v1 · draft

Privacy Policy

Version v1 — DRAFT, pending legal review

1. Who processes your data Controller: Abraham AI LLC, a limited liability company of the State of Wyoming, with its registered address at 312 W 2nd St, #2059, Casper, WY 82601, Wyoming, United States. General and privacy contact: [E-MAIL].

2. Data we collect - Account: e-mail, display name, language. - Content: the audio files you upload and the results created at your request. - Usage: processing records, credits, dates and request status. - Acceptances: date and time you accepted these documents, the version accepted, browser identification and your network address in truncated form (we remove the last block of the address), kept only as proof of acceptance. - Payment: handled by a payment partner; we do not store card numbers.

3. Why we use it To create and maintain your account, run the processing you request, manage credits and payments, provide support, prevent fraud and abuse, and comply with legal obligations.

4. Legal bases Performance of the contract (providing the service), consent (voice profile), legal obligation (tax and acceptance records) and legitimate interest (security and abuse prevention).

5. Your voice and the voice profile A voice profile is created only after your specific consent for that voice, separate from accepting these documents. It is used only to process the recordings you ask for, within your account.

How long we keep it: the voice profile is kept while your account exists and the consent for that voice remains active. It is deleted with your account and also after 24 months without use.

What triggers deletion: (a) you delete the voice profile in "My voices"; (b) you withdraw consent for that voice; (c) you delete your account; (d) the maximum period without use is reached; (e) we find the consent was not valid.

How it is destroyed: the voice profile file is erased from storage and the corresponding record is removed within 30 days after the event that triggers deletion, including backup copies in the normal rotation cycle. After deletion, no new processing can use that profile. Recordings and results already generated are unaffected and can be deleted separately.

We do not sell, rent or share voice profiles, and we do not use them for any purpose other than fulfilling your requests.

6. Sharing We share data only with providers needed to operate the service (hosting, storage, payment, e-mail delivery), acting under contract and only to provide the service to us; and with authorities where the law requires it.

7. Where data is hosted and international transfers Your data passes through three places when you use Abraham: 1. Database and files: your account data, records, and the files you upload are stored on servers located in Canada (AWS ca-central-1 region). 2. Audio processing: your files are processed on dedicated servers located in São Paulo, Brazil (gru region). 3. Website and app: delivered through a global content delivery network, which means temporary copies of pages may pass through servers in several countries.

If you are outside these regions, your data is transferred between them so the service can work. These international transfers rely on applicable contractual safeguards ([TO BE DEFINED: standard clauses / other mechanism]).

8. Retention Account and credit records: while the account exists and for the legally required period afterwards. Recordings and results: while you keep them in your account and, after account closure, for no more than 30 days, when they will be deleted. Original files may also be removed automatically after processing. Acceptances: kept as proof, including previous ones, for the legal period.

9. Your rights You may request access, correction, a copy, deletion of your account and data, withdrawal of consent and information about sharing. Write to [E-MAIL]; we reply within [TO BE DEFINED: period, e.g. 30 days]. You may sign out and request deletion at any time, including before accepting new documents.

10. Security We use encrypted transmission, private storage with restricted access, per-user access rules and internal access limited to what is necessary.

11. Children The service is for people aged 18 or older. We do not knowingly collect data from people under 18; if we identify such an account, we close it and delete the data.

12. Changes When we publish a new version of this Policy, we ask for a new acceptance on your next sign-in. Previous acceptances are preserved.