Privacy Policy

Last updated: July 21, 2026

IMPORTANT PRIVACY INFORMATION

In order to use our Service, we will ask you to describe a real-life goal or difficulty you would like to work on (for example, "negotiating my raise" or "talking to my teenager") and/or create an account by providing your email and name. Your goal description is used solely to generate and adapt your personal course and progress records. It is never sold and never used to build advertising profiles.

We will also automatically collect from your device language settings, IP address, time zone, type and model of a device, device settings, operating system, Internet service provider, mobile carrier, hardware ID, and other unique identifiers (such as IDFA and AAID). We need this data to provide our services, analyze how our customers use the Service and to measure ads for our own product.

For improving the Service and promoting our own product, we use third-party solutions. As a result, we may process data using solutions developed by Amplitude, Meta (Facebook), Google, Hotjar, TikTok, Pinterest, Snapchat, Freshdesk, Solidgate, Supabase, Customer.io, and OpenAI. Therefore, some of the data is stored and processed on the servers of such third parties. This enables us to (1) analyze different interactions (how often users start learning sessions, what sections of the Website our users viewed); (2) serve and measure ads for Graspen (and show them only to a particular group of users, for example, only to those who have made a purchase).

If you decide to make a purchase or subscribe to a paid plan on our Website, we will ask you to provide your email and name. We will use this data to fulfill your order and to render a personalized service.

Please read our Privacy Policy below to know more about what we do with data (Section 3), what data privacy rights are available to you (Section 6) and who will be the data controller (Section 1). If any questions remain unanswered, please contact us at privacy@graspen.ai.

PRIVACY POLICY

This Privacy Policy explains what personal data is collected when you use the website located at https://graspen.ai (the "Website"), the services and products provided through it, including Graspen — an AI-powered personal learning service that builds fully personal courses based on the goal or difficulty you describe, delivers daily micro-sessions, quizzes and interactive exercises, tracks your progress, runs spaced skill re-checks, and issues certificates of demonstrated skill (collectively, the "Service") — and how such personal data will be processed.

BY USING THE SERVICE, YOU PROMISE US THAT (I) YOU HAVE READ, UNDERSTAND AND AGREE TO THIS PRIVACY POLICY, AND (II) YOU ARE OVER 16 YEARS OF AGE (OR HAVE HAD YOUR PARENT OR GUARDIAN READ AND AGREE TO THIS PRIVACY POLICY FOR YOU). If you do not agree, or are unable to make this promise, you must not use the Service. In such case, you must (a) contact us and request deletion of your data; (b) leave the Website and not access or use it; and (c) cancel any active subscriptions or trials.

Any translation from the English version is provided for your convenience only. In the event of any difference in meaning or interpretation between the English language version of this Privacy Policy available at https://graspen.ai/privacy-policy, and any translation, the English language version will prevail. The original English text shall be the sole legally binding version.

"GDPR" means the General Data Protection Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data.

"EEA" includes all current member states to the European Union and the European Free Trade Association. For the purpose of this policy EEA shall include the United Kingdom of Great Britain and Northern Ireland.

"Process", in respect of personal data, includes to collect, store, and disclose to others.

All other capitalized terms are used herein in the same meaning as defined in the Terms.

TABLE OF CONTENTS

1. PERSONAL DATA CONTROLLER
2. CATEGORIES OF PERSONAL DATA WE COLLECT
3. FOR WHAT PURPOSES WE PROCESS PERSONAL DATA
4. UNDER WHAT LEGAL BASES WE PROCESS YOUR PERSONAL DATA (Applies only to EEA-based users)
5. WITH WHOM WE SHARE YOUR PERSONAL DATA
6. HOW YOU CAN EXERCISE YOUR PRIVACY RIGHTS
7. AGE LIMITATION
8. INTERNATIONAL DATA TRANSFERS
9. U.S. STATES PRIVACY NOTICE
10. CHANGES TO THIS PRIVACY POLICY
11. DATA RETENTION
12. HOW "DO NOT TRACK" REQUESTS ARE HANDLED
13. CONTACT US

1. PERSONAL DATA CONTROLLER

Personal AI Labs Inc., a company registered in the United States, having its registered office at C/O Premier Workspaces, 5940 South Rainbow Boulevard, Las Vegas, Nevada 89118, United States, will be the controller of your personal data.

2. CATEGORIES OF PERSONAL DATA WE COLLECT

We collect data you give us voluntarily (for example, your email address and the goal you describe). We also collect data automatically (for example, cookies and technical information about your device) or from third parties (for example, sign-in providers).

2.1. Data we receive directly from you

2.1.1. Identifiers

You may provide us with your name and email address when you create an account with the Service, make a purchase, or contact us by any other means. Your name (or the name you choose to display) may also appear on certificates issued to you, as described below.

2.1.2. Account Data

This includes your login information (email and password) and user ID.

2.1.3. Goal Descriptions and Course Inputs

The core of the Service is the description you provide of a real-life goal or difficulty you want to work on, typically in one or a few sentences (for example, "negotiating my raise" or "talking to my teenager"), together with any clarifying answers, context, or preferences you provide while your course is being built or adapted ("Goal Data"). Because Goal Data is free text written by you, it may reveal sensitive aspects of your personal life — for example, information about your relationships, family, employment situation, finances, emotional state, or wellbeing.

We want to be direct about how this data is treated: Goal Data is used solely to generate and adapt your personal course and your progress records. It is never sold, and it is never used to build advertising profiles or for any advertising purpose. Please only share information you are comfortable providing; the Service does not require you to include sensitive details for a course to be created.

2.1.4. Learning and Progress Data; AI System Outputs

As you use the Service, we collect information about your learning activity and the resulting content generated by the Service, including:

a. Your answers to quizzes and interactive exercises b. Completion of daily micro-sessions (which sessions you started and finished, and when) c. Results of skill checks and spaced re-checks d. Progress tracking data (streaks, milestones, course completion status) e. Preferences and feedback you express about your course, sessions, or exercises, and f. The course content, exercises, explanations, and feedback generated for you by the Service ("AI System Outputs").

We process Learning and Progress Data to personalize and adapt your course, to schedule spaced re-checks, and to determine whether you have demonstrated the skill required to issue a certificate. Please note that information you share while using the Service may be reflected in future AI System Outputs generated for you (for example, exercises may reference the goal you described).

2.1.5. Certificate Data

When you complete a course and demonstrate the relevant skill, the Service issues a certificate of demonstrated skill. A certificate includes the name you choose to have it awarded to, the skill or course title, the date of issuance, and a unique verification identifier. Certificates are verifiable by link or QR code at graspen.ai; they are not accredited credentials. A certificate's verification page exposes only the information contained in the certificate that you choose to share — it does not expose your Goal Data, your quiz answers, or any other account information. Whether, and with whom, you share a certificate or its verification link is entirely your choice.

2.1.6. Purchase Data

When you make payments through the Service, you need to provide your billing data, such as your credit card number, to our payment service providers. We do not collect, store, or have access to full credit card number data, though we may receive some limited information, including credit card-related data (including a secure token reflecting your payment method), data about products or services purchased, date, time and amount of the purchase, the type of payment method used, and limited digits of your card number.

2.1.7. Sensitive Data

The free-text nature of the Service means you may choose to include information in your Goal Data or exercise responses that is considered sensitive and subject to special protections under applicable laws — for example, information about your health, religious beliefs, political opinions, sexual orientation, philosophical views, racial or ethnic origin, or trade union membership.

By providing such sensitive information, you consent to our use of it for the purposes set out in this Privacy Policy — that is, solely to generate and adapt your course and progress records. We will never use sensitive personal data for marketing or advertising purposes. Please only share sensitive personal data if you are comfortable doing so.

2.1.8. Feedback/Communications

We may also process your email and other information provided by you to us through customer support and other communications.

2.2. Data provided by third parties

When you use Sign in with Apple to register an account in the Service, we get personal data from your Apple ID account. This data may include, in particular, your name and verified email address. You may choose to share your real email address or an anonymous one that uses the private email relay service. Apple will show you their detailed privacy information on the Sign in with Apple screen.

When you decide to log in using Facebook, we get personal data from your Facebook account. This includes your profile image, name, and Facebook ID. Unless you opt out on the Facebook Login screen, we will also collect other data, such as email address. For more information, please refer to the Facebook Permissions Reference and to the Facebook Data Policy. In addition, Facebook lets you control the choices you made when connecting your Facebook profile to the Website on their Apps and Websites page.

When you contact us via Facebook Messenger or Instagram Direct Messages, we receive the content of your messages and your Page-Scoped User ID (PSID) — a unique identifier assigned by Meta that is specific to your interaction with our Page and is not your personal Facebook or Instagram profile ID. We also receive message timestamps and delivery status information. This data is processed by our support department to respond to your inquiries. Message content is not used for advertising, profiling, or AI model training. You can request deletion of this data at any time by contacting us at privacy@graspen.ai.

When you decide to log in using Google, we receive personal data from your Google Account: name, email address, and profile picture associated with your Google Account. You can revoke access provided to us on the Google Apps Permissions page. To know more about how Google processes your data, visit its Privacy Policy.

2.3. Data we collect automatically

2.3.1. Data about how you found us

We collect data about your referring website (place on the web where you were when you tapped/clicked on our ad or link).

2.3.2. Device and Location data

We collect data from your device. Examples of such data include: language settings, IP address, time zone, type and model of a device, device settings, operating system, Internet service provider, device identifiers, hardware ID, and Facebook ID.

2.3.3. Usage data

We record how you interact with our Service. For example, we log what pages you have viewed, the features and content you interact with, how often you use the Service, how long you are on the Service, and your purchases. Usage data of this kind is about your interaction patterns; it is distinct from the content of your Goal Data.

2.3.4. Advertising IDs

We collect your Apple Identifier for Advertising ("IDFA"), Identifier for Vendor ("IDFV") or Google Advertising ID ("AAID") (depending on the operating system of your device) when you access our Website from a mobile device. You can typically reset these numbers through the settings of your device's operating system (but we do not control this).

2.3.5. Transaction data

When you make payments through the Service, you need to provide financial account data, such as your credit card number, to our third-party service providers. We do not collect or store full credit card number data, though we may receive credit card-related data and data about the transaction, including: date, time and amount of the transaction, and the type of payment method used.

2.3.6. Cookies

Some of the information we and our third-party partners collect automatically is captured using cookies, which are text files containing small amounts of information that are downloaded to your device, or related technologies, such as web beacons, local shared objects, and tracking pixels, to collect and/or store information. To learn more, please refer to our Cookie Policy.

3. FOR WHAT PURPOSES WE PROCESS YOUR PERSONAL DATA

We process your personal data:

3.1. To provide our Service

We process your personal data for Service provision, namely to build, deliver, and continuously adapt your personal course based on the goal or difficulty you described, to track your progress, and to issue certificates of demonstrated skill. We do not process sensitive personal data for marketing or advertising purposes, nor use your content to train third-party foundation models.

3.1.1. Generating your personal course

We conduct automated processing of your Goal Data to design a course tailored to your specific goal: a sequence of daily micro-sessions (approximately 15 minutes each), quizzes, and interactive exercises. This processing is essential to the Service's core functionality — without it, a personal course cannot be created.

3.1.2. Adapting your course and tracking progress

We process your Learning and Progress Data (quiz answers, exercise responses, session completion, skill-check results) to adapt subsequent sessions to your pace and comprehension, to schedule spaced re-checks that verify retention, and to maintain your progress records. This enables the Service to focus on what you have not yet mastered and to confirm when you have demonstrated the target skill.

3.1.3. Issuing and verifying certificates

When you demonstrate the target skill, we process your chosen awarded-to name, the course/skill title, and the issuance date to generate your certificate and its verification page at graspen.ai. Verification pages expose only the certificate information that you choose to share via the certificate's link or QR code, and nothing else from your account.

3.1.4. AI processing disclosure

Your course content, exercises, and feedback are generated by AI models. To enable the core AI functionality of our Service, we use third-party AI model providers, including OpenAI. These models allow us to interpret your goal description, generate course content, process natural language, and create personalized learning experiences based on your inputs. While your inputs are processed using such providers' technology, we implement measures to ensure your personal data is protected according to our privacy standards. Your Goal Data and Learning and Progress Data are NOT used to train third-party foundation models, and we do not use your personal data to train or fine-tune underlying AI models ourselves. Your content remains specifically associated with your account and is used solely to provide you with the personalized Service. For more information about how OpenAI handles data, you can review OpenAI's Privacy Policy.

We will not process your sensitive personal data — or any content of your Goal Data — for marketing, advertising, or any purpose other than those explicitly specified in this Privacy Policy.

3.1.5. Technical functionality

We use your data to create your account, ensure seamless operation of the Service, prevent technical issues, and store your courses and progress records.

We use Supabase as our database infrastructure to securely store and manage user data, authenticate accounts, and keep your course and progress data in sync. This helps us deliver consistent Service performance while maintaining data integrity and security. For information about Supabase's data practices, you can review their Privacy Policy.

3.2. To improve our Service

We process your personal data for Service improvement, namely to conduct system analytics, monitor performance, and enhance features.

3.2.1. System analytics and monitoring

We collect and analyze technical performance metrics and error logs to identify and fix issues, optimize system performance, and ensure reliability.

3.2.2. Feature development and quality assurance

We analyze anonymized and aggregated usage statistics (for example, which types of exercises users complete most consistently) to understand which features are most valuable and identify areas for improvement. This helps us develop new functionality without processing your personal content.

3.3. To provide you with customer support

We process your personal data to respond to your requests for technical support, Service information, or to any other communication you initiate. For this purpose, we may send you, for example, notifications or emails about the performance of our Service, security, payment transactions, or notices regarding our Terms or this Privacy Policy.

We use Freshdesk to handle customer support inquiries and manage communication with you. When you contact our support team, your inquiries and related information are processed through Freshdesk to help us track, prioritize, and efficiently resolve your requests. For information about Freshdesk's data practices, you can review their Privacy Policy.

3.4. To communicate with you regarding your use of our Service

We communicate with you, for example, by push notifications or by emails. These may include daily session reminders, spaced re-check reminders, or other information about the Service. As a result, you will, for example, receive a reminder that today's micro-session is ready, or a notification that a new feature has been deployed. To opt out of receiving push notifications, you need to change the settings on your device. To opt out of receiving emails, you should click the unsubscribe link in the footer of each email.

The services that we use for these purposes may collect data concerning the date and time when the message was viewed by our Service's users, as well as when they interacted with it, such as by tapping/clicking on links included in the message.

3.5. To research and analyze your use of the Service

This helps us to better understand our business, analyze our operations, maintain, improve, innovate, plan, design, and develop the Service and our new products. We also use such data for statistical analysis purposes, to test and improve our offers. This enables us to better understand what categories of users use our Service. As a consequence, we often decide how to improve the Service based on the results obtained from this processing.

We use Amplitude, which is an analytics service provided by Amplitude Inc. We use this tool to understand how customers use our Service. Amplitude collects various technical information, in particular, time zone, type of device (phone, tablet or laptop), and unique identifiers (including advertising identifiers). Amplitude also allows us to track various interactions that occur on our Website. As a result, Amplitude helps us to decide what features we should focus on. Amplitude provides more information on how they process data in its Privacy Policy.

We use Hotjar, a behavior analytics tool that analyzes Service use, providing feedback through tools such as heatmaps, session recordings, and surveys. For more details, please refer to Hotjar's Privacy Policy.

We use Facebook Analytics, which is a service provided by Meta that allows us to use different analytical tools. On Facebook Analytics we get, in particular, aggregated demographics and insights on how many people visit our Website, how often users make purchases, and other interactions. Learn more about Meta's approach to data from its Privacy Policy.

The content of your Goal Data is not shared with these analytics providers.

3.6. To send you marketing communications

We process your personal data for our marketing campaigns. As a result, you will receive information about our products, such as, for example, special offers or new features available on the Service. We may show you information about our own offers within the Service and send you emails for marketing purposes. If you do not want to receive marketing emails from us, you can unsubscribe following the instructions in the footer of the marketing emails.

To send you marketing communications, we use Customer.io, a cross-channel marketing platform that allows us to send you in-app messages, push notifications, and emails. Please review Customer.io's Privacy Policy.

3.7. To personalize our ads

We and our partners use certain of your personal data (such as device identifiers and Website interaction events — never your Goal Data or course content) to tailor ads for Graspen and possibly even show them to you at the relevant time. For example, if you visited our Website, you might see ads for Graspen in your Facebook feed.

How to opt out or influence personalized advertising

iOS: On your iPhone or iPad, go to Settings > Privacy > Apple Advertising and deselect Personalized Ads.

Android: To opt out of ads on an Android device, go to Settings > Privacy > Ads and enable Opt out of Ads personalization. In addition, you can reset your advertising identifier in the same section (this also may help you to see fewer personalized ads).

macOS: On your Mac, you can disable personalized ads: go to System Preferences > Security & Privacy > Privacy, select Apple Advertising, and deselect Personalized Ads.

Windows: On a laptop running Windows 10 or later, select Start > Settings > Privacy and then turn off the setting for "Let apps use advertising ID to make ads more interesting to you based on your app activity."

In addition, you may get useful information and opt out of some interest-based advertising by visiting the following links:

a. Network Advertising Initiative – http://optout.networkadvertising.org/ b. Digital Advertising Alliance – http://optout.aboutads.info/ c. Digital Advertising Alliance (Canada) – http://youradchoices.ca/choices d. Digital Advertising Alliance (EU) – http://www.youronlinechoices.com/ e. DAA AppChoices page – http://www.aboutads.info/appchoices

Browsers: It is also possible to stop your browser from accepting cookies altogether by changing your browser's cookie settings. You can usually find these settings in the "options" or "preferences" menu of your browser:

a. Cookie settings in Microsoft Edge / Internet Explorer b. Cookie settings in Firefox c. Cookie settings in Chrome d. Cookie settings in Safari (web and iOS)

Google allows its users to opt out of Google's personalized ads and to prevent their data from being used by Google Analytics.

We value your right to influence the ads that you see, thus we are letting you know what service providers we use for this purpose and how some of them allow you to control your ad preferences.

We use the Meta (Facebook) pixel on the Service. The Facebook pixel is code placed on the Service collecting data that helps us track conversions from Facebook ads, build targeted audiences, and remarket to people who have taken some action on the Service (for example, made a purchase).

We use Facebook Ads Manager together with Facebook Custom Audience, which allows us to choose audiences that will see our ads on Facebook or other Meta products (for example, Instagram). Through Facebook Custom Audience we may create a list of users with certain sets of data, such as an IDFA, and choose users that have completed certain actions in the Service (for example, visited certain sections of the Website). As a result, more of our ads may show up while you are using Facebook or other Meta products. You may learn how to opt out of advertising provided to you through Facebook Custom Audience on Meta's help pages. Facebook also allows its users to influence the types of ads they see; you can adjust your ads settings on Facebook.

Google Ads is an ad delivery service provided by Google that can deliver ads to users. In particular, Google allows us to tailor the ads in a way that they will appear, for example, only to users that have conducted certain actions with our Service (for example, made a purchase or visited our Website). Google allows its users to opt out of Google's personalized ads and to prevent their data from being used by Google Analytics.

We also use the Snapchat Advertising Platform together with Snapchat Audience Based Match, which is an ad delivery service provided by Snapchat that can link the activity of some users of our Service with the Snapchat advertising network and show some of our ads to them. Snapchat allows you to opt out of their audience-based ads. Please review Snapchat's Privacy Policy.

TikTok Ads is the service provided by TikTok that can deliver ads to its users. The ads can be tailored to specific categories of users (for instance, based on their geographical location). Please review TikTok's Privacy Policy.

We use Pinterest Ads to deliver group-based advertisements. For example, you may see our ads if you are interested in specific services, information, or offers. Please review Pinterest's Privacy Policy.

For clarity: the data shared with advertising partners is limited to identifiers, device data, and Website interaction events. We never share your Goal Data, your course content, your quiz answers, or your certificates with advertising partners, and we never use them to build advertising profiles.

3.8. To process your payments

We provide paid subscriptions within the Service (the Service is free to start; continued use requires a paid subscription). For this purpose, we use third-party services for payment processing (for example, payment processors). As a result of this processing, you will be able to make a payment and we will be notified that the payment has been made.

We will not store or collect your payment card details ourselves. This information will be provided directly to our third-party payment processors.

To enable purchases and to process your payments, we use Solidgate (see its Privacy Policy) as our payment processing provider.

3.9. To enforce our Terms and to prevent and combat fraud

We use personal data to enforce our agreements and contractual commitments, and to detect, prevent, and combat fraud (including fraudulent certificate verification attempts). As a result of such processing, we may share your information with others, including law enforcement agencies (in particular, if a dispute arises in connection with our Terms).

3.10. To comply with legal obligations

We may process, use, or share your data when the law requires it, in particular, if a law enforcement agency requests your data by available legal means.

4. UNDER WHAT LEGAL BASES WE PROCESS YOUR PERSONAL DATA

In this section, we are letting you know what legal basis we use for each particular purpose of processing. For more information on a particular purpose, please refer to Section 3. This section applies only to EEA-based users.

We process your personal data under the following legal bases:

4.1. Your consent

We rely on your explicit consent to process any sensitive personal data you choose to include in your Goal Data or exercise responses (such as information about your health, religious beliefs, political opinions, sexual orientation, or philosophical views) and to conduct the course personalization that may incorporate such sensitive data. Please do not share any sensitive personal data unless you are comfortable doing so.

You have the right to withdraw your consent at any time by contacting privacy@graspen.ai. We will promptly cease processing the data for which consent has been withdrawn. Please note that the core functionality of our Service depends on processing the goal description you provided, which may include sensitive information. Therefore, withdrawing consent to process certain types of data may result in:

a. Reduced accuracy and personalization of your course, and/or b. Limited functionality of certain Service features.

Under this legal basis we will also send you marketing communications. You have the right to withdraw your consent at any time by using the unsubscribe link in the footer of our emails or in your personal account. We will also send you push notifications if you allow us to. You can disable notifications at any time in the settings of your device.

4.2. To perform our contract with you

Under this legal basis we:

a. Provide our Service (in accordance with our Terms), including generating and adapting your course, tracking progress, and issuing certificates b. Customize your experience c. Provide you with customer support d. Communicate with you regarding your use of our Service e. Process your payments

4.3. For our (or others') legitimate interests, unless those interests are overridden by your interests or fundamental rights and freedoms that require protection of personal data

We rely on legitimate interests:

a. To communicate with you regarding your use of our Service. This includes, for example, sending you an email or push notification to remind you about today's micro-session or an upcoming skill re-check. The legitimate interest we rely on for this purpose is our interest in encouraging you to use our Service and complete your course. b. To research and analyze your use of the Service. Our legitimate interest for this purpose is our interest in improving our Service so that we understand users' preferences and are able to provide you with a better experience (for example, to make the use of the Service easier and more enjoyable, or to introduce and test new features). c. To personalize our ads. The legitimate interest we rely on for this processing is our interest in promoting our Service in a reasonably targeted way. d. To enforce our Terms and to prevent and combat fraud. Our legitimate interests for this purpose are enforcing our legal rights, preventing and addressing fraud and unauthorised use of the Service, and non-compliance with our Terms.

4.4. To comply with legal obligations.

5. WITH WHOM WE SHARE YOUR PERSONAL DATA

We share information with third parties that help us operate, provide, improve, integrate, customize, support, and market our Service. We may share some sets of personal data, in particular, for purposes and with parties indicated in Section 3 of this Privacy Policy. The types of third parties we share information with include, in particular:

5.1. Service providers

We share personal data with third parties that we hire to provide services or perform business functions on our behalf, based on our instructions. We may share your personal information with the following types of service providers:

a. AI model providers (OpenAI) b. Cloud infrastructure and storage providers (Supabase) c. Data analytics providers (Meta, Amplitude, Hotjar) d. Measurement partners e. Communication service providers (Customer.io, Freshdesk) f. Marketing partners (in particular, social media networks and ad platforms; Meta, Google, Snapchat, TikTok, Pinterest) g. Payment service providers (Solidgate)

Only the data necessary for each provider's function is shared. Your Goal Data and course content are shared only with the providers strictly required to deliver the Service (AI model providers and infrastructure providers) — never with analytics, measurement, or marketing partners.

5.2. People you choose to share certificates with

When you share a certificate or its verification link or QR code, anyone with that link can view the certificate's verification page. That page displays only the certificate information (awarded-to name, skill/course title, issuance date, and verification status) — never your Goal Data, learning history, or other account details.

5.3. Law enforcement agencies and other public authorities

We may use and disclose personal data to enforce our Terms, to protect our rights, privacy, safety, or property, and/or that of our affiliates, you or others, and to respond to requests from courts, law enforcement agencies, regulatory agencies, and other public and government authorities, or in other cases provided for by law.

5.4. Third parties as part of a merger or acquisition

As we develop our business, we may buy or sell assets or business offerings. Customers' information is generally one of the transferred business assets in these types of transactions. We may also share such information with any affiliated entity (e.g. parent company or subsidiary) and may transfer such information in the course of a corporate transaction, such as the sale of our business, a divestiture, merger, consolidation, or asset sale, or in the unlikely event of bankruptcy.

5.5. Affiliates

We may share your personal information with our partner organizations that are part of our corporate group — these are companies that are owned by, own, or are jointly owned with us. These partner organizations will use the information in ways that align with this Privacy Policy.

6. HOW YOU CAN EXERCISE YOUR PRIVACY RIGHTS

To be in control of your personal data, you have the following rights:

Accessing / reviewing / updating / correcting your personal data. You may review, edit, or change the personal data that you had previously provided on the Service, including the name displayed on your certificates.

Deleting your personal data. You can request erasure of your personal data as permitted by law.

When you request deletion of your personal data, we will use reasonable efforts to honor your request. In some cases, we may be legally required to keep some of the data for a certain time; in such event, we will fulfill your request after we have complied with our obligations. Please note that deleting your account will also invalidate the verification pages of certificates issued to you, unless you ask us to retain them.

Objecting to or restricting the use of your personal data. You can ask us to stop using all or some of your personal data or limit our use thereof.

Additional information for EEA-based users:

If you are based in the EEA, you have the following rights in addition to the above:

The right to lodge a complaint with a supervisory authority. We would love you to contact us directly, so we could address your concerns. Nevertheless, you have the right to lodge a complaint with a competent data protection supervisory authority, in particular in the EU Member State where you reside, work or where the alleged infringement has taken place.

The right to data portability. If you wish to receive your personal data in a machine-readable format, you can send a respective request to us as described below.

To exercise any of your privacy rights, please send a request to privacy@graspen.ai.

7. AGE LIMITATION

We do not knowingly process personal data from persons under 16 years of age. If you learn that anyone younger than 16 has provided us with personal data, please contact us at privacy@graspen.ai.

8. INTERNATIONAL DATA TRANSFERS

We may transfer personal data to countries other than the country in which the data was originally collected in order to provide the Service set forth in the Terms and for purposes indicated in this Privacy Policy. If these countries do not have the same data protection laws as the country in which you initially provided the information, we deploy special safeguards.

In particular, if we transfer personal data originating from the EEA to countries that do not provide an adequate level of data protection, we use one of the following legal bases: (i) Standard Contractual Clauses approved by the European Commission, or (ii) the European Commission adequacy decisions about certain countries.

9. U.S. STATES PRIVACY NOTICE

Applicability

If you reside in a state that has enacted consumer privacy laws, this section applies to you. This U.S. States Privacy Notice ("Notice") supplements our Privacy Policy and provides disclosures required by laws in states such as California, Colorado, Connecticut, Delaware, Iowa, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Texas, Utah, and Virginia.

This Notice is designed to supplement our Privacy Policy to ensure compliance with state-specific laws and applies to the collection, use, and sharing of your Personal Information through our websites, mobile applications, and other online or offline services (collectively, the "Services").

For California residents, this also serves as our California Notice at Collection.

The definition of "Personal Information" may vary by state law. Generally, it refers to information that identifies, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household.

9.1. Categories of Personal Information We Collect and For What Purposes

The table below outlines the categories of Personal Information we collect, along with purposes of such collection. For more details, refer to other sections of our Privacy Policy.

For additional details on the purposes of processing and third parties with whom data is shared for each specific purpose, please refer to Section 3 of this Privacy Policy.

We may also process de-identified data, ensuring it cannot reasonably be linked back to you. We commit to maintaining and using de-identified data responsibly and will not attempt to re-identify such data unless required to validate our de-identification measures.

9.2. What Personal Information We Share

Certain state privacy laws, such as those in California, require us to disclose the categories of Personal Information that we have shared with third parties for business purposes over the past 12 months. During this period, we have disclosed the categories of Personal Information outlined in the "Categories of Personal Information We Collect" section for business purposes as described in Sections 3 and 5. For example, we may share IP addresses and device identifiers with service providers that assist us with crash monitoring and reporting. We do not disclose Goal Data, Learning and Progress Data, or Sensitive Information to third parties except to the service providers strictly required to deliver the Service (AI model providers and infrastructure providers).

Some U.S. states grant residents the right to opt out of sharing their Personal Information with third parties in exchange for valuable consideration (which may be classified as a "sale" or "share" under state privacy laws, even if no monetary transaction occurs). If you reside in one of these states and would like to limit the disclosure of your Personal Information to third parties for advertising or marketing purposes, please refer to Section 9.4 below.

For details regarding the categories of third parties with whom we share Personal Information, please refer to Section 3 and Section 5 of this Privacy Policy.

9.3. Your Privacy Rights Under State Laws

Certain U.S. state privacy laws grant residents specific rights regarding their personal information. If you reside in a state with such laws, you may have the following rights:

To exercise any of these rights, submit a request to our customer support team via email: support@graspen.ai

Verification

To ensure that we properly handle the requests you make regarding your rights, we are required to verify those requests. Depending on the type of request, this may include your email, date of subscription purchase, date of last activity, date of account creation or some other Service use data that will reasonably identify you as an owner of the account. We may also ask you for additional proof of identity, if necessary.

Right to Appeal

If we deny your request, you may have the right to appeal our decision. To do so, please contact us and explain your concerns. If you are dissatisfied with the result of the appeal, you may escalate the matter by contacting the Attorney General's office in your state of residence.

Authorized Agents

If you are an authorized agent acting on behalf of a consumer, you may submit an opt-out, access, deletion, or correction request by contacting us. If you are making a request on behalf of a California resident, you may be required to submit proof of authorization, such as:

a. A valid power of attorney b. Written permission signed by the consumer, along with identity verification from the consumer

California "Shine the Light" Law

California's Shine the Light law gives California residents the right to ask companies once a year what personal information they share with third parties for those third parties' direct marketing purposes.

To obtain this information from us, please send an email message to privacy@graspen.ai, which includes "Request for California Privacy Information" on the subject line and your state of residence and email address in the body of your message. If you are a California resident, we will provide the requested information to you at your email address in response.

Retention of Personal Information

We retain the categories of personal information listed above as reasonably necessary to fulfill the purposes outlined in this Notice, unless a longer retention period is required or permitted by law. In many situations, we must retain all, or a portion, of your personal information to comply with legal obligations, resolve disputes, enforce our agreements, protect against fraudulent, deceptive, or illegal activity, or for another one of our business purposes.

9.4. Sales, Sharing, and Targeted Advertising

Privacy laws in some U.S. states broadly define the term "sale" to include sharing of information via cookies, pixels, and similar tracking technologies for certain targeted advertising activities. We do not sell Personal Information for monetary compensation, and we never sell or share Goal Data, Learning and Progress Data, or Sensitive Information for any purpose. However, when you visit our websites, we and our advertising partners may collect device data and behavioral insights through tracking technologies, which could be interpreted as a "sale" or "sharing" under state laws, even if no money is exchanged.

We do not knowingly engage in sales, sharing, or targeted advertising using the personal information of individuals under 18.

More information about our data-sharing practices is available in the table below.

Opt-Out Rights

You may opt out of sales, sharing, or targeted advertising by contacting us at privacy@graspen.ai and/or clicking the "unsubscribe" button.

Your opt-out settings apply per device and browser. If you switch devices, clear cookies, or use a different browser, you may need to reapply your opt-out settings.

10. CHANGES TO THIS PRIVACY POLICY

We may modify this Privacy Policy from time to time. If we decide to make material changes to this Privacy Policy, you will be notified by available means such as email and will have an opportunity to review the revised Privacy Policy. By continuing to access or use the Service after those changes become effective, you agree to be bound by the revised Privacy Policy.

11. DATA RETENTION

We will store your personal data for as long as it is reasonably necessary for achieving the purposes set forth in this Privacy Policy (including providing the Service to you). We will also retain and use your personal data as necessary to comply with our legal obligations, resolve disputes, and enforce our agreements.

11.1. Account Information

We retain your account information for as long as your account is active. If you delete your account, we will delete or anonymize your account information within 30 days, except where we need to retain certain information for legitimate business or legal purposes.

11.2. Goal Data, Courses, and Progress Records

Your Goal Data, generated courses, and Learning and Progress Data are retained for as long as your account is active, so that your courses remain available and spaced re-checks can continue. If you delete your account, this data will be permanently deleted within 30 days. You can also delete an individual course (including the goal description it was built from) at any time from within the Service.

11.3. Certificates

Certificate Data is retained for as long as your account is active so that verification links and QR codes continue to work. If you delete your account, your certificates and their verification pages will be deleted within 30 days, unless you ask us to keep the verification pages active.

11.4. Usage Data

We may retain anonymized or aggregated usage data for analytical purposes even after you delete your account, but this data cannot be used to identify you.

11.5. Backup Data

For disaster recovery purposes, we may retain backup copies of your data for a limited period even after deletion from our active systems.

12. HOW "DO NOT TRACK" REQUESTS ARE HANDLED

Except as otherwise stipulated in this Privacy Policy, this Service does not support "Do Not Track" requests. To determine whether any of the third-party services it uses honor "Do Not Track" requests, please read their privacy policies.

13. CONTACT US

You may contact us at any time for details regarding this Privacy Policy and its previous versions.

Personal AI Labs Inc. C/O Premier Workspaces, 5940 South Rainbow Boulevard, Las Vegas, Nevada 89118, United States

For any questions concerning your account or your personal data, please contact us at privacy@graspen.ai. For general inquiries: info@graspen.ai. For support: support@graspen.ai.