Privacy & Data Policy

Innovation Mode Limited ("Company," "we," "us," or "our"), a company registered in Ireland (Company Registration Number: 785034), operates Ainna, accessible at ainna.ai. This Privacy & Data Policy ("Policy") describes how we collect, use, store, share, and protect your personal data when you use Ainna on its self-serve plans (the free trial, Pro and Team).

Ainna Enterprise, the organization-wide edition deployed in a customer's own environment, is governed by a separate written agreement, and that agreement, not this Policy, describes how data is handled there.

We built Ainna with a privacy-first approach because you share sensitive, competitive information with us. Your ideas stay yours.

Our core privacy commitments:

• We do not train AI models on your data

• We do not sell, rent, or trade your personal information

• We do not routinely monitor or scan your content

• We host your data in EU data centres, subject to GDPR

• We don't store your generated Documents; each is created on demand when you download it

• We keep account data only while it's useful, and delete it after 12 months of inactivity on accounts that aren't on a paid plan

• When you delete something, we remove it from our active systems immediately

You stay in control of your data: we retain only what's needed, for as long as it's useful, and you can delete it at any time.

This Policy applies to visitors to our website, registered users, and paying customers, including people invited to take part as Panelists. By using Ainna, you agree to the collection and use of information in accordance with this Policy.

Please read this Policy alongside our Terms of Service. If you do not agree with our practices, please do not use the Service.

Questions about privacy? See How to Contact Us.

For the purposes of the General Data Protection Regulation (GDPR) and other applicable data protection laws, the data controller for the self-serve plans is:

Innovation Mode Limited
Company Registration Number: 785034
Registered Office: 51 Bracken Road Dublin 18, D18 CV48, DUBLIN
Ireland
Email: privacy@ainna.ai

As the data controller, we determine the purposes and means of processing your personal data and are responsible for ensuring that processing complies with applicable law.

We are registered in Ireland and subject to oversight by the Irish Data Protection Commission (DPC). As we are established in Ireland within the European Union, we are subject to the GDPR directly and no separate EU representative is required.

If you have questions about this Policy, or wish to exercise your data protection rights, see How to Contact Us.

These terms align with our Terms of Service and, where applicable, the GDPR:

"Personal Data" means any information relating to an identified or identifiable natural person, including your name, email address, profile information, payment references, device identifiers, and usage data.

"Data Subject" means the individual to whom Personal Data relates — in this Policy, you.

"Special Categories of Personal Data" means sensitive data such as racial or ethnic origin, political opinions, religious beliefs, health data, or sexual orientation. Ainna does not intentionally collect or process such data.

"Inputs" means the information, ideas, and content you provide to Ainna: your product concepts, business information, answers in conversations, uploads, and Your Branding.

"Outputs" means what Ainna generates from Inputs: framings, assessments, scores, narratives, persona profiles, market and competitive analyses, portfolio rankings, Documents, and related material.

"Documents" means the downloadable files Ainna generates, including pitch decks, PRDs, executive summaries, one-pagers, and problem framing documents. Documents are generated on demand from your Opportunity data at the moment you download them and are not stored on our servers (see Section 8).

"Opportunity" means one product concept within Ainna, including its conversations, assessments, scores, personas, analyses, Panel contributions, and Outputs. Also called an "idea" or "project."

"Brainstorming" means the open-ended ideation mode for exploring ideas. It does not consume Opportunity allocations.

"The Panel" means the feature through which you invite people to assess an Opportunity independently. "Panelist" means a person you invite through the Panel.

"Workspace," "Administrator," "Member" refer to the shared space of a Team plan, the person who manages it, and the users granted access to it.

"Customer Data" means your Inputs and Outputs together. Customer Data belongs to you. We do not train AI models on it and do not use it to improve results for other users.

"Usage Data" means technical and analytical data from your use of the Service, such as feature usage, session duration, and performance metrics. It does not include Customer Data.

"Processing" means any operation performed on Personal Data, including collection, storage, use, disclosure, and erasure.

"Subprocessor" means a third-party provider that processes Personal Data on our behalf to help us deliver the Service.

Questions about these definitions? See How to Contact Us.

4.1 Information You Provide Directly

• Account Information: You sign in with LinkedIn or with your email address. If you use LinkedIn, we receive your name, email address, and profile picture, and never your LinkedIn credentials, connections, posts, or activity; we do not send LinkedIn any of your data in return. If you use email, we sign you in with a one-time link sent to your address (a "magic link"); there is no Ainna password to set or store.

• Profile Information: Information you add to your account, such as job title, company name, or a tagline for your documents.

• Conversation Data: The messages exchanged between you and Ainna within an Opportunity, kept to maintain continuity and subject to our retention rules (Section 8).

• Customer Data (Inputs): The product concepts, market information, and strategic thinking within your conversations. This is yours; we do not routinely monitor, scan, or review it. You are responsible for not including material you are prohibited from disclosing (see Terms of Service, Section 7.7).

• Outputs: What Ainna generates from your Inputs. Documents are generated on demand at download and are not stored (Section 8).

• Your Branding: Logos and brand details you upload for use in your documents.

• Payment Information: Handled by Stripe. We never see or store your full card details; we receive a token and the last four digits for reference.

• Panel Information: When you invite a Panelist, you give us that person's name and email address so we can send the invitation. You are responsible for having the right to share those details.

• Referral Data: If you take part in Ainna Fellows, we process your referral link usage, conversions, and rewards.

• Communications: Information you provide when you contact support, send feedback, or respond to a survey.

4.2 Information Collected Automatically

• Device Information: Device type, operating system, browser type and version.

• Log Data: IP address, access times, pages viewed, and actions taken in the Service.

• Usage Data: Features used, session duration, and performance data. This does not include Customer Data.

• Conversation Metadata: Timestamps, message counts, and Opportunity identifiers, used to maintain session state and provide analytics. This does not include the content of your conversations.

• Cookies and Similar Technologies: See Section 10.

Automatic collection applies to technical and usage data only. We do not routinely scan, analyze, or monitor the content of your Inputs or Outputs.

4.3 Information from Third Parties

• LinkedIn: Basic profile information (name, email, profile picture) if you sign in with LinkedIn.

• Payment Processor: Transaction status and limited payment information from Stripe.

• Analytics Providers: Aggregated, anonymized usage and performance data.

We do not buy Personal Data from data brokers or marketing lists.

4.4 Information We Do Not Collect

• We do not collect Special Categories of Personal Data

• We do not collect data from your LinkedIn connections, posts, or activity

• We do not collect biometric data

• We do not collect location data beyond what is inferred from your IP address

• We do not use third-party advertising or tracking pixels

Questions about data collection? See How to Contact Us.

We process your information only for specific, legitimate purposes. Under GDPR we rely on performance of contract, legitimate interests, legal obligation, and consent.

5.1 To Provide and Operate the Service

Legal basis: Performance of contract

• Process your Inputs through AI to generate Outputs and, on demand, Documents

• Maintain your Conversation Data for continuity across an Opportunity

• Authenticate you and manage your account

• Give each person one free trial: we compare a normalised form of your email address (dots and '+' tags removed where the provider ignores them) with existing accounts, and use it for nothing else

• Process payments, manage subscriptions, and track Opportunity allocations

• Apply Your Branding to Outputs

• Send Panel invitations to people you choose

• Provide support and respond to your inquiries

• Send account and inactivity notices

• Process referral activity

5.2 To Improve and Develop the Service

Legal basis: Legitimate interests

• Analyze aggregated, anonymized Usage Data to understand how people use Ainna

• Identify and fix bugs and performance issues

• Develop new features

Critical distinction: we use only aggregated, anonymized Usage Data and Conversation Metadata for improvement. We do not use your Customer Data (Inputs, Outputs, or conversation content) to train, fine-tune, or improve any AI model.

Quality measurement. We may use automated methods to assess the quality of Ainna's conversations, for example whether guidance is coherent and methodologically sound. This can process Conversation Data to produce aggregate quality indicators; only those indicators are retained, they contain no user content, and raw conversation data is never surfaced to our team through this process. It is not model training and does not change the commitment above.

5.3 To Communicate with You

Legal basis: Performance of contract, legitimate interests, and consent where required

• Send transactional emails (sign-in links, receipts, subscription updates)

• Notify you of changes to the Service, Terms, or this Policy

• Send account and inactivity notices

• Respond to support requests

• Send product updates (with consent where required)

• Request optional feedback

5.3.1 Communication Preferences

• Transactional emails are required to operate the Service (sign-in links, receipts, security and account notices) and cannot be opted out of while your account is active.

• Product updates are optional; opt in or out via Account → Profile & preferences → Communication Preferences or the unsubscribe link in any email.

• Marketing communications are sent only with your consent, which you can withdraw at any time.

• Referral notifications can be managed in your notification preferences.

We will never sell your email address or share it with third parties for their marketing.

5.4 To Ensure Security and Prevent Abuse

Legal basis: Legitimate interests and legal obligation

• Detect and address fraud, abuse, and security threats

• Monitor usage patterns and system behavior for anomalies (not the content of your Inputs or Outputs)

• Maintain our built-in AI safeguards

• Protect the rights, property, and safety of Ainna, our users, and the public

• Investigate potential violations of our Terms

We do not routinely scan or read your conversations or Outputs. In limited, exceptional circumstances we may access content where reasonably necessary, for example to investigate an abuse report or comply with a legal obligation; see Terms of Service, Section 10.4.

5.5 To Comply with Legal Obligations

Legal basis: Legal obligation

• Comply with applicable laws and legal processes

• Respond to lawful requests from public authorities

• Retain billing and account records for tax and financial reporting

• Establish, exercise, or defend legal claims

5.6 What We Do Not Do

• We do not sell, rent, or trade your Personal Data

• We do not use your Customer Data to train AI models

• We do not share your Inputs or Outputs to improve results for anyone else

• We do not use your data for advertising or marketing profiling

• We do not routinely monitor or scan the content of your conversations

Questions about how we use your data? See How to Contact Us.

Under the GDPR we must have a lawful basis for processing your Personal Data. This section summarizes the bases used in Section 5.

6.1 Performance of Contract

Processing needed to perform our contract with you (the Terms of Service): creating and managing your account, maintaining your Opportunities, generating Outputs and Documents, processing payments and allocations, applying Your Branding, sending Panel invitations, providing support, sending service-critical emails, and processing referrals.

6.2 Legitimate Interests

Processing for our legitimate interests, where not overridden by your rights: improving the Service using aggregated, anonymized data; securing the Service and preventing abuse; monitoring system behavior (not content); and sending product updates to existing customers where permitted.

We have weighed these interests against your rights and consider them not to override your privacy, particularly because we do not use your Customer Data for these purposes.

6.3 Legal Obligation

Processing to comply with our legal obligations: retaining billing and account records; responding to lawful requests from authorities; complying with data protection law; and defending legal claims.

6.4 Consent

Where required by law, we process certain data with your consent: marketing communications, non-essential cookies (Section 10), and any Special Categories of Personal Data you might volunteer (which we neither request nor intentionally collect). You may withdraw consent at any time via Account → Profile & preferences → Communication Preferences, the unsubscribe link in any email, or by contacting us. Withdrawal does not affect processing carried out before it.

Questions about our legal basis? See How to Contact Us.

Ainna uses AI to process your Inputs and generate Outputs. This section explains how your data flows through our AI systems, and how it doesn't.

7.1 How AI Processing Works

• Your messages are sent to our AI provider for processing

• The AI analyzes your Inputs and applies The Innovation Mode methodology

• Ainna's responses and your Conversation Data are stored to maintain continuity within an Opportunity

• When you download a Document, your Opportunity data is used to render it on the spot; the Document file is not stored (Section 8)

• Opportunities and Conversation Data are kept under the retention rules in Section 8

7.2 Data Minimization

• Minimal data only: we send only the content needed to generate your response, plus limited context from your Opportunity to improve quality.

• Documents built in-house: your generated Documents are assembled within our own European infrastructure and are never sent to the AI provider.

• Be mindful of identifiers: anything you type into a conversation may be processed by the AI provider, so leave out sensitive identifiers you don't need in the analysis.

• No training on your data: the AI provider is contractually prohibited from using your content to train its models.

7.3 Our AI Training Commitment

We do not use your Customer Data to train, fine-tune, or improve any AI model.

• Your Inputs are never used for AI training

• Your Conversation Data is never used for AI training

• Your Outputs are never used for AI training

• Your data is never fed into training pipelines and never used to improve results for other users

Your data is processed to generate your Outputs. That's it.

7.4 Our AI Provider

We currently use OpenAI's API for Ainna's conversational capabilities. Under OpenAI's API terms, content submitted through the API is not used to train or improve its models. OpenAI may retain API data for a limited period (up to 30 days) to monitor for abuse and misuse, after which it is deleted, unless a longer period is required by law. OpenAI is based in the United States; see Section 13 on international transfers.

If we change or add AI providers, we will keep to the same standard: only providers whose terms prevent training on your content. This section names our current provider; the commitment does not depend on which provider we use.

7.5 What Stays Within Our Infrastructure

The following never leave our own systems and are not sent to the AI provider:

• Your account information

• Your Branding

• Your generated Documents

• Your billing and payment records

• Your referral data

Document generation happens entirely within our own EU-based infrastructure.

7.6 Automated Decision-Making

Ainna uses AI to generate content and analysis. This is content generation, not automated decision-making that produces legal or similarly significant effects on you.

• You decide whether to use, modify, or discard any Output

• Scores and assessments are analytical frameworks, not validation or predictions of success (see Terms of Service, Section 11)

• AI-generated content may contain errors and requires your review before use

• We do not use automated decision-making for account suspension, pricing, or access decisions without human review

Questions about AI processing? See How to Contact Us.

You stay in control of your data: we keep it only as long as it's useful, and deletion is straightforward. These rules align with Section 3.4 of our Terms of Service.

8.1 Generated Documents

We don't store your generated Documents. Each Document is rendered from your Opportunity data at the moment you download it, and the only copy is the one you download. You can generate it again any time while the Opportunity exists and your plan includes Document generation. Download the ones you want to keep.

8.2 Opportunities and Account Data

• While a paid plan is active: no inactivity-based deletion applies. Your Opportunities, conversations, and analyses are fully retained.

• Accounts not on an active paid plan: if there is no login for 12 consecutive months, we email you at the address on file. You then have 30 days to log in and keep the account. If you do not, all account data is permanently deleted. Any login resets the clock.

For this section, "login" means an authenticated sign-in to your account.

8.3 Your Deletion Rights

• Delete an Opportunity: remove any Opportunity and its data from your workspace at any time. Its data is deleted immediately.

• Close your account: via Account → Profile & preferences → Your Data; we ask you to confirm, to prevent accidental closure. Closing your account permanently deletes all your Opportunities, conversations, and Outputs.

Before deleting, generate and download anything you want to keep.

8.4 How Deletion Works

When you delete something, we remove it from our active systems immediately, and it cannot be restored through the Service, by you or by us. We keep encrypted backups of the platform for disaster recovery; deleted content ages out of those backups on their normal cycle, and we do not use backups to bring back content a user has deleted. This means deletion is effectively final. Keep your own copies of anything you want to preserve.

8.5 Data We Must Retain

• Billing records: invoices and payment references are retained for the period tax and accounting law requires. These do not include your Customer Data.

• Account records: basic account identifiers are retained for legal and financial purposes.

• Legal holds: data may be preserved if subject to legal proceedings or a lawful request; we will tell you if permitted.

• Security logs: technical access and security logs (not content) are retained for a limited period for fraud prevention and security.

• Anonymized data: fully anonymized, aggregated Usage Data may be retained indefinitely; it cannot be linked back to you.

Questions about retention? See How to Contact Us.

You have meaningful control over your Personal Data, and we honor these rights for all users to the extent reasonably practicable.

9.1 Rights Under GDPR (EU/EEA Users)

• Access: request a copy of the Personal Data we hold about you.

• Rectification: request correction of inaccurate or incomplete data.

• Erasure: request deletion of your Personal Data.

• Restriction: request that we limit how we use your data in certain cases.

• Portability: receive your Personal Data in a structured, machine-readable format.

• Object: object to processing based on legitimate interests or to direct marketing.

• Withdraw consent: where processing is based on consent, without affecting prior processing.

• Automated decision-making: Ainna's AI generates content and assessments for your review; it does not make automated decisions about you.

• Complain: lodge a complaint with a supervisory authority. Our lead authority is the Irish Data Protection Commission (www.dataprotection.ie).

9.2 Rights Under CCPA/CPRA (California Residents)

• Know: request the categories and specific pieces of personal information we have collected.

• Delete: request deletion of personal information we collected from you.

• Correct: request correction of inaccurate personal information.

• Opt out of sale/sharing: we do not sell or share your personal information, so there is nothing to opt out of.

• Limit sensitive information: we do not collect sensitive personal information as defined under CCPA.

• Non-discrimination: you will not be treated differently for exercising your rights.

California residents may use an authorized agent, with written authorization.

9.3 How to Exercise Your Rights

Self-service:

• View and update your profile in Account → Profile & preferences

• Delete an Opportunity from your dashboard

• Close your account in Account → Profile & preferences → Your Data

• Manage communications in Account → Profile & preferences → Communication Preferences

By email:

For access, correction, or a copy of the text content of your Opportunities in a portable format, email privacy@ainna.ai.

We will respond within 30 days, or sooner where the law requires. We may need to verify your identity first. If we cannot fulfill a request, we will explain why.

9.4 We Do Not Sell Your Personal Information

We do not sell, rent, share, or trade your Personal Data for money or other valuable consideration. This applies to all users. We have not done so in the preceding 12 months and have no intention of doing so. Because we do not sell or share Personal Data, we do not offer a "Do Not Sell or Share My Personal Information" link; there is nothing to opt out of.

9.5 Verification

To protect your privacy, we may verify your identity before acting on certain requests, for example by confirming the request from your account email or asking you to sign in. We will not fulfill a request if we cannot verify your identity, since that protects you from unauthorized access.

Questions about your rights? See How to Contact Us.

We use cookies and similar technologies to provide, protect, and improve the Service. We keep tracking to a minimum and never use cookies for advertising or cross-site tracking.

10.1 What Are Cookies?

Cookies are small text files stored on your device that help a site remember your preferences and understand how you use it. Similar technologies include local storage, session storage, and pixel tags.

10.2 Cookies We Use

Essential (always active). Required for the Service to work: authentication, security, session management, and load balancing. Legal basis: performance of contract.

Functional (optional). Remember your preferences, such as theme and interface settings. Legal basis: consent or legitimate interests.

Analytics (optional). Help us understand usage so we can improve: which features are used, navigation paths, performance metrics. This is aggregated and anonymized and does not track the content of your conversations. Legal basis: consent.

10.3 Cookies We Do Not Use

• No advertising cookies

• No third-party marketing pixels

• No cross-site tracking

• No social media trackers

• No data broker integrations

10.4 Your Cookie Choices

When you first visit Ainna, we ask for your consent before setting non-essential cookies, and you can change your preferences at any time in Account Settings → Privacy or through your browser settings. If you disable essential cookies, some features may not work. Changes to non-essential cookie preferences apply immediately.

10.5 Do Not Track

There is no industry-standard response to browser "Do Not Track" signals. While we do not formally respond to them, our practices already align with their intent: no cross-site tracking, no advertising tracking, and no sharing of tracking data with third parties.

Questions about cookies? See How to Contact Us.

We use a small number of third-party providers (subprocessors) to deliver Ainna. They process Personal Data on our behalf under terms that protect your data.

11.1 Our Providers

Cloud Infrastructure — Microsoft Azure

We host Ainna on Microsoft Azure.

• Your data is stored in EU data centres

• Data is encrypted at rest (AES-256) and in transit (TLS 1.2+)

• Azure holds SOC 2 and ISO 27001 certifications, and Microsoft makes its GDPR commitments in its data protection terms

• Your Outputs, Your Branding, and account data remain within our Azure infrastructure, and your Documents are generated there on demand

AI Processing — OpenAI

We use OpenAI's API for conversational AI.

• We send only the content needed to generate your response

• Your Documents are never sent to OpenAI; they are generated within our own infrastructure

• Under OpenAI's API terms, your content is not used to train its models

• OpenAI may retain API data briefly (up to 30 days) to monitor for abuse, then deletes it

• OpenAI is based in the United States (see Section 13)

OpenAI's privacy policy: openai.com/policies/privacy-policy

Payment Processing — Stripe

Stripe processes payments.

• We never see or store your full card details

• Stripe is PCI DSS Level 1 certified

• We receive a token and the last four digits for reference

Stripe's privacy policy: stripe.com/privacy

Authentication — LinkedIn

LinkedIn provides optional sign-in. It verifies your identity when you choose it; we send LinkedIn none of your data.

• We receive only your name, email, and profile picture

• We never see your LinkedIn credentials

• We do not access your connections, posts, or activity

• We do not send LinkedIn any of your data; the data flows one way, from LinkedIn to us, only when you choose to sign in with it

LinkedIn's privacy policy: linkedin.com/legal/privacy-policy

11.2 Our Commitments

Before engaging a subprocessor, we evaluate its privacy and security practices, ensure its terms prohibit using your content to train or improve its own services, verify appropriate safeguards for any international transfer, and confirm data residency where applicable. We remain responsible for our subprocessors' handling of your data.

11.3 Changes

We may update this list as our infrastructure evolves. We will communicate material changes that significantly affect how your data is processed through the Service or by email.

Questions about our providers? See How to Contact Us.

We do not sell, rent, or trade your Personal Data. We share it only in the limited circumstances below, and only the minimum necessary.

12.1 With Service Providers

We share data with the subprocessors in Section 11 solely to operate the Service: cloud infrastructure stores your account data and Opportunities; the AI provider processes conversation content to generate responses (never your Documents); Stripe handles payments; LinkedIn provides optional sign-in. These providers are bound by terms that prohibit using your data for their own purposes, including AI training.

12.2 Within a Team, and with People You Invite

• Team plans: if you use a Team plan, your Opportunities live in a shared workspace that belongs to the account holder, and the Administrator and Members of that workspace can see and work with its content. On the free trial and the Pro plan, your Opportunities are yours alone. Where a Team customer provides personal data it controls, we act as its processor under our Data Processing Agreement.

• The Panel: when you invite a Panelist, that person can see the Opportunity you ask them to assess, for that purpose. You choose whom to invite, and you are responsible for that choice.

We do not otherwise make your Opportunities visible to other users.

12.3 With Your Consent

We may share data when you ask us to, for example by connecting Ainna to a third-party tool you choose, or taking part in a testimonial (only with your written permission). You can withdraw consent at any time, without affecting sharing already carried out.

12.4 For Legal Reasons

We may disclose data where we reasonably believe it necessary to comply with law or a lawful request from authorities; to protect the rights, property, or safety of Innovation Mode Limited, our users, or the public; to enforce our Terms; or to prevent fraud or security threats. If we receive a legal request for your data, we will tell you before disclosure unless legally prohibited, and where permitted give you the chance to challenge it.

12.5 Business Transfers

If we are involved in a merger, acquisition, reorganization, or sale of assets, your Personal Data may transfer as part of that transaction. We will notify you beforehand, your data will remain subject to protections at least as strong as this Policy, and if the acquirer intends to use your data differently you will be able to delete your account before the transfer.

12.6 Aggregated and Anonymized Data

We may share aggregated, anonymized data that cannot identify you or your content, such as overall usage statistics and performance metrics. This is not Personal Data under GDPR.

12.7 What We Never Share

• We never sell your Personal Data to data brokers or advertisers

• We never share your Customer Data with the AI provider for training

• We never share your data with third parties for their marketing

• We never make your Opportunities visible to other users except within your own Team workspace or to Panelists you invite

Your data is not our product. You are our customer.

Questions about data sharing? See How to Contact Us.

We are based in Ireland and store your data in the European Union by default, so it benefits from GDPR protections.

13.1 Where Your Data Is Stored

Your account data, Opportunities, Outputs, and Your Branding are stored in EU data centres, and your Documents are generated there on demand.

13.2 Where Your Data May Be Processed

Some processing happens outside the EU:

• AI processing: conversation content is processed by OpenAI in the United States. Your Documents are not sent outside the EU.

• Payments: Stripe operates globally; we never see or store your card details.

• Support: your inquiry may be handled by team members in different locations.

Because OpenAI is a US provider, it may in principle be subject to US legal process, including requests that reach data held outside the US. This is one reason we minimize what we send: only the content needed to generate a response, and never your Documents. Leave out sensitive identifiers you don't need in the analysis.

13.3 Safeguards

Where Personal Data is transferred outside the EU/EEA to a country without an adequacy decision, we rely on appropriate safeguards, primarily the EU Standard Contractual Clauses, together with the data minimization described above and encryption in transit and at rest.

13.4 Your Rights

You can ask where your data is processed and what safeguards apply, and object to transfers in certain circumstances. Contact privacy@ainna.ai.

Questions about international transfers? See How to Contact Us.

We built Ainna with security and privacy as foundational principles.

14.1 Technical Measures

• Encryption in transit: TLS 1.2 or higher

• Encryption at rest: AES-256

• EU data residency: your data is stored in EU data centres

• Access controls: role-based access and least privilege

• Passwordless sign-in: we use LinkedIn OAuth or a one-time email link, so there is no Ainna password to steal

• Infrastructure security: firewalls, monitoring, and regular patching

• Documents not stored: generated Documents are rendered on demand and not retained, so there is less to expose

14.2 Privacy-First Architecture

• Minimal AI data exchange: we send only the content needed to generate a response, and never your Documents

• Minimal collection: we collect only what's needed to provide the Service

• Documents on demand: generated files aren't stored, reducing long-term exposure

• Prompt deletion: when you delete content, it's removed from active systems immediately (Section 8.4)

14.3 Organizational Measures

• Regular security awareness training for our team

• Assessment of third-party providers before engagement, with ongoing monitoring

• Least-privilege access for team members

• Documented incident response procedures

• Periodic review of our security controls

14.4 Your Role in Security

• Protect your sign-in: keep access to your email and, if you use it, your LinkedIn account secure, and enable two-factor authentication where available

• Download what you want to keep: Documents are generated on demand and not stored, so download the ones you need

• Be mindful of what you share: avoid sensitive identifiers you don't need, and don't submit health records, payment card numbers, or material non-public information about listed companies

• Report suspicious activity: contact security@ainna.ai if you suspect unauthorized access

• Don't share access: your account is personal to you

14.5 Security Incidents

No system is completely secure. If we discover a breach affecting your Personal Data, we will notify affected users without undue delay, notify the Irish Data Protection Commission within 72 hours where the breach is likely to result in a risk to your rights, explain what happened and what data was affected, and take immediate steps to contain and remediate it.

If you believe your account has been compromised, contact security@ainna.ai.

Questions about security? See How to Contact Us.

Ainna is built for product managers, founders, and business professionals, and is not intended for anyone under 18.

15.1 Age Requirement

You must be at least 18 to create an account and use Ainna. By using the Service, you confirm you meet this requirement.

15.2 No Collection from Minors

We do not knowingly collect Personal Data from anyone under 18. If you are under 18, please do not register or provide us with any personal information.

15.3 If We Learn of Underage Use

If we learn we have collected Personal Data from someone under 18, we will suspend the account, delete the associated data, and retain nothing except what the law requires.

If you believe we may have collected information from someone under 18, contact privacy@ainna.ai.

Questions about our age policy? See How to Contact Us.

Ainna may contain links to third-party websites and services we don't operate.

16.1 Services We Link To

• LinkedIn — for optional authentication (LinkedIn Privacy Policy)

• Stripe — for payment processing (Stripe Privacy Policy)

• The Innovation Mode — for methodology resources (theinnovationmode.com)

We encourage you to review their privacy policies.

16.2 Links in Your Outputs

Your Documents may contain links to external sites based on the content you provide. These are for convenience and do not imply endorsement or verification by Innovation Mode Limited.

16.3 Our Responsibility

We have no control over, and take no responsibility for, third-party sites. When you leave Ainna for a third-party site, this Policy no longer applies and that site's own terms and privacy policy govern.

Questions about external links? See How to Contact Us.

We may update this Policy to reflect changes in our practices, technology, or legal requirements. We will handle your data under the Policy in effect at the time of collection, unless you consent to a change.

17.1 Notice of Changes

• Changes that reduce your rights or materially change how we handle your data: we will notify you by email and by notice in the Service at least 7 days before they take effect.

• Minor changes (clarifications, formatting, corrections) take effect when posted, and we update the "Last Updated" date at the top.

• Changes required by law may take effect on the timeline the law requires, and we will notify you as soon as practicable.

17.2 Your Choices

Continued use of Ainna after a change takes effect is acceptance of the revised Policy. If you do not agree, you can stop using the Service, request deletion of your data, or export the text content of your Opportunities before closing your account. We will not retroactively change how we handle data already collected under a previous Policy without your consent.

Questions about policy changes? See How to Contact Us.

Ainna's analysis is generated by AI and is a starting point for your judgment, not a substitute for it. You decide what to rely on, and you are responsible for verifying what matters before acting on it. Ainna is built to keep you, and the experts you choose to involve, in the loop; see our Terms of Service, Section 11 for the full disclaimers on AI-generated content.

Questions? See How to Contact Us.

We're here to help with any privacy question or concern.

Privacy & Data Requests

For access, deletion, export, or privacy concerns:

Email privacy@ainna.ai

Security

To report a security concern or suspected account compromise:

Email security@ainna.ai

General Inquiries

Email hello@ainna.ai

18.1 Self-Service Options

• View or update your profile: Account → Profile & preferences

• Delete an Opportunity: from your dashboard

• Close your account: Account → Profile & preferences → Your Data

• Manage communications: Account → Profile & preferences → Communication Preferences

• Manage cookies: Account Settings → Privacy

18.2 Response Times

• Privacy requests: within 30 days, or sooner where GDPR requires

• Security concerns: acknowledged within 24 hours

• General support: within 24 hours on business days

Complex requests may take longer; we'll keep you informed. Subscribers receive priority support.

18.3 Supervisory Authority

If you are in the EU and believe we have not adequately addressed your concern, you may lodge a complaint with a data protection supervisory authority. Our lead authority is:

Data Protection Commission (Ireland)

21 Fitzwilliam Square South, Dublin 2, D02 RD28, Ireland

Website: www.dataprotection.ie

You may also complain to the supervisory authority in your country of residence.

18.4 Our Details

Innovation Mode Limited

Company Registration Number: 785034

Registered Office: 51 Bracken Road Dublin 18, D18 CV48, DUBLIN

Ireland

You can also manage your data and communications anytime from within Ainna via Account → Profile & preferences.