layer for an organization using Ailoot through the dashboard, API or another corporate order. The particular B2B order and data processing appendix determine the applicable roles, routes, audits, periods, transfer terms and special settings. These terms apply to the Client when expressly incorporated into its B2B agreement with the ailoot.ai service.

For an ordinary personal account, the ailoot.ai service usually determines the purposes of account, payment, protection and support processing as an independent operator; the main text of the Policy applies. For personal data about its employees, clients or other individuals that a client organization transmits through Ailoot and for which it determines the purposes and essential means, the “client as controlling party — Ailoot as processor” layer described below applies within the B2B agreement actually concluded.

1. Roles, scope and hierarchy

In this appendix:

• Client means an organization or entrepreneur that has entered into a B2B order for Ailoot with the ailoot.ai service;
• Controlling Party means the Client when it determines the purposes and essential means of processing personal data of its users, employees, clients or other individuals;
• Processor means the ailoot.ai service when it processes Customer Personal Data on the Client’s documented instructions to provide Ailoot;
• Customer Data means data that the Client, its administrator or API user transmits to Ailoot on the Client’s behalf, including personal data;
• Customer Personal Data means the part of Customer Data that is personal data under applicable law;
• Subprocessor means a person engaged by Ailoot to process Customer Personal Data on behalf of the Client in the applicable role;
• Documented Instructions means the written terms of the contract or order, the configuration selected by the Client, dashboard/API settings and other instructions from an authorized person that Ailoot can lawfully and technically carry out.

A separate B2B order or DPA takes precedence over this general appendix for matters it specifically governs. In personal data matters, the DPA takes precedence over general commercial terms to the extent of any conflict. Mandatory law takes precedence over the contract. Nothing in this appendix removes individuals’ rights under applicable law or automatically makes every external supplier a subprocessor: the role depends on the actual flow, contract and processing purpose.

The ailoot.ai service remains an independent operator for the minimum data needed to manage its own contract and product: creating and administering the Client’s account, balance payments and accounting and taxes, preventing fraud and violations, protecting infrastructure, maintaining mandatory reporting, resolving disputes and protecting legal claims. These independent purposes are governed by the main text of the Policy, rather than an unrestricted instruction from the Client.

2. Processing only on instructions and for a permitted purpose

When acting as a processor, Ailoot processes Customer Personal Data only to provide, support, protect and deliver Ailoot under the B2B agreement, order, selected configuration and the Client’s lawful instructions. Processing may include receiving, recording, organizing, storing, accessing, transmitting to the selected route, displaying a result, limited caching, deletion or anonymization, technical diagnostics and security measures — only to the extent necessary for the relevant function.

The Client is responsible for ensuring that its instructions are lawful, transparent to data subjects, do not infringe third-party rights, comply with its processing basis and contain the necessary notices or consents. The Client instructs Ailoot only to carry out processing that it may lawfully carry out itself, and does not use the user interface to covertly transmit special-category, biometric, medical, children’s or other high-risk information without appropriate assessment, contract and safeguards.

Ailoot informs the Client if, on a reasonable assessment, an express instruction conflicts with applicable law or the B2B agreement, except where disclosure is prohibited by law. Ailoot may process Customer Personal Data differently if required by law; where the law permits, it notifies the Client before that processing or without undue delay afterward.

The Client appoints authorized administrators and keeps their contact details up to date. An instruction changing the model, route, retention, administrator access, export, data type or cross-border transfer must come from such an authorized person and be expressly reflected in the available configuration or order. An unclear email, an instruction from an unauthorized person or a request outside the documented configuration need not be carried out as an instruction from the controlling party.

3. Processing details: mandatory appendix for each B2B order

Each B2B order contains an actual Customer Personal Data processing record. The record defines the specific data and processing purposes; it does not cover an undefined scope of “any data for any purpose”. Its minimum contents are:

A model supplier receives Customer Data only within the selected and applicable route: request content (prompt and files) is transmitted to the model supplier serving that request, and that supplier may be located outside the Client’s country. Appendix 5 to the Offer (“Model and Supplier Terms”) allows users to review published supplier terms. It does not replace the information agreed with the Client about the actual recipient, data regime and international transfer. No-training, limited-retention or specific-territory arrangements apply to the Client when expressly stated in the applicable configuration or B2B agreement.

4. Confidentiality and access by authorized persons

Ailoot permits Customer Personal Data to be processed only by persons who need that access to provide the service, ensure security, provide support, comply with the law or perform the B2B agreement. Those persons must be bound by confidentiality obligations appropriate to the nature of the data and no less stringent than required by the contract and law. Access is organized according to the principles of necessity and proportionality to the function.

The Client must also restrict access to its configuration, API keys, administrative credentials and dashboard. Sharing a key with an unauthorized person, using a shared account without role-based control or using another organization’s data outside the instructions may create a risk for which Ailoot cannot be responsible as if it were its own action. This does not relieve Ailoot of its obligation to protect systems and respond to a confirmed incident within its area of control.

Confidential data does not include information that became publicly available without a breach by the recipient, was lawfully obtained from a third party without a confidentiality obligation, was independently developed without access to confidential information or must be disclosed by law. In the event of mandatory disclosure, Ailoot notifies the Client where lawful and limits disclosure to what is necessary.

5. Subprocessors, model suppliers and route changes

Ailoot may engage subprocessors where necessary to provide, support, secure or deliver Ailoot. Before a subprocessor accesses Customer Personal Data, Ailoot ensures applicable contractual obligations regarding confidentiality, security and processing only for the permitted purpose. Ailoot remains responsible to the Client within the B2B agreement for the subprocessor’s performance of its obligations, unless mandatory law requires otherwise.

The separate DPA/order specifies how to obtain an up-to-date register of significant subprocessors and model routes. The register contains information confirmed as of the entry date about the recipient/category, function, route status and country/transfer where that disclosure is required. The register is determined by the product, model and the Client’s configuration.

If the B2B agreement provides the Client with notification or a right to raise a reasoned objection to a new material subprocessor, it determines the channel, period, justification requirement, possible alternatives and consequences if no technically permissible solution exists. That right operates within the limits of the law, security, supplier availability and the product. If the individual B2B agreement does not establish that right, route changes are governed by the general terms and applicable law.

A model/route change that materially changes the terms for Customer Personal Data is handled as a configuration change: Ailoot discloses it to the authorized Client to the extent provided by the contract and obtains the required confirmation/action before use where necessary under the law, order or agreed setting. Automatic fallback is not used to circumvent an agreed data restriction.

6. Security and personal data incidents

Ailoot applies measures to Customer Personal Data proportionate to the risk of the actual processing. The B2B appendix contains a verified set of applicable organizational and technical measures. Certification, a particular algorithm, audit, infrastructure country, recovery time or independent verification forms part of Ailoot’s obligations only where expressly stated in the B2B agreement or appendix.

On discovering a personal data incident within its area of control, Ailoot takes reasonable measures to contain it, investigate and reduce its consequences. If the incident affects Customer Personal Data and requires notification to the Client under the law or B2B agreement, Ailoot notifies the Client without undue delay once it has sufficient initial information. The notice includes information known at that time about the nature of the event, affected categories/systems, measures taken or planned and a channel for further communication. Subsequent information may be refined as the investigation proceeds.

The Client determines whether it must notify data subjects or a supervisory authority in its role as controlling party, unless the law imposes a different obligation directly on Ailoot. Ailoot provides reasonable assistance within the available information, actual product and contract. The notification period is determined by applicable law, the B2B agreement and the agreed incident process.

7. Data subject requests, public authorities and cooperation

If Ailoot receives a data subject request relating to Customer Personal Data for which the Client is responsible as controlling party, Ailoot forwards the request to the Client where possible or suggests that the subject contact the Client. It provides reasonable assistance to the Client within the B2B agreement, available information and the law. Ailoot’s response is limited so as not to disclose another subject’s data, the Client’s trade secrets, security measures or legally protected information.

At the Client’s justified request, Ailoot may provide proportionate assistance with a data protection impact assessment, consultation with an authority or performance of another obligation of the controlling party, if related to the service actually provided. The scope, costs, time frames and permissible materials are determined by the B2B agreement, the nature of the request and security. Such assistance does not mean that Ailoot acts as the Client’s legal adviser.

When receiving a lawful request from a public authority, Ailoot assesses it within its competence and discloses only what is necessary. If the contract and law permit, Ailoot notifies the Client before disclosure or immediately afterward. Notification may be delayed or omitted where it is prohibited, may impede an investigation, create a risk or breach a legal obligation.

8. Compliance information and audit

The Client may request information reasonably necessary to confirm performance of the agreed B2B layer. Ailoot considers the request in light of confidentiality, security, other clients’ rights, available evidence and the nature of processing. Available documents, questionnaire responses, a summary of measures or independent evidence may be an acceptable alternative to an audit if they actually exist and are sufficient for the purpose.

An on-site or remote audit is conducted when expressly provided for in the B2B agreement and its scope, timing, auditor independence, confidentiality, system protection, frequency and costs have been agreed. An audit does not provide access to infrastructure, source code, keys, other clients’ data, a model supplier’s security or other materials whose disclosure violates confidentiality, security, third-party rights or the law.

9. Return, deletion and termination of a B2B order

On termination of a B2B order, the Client is given a reasonable opportunity to request return or export of Customer Data in an available format, if technically feasible and if it does not violate third-party rights, security, the law or supplier terms. The B2B order or processing appendix specifies the period, format, cost, scope and contact for such a request.

After the applicable return/export period, Ailoot deletes or anonymizes Customer Personal Data within its role unless the law, security, a dispute, accounting, protection of rights or the contract requires limited retention. Backup and isolated copies are cleared according to the actual cycle, are not returned to ordinary use and do not provide access to a restored account without an independent basis. Model suppliers may retain data under their own contractual terms; the applicable path and available assistance are specified in the register/appendix.

Return and deletion follow the criteria of the B2B order, actual product, backup cycle and applicable law. A special period, data residency, retention lock, destruction certificate or separate export applies when agreed before processing and stated in the appendix.

10. International transfers

For Customer Personal Data subject to international transfer restrictions, the parties first identify the actual flow: exporter, importer, roles, countries, data categories, recipients, model route and applicable law. They then enter into a separate appendix or use another recognized mechanism if necessary. This may include contractual terms for the EEA, United Kingdom, Switzerland or another territory, but only after the required parties, appendices and information have been completed.

An individual cross-border transfer appendix becomes part of the B2B agreement after the applicable mechanism is identified and the necessary information about the parties, route and data is completed. The main text of the Policy applies as a public notice; a specific guarantee of processing in one country, SCC, UK addendum or other transfer mechanism applies only in an individual appendix where expressly stated.

11. Liability, changes and relationship with other terms

Data processing obligations and remedies apply within the B2B agreement and mandatory law. The liability cap, indemnity, confidentiality and dispute resolution procedure apply to the extent expressly established by the B2B agreement. A B2B limitation does not apply to a consumer where prohibited by law and does not limit a data subject’s inalienable rights.

Ailoot may update the general B2B layer when the law, product, actual subprocessor or security requirements change. A material change applies under the notification and prospective-effect procedure agreed with the Client and does not retroactively change an already agreed route, processing appendix or rights under mandatory law. Organization inquiries may be sent to support@ailoot.ai; a B2B order may establish a separate operational contact.

Minimum processing record form

The following form is completed with current information for a particular B2B order:

Appendix 5. Consent to Personal Data Processing

By registering in the dashboard on ailoot.ai, creating an API key, topping up the balance or otherwise using the ailoot.ai service (“Ailoot”, the “Service”), I freely, of my own will and in my own interest, consent to the Service’s processing of my personal data on the terms below. This consent is a standalone document: it is included as appendix 5 to the Ailoot Privacy Policy solely for ease of reference and does not form part of the Ailoot Offer and License Agreement or the main text of the Ailoot Privacy Policy.

1. Operator

The personal data operator is the ailoot.ai service. The operator may be contacted by email at support@ailoot.ai.

2. Processing purposes

1. Creating and maintaining an account, verifying sign-in, restoring access, issuing and verifying API keys, providing the dashboard.
2. Executing API requests: transmitting necessary request materials to the model supplier serving the request, returning the result, storing generated media for downloading, recording usage.
3. Payments and accounting: crediting a top-up after confirmation from the payment provider identified on the payment page, reserving the expected cost of a request and debiting the actual cost once, accounting for disputed payments and associated debt, considering refunds.
4. User support and consideration of inquiries, claims and disputes.
5. Ensuring the Service’s security and functionality, preventing fraud and abuse.
6. Fulfilling obligations established by applicable legislation.

3. List of data

1. Account data: email address; display name if I provide it; account and session identifiers; settings and consent history.
2. API keys: identifier, name, visible part of the key, creation time, status and settings.
3. Usage records: model, method, time, volume, cost, request identifiers, reserves and debits.
4. Payment information received from the payment provider identified on the payment page: transaction identifier, payment method, status, amounts, applied exchange rate and fee, without full card details.
5. Request materials and results: text, files, images, audio and video that I submit, and generated results, including media stored for downloading.
6. Technical data: IP address, browser or client application information, activity logs and diagnostic information.
7. The content of my support inquiries.

4. Operations with data

Collection, recording, systematization, accumulation, storage, clarification (updating, modification), retrieval, use, transmission (provision, access), anonymization, blocking, deletion and destruction, using automated means and without them.

5. Data transfers

I understand and agree that the content of my requests (prompts and files) is transmitted to the model supplier serving the request (for example, Anthropic, OpenAI, Google, xAI, Alibaba, MiniMax, NVIDIA), and that this supplier may be located outside my country of residence. Payment information is processed by the payment provider identified on the payment page. The recipient categories are listed in section 5 of the Ailoot Privacy Policy.

6. Duration and withdrawal

Consent remains valid until the processing purposes are achieved or until it is withdrawn. Retention periods for individual data categories are determined by section 7 of the Ailoot Privacy Policy.

I may withdraw consent by sending a statement to support@ailoot.ai. After withdrawal, the Service ceases processing that requires consent, except where processing may continue on another basis provided for by applicable legislation (for example, to perform the contract, account for payments or protect rights). Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.

7. Rights

My rights concerning personal data and the procedure for exercising them are described in section 9 of the Ailoot Privacy Policy.

Appendix 6. Infringement of Intellectual Property Rights

This appendix is Appendix 7 to the Ailoot Offer and License Agreement and is included in the Ailoot Privacy Policy for ease of reference. It supplements the Offer, Appendix 4 to the Offer (“Ailoot Acceptable Use Rules”), Appendix 5 to the Offer (“Model and Supplier Terms”) and Appendix 6 to the Offer (“Special Terms for Ailoot Features”).

1. Purpose and limits of the procedure

1.1. Ailoot considers good-faith reports of alleged infringement of copyright, related rights, trademark rights, patent rights, database rights, trade secrets, likeness rights and other intellectual property or similar rights in connection with Content, a feature description or other material available through Ailoot.

1.2. This procedure is not a declaration that a special US procedure applies, that a DMCA agent has been appointed or that the law of any one country is automatically accepted. Applicable law, the complainant’s authority, place of use, nature of the right and the selected Model’s terms may differ. A report does not replace a court injunction, license agreement, mandatory governmental procedure or legal advice.

1.3. Ailoot may have limited technical access to a private prompt, file or Result. We are not obliged to disclose private materials, secrets, third-party data, keys or investigation information to the other party. If the matter concerns a supplier’s Route, its mandatory procedure may require a separate request to that supplier; this information must be stated in Appendix 5 to the Offer (“Model and Supplier Terms”).

2. How to submit a report

2.1. Reports must be sent to support@ailoot.ai with the subject “Ailoot IP Complaint”. Do not send passwords, API keys, CVV/CVC, PIN, one-time banking codes or materials unnecessary to identify the subject of the complaint.

2.2. To enable us to investigate, the report must, to the extent reasonably possible, contain:

• the complainant’s name, a convenient contact and the country/territory to which the claim relates;

• an indication of whether the complainant acts as a rights holder, representative, licensee or another authorized person; for a representative, available evidence of authority;

• a description of the protected subject matter and the specific right relied on; where available, a link to the original source, registration number, license, creation date or other material helping to verify the right;

• an exact link, request or material identifier, user, time, screenshot or another way to locate the disputed material in Ailoot; for private material, the request ID or account only to the extent lawfully available to the complainant;

• an explanation of why the use allegedly infringes the right and what action is requested: restricting access, deleting material, clarifying attribution, forwarding contact details, preserving evidence or another proportionate action;

• confirmation of a good-faith belief that the information is accurate and the request lawful, together with an electronic signature, a name at the end of the message or another way to confirm who made the statement.

2.3. If the information is insufficient, contradictory or concerns material that Ailoot cannot locate, we may request clarification. A request for clarification is not a refusal on the merits and does not mean the disputed material has been deemed lawful. We do not require a complainant to provide in advance evidence that the law does not oblige them to disclose or whose transmission would create a further infringement of rights.

3. Investigation and possible measures

3.1. After receiving a sufficiently specific report, Ailoot checks the available information, applicable contract, nature of the feature, the affected party’s arguments and legal requirements. We may request additional materials, temporarily preserve relevant logs to a permissible extent, restrict access to material, remove metadata, temporarily restrict a particular feature or decline to act if the complaint clearly does not relate to Ailoot or lacks a legal basis.

3.2. Not every resemblance between a Result and another person’s work proves infringement. A generative Result may not be unique, and questions of authorship, licensing, fair use, quotation, parody, public domain, contract and territorial law require consideration of the circumstances of the particular case. We will not promise automatic deletion based on a single assertion and do not finally resolve a complex dispute over rights in place of a competent authority or court.

3.3. In the event of an urgent threat of ongoing infringement, a risk of disclosure of trade secrets, public access to personal data or a mandatory legal requirement, a measure may be taken before the user responds. In other cases, we notify the affected User where possible without disclosing unnecessary complainant data or violating the law, security or third-party rights.

3.4. Restricting material under this procedure does not constitute an admission of liability, does not remove mandatory consumer protection and does not create a right to access another person’s Content. For actions involving the API or a private request, the minimum sufficient measure is selected: for example, it may concern a particular material, key or Route rather than the entire account.

4. Explanation and counterstatement by the affected party

4.1. The User or another affected rights holder may respond to the notice by writing to support@ailoot.ai and providing the report/material ID, their contact details, the basis for use, a relevant license, permission, evidence of authorship, an explanation of mistaken identification or other available material. The counterstatement must be made in good faith and must not contain others’ secrets or personal data without entitlement.

4.2. Where necessary, we may send a limited part of the counterstatement to the complainant for investigation and dispute resolution, but only to the extent necessary for that purpose and compatible with the law and the main text of the Ailoot Privacy Policy. We may suggest that the parties resolve the matter directly, provide a decision by a competent authority, clarify a license or wait for a statutory period. The Ailoot Service is not obliged to publish the disputed material, put the parties in contact with each other or restore access until the risk and legal situation have been clarified.

4.3. If the complainant withdraws the complaint, the parties reach an agreement, a binding decision is provided or available information shows no basis for the restriction, Ailoot reconsiders the restriction within reasonable limits. Restoration is not required if the material remains prohibited by law, model terms, security, another person’s rights or the actual discontinuation of the feature.

5. Repeated and bad-faith infringements

5.1. In the event of repeated confirmed infringement of rights, deliberate circumvention of a previously imposed measure, uploading material known to belong to another person and to be prohibited, or using accounts for such circumvention, Ailoot may issue a warning, restrict a feature, revoke a key or suspend a Route or account in accordance with Appendix 4 to the Offer (“Ailoot Acceptable Use Rules”) and the Offer.

5.2. Repetition is assessed based on the facts, degree of fault, explanation, type of right, consequences and available remedies. No automatic numerical threshold is set at which any dispute must result in account closure. A good-faith licensing dispute, an error, a withdrawn complaint or an unproven allegation is not equivalent to an established infringement.

5.3. A knowingly false complaint, falsification of authority, an attempt to censor lawful material, abuse of counterstatements or disclosure of others’ data during a dispute may also lead to refusal to allow use of this procedure and proportionate measures. This does not limit a person’s right to protect their rights in good faith through a court, competent authority or another lawful mechanism.

6. Confidentiality, evidence and contacts

6.1. Ailoot uses information from the complaint and response to consider the inquiry, ensure security, comply with the law, protect rights and maintain necessary records. The retention period depends on the subject of the dispute, applicable law, a potential claim, the appeal period and the need to protect the Service. Details of personal data processing are stated in the main text of the Ailoot Privacy Policy.

6.2. If a complaint contains information about an immediate risk to a person, child, infrastructure or personal data, or another legal reporting obligation, Ailoot may refer it to the competent channel prescribed by law and take an urgent protective measure. This does not turn the IP procedure into a replacement for emergency services.

6.3. Contact for IP complaints and responses: support@ailoot.ai. Service Provider: the ailoot.ai service.