BLUEPINKSECURITY INC. / PUBLIC LEGAL DOCUMENT

Privacy Policy

Public website, TIAP conversations and business communications

1. Scope and identity of the controller

This Privacy Policy describes how Bluepinksecurity Inc. (“BPS,” “we,” “our” or “us”), a Delaware corporation, handles personal information when individuals visit bluepinksecurity.com, speak or otherwise interact with TIAP, our conversational AI agent and interactive orb, submit enquiries, request a business follow-up, or subscribe to our communications. It applies to clients, investors, institutional visitors, researchers, partners, candidates, journalists and other visitors. BPS acts as a controller or business in relation to these visitor interactions, to the extent those terms apply under the relevant law. Where BPS processes data solely on behalf of a contracting customer under documented instructions, the applicable customer agreement and Data Processing Addendum govern that separate processing.

2. Information we collect

The information may include: (a) details voluntarily shared, such as name, business email, organization, role, preferred language and enquiry category; (b) the content of a conversation, including speech sent to the voice service, transcribed words, prompts, AI responses, contact preferences and summaries; (c) consent and preference records, including permission for a specific reply, optional marketing permission and unsubscribe requests; (d) technical and security information, such as IP address, browser and device characteristics, timestamps, service diagnostics and connection events needed for service delivery and protection; and (e) correspondence, meeting arrangements and records of our responses. We ask for information proportionate to the specific request. Please avoid disclosing passwords, payment-card information, health records, identity documents, confidential third-party material or other sensitive data in a public TIAP session.

3. Voice processing and transparency

TIAP is Bluepinksecurity’s conversational AI agent, presented as an interactive orb. When you enable the microphone and begin a session, audio is transmitted for processing by voice and AI service providers so that TIAP can understand and respond. A browser or operating-system microphone permission permits access to the microphone; separate disclosures and permissions apply when legally required for recording or another purpose. As configured on the date of this Policy, the TIAP voice service has voice recording disabled, audio deletion enabled and a 30-day conversation-retention setting. Transcripts and associated information may be processed and retained under the provider's settings and BPS's legitimate operational requirements. The precise lifecycle of each data type depends on the provider's configuration and legal retention requirements. We will update this Policy if these practices materially change. TIAP is intended for conversation and enquiry routing rather than biometric identification of individual speakers.

4. Purposes and legal bases

We process information to operate and secure the website and TIAP; provide requested responses and follow-up; organize prospective commercial, research or employment discussions; identify and troubleshoot malfunctions; meet legal requirements; maintain appropriate records of consent and objections; and communicate institutional news when permitted. Under the EU/UK GDPR, the applicable lawful basis varies by purpose: steps requested before entering a contract or performance of an agreement where relevant; legitimate interests in responding to business enquiries and securing public services, balanced against individual rights; compliance with a legal obligation; and consent where necessary for specific recording, optional electronic marketing or other processing. We identify the relevant basis before processing and honor applicable withdrawal and objection rights.

5. Contact permissions and newsletters

Sharing an email address with TIAP for a specific response permits BPS to use it for that requested follow-up, subject to applicable law. It does not by itself enroll the visitor in a newsletter. BPS may send product information, research updates, institutional news, event invitations, partnership announcements and other promotional email only where an applicable legal basis permits it. We obtain prior opt-in consent when required, including applicable consumer and national electronic-marketing rules, and may conduct carefully scoped professional outreach where local law permits. Every promotional message includes a clear unsubscribe method. We implement marketing objections promptly and, for United States commercial email, within the legally required period. We may retain a minimal suppression record to prevent further marketing after an unsubscribe. Unsubscribing from marketing does not prevent replies to a separate enquiry you have requested.

6. Cookies and device storage

The BPS v3 public website is designed without advertising cookies, marketing pixels, visitor-profiling cookies or behavioral cross-site tracking. See our Cookies Policy for the current no-cookie approach. Separate infrastructure supporting the connection or TIAP may receive network and diagnostic information without placing cookies. Browser permissions, speech processing and server logs can therefore involve personal data even in a cookie-free interface. If a later deployment introduces non-essential cookies or comparable technologies, BPS will update its notices and request any consent required before using them.

7. Sharing and service providers

Authorized BPS personnel and vetted providers may access information to fulfill the identified purposes under appropriate agreements and access controls. Provider categories can include web hosting, voice processing, transcription, AI inference, customer relationship management, business email, security monitoring and technical support. The public TIAP uses specialized voice-processing infrastructure. The set of subprocessors, processing locations and functions may change with the actual deployment. BPS does not sell public visitor personal information or share it for cross-context behavioral advertising as part of the BPS v3 website. Disclosures may also occur where law requires, to protect rights or systems, or as part of a lawful corporate transaction with appropriate safeguards.

8. International transfers

BPS is a United States company serving international audiences. Personal information may be accessed or processed in the United States and other jurisdictions where our providers operate. Where an international transfer is restricted by the GDPR or another applicable law, we assess and use a valid transfer mechanism, which may include an applicable adequacy decision or executed Standard Contractual Clauses together with supplementary measures where required. A provider's or BPS's participation in a recognized data-transfer framework is relied on only within the verified scope and duration of that participation. Details of applicable safeguards may be requested through the contact method below.

9. Retention and deletion

We retain enquiry details for the period reasonably needed to respond and manage the related relationship, subject to applicable limitation periods, security needs and legal obligations. Marketing preference and suppression records are retained as needed to respect a current subscription or unsubscribe request. Technical logs are retained for proportionate operational and security purposes. The current voice service configuration specifies a 30-day conversation retention period, voice recording disabled and audio deletion enabled. These settings do not establish that every transcript, exported contact record, backup or legally retained business record is automatically erased after 30 days. We address verified access and erasure requests in accordance with applicable law and implement deletion through relevant systems where required.

10. Privacy rights and choices

Depending on your location and applicable law, you may request information about processing, access to your data, correction, deletion, restriction, portability, or objection to certain processing; withdraw consent prospectively; and opt out of promotional communications. Residents of states with applicable United States privacy statutes may have statutory rights to access, correct, delete, obtain copies, appeal a decision and opt out of specified data uses, subject to the law's thresholds and exceptions. We do not discriminate unlawfully against individuals for exercising privacy rights. EU/EEA and UK individuals may also complain to a competent data protection authority. We verify requests using information reasonably necessary to protect the requester and respond within legally applicable deadlines.

11. Security and children

BPS applies risk-based measures for authorized access, confidentiality, vendor governance, incident handling and data lifecycle management. Every Internet-accessible service carries residual security risk. Details about BPS's approach and the distinction between planned controls and independently validated claims are available in the Trust Center. TIAP is intended for adults and professional audiences. We do not knowingly solicit personal information from children through TIAP. If we learn that information was collected from a child in circumstances requiring deletion or additional authorization, we will take the legally required steps.

12. Automated processing and decisions

TIAP produces automated conversational responses and can categorize enquiries for an appropriate follow-up. Its output does not itself approve investments, make employment decisions, establish a binding commercial commitment, grant security access or decide matters with legal or similarly significant effects for an individual. Requests requiring human review are referred to authorized BPS personnel as appropriate.

13. How to contact us

For privacy questions, requests to access, correct or delete personal information, objections to processing, consent withdrawal and other data protection enquiries, email dpo@bluepinksecurity.com. Please identify the nature of your request and provide information reasonably necessary for BPS to locate the relevant records. Company: Bluepinksecurity Inc., a Delaware corporation. Registered agent for service of process: Legalinc Corporate Services Inc., 131 Continental Dr., Suite 305, Newark, DE 19713, United States. The registered agent address is for legal service of process; dpo@bluepinksecurity.com is the dedicated contact for privacy and data protection requests.

14. Updates

Last updated: 18 October 2026. We will publish material changes at https://bluepinksecurity.com/legal/privacy and provide additional notice or seek renewed consent where required by law.

ISSUED BY BLUEPINKSECURITY INC.

Data protection and legal enquiries: dpo@bluepinksecurity.com

Last updated: 18 October 2026