1. Scope of This Privacy Policy

This Privacy Policy explains how Synthetic Brain Labs, Inc. ("we," "our," or "us") collects, uses, retains, discloses, and otherwise processes personal data in connection with Direct Inference, our AI inference service, dashboard, websites, documentation, APIs, and related support services (collectively, the "Service").

This Privacy Policy does not apply to personal data we process for a product, service, or relationship that has its own privacy notice. If another privacy notice or written agreement applies to your use of a specific service, that notice or agreement controls for that service.

2. How We Collect Personal Data and What We Collect

We may collect personal data directly from you, automatically when you use the Service, from your organization or account administrators, and from third parties that help us provide the Service.

The personal data we process may include:

• Account and profile data, such as name, email address, organization, role, account identifiers, authentication information, settings, and billing information.
• Service interaction data, such as prompts, uploaded content, outputs, request and response metadata, request identifiers, feature usage, feedback, session data, timestamps, cost and usage records, and support context.
• Technical and security data, such as IP address, browser type, device and operating-system information, diagnostic logs, crash logs, security signals, cookies or similar technologies, and API-key activity.
• Billing and commercial data, such as payment status, invoices, credits, usage, spend caps, and transaction records. Payment-card data is processed by our payment processor and is not stored by us in full.
• Support and communications data, such as contact forms, support tickets, survey responses, security-review requests, correspondence, and communications preferences.

3. Purposes of Processing Personal Data

We may process personal data for the following purposes:

• To provide, operate, maintain, secure, support, and improve the Service.
• To authenticate users, provision accounts, administer API keys, process billing, enforce spend controls, and provide customer support.
• To analyze usage, measure reliability and performance, debug issues, investigate incidents, perform quality assurance, and maintain service integrity.
• To prevent fraud, abuse, security incidents, and unauthorized access; to enforce our terms, policies, and agreements; to resolve disputes; and to comply with legal obligations.
• To communicate with you about the Service, account administration, security updates, billing, product changes, and requests or inquiries you send us.
• To develop and improve our systems using operational, aggregated, de-identified, or otherwise privacy-protective data.

4. Disclosure of Personal Data

We may disclose personal data to the following recipients for the purposes described above and as otherwise permitted or required by applicable law:

• Authorized vendors, service providers, and contractors, including providers of AI model inference, cloud infrastructure, hosting, authentication, security, analytics, payment processing, customer support, email delivery, and business operations.
• Professional advisers, auditors, insurers, and consultants.
• A buyer, successor, or other participant in connection with a merger, acquisition, financing, reorganization, bankruptcy, sale of assets, or similar corporate transaction.
• Government authorities, courts, regulators, law-enforcement bodies, or other third parties where we believe disclosure is required or appropriate for legal, compliance, security, or safety reasons.
• Other third parties when you direct us to disclose the information, consent to the disclosure, or the disclosure is otherwise described at the time of collection.

5. International Transfers of Personal Data

We are based in the United States, and personal data may be processed in the United States and in other countries where we, our vendors, or our service providers operate. These countries may have data-protection laws that differ from the laws of your country or region.

Where required, we use appropriate safeguards for international transfers, such as transferring data to jurisdictions recognized as providing adequate protection, entering into data-transfer agreements or standard contractual clauses, relying on other lawful transfer mechanisms, or obtaining consent where applicable.

You may request more information about transfer safeguards by contacting us at security@directinference.com.

6. Retention of Personal Data

We retain personal data only for as long as reasonably necessary for the purposes described in this Privacy Policy, unless a longer retention period is required or permitted by law, regulation, contract, security need, or legitimate business purpose.

Retention periods may vary based on the type of data, account status, billing and tax obligations, audit requirements, security needs, backup practices, dispute resolution, and operational requirements. We may retain aggregated or de-identified data indefinitely where permitted by law.

7. Your Rights and Choices

Depending on where you are located, you may have rights regarding your personal data, including the right to access, correct, delete, or receive a copy of your personal data; to object to or restrict certain processing; to withdraw consent where processing is based on consent; and to appeal or lodge a complaint with a regulator.

You may exercise available rights through account tools we make available or by contacting us at security@directinference.com. We may take steps to verify your identity and authority before responding to a request.

Because we do not use customer prompts, uploaded content, or outputs to train or fine-tune models, there is no separate training opt-out required for that use.

8. Security

We use technical, administrative, and organizational safeguards designed to protect personal data against unauthorized access, disclosure, alteration, loss, misuse, and destruction. These safeguards may include encryption, access controls, logging, monitoring, employee training, least-privilege practices, vendor diligence, and security-review processes.

No system is perfectly secure. You are responsible for safeguarding your credentials and API keys, using appropriate access controls, and notifying us promptly if you believe your account or credentials have been compromised.

9. Children

The Service is intended for users who are at least eighteen (18) years old. We do not knowingly collect or process personal data from children under eighteen (18). If we learn that we have collected personal data from a child, we will delete it as soon as reasonably practicable.

10. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we make changes, we will update the last-updated date above and may provide additional notice through the Service or other reasonable means. We encourage you to review this Privacy Policy periodically.

11. Contact

If you have questions, requests, concerns, or complaints about this Privacy Policy or our processing of personal data, please contact Synthetic Brain Labs, Inc. at security@directinference.com.