LEGAL

Privacy Policy

PRIVACY POLICY - UPDATED FOR THREE-LAYER BUSINESS MODEL

Cognitiva Systems Inc.
Effective Date: 15 April 2026
Last Updated: 15 April 2026

BINDING LEGAL DOCUMENT

This Privacy Policy is a binding legal agreement between you and Cognitiva Systems Inc. By using our services, you agree to this policy. If you do not agree, do not use our services.

English Version Controls: In case of conflicts between translations, the English version govails.

KEY PRINCIPLES

✓ Data Protection - Your data is protected with industry-standard security
✓ GDPR/CCPA Compliance - Full compliance with global privacy regulations
✓ Your Rights - Access, correct, delete, or export your data anytime
✓ International Standards - EU-U.S. Data Privacy Framework, Standard Contractual Clauses

PREAMBLE

Cognitiva Systems Inc. ("Cognitiva," "we," "us," or "our") operates a three-layer platform:

  1. Layer 1 - CognitivaOS: Campaign execution platform (SaaS subscription)
  2. Layer 2 - Data Infrastructure: Anonymized dataset creation and licensing
  3. Layer 3 - Intelligence Platform: AI-powered decision APIs

This Privacy Policy explains how we collect, use, share, and protect personal data across all three layers.

Critical Disclosure: We generate revenue from all three layers, including licensing anonymized datasets and selling AI services. This is core to our business model and funds platform development.

SECTION 1: SCOPE AND APPLICATION

1.1 Who This Policy Applies To

This Privacy Policy applies to:

1.2 Regulatory Compliance

We comply with:

1.3 Data Collection Methods

Personal data is collected ONLY through:

✓ Direct provision by you (account creation, forms, API usage)
✓ Automatic collection (cookies, logs, analytics)
✓ Client API exports (with explicit authorization)

✗ We do NOT scrape, harvest, or collect data without authorization
✗ We do NOT purchase personal data from third-party brokers
✗ We do NOT access client systems without explicit permission

SECTION 2: DATA CONTROLLER

2.1 Controller Identity

Data Controller:
Cognitiva Systems Inc.
407 E Ayre St #1484
Wilmington, DE 19804
United States

Privacy Contact:
Email: privacy@cognitiva.systems
Response Time: Within 48 hours for urgent requests

2.2 Controller Responsibilities

As data controller, we:

SECTION 3: EU REPRESENTATIVE

3.1 GDPR Article 27 Representative

For EU data subjects, our designated EU Representative is:

Contact: eu-datarights@cognitiva.systems

EU residents may contact our representative regarding:

Note: This does not replace your right to contact us directly or file complaints with your local Data Protection Authority.

SECTION 4: PROCESSING ROLES AND PURPOSES

4.1 When Cognitiva Acts as Controller

We are the data controller for:

Website & Marketing:

Account Management:

Product Development:

4.2 When Clients Act as Controller

For campaign execution data within CognitivaOS:

Client is Controller:
Clients determine purposes and means of processing campaign data (messages, approvals, deliverables, participant information).

Cognitiva is Processor:
We process this data solely on client instructions to provide the CognitivaOS platform.

Data Processing Agreement:
Enterprise clients receive a separate DPA governing processor obligations.

4.3 Joint Controller Arrangements

For certain data transformation activities:

Joint Determination:
When clients authorize export of campaign data for anonymization and AI training, we jointly determine:

Client Rights:
Clients may opt-out of contributing data to anonymized datasets (contact privacy@cognitiva.systems). This may limit access to certain AI-powered features.

4.4 AI Model Training and Commercial Use

Critical Disclosure:

Anonymized campaign data (per Section 8) is used to train machine learning models that power:

✓ Creator matching algorithms
✓ Payment risk detection systems
✓ Campaign success prediction models
✓ Compliance monitoring tools
✓ Content quality scoring
✓ Timeline risk assessment
✓ Budget optimization

Commercial Deployment:

These models are offered commercially as:

  1. Platform Features: Embedded in CognitivaOS subscriptions (included)
  2. API Services: Intelligence Platform APIs (per-decision pricing)
  3. Licensed Technology: Enterprise licensing agreements

Revenue Model:

AI model development and deployment is a core revenue stream. Subscription fees alone do not fund platform development. Data-derived and AI revenues subsidize competitive subscription pricing.

Client Consent:

By using CognitivaOS and authorizing data export, you consent to AI training on anonymized derivatives. You may withdraw consent (limits features).

SECTION 5: CATEGORIES OF PERSONAL DATA

5.1 Business & Account Data

What We Collect:

Why We Collect:

Legal Basis: Contract performance, legitimate interest

5.2 Identity & Payment Data

What We Collect:

Why We Collect:

Legal Basis: Contract performance, legal obligation

Important: Actual payment credentials are processed by Stripe, our payment processor. We receive only tokenized references, never raw payment card data.

5.3 Campaign Execution Data

Critical Section - Read Carefully

What Is Campaign Execution Data:

When clients use CognitivaOS, they create campaigns containing:

How We Collect It:

✓ Data is generated WITHIN CognitivaOS during normal platform use
✓ Clients may authorize API export for enhanced features
✓ Export is OPTIONAL and explicitly consented to

✗ We do NOT scrape external platforms
✗ We do NOT access client data without authorization
✗ We do NOT collect data from sources outside our platform

What We Do With It:

Raw Data (As Processor):

Anonymized Data (As Controller):

When clients authorize export:

  1. Transformation: Raw data undergoes anonymization (Section 8)
  2. Dataset Creation: Anonymized data forms structured datasets
  3. Model Training: Datasets train AI models (Section 4.4)
  4. Commercial Use: Anonymized datasets may be licensed (Section 11.7)

Key Safeguards:

✓ Direct identifiers removed
✓ Contextual information minimized
✓ Re-identification risk assessed
✓ Unique markers suppressed

Client Ownership:

5.4 Technical & Usage Data

Automatically Collected:

Why We Collect:

Legal Basis: Legitimate interest, contract performance

Retention: Logs retained for 90 days; aggregated analytics retained indefinitely

SECTION 6: SPECIAL CATEGORY DATA

6.1 Intentional Non-Collection

We do NOT intentionally collect special category data under GDPR Article 9:

✗ Health or medical information
✗ Biometric data for unique identification
✗ Religious or philosophical beliefs
✗ Trade union membership
✗ Genetic data
✗ Data concerning sex life or sexual orientation
✗ Racial or ethnic origin
✗ Political opinions
✗ Criminal convictions or offenses

6.2 Inadvertent Detection

If special category data is detected in campaign content:

Automated Response:

Manual Review:

6.3 Children's Data

Age Restriction: CognitivaOS requires users be 18+ (or age of majority in jurisdiction).

No Intentional Collection:
We do NOT knowingly collect data from individuals under 18.

Discovery Protocol:
If we learn a user is underage:

  1. Account is suspended immediately
  2. Data is deleted within 30 days
  3. Parent/guardian is notified if contact info available

Campaign Content:
If campaign content involves minors (e.g., educational campaigns):

SECTION 7: INSOLVENCY PROCEEDINGS

7.1 Legal Authority Processing

In insolvency, bankruptcy, or liquidation proceedings:

Lawful Basis:
We may process company communications under court authority or administrator direction.

Permitted Uses:

Limitations:

No Legal Advice:
This policy does not constitute legal advice about insolvency proceedings. Consult qualified insolvency counsel.

SECTION 8: ANONYMIZATION PROCEDURES

Critical Section for Understanding Data Monetization

8.1 Anonymization Standard

We apply anonymization per:

Anonymization Goal:
Data cannot be re-identified using reasonably available means, considering:

8.2 Anonymization Techniques

Direct Identifier Removal:

Contextual Minimization:

Structural Transformation:

Metadata Stripping:

Re-Identification Risk Controls:

8.3 What Anonymization Is NOT

Anonymized data is NOT:

✗ Encrypted data (encryption is reversible)
✗ Pseudonymized data (pseudonyms can be reversed)
✗ Aggregated data (aggregation alone doesn't prevent re-identification)
✗ "De-identified" without verification (we verify irreversibility)

Anonymized data IS:

✓ Irreversibly transformed
✓ No reasonable re-identification path
✓ Outside GDPR scope (Recital 26)
✓ Freely usable for research, AI training, commercial licensing

8.4 Limitations and Risks

No Absolute Guarantee:
While we apply rigorous anonymization, we cannot guarantee absolute elimination of re-identification risk. Future techniques or data combinations might enable re-identification.

Ongoing Assessment:
We continuously monitor:

Client Disclosure:
Clients authorizing data export acknowledge anonymization limitations and accept residual risk.

SECTION 9: LEGAL BASES FOR PROCESSING

9.1 GDPR Legal Bases

Contract Performance (GDPR Article 6(1)(b)):

Legitimate Interest (GDPR Article 6(1)(f)):

Legal Obligation (GDPR Article 6(1)(c)):

Consent (GDPR Article 6(1)(a)):

9.2 Legitimate Interest Balancing

Where we rely on legitimate interest, we balance:

Our Interests:

Your Rights:

Assessment:
We conduct and document legitimate interest assessments (LIAs) available upon request.

SECTION 10: DATA PROTECTION IMPACT ASSESSMENT (DPIA)

10.1 High-Risk Processing Assessment

We conduct DPIAs for:

10.2 Campaign Data Anonymization DPIA

Identified Risks:

Mitigation Measures:

Proportionality Assessment:

10.3 Review and Updates

DPIAs are reviewed:

Supervisory Authority Consultation:
If high residual risk cannot be mitigated, we consult with relevant Data Protection Authority before proceeding.

SECTION 11: DATA SHARING AND DISCLOSURE

11.1 Internal Personnel

Who Has Access:

Access Controls:

11.2 Service Providers

Categories:

Safeguards:

11.3 Stripe Payment Processing

What Stripe Receives:

Stripe's Role:
Stripe is an independent data controller for payment data.

Stripe's Privacy Policy:
https://stripe.com/privacy

Our Responsibility:
We are NOT liable for:

11.4 Legal and Regulatory

Required Disclosures:

Disclosure Protocol:

11.5 Business Transfers

Mergers, Acquisitions, Asset Sales:

If Cognitiva is acquired or merges:

Bankruptcy/Insolvency:

If Cognitiva enters insolvency:

11.6 Advisors and Auditors

Limited Access:

Purpose: Corporate governance, compliance, financial reporting

11.7 Data-Derived Products (Revenue Model)

CRITICAL COMMERCIAL DISCLOSURE

Revenue Stream Transparency

Cognitiva generates revenue from THREE sources:

1. Execution SaaS ($200-500/month per agency):

2. Data Product Licensing (Enterprise pricing):

3. AI Intelligence Services (Per-decision pricing):

Who We License Anonymized Data To

Permitted Licensees:

Prohibited Licensees:

What Anonymized Datasets Include

Included:

Excluded:

Dataset Use Restrictions

Licensees are contractually prohibited from:

✗ Attempting to re-identify data subjects
✗ Combining datasets to reverse anonymization
✗ Selling or sublicensing data
✗ Using data for discriminatory purposes
✗ Using data for surveillance
✗ Using data beyond licensed scope

Enforcement:
License violations result in immediate termination and legal action.

Client Rights Regarding Data Licensing

Opt-Out Option:

Clients may request exclusion from data product contributions:

Opt-Out Consequences:

Exclusion may limit access to:

Basic platform functionality remains available.

No Opt-Out Fee:
Opt-out is free. Subscription price remains unchanged.

Revenue Necessity Disclosure

Why Data Revenue Matters:

SaaS subscription fees ($200-500/month) do NOT fully fund:

Data product revenue subsidizes subscription pricing, keeping CognitivaOS affordable for small agencies while funding innovation.

Alternative Business Model:

Without data revenue, subscription prices would need to be 3-5x higher to achieve financial sustainability. Data licensing enables us to serve smaller agencies that couldn't afford premium-only pricing.

Transparency Commitment

Public Reporting:

We publish annually:

Next Report: 15 April 2026

CCPA "Sale" Disclosure

California Residents:

Under CCPA/CPRA, licensing anonymized data may constitute a "sale" even if data is anonymized.

Your CCPA Rights:

Opt-Out Link:
[Do Not Sell My Personal Information]

Processing Time: 15 business days

Note: Opt-out applies to future data only. We cannot recall anonymized data already distributed.

SECTION 12: INTERNATIONAL DATA TRANSFERS

12.1 Transfer Necessity

Cognitiva operates globally. Data may be transferred to:

12.2 Transfer Safeguards

For EEA to U.S. Transfers:

SCC Modules Used:

Supplementary Measures:

12.3 Schrems II Compliance

Following CJEU Schrems II decision:

Risk Assessment:
We assess U.S. surveillance law impact on each data transfer.

Additional Safeguards:

Client Notification:
If we receive government access demands affecting EEA data, we notify affected clients unless legally prohibited.

12.4 Data Localization Options

Enterprise Clients:

Upon request and subject to feasibility:

Additional Cost:
Data localization may incur additional infrastructure costs.

SECTION 13: DATA RETENTION

13.1 Retention Principles

We retain personal data only as long as necessary for:

13.2 Retention Periods

Account Data:

Campaign Execution Data:

Technical Logs:

Marketing Data:

Legal Hold:
Data subject to litigation, investigation, or regulatory action is retained until matter resolution.

13.3 Deletion Procedures

Secure Deletion:

Anonymized Data:

Once data is anonymized (Section 8), it is outside GDPR scope and may be retained indefinitely without deletion upon request.

Backup Retention:

Backups containing personal data:

SECTION 14: YOUR RIGHTS

14.1 GDPR Rights (EEA/UK Residents)

Right of Access (Article 15):

Right to Rectification (Article 16):

Right to Erasure / "Right to be Forgotten" (Article 17):

Right to Restriction (Article 18):

Right to Data Portability (Article 20):

Right to Object (Article 21):

Right to Not Be Subject to Automated Decisions (Article 22):

14.2 CCPA/CPRA Rights (California Residents)

Right to Know:

Right to Delete:

Right to Correct:

Right to Opt-Out of Sale/Sharing:

Right to Limit Use of Sensitive Personal Information:

Right to Non-Discrimination:

14.3 How to Exercise Rights

Contact Methods:

Email: privacy@cognitiva.systems
Subject Line: "[RIGHT NAME] Request - [Your Name]"
Include: Full name, email address, account details (if applicable)

Identity Verification:

To prevent unauthorized access:

Response Time:

No Fee:
First request is free. Excessive or repetitive requests may incur reasonable administrative fee.

Authorized Agent (CCPA):

California residents may designate an authorized agent:

SECTION 15: SECURITY MEASURES

15.1 Technical Safeguards

Encryption:

Access Controls:

Network Security:

Application Security:

15.2 Organizational Safeguards

Personnel:

Vendor Management:

Physical Security:

15.3 Incident Response

Breach Detection:

Breach Response:

  1. Contain: Isolate affected systems
  2. Assess: Determine scope and impact
  3. Notify: Affected individuals, authorities (if required)
  4. Remediate: Fix vulnerabilities
  5. Review: Post-incident analysis

Notification Timeline:

What We Tell You:

SECTION 16: COOKIES AND TRACKING

16.1 Cookie Categories

Strictly Necessary:

Not Used: NO strictly necessary cookies can be declined.

Performance/Analytics:

Can Decline: YES, but impacts product improvement.

Functional:

Can Decline: YES, but impacts user experience.

Marketing:

Can Decline: YES, no impact on core functionality.

16.2 Cookie Control

Banner: Displayed on first visit with granular consent options.

Manage Settings: Available at privacy-settings page anytime.

Do Not Track: We respect DNT signals from browsers.

Third-Party Cookies:
We limit third-party cookies to essential service providers.

16.3 Analytics Details

Google Analytics:

Purpose: Understand how users interact with our site to improve experience.

Opt-Out: https://tools.google.com/dlpage/gaoptout

SECTION 17: CHILDREN'S PRIVACY

17.1 Age Restrictions

Minimum Age: 18 years or age of majority in your jurisdiction.

Verification: Self-certification during signup.

Enforcement: Suspension upon discovery of underage users.

17.2 Parental Rights

If we learn we have collected data from a child:

  1. Account suspended immediately
  2. Data deleted within 30 days
  3. Parent/guardian notified (if contact info available)
  4. No further processing

Parent Contact: privacy@cognitiva.systems with "Child Privacy" subject line.

17.3 Campaign Content Involving Minors

If campaigns target/involve minors (educational, youth programs):

Client Obligations:

Our Safeguards:

SECTION 18: CHANGES TO THIS POLICY

18.1 Update Process

Review Frequency: At least annually

Triggers for Updates:

18.2 Notification

Material Changes:

Non-Material Changes:

18.3 Continued Use

Continued use after effective date constitutes acceptance of updated policy.

Objection:
If you object to material changes:

SECTION 19: CONTACT AND COMPLAINTS

19.1 Privacy Team Contact

General Inquiries:
Email: privacy@cognitiva.systems
Response Time: 48 hours for urgent, 5 business days for general

Data Subject Rights Requests:
Email: privacy@cognitiva.systems
Subject: "[RIGHT NAME] Request"
Response Time: 30 days (GDPR), 45 days (CCPA)

EU Representative:
Email: eu-datarights@cognitiva.systems

Security Issues:
Email: security@cognitiva.systems
Response Time: 24 hours for critical issues

19.2 Supervisory Authority Complaints

EEA/UK Residents:

You have the right to lodge a complaint with your Data Protection Authority:

Lead Supervisory Authority (if established):
[To be determined based on EU establishment]

Find Your Local DPA:
https://edpb.europa.eu/about-edpb/about-edpb/members_en

UK:
Information Commissioner's Office (ICO)
https://ico.org.uk/make-a-complaint/

19.3 California Attorney General

California Residents:

CCPA violations may be reported to:

California Attorney General
Privacy Unit
https://oag.ca.gov/contact/consumer-complaint-against-business-or-company

SECTION 20: DEFINITIONS

Anonymization: Irreversible transformation preventing re-identification.

Controller: Entity determining purposes and means of processing.

Personal Data: Information relating to identified or identifiable individual.

Processing: Any operation on personal data (collection, storage, use, etc.).

Processor: Entity processing data on behalf of controller.

Special Category Data: Sensitive data under GDPR Article 9 (health, biometric, etc.).

EFFECTIVE DATE

This Privacy Policy is effective as of 15 April 2026.

Previous version: [LINK TO ARCHIVED VERSION]

END OF PRIVACY POLICY

Document Version: 2.0
Last Reviewed: 15 April 2026
Next Review: [INSERT DATE + 12 months]
Approved By: [Legal Counsel Name], [Date]

QUICK REFERENCE

Your Rights:

Contact:

Key Points:

Transparency:

Privacy Policy | Cognitiva