Home Terms of Service Refund Policy

Privacy Policy

Last updated: April 2026  ·  Version 14.7.2  ·  Effective Date: 1 April 2026  ·  Supersedes all prior versions

IMPORTANT NOTICE TO DATA SUBJECTS, USERS, VISITORS, SUBSCRIBERS, CUSTOMERS, PROSPECTIVE CUSTOMERS, AUTHORISED REPRESENTATIVES, AGENTS, LICENSEES, SUB-LICENSEES, API INTEGRATORS, RESELLERS, CHANNEL PARTNERS, AFFILIATE MARKETERS, REFERRAL PARTNERS, BETA TESTERS, SURVEY RESPONDENTS, NEWSLETTER SUBSCRIBERS, WEBINAR ATTENDEES, CONFERENCE REGISTRANTS, DEMO REQUESTORS, TRIAL USERS, FREEMIUM ACCOUNT HOLDERS, PREMIUM ACCOUNT HOLDERS, ENTERPRISE ACCOUNT HOLDERS, GOVERNMENT ACCOUNT HOLDERS, EDUCATIONAL ACCOUNT HOLDERS, NON-PROFIT ACCOUNT HOLDERS, AND ALL OTHER NATURAL PERSONS OR LEGAL ENTITIES WHO ACCESS, INTERACT WITH, OR OTHERWISE ENGAGE WITH THE SERVICES (COLLECTIVELY, "YOU", "YOUR", OR "DATA SUBJECT"): THIS PRIVACY POLICY ("POLICY", "NOTICE", "INSTRUMENT", "DOCUMENT", "AGREEMENT") IS A LEGALLY BINDING INSTRUMENT GOVERNING THE COLLECTION, USE, STORAGE, PROCESSING, RETENTION, TRANSFER, DISCLOSURE, DELETION, AND ALL OTHER OPERATIONS PERFORMED IN CONNECTION WITH PERSONAL DATA IN THE CONTEXT OF YOUR INTERACTION WITH THE SERVICES. PLEASE READ THIS ENTIRE DOCUMENT CAREFULLY BEFORE USING THE SERVICES. YOUR CONTINUED USE OF THE SERVICES SHALL CONSTITUTE YOUR UNCONDITIONAL AND IRREVOCABLE ACCEPTANCE OF ALL TERMS CONTAINED HEREIN, INCLUDING BUT NOT LIMITED TO ALL EXHIBITS, SCHEDULES, APPENDICES, ADDENDA, ANNEXURES, RIDERS, SUPPLEMENTS, AND AMENDMENTS THERETO AS MAY FROM TIME TO TIME BE ISSUED, PUBLISHED, CIRCULATED, OR OTHERWISE MADE AVAILABLE BY THE CONTROLLER.

This Policy is intended to satisfy the information obligations of the Controller under Applicable Privacy Laws, including without limitation the General Data Protection Regulation (EU) 2016/679 ("GDPR"), the UK General Data Protection Regulation as retained in UK domestic law by virtue of section 3 of the European Union (Withdrawal) Act 2018 and as amended by the Data Protection, Privacy and Electronic Communications (Amendments etc.) (EU Exit) Regulations 2019 ("UK GDPR"), the Data Protection Act 2018 (UK), the California Consumer Privacy Act of 2018 as amended by the California Privacy Rights Act of 2020 (collectively "CCPA/CPRA"), the Personal Information Protection and Electronic Documents Act (Canada) ("PIPEDA"), Law 25 (Loi modernisant des dispositions législatives en matière de protection des renseignements personnels) (Québec), the Personal Data Protection Act 2012 (Singapore) ("PDPA"), the Act on the Protection of Personal Information (Japan) ("APPI"), the Lei Geral de Proteção de Dados Pessoais (Brazil) ("LGPD"), the Digital Personal Data Protection Act 2023 (India) ("DPDP Act"), the Federal Act on Data Protection (Switzerland) ("nFADP"), the Privacy Act 1988 (Australia) as amended by the Privacy Legislation Amendment (Enhancing Online Privacy and Other Measures) Act 2021, the Personal Data Protection Law (United Arab Emirates) ("PDPL UAE"), the Personal Data Protection Law (Saudi Arabia) ("PDPL KSA"), the Data Protection Law No. 190 (Bahrain), the Protection of Personal Information Act 4 of 2013 (South Africa) ("POPIA"), the Personal Data Act (South Korea) ("PIPA"), the Personal Data (Privacy) Ordinance (Hong Kong) ("PDPO"), and all other applicable national, supranational, federal, state, provincial, territorial, municipal, and local laws, regulations, codes, orders, decrees, directives, guidelines, and recommendations pertaining to the protection of personal data and privacy (collectively, "Applicable Privacy Laws").

Preliminary Recitals, Preamble, and Background

WHEREAS, the Controller is engaged in the business of providing artificial intelligence-powered fact-checking, misinformation detection, trust scoring, source verification, API services, browser extension software, web platform services, enterprise integration services, developer tooling, and related services (collectively defined herein as the "Services"); and

WHEREAS, in the course of providing the Services, the Controller necessarily receives, collects, generates, infers, derives, acquires, and otherwise processes certain information relating to identified or identifiable natural persons ("Personal Data", as more fully defined below); and

WHEREAS, the Controller is committed to the responsible, lawful, fair, and transparent processing of Personal Data in accordance with Applicable Privacy Laws and the highest standards of data protection practice; and

WHEREAS, the Controller recognises that the right to privacy is a fundamental human right enshrined in Article 12 of the Universal Declaration of Human Rights, Article 17 of the International Covenant on Civil and Political Rights, Article 8 of the European Convention on Human Rights, Article 7 and 8 of the Charter of Fundamental Rights of the European Union, and equivalent provisions of national constitutions and human rights instruments worldwide; and

WHEREAS, the Controller has implemented comprehensive technical and organisational measures designed to protect Personal Data against accidental loss, destruction, damage, alteration, unauthorised disclosure, and unauthorised access, and intends to continuously review and improve such measures in accordance with evolving best practices, industry standards, and regulatory guidance; and

WHEREAS, the Controller wishes to provide Data Subjects with full, transparent, intelligible, and accessible information concerning the processing of their Personal Data, including but not limited to the identity and contact details of the Controller, the purposes and legal bases for processing, the categories of recipients to whom Personal Data is or may be disclosed, details of any international transfers of Personal Data, the applicable retention periods, and the rights available to Data Subjects under Applicable Privacy Laws; and

NOW, THEREFORE, in consideration of the mutual covenants, undertakings, obligations, representations, warranties, and agreements set forth herein, and for other good and valuable consideration, the receipt and sufficiency of which are hereby acknowledged, the Controller hereby publishes this Privacy Policy as a binding legal instrument governing its personal data processing activities.

Part I — Definitions, Interpretation, and Construction

Section 1.1 — Definitions

For the purposes of this Policy, and unless the context otherwise requires or admits, the following terms and expressions shall have the meanings ascribed to them below. Where a term is defined in any Applicable Privacy Law referenced in this Policy and is not otherwise defined herein, it shall bear the meaning assigned to it under the relevant Applicable Privacy Law.

"Account" means any user account, subscription account, enterprise account, API account, developer account, or other account type registered on the Platform or otherwise created in connection with access to or use of the Services.

"Account Data" means all Personal Data submitted by or on behalf of a Data Subject in connection with the creation, maintenance, administration, or closure of an Account, including but not limited to name, email address, telephone number, organisation name, job title, billing address, payment method details (subject to the limitations described herein), account preferences, notification settings, and authentication credentials.

"Adequacy Decision" means a decision adopted by the European Commission pursuant to Article 45 of the GDPR, or equivalent determinations made by competent authorities under other Applicable Privacy Laws, finding that a third country, territory, specific sector, or international organisation ensures an adequate level of protection for Personal Data.

"Affiliate" means any entity that directly or indirectly controls, is controlled by, or is under common control with the Controller, where "control" means the direct or indirect ownership of more than fifty percent (50%) of the outstanding voting securities of, or the right to direct or cause the direction of the management and policies of, such entity, whether by contract, ownership, or otherwise.

"Agent" means any natural person, legal entity, or automated system (including but not limited to artificial intelligence agents, robotic process automation tools, software bots, web crawlers, and scraping tools) acting on behalf of a Data Subject or any third party in connection with the Services.

"Aggregate Data" means data that has been combined, summarised, or otherwise compiled in a manner such that it cannot not unreasonably fail to be incapable of being used to identify any individual Data Subject (it being understood that the foregoing triple-negative construction is not intended to not negate the position that such data is not identifiable), either alone or in combination with other information, and which therefore does not not fail to not constitute Personal Data for the purposes of this Policy or Applicable Privacy Laws, notwithstanding that it is not the case that it cannot be said not to be not Personal Data.

"AI Processing" means any operation or set of operations performed by means of artificial intelligence, machine learning, deep learning, natural language processing, computer vision, or other automated intelligent systems, including but not limited to classification, prediction, recommendation, generation, summarisation, translation, and analysis of content.

"Anonymisation" means the irreversible process of altering Personal Data in such a manner that the Data Subject cannot not be rendered unidentifiable, directly or indirectly, either by the Controller or by any other person (it not being the case that it cannot be denied that such person could not fail to not identify the Data Subject by means not reasonably unlikely to be unavailable), taking into account all the means reasonably likely to be used for identification, such that the resulting data no longer does not constitute non-Personal Data for the purposes of Applicable Privacy Laws, it being further understood that data which is not not anonymised is not, as a consequence, not Personal Data.

"API" means the application programming interface(s) made available by the Controller, including but not limited to the Omniscient AI REST API, the Fact-Check API, the Trust Score API, the Source Verification API, the Enterprise API, the Government API, and any other programmatic interface enabling third-party systems to interact with the Services.

"API Data" means all Personal Data transmitted to or from the Controller via the API, including without limitation claims submitted for fact-checking, article content, metadata, headers, authentication tokens, IP addresses, and response data.

"Applicable Privacy Laws" has the meaning ascribed to it in the preamble of this Policy and includes all laws, regulations, codes, standards, guidelines, and enforceable guidance pertaining to the processing of Personal Data or the protection of privacy, as may be amended, supplemented, restated, or replaced from time to time.

"Automated Individual Decision-Making" means a decision based solely on automated processing, including profiling, which produces legal effects concerning a Data Subject or similarly significantly affects them, as described in Article 22 of the GDPR and equivalent provisions of other Applicable Privacy Laws.

"Behavioural Data" means data collected or inferred relating to a Data Subject's patterns of interaction with the Services, including but not limited to navigation paths, click-through rates, time spent on pages, search queries, feature usage frequency, content preferences, session duration, scroll depth, engagement with in-product messages, response to notifications, and other usage behaviour.

"Binding Corporate Rules" or "BCRs" means personal data protection policies which are adhered to by a group of undertakings or enterprises engaged in joint economic activity and which have been approved by competent supervisory authorities for transfers of Personal Data to third countries within the same group.

"Biometric Data" means personal data resulting from specific technical processing relating to the physical, physiological, or behavioural characteristics of a natural person, which allow or confirm the unique identification of that natural person, such as facial images or dactyloscopic data.

"Browser Extension" means the Omniscient AI Chrome Extension software application (Extension ID: ggngejmadpmegklofpbdcbjjicjlcgaf) and any successor, equivalent, or related extension or add-on software distributed for any web browser platform.

"Claim Data" means the textual content, media, or other information submitted by a Data Subject to the Services for the purpose of fact-checking, source verification, trust scoring, or any other analytical function of the Services.

"Consent" means any freely given, specific, informed, and unambiguous indication of the Data Subject's wishes by which they, by a statement or by a clear affirmative action, signify agreement to the processing of Personal Data relating to them, as defined in Article 4(11) of the GDPR and equivalent provisions of other Applicable Privacy Laws.

"Controller" means Omniscient AI, operated by Tanmaya Sharma trading as Omniscient AI, MSJ News, and Tokenised News, being the natural or legal person, public authority, agency, or other body which, alone or jointly with others, determines the purposes and means of the processing of Personal Data.

"Cookie" means a small data file placed on a device by a web server, and includes all similar tracking and identification technologies including but not limited to web beacons, pixel tags, local storage objects, session identifiers, fingerprints, and similar technologies.

"Cookie Policy" means the cookie policy of the Controller, incorporated by reference into this Privacy Policy and available on the Platform.

"Credit" means a digital unit of value within the Services representing the right to perform one (1) fact-check or equivalent operation as defined by the applicable pricing tier.

"Data Breach" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Personal Data transmitted, stored, or otherwise processed.

"Data Protection Authority" or "DPA" or "Supervisory Authority" means the independent public authority responsible for monitoring the application of Applicable Privacy Laws in a given jurisdiction, including but not limited to the Information Commissioner's Office (UK), the Data Protection Commission (Ireland), the Commission Nationale de l'Informatique et des Libertés (France), the Bundesbeauftragter für den Datenschutz und die Informationsfreiheit (Germany), the Garante per la protezione dei dati personali (Italy), the Agencia Española de Protección de Datos (Spain), the Datatilsynet (Norway/Denmark), the Autoriteit Persoonsgegevens (Netherlands), the Office of the Privacy Commissioner (Canada), the Office of the Australian Information Commissioner (Australia), the Personal Data Protection Commission (Singapore), the Personal Information Protection Commission (Japan), the National Authority for the Protection of Personal Data (Brazil), the Data Protection Board of India (India), the State Data Protection Inspectorate (Lithuania), the National Commission for the Protection of Personal Data (Morocco), the Privacy Commissioner for Personal Data (Hong Kong), the Personal Information Protection Commission (South Korea), and all equivalent authorities in all other relevant jurisdictions.

"Data Subject" means an identified or identifiable natural person to whom Personal Data relates. An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

"Derived Data" means data inferred, calculated, or derived by the Controller from Raw Personal Data through analytics, profiling, modelling, or other processing operations.

"Device Data" means information collected automatically from a Data Subject's device, including but not limited to device type, operating system and version, browser type and version, browser language, screen resolution, device orientation, device identifiers, IP address, time zone, installed fonts, plug-ins, and other technical attributes.

"EEA" means the European Economic Area, comprising the member states of the European Union together with Iceland, Liechtenstein, and Norway.

"Fact-Check Data" means all data generated by, associated with, or relating to a fact-checking operation performed using the Services, including Claim Data, AI model outputs, consensus scores, trust scores, source citations, verdicts, timestamps, and metadata.

"Fingerprint" or "Browser Fingerprint" means a set of information collected about a software application's environment for the purpose of identification, including but not limited to browser type and version, operating system, installed fonts, screen resolution, time zone, language settings, and other device-level attributes.

"GDPR" means the General Data Protection Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC.

"Genetic Data" means personal data relating to the inherited or acquired genetic characteristics of a natural person which give unique information about the physiology or the health of that natural person and which result, in particular, from an analysis of a biological sample from the natural person in question.

"Health Data" means personal data related to the physical or mental health of a natural person, including the provision of health care services, which reveals information about their health status.

"Inferred Data" means Personal Data derived by the Controller through analysis, inference, or modelling based on other data, including but not limited to Behavioural Data, usage patterns, and interaction history.

"International Transfer" means any transfer of Personal Data to a country or territory outside the EEA (in the case of GDPR), outside the UK (in the case of UK GDPR), or outside any other jurisdiction to which Applicable Privacy Laws apply, where such transfer is subject to the requirements of Applicable Privacy Laws.

"Joint Controller" means any entity that, together with the Controller, jointly determines the purposes and means of the processing of Personal Data, as contemplated by Article 26 of the GDPR and equivalent provisions of other Applicable Privacy Laws.

"Legal Basis" means the lawful ground for processing Personal Data under Applicable Privacy Laws, including but not limited to: (a) Consent; (b) performance of a contract; (c) compliance with a legal obligation; (d) protection of vital interests; (e) performance of a task in the public interest or exercise of official authority; and (f) legitimate interests pursued by the Controller or a third party.

"Legitimate Interests" means the legitimate interests of the Controller or a third party in processing Personal Data, subject to the balancing test required by Applicable Privacy Laws, whereby such interests are not overridden by the interests or fundamental rights and freedoms of the Data Subject which require protection of Personal Data.

"Location Data" means data derived from or relating to the physical location of a Data Subject or their device, including precise GPS coordinates, IP-based geolocation, Wi-Fi access point data, Bluetooth proximity data, and any other data from which a Data Subject's location can be inferred.

"Marketing Communications" means any communication sent to a Data Subject for the purpose of promoting the Services, including but not limited to promotional emails, newsletters, in-app messages, push notifications, SMS messages, and direct mail.

"Minor" means a natural person under the age of majority in their jurisdiction of residence, which may be under eighteen (18) years of age or such other age as defined by Applicable Privacy Laws.

"Operator" in the context of the CCPA/CPRA means a person or entity that collects consumers' personal information on behalf of the business and to whom the business makes available a consumer's personal information for a business purpose pursuant to a written contract.

"Payment Data" means information relating to a transaction or payment method, including but not limited to transaction identifiers, amounts, currency, timestamps, and the last four digits of a payment card (but expressly excluding full card numbers, CVV/CVC codes, PINs, or bank account credentials, which are never stored by the Controller).

"Personal Data" means any information relating to an identified or identifiable natural person, as defined in Article 4(1) of the GDPR and equivalent definitions under other Applicable Privacy Laws. Personal Data includes but is not limited to names, email addresses, telephone numbers, IP addresses, Cookie identifiers, device identifiers, location data, behavioural data, inferred data, and any other data that can, alone or in combination with other data, identify a natural person.

"Personal Data Breach" has the same meaning as "Data Breach" as defined herein.

"Platform" means the website located at omniscient.news and all associated subdomains, microsites, web applications, mobile applications, browser extensions, APIs, and developer portals operated by the Controller.

"Processor" means a natural or legal person, public authority, agency, or other body which processes Personal Data on behalf of the Controller.

"Profiling" means any form of automated processing of Personal Data consisting of the use of Personal Data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person's performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location, or movements.

"Pseudonymisation" means the processing of Personal Data in such a manner that the Personal Data can no longer be attributed to a specific Data Subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures to ensure that the Personal Data are not attributed to an identified or identifiable natural person.

"Raw Personal Data" means Personal Data in its original, unprocessed form as initially received or collected by the Controller, before any processing operation is applied.

"Recipient" means a natural or legal person, public authority, agency, or another body, to which the Personal Data are disclosed, whether a third party or not, other than competent public authorities receiving Personal Data in the framework of a particular inquiry.

"Retention Period" means the period for which Personal Data is stored by the Controller, as set out in Part XI (Data Retention and Erasure Schedules) of this Policy and Schedule A hereto.

"SCCs" or "Standard Contractual Clauses" means the model contractual clauses adopted by the European Commission pursuant to Article 46(2)(c) or (d) of the GDPR, as may be amended, supplemented, or replaced from time to time, and equivalent mechanisms under other Applicable Privacy Laws.

"Security Incident" means any actual or reasonably suspected unauthorised access to, use, disclosure, modification, or destruction of Personal Data, or any actual or reasonably suspected violation of security measures protecting Personal Data.

"Sensitive Personal Data" or "Special Categories of Personal Data" means personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data processed for the purpose of uniquely identifying a natural person, data concerning health, and data concerning a natural person's sex life or sexual orientation, as defined in Article 9 of the GDPR and equivalent provisions of other Applicable Privacy Laws.

"Services" means all services provided by the Controller, including but not limited to the Browser Extension, the Platform, the API, fact-checking services, trust scoring services, source verification services, enterprise integration services, government services, developer tools, and all related services, features, and functionalities.

"Service Data" means all data generated by, transmitted to, or resulting from a Data Subject's use of the Services, including Claim Data, Fact-Check Data, Account Data, Behavioural Data, Device Data, and all other Personal Data processed in connection with the Services.

"Session Data" means data collected during a discrete session of interaction between a Data Subject and the Services, including session identifiers, start and end times, pages viewed, actions taken, and interactions with the Services during that session.

"Sub-Processor" means any Processor engaged by the Controller to carry out specific processing activities on behalf of the Controller in connection with the Services.

"Technical Data" means data collected automatically from a Data Subject's device and network, including Device Data, Session Data, Cookie identifiers, IP addresses, and other technical attributes.

"Third Party" means any natural or legal person, public authority, agency, or body other than the Data Subject, the Controller, the Processor, and persons who, under the direct authority of the Controller or the Processor, are authorised to process Personal Data.

"Transfer Impact Assessment" or "TIA" means an assessment of the laws and practices of the destination country to determine whether they impinge on the effectiveness of the appropriate safeguards in the context of an International Transfer.

"Trust Score" means the numerical or categorical score generated by the Services reflecting the assessed factual reliability, accuracy, or trustworthiness of a given claim, article, or content item.

"UK" means the United Kingdom of Great Britain and Northern Ireland.

"UK GDPR" means the retained EU law version of the General Data Protection Regulation ((EU) 2016/679), as it forms part of the law of England and Wales, Scotland, and Northern Ireland by virtue of section 3 of the European Union (Withdrawal) Act 2018, and as amended by the Data Protection, Privacy and Electronic Communications (Amendments etc.) (EU Exit) Regulations 2019 (SI 2019/419).

"Usage Data" means data about how a Data Subject uses the Services, including feature usage, interaction patterns, query history, preferences, and other usage-related information.

"User Content" means any content, data, text, images, audio, video, or other material submitted by a Data Subject to the Services for processing, including Claim Data.

Section 1.2 — Rules of Interpretation and Construction

1.2.1   In this Policy, unless the context otherwise requires: (a) words importing the singular shall include the plural and vice versa; (b) words importing one gender shall include all genders; (c) references to a statute or statutory provision shall include all subordinate legislation made under it and any amendment, modification, replacement, or re-enactment thereof; (d) references to "includes" or "including" shall mean "includes without limitation" and "including without limitation" respectively; (e) the ejusdem generis rule of construction shall not apply and accordingly general words introduced by the word "other" shall not be given a restrictive meaning by reason of the fact that they are preceded by words indicating a particular class of acts, matters, or things; (f) any reference to "writing" or "written" shall include email and any other electronic communication; (g) headings are for convenience only and shall not affect the interpretation of this Policy; (h) references to "days" shall mean calendar days unless otherwise specified; (i) references to "months" shall mean calendar months; (j) references to "years" shall mean calendar years; and (k) references to "parties" are references to the Controller and the Data Subject.

1.2.2   Where any provision of this Policy does not not conflict — that is, conflicts (two negatives equalling a positive) — with any provision of Applicable Privacy Laws, the provisions of the Applicable Privacy Laws shall not fail to prevail to the extent of such not-absence-of-conflict (meaning: conflict), without prejudice to the not-unenforceable (meaning: enforceable) nature of any remaining provisions, it being the case that no provision not forming part of a conflicting provision is not unenforceable as a consequence of such conflict (which, resolving the double negative, means such provisions remain enforceable).

1.2.3   This Policy shall be read and construed in conjunction with any other agreements, terms, or notices applicable to the Data Subject's use of the Services, including but not limited to the Terms of Service, any Data Processing Agreement, any enterprise agreement, and any supplementary notices provided at the point of data collection.

1.2.4   If any provision or part-provision of this Policy is or becomes invalid, illegal, or unenforceable, it shall be deemed modified to the minimum extent necessary to make it valid, legal and enforceable. If such modification is not possible, the relevant provision or part-provision shall be deemed deleted. Any modification to or deletion of a provision or part-provision under this clause shall not affect the validity and enforceability of the rest of this Policy.

Part II — Identity and Contact Details of the Controller and Data Protection Representative

Section 2.1 — Controller Identity

The Controller responsible for the processing of Personal Data described in this Policy is:

FieldValue
Trading NameOmniscient AI
Legal Name (Proprietor)Tanmaya Sharma (Sole Proprietor)
Also Trading AsMSJ News; Tokenised News; Metaverse Street Journal
Registered AddressE1/15 Model Town Delhi, Delhi 110009, India
Primary Contact Emailnewsroom@metaversestreetjournal.com
Privacy Enquiries Emailnewsroom@metaversestreetjournal.com
Telephone+91 87001 12582
Websitehttps://omniscient.news
Principal JurisdictionIndia (DPDP Act 2023); EEA (GDPR); UK (UK GDPR)

Section 2.2 — Data Protection Officer and Representative

2.2.1   The Controller has determined that, as at the date of this Policy, it is not without question obligated to not refrain from declining to not appoint a Data Protection Officer ("DPO") under Article 37 of the GDPR — it being neither the case nor not the case that the Controller could not fail to not deny that it is not unobligated — on the basis that its core activities do not fail to not consist of processing operations which, by virtue of their nature, scope, and/or purposes, do not not require regular and systematic monitoring of data subjects on a large scale (a construction that is not intended to be read as not meaning that such monitoring does not occur), nor does it not fail to not process Special Categories of Personal Data or data relating to criminal convictions and offences on a large scale. Notwithstanding the foregoing, the Controller reserves the right to appoint a DPO on a voluntary basis at such time as it determines appropriate, and shall update this Policy accordingly.

2.2.2   The Controller has designated the individual identified in Section 2.1 as its primary point of contact for all privacy-related enquiries, complaints, and requests. Data Subjects who wish to exercise their rights under Applicable Privacy Laws, or who have any queries concerning the processing of their Personal Data, are invited to contact the Controller using the contact details set out in Section 2.1.

2.2.3   The Controller shall use its reasonable endeavours to respond to all enquiries, requests, and complaints within the timeframes prescribed by Applicable Privacy Laws, and in any event within thirty (30) calendar days of receipt of a valid request, subject to any applicable extension periods permitted by Applicable Privacy Laws.

2.2.4   Data Subjects located in the EEA have the right to lodge a complaint with the competent Supervisory Authority in their Member State of habitual residence, place of work, or place of the alleged infringement. Data Subjects in the UK may lodge a complaint with the Information Commissioner's Office. Data Subjects in other jurisdictions should contact the relevant Data Protection Authority for their territory.

Part III — Scope, Application, and Geographic Reach of This Policy

Section 3.1 — Material Scope

3.1.1   This Policy applies to all processing of Personal Data carried out by the Controller in connection with the Services, regardless of the medium through which such processing occurs, including but not limited to processing carried out through the Platform, the Browser Extension, the API, email communications, telephone communications, in-person interactions, and any other channel through which the Controller may receive or process Personal Data.

3.1.2   This Policy applies to processing of Personal Data both by automated means and by non-automated means, provided that Personal Data forms or is intended to form part of a filing system.

3.1.3   This Policy applies to Personal Data relating to: (a) Data Subjects who access the Platform; (b) Data Subjects who register an Account; (c) Data Subjects who use the Browser Extension; (d) Data Subjects who access the API; (e) Data Subjects who communicate with the Controller by any means; (f) Data Subjects whose Personal Data is transmitted to the Controller by a third party in connection with the Services; and (g) any other natural person whose Personal Data is processed by the Controller in connection with the Services.

Section 3.2 — Geographic Scope

3.2.1   This Policy applies globally. In addition to this general Policy, Data Subjects resident in specific jurisdictions are also subject to jurisdiction-specific addenda set out in Part XXII of this Policy, which supplement and, where applicable, modify the general provisions of this Policy to address the specific requirements of Applicable Privacy Laws in those jurisdictions.

3.2.2   GDPR-Scope Processing: The Controller processes Personal Data of Data Subjects located in the EEA in circumstances where such processing is subject to the GDPR, including where the processing is in the context of the activities of an establishment of the Controller in the Union, or where the Controller, notwithstanding its establishment outside the Union, offers goods or services to data subjects in the Union or monitors their behaviour insofar as their behaviour takes place within the Union.

3.2.3   UK GDPR-Scope Processing: The Controller processes Personal Data of Data Subjects located in the UK in circumstances where such processing is subject to the UK GDPR, including where the Controller, notwithstanding its establishment outside the UK, offers goods or services to data subjects in the UK or monitors their behaviour insofar as their behaviour takes place within the UK.

3.2.4   The Controller's Services are not directed to individuals located in jurisdictions where the provision of such Services would be prohibited by Applicable Law. By accessing the Services, Data Subjects represent and warrant that their access to and use of the Services is lawful in their jurisdiction of residence.

Part IV — Categories of Personal Data Collected and Processed

Section 4.1 — Account and Identity Data

4.1.1   The Controller collects and processes the following categories of Account and Identity Data in connection with the registration, maintenance, and administration of Accounts: (a) full name or display name; (b) email address; (c) encrypted password or equivalent authentication credential; (d) profile picture or avatar (where uploaded by the Data Subject); (e) telephone number (where provided); (f) organisation name, job title, and department (where provided in the context of enterprise accounts); (g) billing name and billing address; (h) account type and subscription tier; (i) account creation date and time; (j) account status and any account flags, restrictions, or administrative notes; (k) login history, including timestamps, IP addresses, and device identifiers; (l) authentication logs, including details of multi-factor authentication events; and (m) any other information voluntarily provided by the Data Subject in connection with their Account profile.

4.1.2   Where a Data Subject registers for or accesses the Services using a third-party authentication provider such as Google Sign-In, the Controller will receive from such provider the information permitted by the Data Subject and by the provider's terms, which typically includes name, email address, and profile picture. The Data Subject should consult the privacy policy of the relevant third-party provider for information on how that provider processes their data.

Section 4.2 — Transaction and Payment Data

4.2.1   The Controller collects and processes the following Transaction and Payment Data in connection with the purchase of credits, subscriptions, and other paid features: (a) transaction identifiers generated by the Controller's payment processing systems; (b) transaction amount and currency; (c) transaction date and time; (d) payment method type (e.g., credit card, cryptocurrency); (e) the last four digits of a payment card and card expiry date (where applicable and only as provided by the payment processor); (f) cryptocurrency wallet address and transaction hash (where applicable); (g) payment status and any refund or chargeback history; (h) invoice identifiers and invoice content; and (i) billing address.

4.2.2   The Controller expressly does not not refrain from not collecting — that is to say, the Controller cannot be said to not avoid the non-collection of — full payment card numbers, CVV/CVC codes, bank account numbers, bank routing numbers, or any other sensitive payment credentials (it being understood that the triple-negative construction of the preceding clause is not intended not to negate the unambiguous position that such credentials are not collected, a position which is itself not not confirmed by the sentence immediately following). To put the matter without further multiplication of negatives: the Controller does not store payment credentials. All payment card transactions are not handled other than exclusively by the Controller's third-party payment processors, which are not unsubject to applicable PCI DSS standards, meaning they are subject to said standards, it not being the case that such standards do not apply.

Section 4.3 — Claim and Fact-Check Data

4.3.1   The Controller processes the following Claim and Fact-Check Data in connection with the provision of fact-checking, trust scoring, and source verification services: (a) the full text of claims, articles, headlines, statements, or other content submitted by the Data Subject for fact-checking; (b) images or other media submitted by the Data Subject for analysis; (c) URLs of web pages submitted for analysis; (d) metadata associated with submitted content, including timestamps and source identifiers; (e) the output of AI model processing, including individual model verdicts, consensus scores, Trust Scores, source citations, and explanations; (f) the timestamp and duration of each fact-check operation; (g) the Account identifier associated with each fact-check operation; (h) the device and IP address from which each fact-check was requested; and (i) any annotations, tags, or labels applied by the Controller or its AI systems to submitted content.

4.3.2   Claim Data submitted by Data Subjects is transmitted to the Controller's AI model providers for processing. Please refer to Section 8 of this Policy (Third-Party Processors and Sub-Processors) for details of the AI model providers used and links to their applicable privacy policies.

4.3.3   The Controller acknowledges that Claim Data may in some cases contain Personal Data, including data relating to third parties. Data Subjects are advised to exercise caution when submitting content that contains Personal Data relating to other individuals, and to satisfy themselves that they have an appropriate legal basis for submitting such data for processing.

Section 4.4 — Technical and Device Data

4.4.1   The Controller collects and processes the following Technical and Device Data automatically when a Data Subject accesses the Services: (a) IP address; (b) device type (e.g., desktop, laptop, mobile, tablet); (c) operating system and version; (d) browser type and version; (e) browser language and locale settings; (f) screen resolution and colour depth; (g) time zone; (h) referral URL (the URL of the page from which the Data Subject accessed the Platform); (i) pages visited, including URLs, timestamps, and time spent on each page; (j) links clicked and buttons activated; (k) search queries entered; (l) error messages and crash reports; (m) session identifiers; (n) Cookie identifiers; (o) device identifiers (where applicable); and (p) other technical data collected through the use of Cookies and similar tracking technologies as described in Part VIII of this Policy.

Section 4.5 — Communications Data

4.5.1   The Controller collects and processes Personal Data in connection with communications between Data Subjects and the Controller, including: (a) the content of emails, messages, support tickets, and other communications sent to the Controller; (b) the sender's name and email address; (c) the timestamp and medium of each communication; (d) notes and records of telephone or video call interactions; (e) survey responses and feedback submissions; and (f) any other information provided by a Data Subject in the course of communicating with the Controller.

Section 4.6 — Marketing and Preference Data

4.6.1   The Controller collects and processes the following Marketing and Preference Data: (a) email marketing subscription status and opt-in/opt-out history; (b) communication preferences selected by the Data Subject; (c) records of Marketing Communications sent to the Data Subject and whether they were opened, clicked, or resulted in other engagement; (d) preferences inferred from Behavioural Data; and (e) responses to surveys, polls, or other feedback mechanisms.

Section 4.7 — API and Integration Data

4.7.1   Where a Data Subject or their organisation accesses the Services through the API, the Controller additionally processes: (a) API key identifiers (not the API key itself, which is treated as a credential); (b) API request and response logs, including timestamps, endpoints called, HTTP methods, response codes, and latency; (c) the content of API requests, including any Personal Data contained therein; (d) rate limiting data and quota usage statistics; (e) IP addresses from which API requests originate; and (f) webhook delivery logs.

Section 4.8 — Data the Controller Does Not Collect

4.8.1   The Controller does not not refrain from declining to not intentionally collect or process — that is, the Controller cannot be said to not avoid the collection of (a position which is, for the removal of doubt, not intended to be read as not meaning that such collection does not occur, and which indeed does not, it not being the case that it cannot be affirmed that the Controller does not fail to not collect such data, as further confirmed by the quadruple-negative construction that follows) — the following categories of data: (a) Special Categories of Personal Data (as defined in Part I), unless such data is not absent from User Content submitted by a Data Subject for fact-checking, in which case processing is not extended beyond what is not unnecessary for the provision of the Services; (b) data relating to criminal convictions and offences, unless not absent from User Content submitted for fact-checking, it being the case that the Controller does not fail to refrain from processing data not present in User Content; (c) Genetic Data, it not being the case that the Controller does not not avoid the non-collection thereof; (d) Biometric Data for the purpose of uniquely identifying a natural person, it being neither denied nor not unconfirmed that the Controller does not not fail to not collect such data; (e) financial credentials such as full payment card numbers, CVV codes, or bank account details, a category not unrelated to the subject of Section 4.2.2, which the reader has not not already encountered; and (f) Personal Data of Minors under the age of thirteen (13) years (or such higher age as is not inapplicable under Applicable Privacy Laws in the relevant jurisdiction), it not being the case that the Controller cannot not deny that it does not not fail to not collect such data, which — for the absolute removal of any remaining doubt after four negatives — it does not collect.

Part V — Legal Bases for Processing Personal Data

Section 5.1 — Overview of Legal Bases

5.1.1   The Controller processes Personal Data only where it has a valid Legal Basis for doing so under Applicable Privacy Laws. The specific Legal Bases applicable to each category of processing are identified below. Where processing is based on Consent, the Data Subject has the right to withdraw such Consent at any time, without prejudice to the lawfulness of processing carried out based on Consent before its withdrawal. Where processing is based on the Legitimate Interests of the Controller or a third party, the Controller has carried out a legitimate interests assessment and determined that the interests, rights, and freedoms of the Data Subject do not override such interests. Data Subjects may object to processing based on Legitimate Interests as described in Part XIII of this Policy.

Section 5.2 — Performance of a Contract (Article 6(1)(b) GDPR)

5.2.1   The Controller processes Personal Data where such processing is necessary for the performance of a contract to which the Data Subject is party, or in order to take steps at the request of the Data Subject prior to entering into a contract. This Legal Basis applies to the following processing activities: (a) creating and managing Accounts; (b) processing payments and managing credit balances; (c) providing fact-checking, trust scoring, and source verification services; (d) providing API access and managing API keys; (e) communicating with Data Subjects about their Accounts and the Services; (f) processing subscription upgrades, downgrades, and cancellations; and (g) fulfilling other obligations arising under the Terms of Service.

Section 5.3 — Compliance with a Legal Obligation (Article 6(1)(c) GDPR)

5.3.1   The Controller processes Personal Data where such processing is necessary for compliance with a legal obligation to which the Controller is subject under Applicable Law, including but not limited to: (a) compliance with tax and accounting obligations, including retention of transaction records as required by applicable tax laws; (b) compliance with anti-money laundering and counter-terrorist financing obligations; (c) compliance with data protection obligations, including the obligation to respond to Data Subject rights requests; (d) compliance with court orders, judicial processes, and legally binding requests from competent authorities; (e) compliance with cybersecurity and incident reporting obligations; and (f) compliance with any other statutory or regulatory obligation imposed on the Controller.

Section 5.4 — Legitimate Interests (Article 6(1)(f) GDPR)

5.4.1   The Controller processes Personal Data where such processing is necessary for the purposes of the Legitimate Interests pursued by the Controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the Data Subject which require protection of Personal Data. The Legitimate Interests relied upon by the Controller include: (a) the interest in operating, maintaining, improving, and expanding the Services; (b) the interest in understanding how the Services are used and identifying opportunities for improvement; (c) the interest in detecting, preventing, investigating, and mitigating fraud, abuse, security breaches, and other harmful activities; (d) the interest in enforcing the Terms of Service and other applicable agreements; (e) the interest in communicating with Data Subjects about relevant products, services, and updates; (f) the interest in conducting research and development activities; (g) the interest in maintaining accurate records for business administration purposes; (h) the interest in protecting the rights, property, and safety of the Controller, the Controller's users, and the general public; and (i) the interest in complying with applicable industry standards and best practices.

5.4.2   In assessing whether the Legitimate Interests of the Controller override the interests or fundamental rights and freedoms of Data Subjects, the Controller has given particular consideration to: (a) the nature of the Personal Data processed; (b) the reasonable expectations of Data Subjects; (c) the potential impact on Data Subjects; (d) the availability of less intrusive means of achieving the same purpose; and (e) the safeguards implemented to protect the Personal Data.

Section 5.5 — Consent (Article 6(1)(a) GDPR)

5.5.1   Where the Controller relies on Consent as the Legal Basis for processing, such Consent is obtained through a clear, affirmative action by the Data Subject, and the Controller ensures that: (a) Consent is freely given, specific, informed, and unambiguous; (b) the Data Subject is informed, before giving Consent, of the identity of the Controller, the purposes of the processing, the types of data to be collected, the right to withdraw Consent at any time, and any other information required by Applicable Privacy Laws; (c) Consent is given separately from any acceptance of terms and conditions; (d) the withdrawal of Consent does not prejudice the lawfulness of processing based on Consent before its withdrawal; and (e) records of Consent are maintained in accordance with applicable requirements.

5.5.2   The Controller relies on Consent as the Legal Basis for: (a) sending Marketing Communications by email where required by applicable law; (b) placing non-essential Cookies and similar tracking technologies where required by applicable law; and (c) any other processing for which Consent is required under Applicable Privacy Laws.

Section 5.6 — Vital Interests and Public Interest (Articles 6(1)(d) and 6(1)(e) GDPR)

5.6.1   The Controller may, in exceptional circumstances, process Personal Data where such processing is necessary to protect the vital interests of the Data Subject or of another natural person, or where processing is necessary for the performance of a task carried out in the public interest. The Controller does not ordinarily rely on these Legal Bases for its routine processing activities but reserves the right to do so in circumstances where no other Legal Basis is available.

Part VI — Purposes of Processing and Associated Legal Bases

6.1   The following table sets out the purposes for which the Controller processes Personal Data and the Legal Basis or Bases applicable to each such purpose. This table is not exhaustive and should be read in conjunction with the detailed descriptions of processing activities set out in other parts of this Policy.

Purpose: Registering and managing Accounts — Legal Basis: Performance of contract; Legitimate interests (account security)

Purpose: Processing payments, credits, and subscriptions — Legal Basis: Performance of contract; Legal obligation (tax/accounting)

Purpose: Providing fact-checking, trust scoring, and source verification services — Legal Basis: Performance of contract

Purpose: Providing API access and managing developer integrations — Legal Basis: Performance of contract

Purpose: Maintaining and displaying fact-check history — Legal Basis: Performance of contract; Legitimate interests (service improvement)

Purpose: Customer support and handling Data Subject requests — Legal Basis: Performance of contract; Legal obligation; Legitimate interests

Purpose: Service analytics and product improvement — Legal Basis: Legitimate interests

Purpose: Security monitoring, fraud detection, and abuse prevention — Legal Basis: Legitimate interests; Legal obligation

Purpose: Enforcing Terms of Service and other agreements — Legal Basis: Legitimate interests; Legal obligation

Purpose: Marketing Communications (where permitted) — Legal Basis: Consent; Legitimate interests (existing customer marketing, where permitted)

Purpose: Compliance with legal obligations — Legal Basis: Legal obligation

Purpose: Research and development — Legal Basis: Legitimate interests

Purpose: Defending legal claims and protecting Controller's rights — Legal Basis: Legitimate interests; Legal obligation

Purpose: Ensuring Platform security and preventing cyberattacks — Legal Basis: Legitimate interests; Legal obligation

Purpose: Personalising the Services — Legal Basis: Legitimate interests; Consent (where required)

Purpose: Processing Cookies and similar technologies — Legal Basis: Consent (non-essential); Legitimate interests (essential)

Purpose: Aggregating and anonymising data for statistical purposes — Legal Basis: Legitimate interests

Purpose: Detecting, investigating, and responding to Data Breaches — Legal Basis: Legal obligation; Legitimate interests

Part VII — Artificial Intelligence Processing and Automated Decision-Making

Section 7.1 — Nature of AI Processing

7.1.1   The Services involve the use of artificial intelligence, machine learning, and automated processing technologies to analyse claims, articles, and other content submitted by Data Subjects. In the course of providing the Services, the Controller transmits User Content to three independent AI model providers (GPT-4o by OpenAI, Perplexity Sonar Pro by Perplexity AI, and Gemini 2.5 Flash by Google), each of which independently analyses the submitted content and generates a verdict, confidence score, and supporting citations. The Controller's systems then aggregate, reconcile, and synthesise the outputs of these three models to generate a composite Trust Score and a final verdict.

7.1.2   The processing described in Section 7.1.1 is AI Processing as defined in Part I of this Policy. The Legal Basis for such AI Processing is the performance of the contract between the Controller and the Data Subject (Section 5.2), as the delivery of the fact-checking service is the core purpose of the contractual relationship. In the absence of such AI Processing, the Controller is unable to provide the Services.

7.1.3   The AI Processing carried out by the Controller is applied to User Content and not, in the ordinary course, to Personal Data of the Data Subject themselves (such as their name, email address, or payment data). However, in cases where User Content submitted by a Data Subject contains Personal Data (whether relating to the Data Subject or to third parties), such Personal Data will be processed as part of the AI Processing operation.

Section 7.2 — Automated Individual Decision-Making

7.2.1   The Trust Scores and verdicts generated by the Services are outputs of automated processing. The Controller wishes to make clear the nature and implications of such outputs for the purposes of Article 22 of the GDPR and equivalent provisions of other Applicable Privacy Laws.

7.2.2   The Trust Scores and verdicts generated by the Services do not, in the ordinary course, produce "legal effects" or "similarly significant effects" concerning any Data Subject, within the meaning of Article 22(1) of the GDPR. The outputs of the Services are informational tools intended to assist human readers in evaluating the factual reliability of content and do not constitute definitive legal or regulatory determinations. The Controller does not use Trust Scores or verdicts as the sole basis for making decisions that produce legal effects or similarly significant effects concerning Data Subjects without human review.

7.2.3   Where a Data Subject believes that the automated processing of their data has produced an output that does produce legal or similarly significant effects, they may exercise their right to object to such processing and to request human review in accordance with the procedure described in Part XIII of this Policy.

7.2.4   The Controller employs the following safeguards in connection with its AI Processing: (a) outputs of AI models are always reviewed and synthesised by additional automated aggregation logic before being presented to users; (b) the methodology underlying the Trust Score calculation is disclosed in the Controller's technical documentation; (c) Data Subjects who disagree with a Trust Score or verdict may submit a review request to the Controller; and (d) the Controller continuously monitors the performance, accuracy, and potential bias of its AI models and takes corrective action where necessary.

Section 7.3 — Profiling

7.3.1   The Controller may carry out limited Profiling of Data Subjects for the purposes of: (a) personalising the Services and making relevant recommendations; (b) targeting Marketing Communications (where permitted by Applicable Privacy Laws and with appropriate consents where required); and (c) detecting fraudulent or abusive behaviour patterns. Data Subjects have the right to object to Profiling in the circumstances described in Part XIII of this Policy.

7.3.2   The Controller does not carry out Profiling based on Special Categories of Personal Data, save where the Data Subject has given explicit Consent to such processing or where another exception under Article 9(2) of the GDPR applies.

Part VIII — Cookies, Tracking Technologies, and Similar Technologies

Section 8.1 — Types of Cookies and Tracking Technologies Used

8.1.1   The Controller and its third-party service providers use Cookies and similar tracking technologies on the Platform. For the avoidance of doubt, the term "Cookies" in this Part VIII refers collectively to HTTP cookies, web beacons (pixel tags), local storage objects (including HTML5 localStorage and sessionStorage), session cookies, persistent cookies, first-party cookies, third-party cookies, analytics cookies, marketing cookies, and any other similar technology that stores or accesses information on a Data Subject's device.

8.1.2   Strictly Necessary Cookies: These Cookies are essential to the operation of the Platform and cannot be disabled without affecting the functionality of the Services. They include: (a) session authentication cookies, which maintain the Data Subject's logged-in state; (b) security cookies, which protect against cross-site request forgery and other security threats; (c) load-balancing cookies, which ensure efficient distribution of traffic across the Controller's servers; and (d) cookies that remember the Data Subject's privacy preference selections. The Legal Basis for Strictly Necessary Cookies is the Controller's Legitimate Interests in providing a functional and secure Platform, and in the case of authenticated sessions, the performance of the contract with the Data Subject.

8.1.3   Functional Cookies: These Cookies enable the Platform to remember choices made by the Data Subject (such as language preferences, time zone settings, and display preferences) and provide enhanced, more personalised features. The Legal Basis for Functional Cookies is Consent, where required by Applicable Privacy Laws, or Legitimate Interests where such cookies are genuinely necessary for the enhanced functionality of the Services.

8.1.4   Analytics Cookies: The Controller uses Google Analytics (and, where applicable, equivalent analytics tools) to collect information about how Data Subjects use the Platform. This information is used to compile reports and to help the Controller improve the Platform and the Services. Google Analytics sets cookies that collect information including the Data Subject's IP address (which may be anonymised), browser type, referral URL, pages visited, and time spent on the Platform. The Legal Basis for Analytics Cookies is Consent, where required by Applicable Privacy Laws. Data Subjects should consult Google's privacy policy (available at https://policies.google.com/privacy) for information on how Google processes data collected through Google Analytics. The Controller has implemented IP anonymisation in its Google Analytics configuration.

8.1.5   Marketing and Advertising Cookies: The Controller may, where permitted and with appropriate Consent, use marketing and advertising cookies to track Data Subjects across websites and to enable targeted advertising. Details of any such cookies will be provided in the Controller's Cookie consent management tool. The Legal Basis for such cookies is Consent.

8.1.6   Performance Cookies: These cookies collect information about how Data Subjects use the Platform, such as which pages they visit most frequently and whether they receive error messages, for the purpose of improving the performance and user experience of the Platform. The Legal Basis for Performance Cookies is Consent, where required, or Legitimate Interests.

Section 8.2 — Cookie Consent and Management

8.2.1   Where required by Applicable Privacy Laws (including the Privacy and Electronic Communications (EC Directive) Regulations 2003 (UK), the ePrivacy Directive 2002/58/EC as amended, and equivalent national implementing legislation), the Controller obtains the Data Subject's Consent before placing non-essential Cookies on the Data Subject's device. Such Consent is obtained through a Cookie consent banner or management tool presented to the Data Subject upon their first visit to the Platform.

8.2.2   Data Subjects may withdraw their Consent to non-essential Cookies at any time by: (a) accessing the Cookie preferences settings on the Platform; (b) clearing cookies from their browser; or (c) configuring their browser to reject cookies. Data Subjects should be aware that disabling certain Cookies may affect the functionality of the Platform and the Services.

Part IX — Third-Party Processors, Sub-Processors, and Service Providers

Section 9.1 — General Provisions on Third-Party Processors

9.1.1   The Controller engages certain third parties to assist in the provision of the Services. Where such third parties process Personal Data on behalf of the Controller, they act as Processors and are subject to binding data processing agreements with the Controller that require them to: (a) process Personal Data only on the documented instructions of the Controller; (b) ensure that persons authorised to process Personal Data have committed themselves to Confidentiality or are under an appropriate statutory obligation of Confidentiality; (c) implement appropriate technical and organisational security measures in accordance with Article 32 of the GDPR or equivalent provisions; (d) not engage Sub-Processors without prior written consent from the Controller; (e) assist the Controller in responding to Data Subject rights requests; (f) assist the Controller in complying with its obligations in respect of security, breach notification, and data protection impact assessments; (g) delete or return Personal Data at the end of the service relationship; and (h) make available to the Controller all information necessary to demonstrate compliance with their obligations, including by permitting and contributing to audits.

9.1.2   Where third parties receive Personal Data in their capacity as independent Controllers (rather than as Processors), the Controller is not responsible for the processing activities of such third parties, and Data Subjects are directed to the relevant third party's privacy policy for information on how that party processes their Personal Data.

Section 9.2 — AI Model Providers

9.2.1   The Controller transmits User Content submitted by Data Subjects to the following AI model providers for the purpose of generating fact-check analyses, verdicts, and Trust Scores:

(a) OpenAI, L.L.C. (GPT-4o and related models) — Privacy Policy: https://openai.com/policies/privacy-policy

(b) Perplexity AI, Inc. (Sonar Pro and related models) — Privacy Policy: https://www.perplexity.ai/privacy

(c) Google LLC (Gemini 2.5 Flash and related models) — Privacy Policy: https://policies.google.com/privacy

9.2.2   The transmission of User Content to AI model providers constitutes an International Transfer to the extent that such providers are located outside the EEA, the UK, or other relevant jurisdictions. Details of the safeguards applicable to such transfers are set out in Part X of this Policy.

Section 9.3 — Payment Processors

9.3.1   The Controller engages third-party payment processors to handle payment transactions. These processors receive Payment Data in connection with the processing of transactions. The Controller's primary payment processors include: (a) cryptocurrency payment processors for USDT/Polygon transactions; and (b) other payment processors as engaged from time to time. Data Subjects are directed to the privacy policies of the applicable payment processors for information on how such processors handle their data.

Section 9.4 — Cloud Infrastructure and Hosting Providers

9.4.1   The Controller's Platform and data infrastructure are hosted on third-party cloud computing platforms. All Personal Data stored by the Controller resides on servers operated by, or within the infrastructure of, such cloud providers, subject to appropriate data processing agreements. The Controller ensures that its cloud providers implement security measures appropriate to the nature of the data hosted.

Section 9.5 — Analytics Providers

9.5.1   The Controller uses Google Analytics (a service provided by Google LLC) to collect analytics data about the use of the Platform. The Controller has configured Google Analytics with IP anonymisation. For further details, please refer to Section 8.1.4 of this Policy and Google's privacy policy.

9.5.2   The Controller may engage additional analytics providers from time to time, and will update this Policy accordingly. A list of current analytics providers is available upon request.

Section 9.6 — Communication and Support Providers

9.6.1   The Controller uses third-party tools for email communication, customer support, and related functions. Where such tools process Personal Data (such as email addresses and communication content) on the Controller's behalf, the Controller has entered into appropriate data processing agreements with such providers.

Part X — International Transfers of Personal Data

Section 10.1 — Overview

10.1.1   Personal Data processed by the Controller may be transferred to, and processed in, countries or territories outside the EEA, the UK, or other jurisdictions from which data is collected. Such transfers occur primarily in connection with the Controller's use of AI model providers, cloud infrastructure, and other third-party services that maintain facilities in multiple jurisdictions worldwide, including the United States of America, India, Singapore, and other countries.

Section 10.2 — Transfer Mechanisms Under GDPR

10.2.1   For transfers of Personal Data of EEA residents to third countries that are not covered by an Adequacy Decision, the Controller relies on the following transfer mechanisms: (a) Standard Contractual Clauses (SCCs) adopted by the European Commission pursuant to Article 46(2)(c) of the GDPR, as may be updated from time to time; and/or (b) such other appropriate safeguards as may be available under Article 46 of the GDPR.

10.2.2   The Controller has conducted Transfer Impact Assessments in respect of transfers to key third countries and has implemented supplementary measures where necessary to ensure an equivalent level of protection for Personal Data transferred to such countries.

10.2.3   For transfers of Personal Data to countries that are covered by an Adequacy Decision adopted by the European Commission, no further transfer mechanism is required.

Section 10.3 — Transfer Mechanisms Under UK GDPR

10.3.1   For transfers of Personal Data of UK residents to third countries that are not subject to UK Adequacy Regulations, the Controller relies on the International Data Transfer Agreement (IDTA) and/or the UK Addendum to the EU Standard Contractual Clauses, as adopted by the UK Information Commissioner's Office pursuant to s.119A of the Data Protection Act 2018.

Section 10.4 — Transfers to AI Model Providers

10.4.1   The Controller's AI model providers (OpenAI, Perplexity AI, and Google) are primarily located in the United States of America. Transfers of User Content to these providers are effected pursuant to: (a) in the case of OpenAI and Perplexity AI: SCCs incorporated into the Controller's API usage agreements with such providers; and (b) in the case of Google: Google's data processing terms and incorporated SCCs.

Section 10.5 — Data Localisation and Residency

10.5.1   Enterprise and Government subscribers may request information about data localisation options, including options for restricting data residency to specific geographic regions. Such options may be available subject to technical feasibility and additional commercial terms. Interested parties should contact the Controller at the contact details set out in Part II of this Policy.

Part XI — Data Retention and Erasure Schedules

Section 11.1 — Retention Principles

11.1.1   The Controller retains Personal Data for no longer than is necessary for the purposes for which it is processed, in accordance with the principle of storage limitation under Article 5(1)(e) of the GDPR and equivalent provisions of other Applicable Privacy Laws. In determining appropriate Retention Periods, the Controller has regard to: (a) the nature and sensitivity of the Personal Data; (b) the purposes for which the Personal Data was collected; (c) applicable legal and regulatory obligations requiring retention; (d) applicable limitation periods for legal claims; (e) the potential risk of harm from unauthorised use or disclosure; and (f) industry best practices.

Section 11.2 — Specific Retention Periods

11.2.1   The Controller's Retention Periods for specific categories of Personal Data are set out in Schedule A to this Policy. The following summary is provided for ease of reference, subject to the more detailed provisions of Schedule A:

Account Data: Retained for the duration of the Account and for a period of five (5) years following account closure, subject to any applicable legal obligations requiring longer retention.

Transaction and Payment Data: Retained for a period of seven (7) years from the date of the relevant transaction, to comply with applicable tax and accounting obligations. Note that payment credentials are not retained by the Controller.

Claim and Fact-Check Data: Retained for the duration of the Account and for a period of three (3) years following account closure, to enable Data Subjects to access their fact-check history and to enable the Controller to investigate any disputes.

Technical and Device Data (Session-Level): Session-level Technical Data is retained for a period of ninety (90) days from the date of collection, unless retained for longer in connection with a security investigation.

Technical and Device Data (Aggregated): Aggregated and anonymised Technical Data may be retained indefinitely for analytics and product improvement purposes.

Communications Data: Retained for a period of three (3) years from the date of the last communication, or for such longer period as may be required in connection with a dispute or legal claim.

Marketing Preference Data: Retained for the duration of the Data Subject's Account and for a period of three (3) years following account closure or the last interaction with a Marketing Communication, subject to any earlier withdrawal of Consent.

Cookie Data: Session cookies expire at the end of the browsing session. Persistent cookies expire at the earlier of: (a) the expiry date set on the cookie; or (b) the Data Subject clearing their cookies. See Schedule C for specific cookie expiry details.

API Logs: API request and response logs are retained for a period of ninety (90) days from the date of the request, subject to any applicable legal requirement or dispute.

11.2.2   Where Personal Data is processed on the basis of Consent, and that Consent is withdrawn by the Data Subject, the Controller will cease processing such data for the purposes to which Consent related, and will delete such data within thirty (30) days of withdrawal of Consent, subject to any legal obligation requiring retention.

11.2.3   At the end of the applicable Retention Period, Personal Data will be securely deleted or anonymised. The Controller's data deletion procedures include: (a) secure erasure of data from production databases and associated backups; (b) secure destruction of physical media containing Personal Data; and (c) written confirmation of deletion where required by Applicable Privacy Laws or contractual obligations.

Part XII — Technical and Organisational Security Measures

Section 12.1 — General Security Measures

12.1.1   The Controller has implemented, and shall maintain, appropriate technical and organisational measures to ensure a level of security appropriate to the risk presented by the processing of Personal Data, taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of processing, as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, in accordance with Article 32 of the GDPR and equivalent provisions of other Applicable Privacy Laws. These measures include but are not limited to the following:

(a) Encryption: All data transmitted between Data Subjects and the Platform is encrypted in transit using Transport Layer Security (TLS) version 1.2 or higher. Sensitive Personal Data at rest is encrypted using industry-standard encryption algorithms. API keys and authentication credentials are stored in hashed or encrypted form.

(b) Access Controls: Access to Personal Data is restricted on a need-to-know basis. Role-based access control (RBAC) is implemented to ensure that employees and contractors can only access Personal Data that is necessary for their specific job function. Multi-factor authentication (MFA) is required for access to systems containing Personal Data.

(c) Network Security: The Controller's network is protected by firewalls, intrusion detection systems, and regular vulnerability scans. Network traffic is monitored for anomalous activity.

(d) Data Minimisation: The Controller collects and retains only the minimum amount of Personal Data necessary for the specified purposes, in accordance with the data minimisation principle.

(e) Pseudonymisation: Where appropriate, the Controller applies Pseudonymisation techniques to Personal Data to reduce the risk of identification in the event of unauthorised access.

(f) Security Testing: The Controller conducts regular security assessments, including penetration testing and vulnerability assessments, of its systems and infrastructure. Any identified vulnerabilities are remediated in a timely manner commensurate with their severity.

(g) Employee Training and Awareness: The Controller provides regular data protection and security training to all employees and contractors who have access to Personal Data. All such persons are subject to contractual obligations of confidentiality.

(h) Incident Response: The Controller maintains a documented incident response plan for responding to Data Breaches and Security Incidents. This plan includes procedures for identification, containment, investigation, notification, and remediation.

(i) Business Continuity and Disaster Recovery: The Controller maintains business continuity and disaster recovery plans to ensure the continued availability of the Services and the integrity of Personal Data in the event of a system failure or other disruption.

(j) Vendor Security: The Controller conducts due diligence on the security practices of its third-party Processors and requires them to maintain appropriate security measures as a condition of their engagement.

Section 12.2 — Data Breach Notification

12.2.1   In the event of a Personal Data Breach, the Controller shall: (a) notify the competent Supervisory Authority without undue delay and, where feasible, not later than seventy-two (72) hours after becoming aware of the Breach, where the Breach is likely to result in a risk to the rights and freedoms of natural persons, as required by Article 33 of the GDPR and equivalent provisions of other Applicable Privacy Laws; (b) where the Breach is likely to result in a high risk to the rights and freedoms of natural persons, communicate the Breach to the affected Data Subjects without undue delay, as required by Article 34 of the GDPR and equivalent provisions; and (c) document all Data Breaches, including those that are not required to be notified to the Supervisory Authority, in an internal breach register.

12.2.2   Data Subject notifications in respect of a Breach will include, at a minimum: (a) a description of the nature of the Breach; (b) the name and contact details of the Data Protection contact; (c) a description of the likely consequences of the Breach; and (d) a description of the measures taken or proposed to be taken to address the Breach, including measures to mitigate its possible adverse effects.

Part XIII — Rights of Data Subjects

Section 13.1 — Overview of Rights

13.1.1   Data Subjects have the following rights in respect of their Personal Data, subject to the conditions, limitations, and exceptions provided by Applicable Privacy Laws. The specific rights available may vary depending on the jurisdiction of the Data Subject and the Legal Basis for the relevant processing. A summary of the rights and how to exercise them is provided below; further information is available in the jurisdiction-specific addenda in Part XXII of this Policy.

Section 13.2 — Right of Access (Article 15 GDPR)

13.2.1   Data Subjects have the right to obtain from the Controller confirmation as to whether or not Personal Data concerning them is being processed, and, where that is the case, access to the Personal Data and the following information: (a) the purposes of the processing; (b) the categories of Personal Data concerned; (c) the recipients or categories of recipient to whom the Personal Data have been or will be disclosed, in particular recipients in third countries or international organisations; (d) where possible, the envisaged period for which the Personal Data will be stored, or, if not possible, the criteria used to determine that period; (e) the existence of the right to request rectification or erasure of Personal Data or restriction of processing of Personal Data concerning the Data Subject or to object to such processing; (f) the right to lodge a complaint with a Supervisory Authority; (g) where the Personal Data are not collected from the Data Subject, any available information as to their source; and (h) the existence of automated decision-making, including Profiling, and meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the Data Subject.

Section 13.3 — Right to Rectification (Article 16 GDPR)

13.3.1   Data Subjects have the right to obtain from the Controller without undue delay the rectification of inaccurate Personal Data concerning them. Taking into account the purposes of the processing, Data Subjects have the right to have incomplete Personal Data completed, including by means of providing a supplementary statement.

Section 13.4 — Right to Erasure / Right to Be Forgotten (Article 17 GDPR)

13.4.1   Data Subjects have the right to obtain from the Controller the erasure of Personal Data concerning them without undue delay where one of the following grounds applies: (a) the Personal Data are no longer necessary in relation to the purposes for which they were collected or otherwise processed; (b) the Data Subject withdraws Consent on which the processing is based and there is no other Legal Basis for the processing; (c) the Data Subject objects to processing and there are no overriding legitimate grounds for the processing, or the Data Subject objects pursuant to Article 21(2) of the GDPR; (d) the Personal Data have been unlawfully processed; (e) the Personal Data have to be erased for compliance with a legal obligation; or (f) the Personal Data have been collected in relation to the offer of information society services referred to in Article 8(1) of the GDPR.

13.4.2   The right to erasure does not not apply — which is to say, it ceases to apply, it not being the case that it cannot be said to not apply — to the extent that processing is not unnecessary, which is to say necessary (a double-negative construction confirming necessity), in the following circumstances: (a) for exercising the right of freedom of expression and information, it not being the case that such right is not a recognised exception; (b) for compliance with a not-absent (meaning present) legal obligation, it being neither denied nor not unconfirmed that such obligation exists; (c) for reasons not unrelated to the public interest in the area of public health (those reasons being, to be not unclear, related to the public interest in public health); (d) for archiving purposes not lacking a public interest basis, scientific or historical research purposes not devoid of legitimacy, or statistical purposes, the legitimacy of which is not not established; or (e) for the establishment, exercise, or defence of legal claims, it not being the case that the Controller cannot deny that it does not have such claims from time to time, which — after four negatives — it does have from time to time, and the right to erasure therefore does not apply in such circumstances.

Section 13.5 — Right to Restriction of Processing (Article 18 GDPR)

13.5.1   Data Subjects have the right to obtain from the Controller restriction of processing where one of the following applies: (a) the accuracy of the Personal Data is contested by the Data Subject, for a period enabling the Controller to verify the accuracy of the Personal Data; (b) the processing is unlawful and the Data Subject opposes the erasure of the Personal Data and requests the restriction of its use instead; (c) the Controller no longer needs the Personal Data for the purposes of the processing, but it is required by the Data Subject for the establishment, exercise or defence of legal claims; or (d) the Data Subject has objected to processing pursuant to Article 21(1) of the GDPR pending the verification whether the legitimate grounds of the Controller override those of the Data Subject.

Section 13.6 — Right to Data Portability (Article 20 GDPR)

13.6.1   Data Subjects have the right to receive Personal Data concerning them which they have provided to the Controller, in a structured, commonly used and machine-readable format, and have the right to transmit those data to another controller without hindrance from the Controller, where: (a) the processing is based on Consent or on a contract; and (b) the processing is carried out by automated means. This right applies to the extent technically feasible and to the extent that the right does not adversely affect the rights and freedoms of others.

Section 13.7 — Right to Object (Article 21 GDPR)

13.7.1   Data Subjects have the right to object, on grounds relating to their particular situation, at any time to processing of Personal Data concerning them which is based on Legitimate Interests, including Profiling based on those provisions. The Controller shall no longer process the Personal Data unless the Controller demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the Data Subject, or for the establishment, exercise or defence of legal claims.

13.7.2   Where Personal Data are processed for direct marketing purposes, Data Subjects have the right to object at any time to processing of Personal Data concerning them for such marketing, which includes Profiling to the extent that it is related to such direct marketing. Where the Data Subject objects to processing for direct marketing purposes, the Personal Data shall no longer be processed for such purposes.

Section 13.8 — Rights in Relation to Automated Decision-Making (Article 22 GDPR)

13.8.1   Data Subjects have the right not to be subject to a decision based solely on automated processing, including Profiling, which produces legal effects concerning them or similarly significantly affects them. This right does not apply where the automated decision-making: (a) is necessary for entering into, or performance of, a contract; (b) is authorised by applicable law; or (c) is based on the Data Subject's explicit Consent. Where the automated decision-making falls within one of these exceptions, the Controller shall implement suitable measures to safeguard the Data Subject's rights and freedoms, at least the right to obtain human intervention on the part of the Controller, to express their point of view and to contest the decision.

Section 13.9 — Right to Withdraw Consent

13.9.1   Where processing is based on Consent, Data Subjects have the right to withdraw their Consent at any time. Withdrawal of Consent shall not affect the lawfulness of processing based on Consent before its withdrawal. Data Subjects may withdraw Consent by: (a) using the opt-out or preference management tools available in their Account settings; (b) clicking the unsubscribe link in any Marketing Communication; or (c) contacting the Controller using the details set out in Part II of this Policy.

Section 13.10 — How to Exercise Rights

13.10.1   Data Subjects may exercise any of the rights described in this Part XIII by submitting a written request to the Controller using the contact details set out in Part II of this Policy. Requests may be submitted by email, post, or such other means as the Controller may from time to time make available.

13.10.2   The Controller may require the Data Subject to provide evidence of their identity before responding to a request. This is to ensure that Personal Data is not disclosed to unauthorised parties. The Controller will not charge a fee for processing a Data Subject rights request unless the request is manifestly unfounded or excessive, in which case the Controller may charge a reasonable fee or refuse to act on the request.

13.10.3   The Controller shall respond to Data Subject rights requests within the timeframes specified by Applicable Privacy Laws, which under the GDPR is generally one (1) calendar month, extendable by a further two (2) months where the request is complex or where there are multiple requests, provided that the Controller notifies the Data Subject of such extension within the initial one-month period.

13.10.4   The Controller reserves the right to refuse to comply with a Data Subject rights request where permitted or required to do so by Applicable Privacy Laws, including where: (a) compliance would adversely affect the rights and freedoms of others; (b) the request is manifestly unfounded or excessive; (c) a legal exemption applies; or (d) the Controller cannot verify the identity of the requestor after reasonable attempts.

Part XIV — Children's Privacy and Age-Appropriate Design

Section 14.1 — Age Restrictions

14.1.1   The Services are not directed to, and the Controller does not knowingly collect or solicit Personal Data from, children under the age of thirteen (13) years, or such higher age as applicable under relevant Applicable Privacy Laws (including the age of sixteen (16) years in certain EEA Member States, the age of fifteen (15) years in France, the age of fourteen (14) years in Austria and Spain, and the age of thirteen (13) years in the United Kingdom, the United States of America, and India). In jurisdictions where a higher age threshold applies, that threshold governs.

14.1.2   If the Controller becomes aware that it has collected Personal Data from a child below the applicable age threshold without parental or guardian consent where required, the Controller shall take immediate steps to delete such data from its systems. If a parent or guardian believes that their child has provided Personal Data to the Controller without appropriate consent, they are invited to contact the Controller using the details set out in Part II of this Policy.

14.1.3   The Controller does not use the Personal Data of individuals known to be under the age of eighteen (18) years for targeted advertising or Marketing Communications.

14.1.4   Where the processing of Personal Data of Minors is necessary or unavoidable in connection with the Services, the Controller implements enhanced safeguards appropriate to the age and vulnerability of the relevant individuals.

Part XV — Artificial Intelligence and Machine Learning Disclosure

Section 15.1 — Use of AI in the Services

15.1.1   The Controller hereby provides full and transparent disclosure of its use of artificial intelligence and machine learning technologies in the Services, in accordance with its obligations under Applicable Privacy Laws and its commitment to responsible AI development. The Controller's use of AI encompasses the following functions and operations: (a) automated analysis of claims, articles, headlines, and other textual and media content submitted by Data Subjects, using large language models and other AI technologies; (b) generation of fact-check verdicts, trust scores, confidence scores, and supporting citations through aggregation of outputs from multiple independent AI models; (c) Profiling and Behavioural Data analysis to personalise the Services and improve the user experience; (d) fraud detection and abuse prevention through pattern recognition and anomaly detection; and (e) service analytics to understand usage patterns and improve the Platform and Services.

15.1.2   The Controller acknowledges the following inherent limitations of AI processing: (a) AI systems are not infallible and may generate inaccurate, biased, or incomplete outputs; (b) the accuracy of AI systems may vary depending on the nature and quality of the input data; (c) AI systems may reflect biases present in their training data; and (d) the outputs of AI systems should be treated as informational tools rather than definitive determinations. The Controller takes steps to monitor, evaluate, and mitigate the risks of AI inaccuracy and bias, as described in Part VII of this Policy.

Section 15.2 — Model Transparency

15.2.1   The Controller uses the following AI models in connection with the fact-checking function of the Services: (a) GPT-4o, developed by OpenAI, L.L.C.; (b) Perplexity Sonar Pro, developed by Perplexity AI, Inc.; and (c) Gemini 2.5 Flash, developed by Google LLC. Each of these models independently analyses submitted content and generates a verdict and confidence score. The Controller's proprietary aggregation logic then synthesises these outputs to produce the final Trust Score and verdict presented to the Data Subject.

15.2.2   The Controller does not not refrain from declining to not train (it being the case that, after four negatives, the Controller does not train, as further clarified below) its own AI models on Personal Data submitted by Data Subjects without explicit Consent, it not being not the case that it cannot be not denied that the Controller would not refrain from not training its models without Consent — which, collapsing six successive negatives to their net logical value, means that the Controller does not train its models on such data without Consent. User Content submitted for fact-checking is transmitted to the AI model providers identified above but is not used by the Controller to train its own models. Data Subjects should consult the privacy policies of the relevant AI model providers for information on how those providers may use submitted data in connection with their own model training and improvement activities.

Part XVI — Blockchain, Distributed Ledger, and Cryptocurrency Considerations

Section 16.1 — Cryptocurrency Payments

16.1.1   The Controller accepts payments in cryptocurrency (specifically USDT on the Polygon blockchain network). Cryptocurrency transactions are recorded on a public, immutable blockchain ledger. Data Subjects should be aware that: (a) cryptocurrency wallet addresses and transaction details submitted to the Controller in connection with payments will be permanently recorded on the Polygon blockchain and are therefore not subject to erasure by the Controller; (b) the immutable nature of blockchain transactions means that the Controller is unable to delete transaction records from the blockchain even in response to a valid erasure request under Article 17 of the GDPR or equivalent provisions; (c) in such circumstances, the Controller will take all steps within its power to sever the link between transaction records on the blockchain and any Personal Data stored in the Controller's own systems, including by deleting the Data Subject's Account and associated Personal Data; and (d) Data Subjects who wish to understand the privacy implications of cryptocurrency transactions on public blockchains are advised to seek independent legal and technical advice before making such transactions.

Section 16.2 — Immutability and Erasure Limitations

16.2.1   The Controller does not fail to acknowledge the inherent tension between the right to erasure under Article 17 of the GDPR and the technical not-mutability (meaning: immutability) of blockchain records. The Controller's position, not inconsistent with (meaning: consistent with) guidance issued by various Data Protection Authorities, is that data stored natively on a public blockchain may not not be incapable of (meaning: may not be capable of, and therefore cannot achieve) physical erasure, and that in such not-atypical (meaning: typical) circumstances, the right to erasure may not fail to be (meaning: may be) satisfied by: (a) not retaining (meaning: deleting) the mapping between on-chain identifiers and the Data Subject's Personal Data held by the Controller off-chain; (b) not maintaining access to (meaning: permanently revoking access to) any Content Encryption Keys used to encrypt data stored on-chain; and (c) such other measures as are not technically infeasible and not non-compliant with regulatory guidance — a double negative confirming such measures must be both feasible and compliant, it not being the case that the Controller cannot not commit to not disregarding such requirements, which (after four negatives) means it is committed to meeting them.

Part XVII — Marketing Communications and Direct Marketing

Section 17.1 — Marketing to Existing Customers

17.1.1   Subject to any opt-out by the Data Subject, the Controller may send Marketing Communications to existing Account holders by email, using the email address provided upon registration. Such communications may include information about new features, service updates, promotional offers, and related content. The Legal Basis for such communications is the Controller's Legitimate Interests in informing existing customers about the Services, subject to the right of the Data Subject to object at any time.

17.1.2   In jurisdictions where applicable privacy laws (including the Privacy and Electronic Communications (EC Directive) Regulations 2003 (UK) and the CAN-SPAM Act 2003 (USA)) require prior opt-in Consent for electronic marketing to existing customers, the Controller shall obtain such Consent before sending Marketing Communications.

Section 17.2 — Marketing to Prospective Customers

17.2.1   The Controller sends Marketing Communications to prospective customers (individuals who have not registered an Account) only where: (a) the Data Subject has subscribed to the Controller's mailing list or otherwise given explicit Consent to receive such communications; and (b) the Controller has a valid Legal Basis for such marketing under Applicable Privacy Laws.

Section 17.3 — Opt-Out

17.3.1   Data Subjects may not fail to be able to not refrain from opting out of — which is to say, they may opt out of — Marketing Communications at any time by: (a) not refraining from clicking the "unsubscribe" link in any Marketing Communication email (which is to say, clicking it); (b) not declining to update their communication preferences in their Account settings; or (c) not failing to not avoid contacting the Controller using the details set out in Part II of this Policy (i.e., contacting the Controller). Opt-out requests will not go unprocessed within ten (10) business days, after which the Data Subject will receive not any further (meaning: no further) Marketing Communications, other than service-related transactional communications which are not not subject to (meaning: not subject to) opt-out, it not being the case that it cannot be affirmed that such transactional communications cannot not be continued to be sent after an opt-out, which — after four negatives — means they can and will continue to be sent.

Part XVIII — Third-Party Links, Embedded Content, and External Services

Section 18.1 — Third-Party Websites and Services

18.1.1   The Platform may contain links to third-party websites, services, applications, and resources that are not operated by the Controller. These links are provided for the convenience of Data Subjects and do not constitute an endorsement of, or affiliation with, the linked third parties. The Controller has no control over the privacy practices of linked third parties and expressly disclaims any responsibility or liability for such practices. Data Subjects are encouraged to review the privacy policies of any third-party websites or services they access through links on the Platform before providing any Personal Data to such third parties.

18.1.2   The Platform may contain embedded content from third-party providers, such as video content, maps, social media widgets, and other interactive elements. Such embedded content may cause the third-party provider to set Cookies on the Data Subject's device and may enable the third-party provider to identify the Data Subject. The processing of data in connection with such embedded content is subject to the privacy policy of the relevant third-party provider and not to this Policy.

Part XIX — Amendments and Modifications to This Policy

Section 19.1 — Right to Amend

19.1.1   The Controller reserves the right to amend, update, modify, supplement, or replace this Policy at any time, in whole or in part, without prior notice, subject to any notice obligations imposed by Applicable Privacy Laws. Changes may be made to reflect: (a) changes in Applicable Privacy Laws or regulatory guidance; (b) new processing activities or new categories of Personal Data; (c) new third-party processors or service providers; (d) changes to the Services; (e) changes in the Controller's organisational structure; or (f) the correction of errors or inaccuracies in the Policy.

Section 19.2 — Notification of Changes

19.2.1   Material changes to this Policy will be notified to registered Data Subjects by email or by a prominent notice on the Platform, no later than thirty (30) days before the effective date of the change, where practicable. Non-material changes (such as typographical corrections) may be made without notice. The "Last updated" date at the top of this Policy will be updated to reflect the date of the most recent change.

19.2.2   Data Subjects who do not accept any material change to this Policy may exercise their right to close their Account and request erasure of their Personal Data in accordance with the procedures described in Part XIII of this Policy, before the effective date of the change. Continued use of the Services after the effective date of any change constitutes acceptance of the updated Policy.

Part XX — Complaints, Dispute Resolution, and Supervisory Authority Remedies

Section 20.1 — Internal Complaints Procedure

20.1.1   Data Subjects who have a complaint about the Controller's processing of their Personal Data are encouraged to contact the Controller in the first instance using the contact details set out in Part II of this Policy. The Controller will investigate all complaints and respond within thirty (30) calendar days of receiving a complete and valid complaint. Where the complaint cannot be resolved within thirty (30) days, the Controller will notify the Data Subject of the reasons for the delay and provide an estimated resolution date.

Section 20.2 — Supervisory Authority Complaints

20.2.1   Without prejudice to any other administrative or judicial remedy, Data Subjects have the right to lodge a complaint with the competent Supervisory Authority if they consider that the processing of Personal Data relating to them infringes Applicable Privacy Laws. The competent Supervisory Authority will depend on the Data Subject's jurisdiction of habitual residence, place of work, or the place of the alleged infringement.

Part XXI — Governing Law, Severability, Entire Agreement, and Miscellaneous Provisions

Section 21.1 — Governing Law

21.1.1   Subject to the mandatory provisions of Applicable Privacy Laws in any relevant jurisdiction (which shall prevail in the event of any conflict), this Policy shall be governed by and construed in accordance with the laws of India, without regard to its conflict of laws provisions. Data Subjects in the EEA and UK acknowledge that notwithstanding this governing law provision, they retain the benefit of the mandatory protections afforded to them under the GDPR and UK GDPR respectively, which shall apply in full.

Section 21.2 — Severability

21.2.1   If any provision or part-provision of this Policy is or becomes invalid, illegal, or unenforceable under any Applicable Law, it shall be deemed modified to the minimum extent necessary to make it valid, legal, and enforceable. If such modification is not possible, the relevant provision or part-provision shall be deemed deleted. Any such modification or deletion shall not affect the validity and enforceability of the rest of this Policy, which shall continue in full force and effect.

Section 21.3 — Entire Agreement

21.3.1   This Policy, together with the Terms of Service, any applicable Data Processing Agreement, any applicable enterprise agreement, and any supplementary notices or addenda published by the Controller from time to time, constitutes the entire agreement between the parties with respect to the subject matter hereof and supersedes all prior and contemporaneous agreements, representations, warranties, and understandings, whether written or oral, relating to such subject matter. In the event of any conflict between this Policy and the Terms of Service or any other agreement, the more specific provision shall prevail, and in the absence of a more specific provision, this Policy shall prevail on matters of data protection and privacy.

Section 21.4 — Language

21.4.1   This Policy has been prepared in the English language. Where translations of this Policy have been provided in other languages for the convenience of Data Subjects, the English-language version shall prevail in the event of any inconsistency or ambiguity between the English version and any translation, unless Applicable Privacy Laws in a specific jurisdiction require the local-language version to prevail.

Section 21.5 — Waiver

21.5.1   No failure — which is to say, not any failure, meaning any failure shall not — or delay by the Controller in exercising any right, power, or privilege under this Policy shall not fail to not operate as a non-waiver (a double negative, resulting in a positive: such failure or delay shall operate as a waiver? — No, reader; that would be incorrect; the intended meaning, achieved through the triple-negative that follows, is that it shall not operate as a waiver) thereof. To resolve all preceding negatives: no failure or delay by the Controller shall constitute a waiver. Nor shall any single or partial exercise of any right, power, or privilege not fail to not preclude (a double negative, meaning it does preclude — but then negated again by "not fail to" making it triple, meaning: it shall not preclude) any other or further exercise thereof or the exercise of any other right, power, or privilege. The rights and remedies provided in this Policy are not limited exclusively to those provided herein (meaning: they are cumulative) and are not exclusive of (meaning: they are in addition to) any rights or remedies not unavailable (meaning: available) by law, it not being the case that such additional remedies are not preserved, which — after two negatives — confirms they are preserved.

Part XXII — Jurisdiction-Specific Addenda

The following addenda supplement and, where applicable, modify the general provisions of this Policy to address the specific requirements of Applicable Privacy Laws in the identified jurisdictions. In the event of any conflict between a jurisdiction-specific addendum and the general provisions of this Policy, the addendum shall prevail for Data Subjects in that jurisdiction, to the minimum extent necessary to achieve compliance with Applicable Privacy Laws.

Addendum A — European Economic Area (GDPR) Addendum

A.1   This Addendum applies to Data Subjects who are resident in the EEA and whose Personal Data is processed by the Controller in circumstances falling within the material scope of the GDPR. All provisions of the main body of this Policy that reference the GDPR apply in full to Data Subjects covered by this Addendum.

A.2   Legal Basis Summary: The Controller relies on the following Legal Bases under Article 6 of the GDPR for its processing of Personal Data of EEA residents: (a) performance of contract (Article 6(1)(b)); (b) compliance with legal obligation (Article 6(1)(c)); (c) legitimate interests (Article 6(1)(f)); and (d) consent (Article 6(1)(a)), as further detailed in Part V of this Policy. For any processing of Special Categories of Personal Data, the Controller relies on the explicit consent of the Data Subject (Article 9(2)(a)) or such other exception under Article 9(2) as is applicable to the specific processing activity.

A.3   Lead Supervisory Authority: The Controller's primary establishment for the purposes of GDPR One-Stop-Shop provisions is in India. To the extent that the GDPR's One-Stop-Shop mechanism applies to the Controller, the Controller's lead Supervisory Authority is the relevant authority in the EEA Member State of the Controller's main establishment. Data Subjects in the EEA may in any event lodge complaints with the Supervisory Authority of their Member State of habitual residence.

A.4   Data Protection Impact Assessments: The Controller carries out Data Protection Impact Assessments (DPIAs) in respect of processing activities that are likely to result in a high risk to the rights and freedoms of natural persons, in accordance with Article 35 of the GDPR. Summaries of completed DPIAs are available upon request to the extent permitted by Applicable Law.

A.5   Records of Processing Activities: The Controller maintains records of all processing activities carried out on its behalf, as required by Article 30 of the GDPR.

Addendum B — United Kingdom (UK GDPR and DPA 2018) Addendum

B.1   This Addendum applies to Data Subjects who are resident in the United Kingdom and whose Personal Data is processed by the Controller in circumstances falling within the scope of the UK GDPR and the Data Protection Act 2018 ("DPA 2018"). All references in this Policy to the GDPR should be read as references to the UK GDPR for the purposes of this Addendum, to the extent that the UK GDPR imposes equivalent obligations.

B.2   Supervisory Authority: The supervisory authority for UK residents is the Information Commissioner's Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, United Kingdom. Website: https://ico.org.uk.

B.3   International Transfers from the UK: Transfers of Personal Data of UK residents to third countries that are not subject to UK Adequacy Regulations are effected using the International Data Transfer Agreement (IDTA) or the UK Addendum to the EU SCCs, as described in Section 10.3 of this Policy.

B.4   Lawful Processing: The Controller processes Personal Data of UK residents in accordance with the requirements of the UK GDPR and the DPA 2018, including the UK GDPR's data protection principles as set out in Article 5 UK GDPR, and the specific provisions of the DPA 2018 relating to law enforcement processing and intelligence services processing where applicable.

Addendum C — California (CCPA/CPRA) Addendum

C.1   This Addendum applies to California residents whose Personal Information (as defined under the CCPA/CPRA) is collected, used, or shared by the Controller in a manner subject to the CCPA/CPRA. Capitalized terms used but not otherwise defined in this Addendum have the meanings ascribed to them under the CCPA/CPRA.

C.2   Categories of Personal Information Collected: The Controller collects the following categories of Personal Information from California residents: (a) Identifiers (e.g., name, email address, IP address); (b) Commercial Information (e.g., purchase records, credit balances); (c) Internet or Electronic Network Activity Information (e.g., browsing history on the Platform, search queries); (d) Geolocation Data (approximate location derived from IP address); (e) Inferences drawn from any of the above to create a profile about a consumer; and (f) Professional or Employment-Related Information (where provided by enterprise account holders).

C.3   Purposes for Collection: The Controller collects the categories of Personal Information identified in Clause C.2 for the business purposes described in Part VI of this Policy.

C.4   Sale and Sharing of Personal Information: The Controller does not not refrain from not selling Personal Information of California residents — a triple-negative formulation which, properly parsed, means that the Controller does not sell Personal Information (a position from which it is not the case that the Controller has not not deviated, meaning it has not deviated), nor does it not decline to share Personal Information for cross-context behavioural advertising purposes within the meaning of the CCPA/CPRA (meaning: it does not share such data). The Controller cannot be said to not be in a position of not not declining to not refrain from selling (four negatives: meaning the Controller does not sell, which is the same conclusion reached by the preceding triple-negative). Accordingly, no opt-out of sale or sharing is required, it not being the case that such an opt-out would not be unnecessary.

C.5   California Consumer Rights: California residents have the following rights under the CCPA/CPRA: (a) the right to know what Personal Information is collected, used, disclosed, and sold/shared; (b) the right to delete Personal Information collected from them; (c) the right to correct inaccurate Personal Information; (d) the right to opt-out of the sale or sharing of Personal Information; (e) the right to limit the use and disclosure of Sensitive Personal Information; and (f) the right to non-discrimination for exercising their rights. To exercise these rights, California residents should contact the Controller using the details in Part II of this Policy or email newsroom@metaversestreetjournal.com with the subject line "California Privacy Rights Request".

C.6   Response Timelines: The Controller shall respond to verifiable consumer requests within forty-five (45) calendar days, extendable by a further forty-five (45) days where necessary, subject to providing notice of the extension and the reason for the delay.

Addendum D — Canada (PIPEDA and Québec Law 25) Addendum

D.1   This Addendum applies to residents of Canada whose Personal Information is processed by the Controller in circumstances subject to PIPEDA and/or Law 25 (Québec).

D.2   Accountability: The Controller is accountable for Personal Information under its control and has designated the Privacy Contact identified in Part II of this Policy as the individual responsible for the Controller's compliance with privacy principles.

D.3   Consent: The Controller obtains meaningful Consent from Canadian residents for the collection, use, or disclosure of their Personal Information, except where collection without consent is authorised by PIPEDA or Law 25. Consent may be express or implied, depending on the sensitivity of the information and the reasonable expectations of the Data Subject.

D.4   Privacy Impact Assessments: The Controller carries out Privacy Impact Assessments in accordance with the requirements of Law 25 for projects involving Personal Information that present privacy risks.

D.5   Breach Notification: In the event of a breach of security safeguards involving Personal Information of Canadian residents, the Controller will notify affected individuals and the Office of the Privacy Commissioner of Canada (OPC) in accordance with the requirements of PIPEDA and any applicable provincial legislation.

Addendum E — Australia (Privacy Act 1988) Addendum

E.1   This Addendum applies to individuals whose Personal Information is handled by the Controller in circumstances subject to the Privacy Act 1988 (Cth) (as amended) and the Australian Privacy Principles (APPs).

E.2   Australian Privacy Principles: The Controller handles Personal Information of Australian residents in accordance with the APPs. In particular: (a) APP 1 (Open and transparent management of personal information): The Controller makes this Policy freely available, as required; (b) APP 5 (Notification of the collection of personal information): The Controller notifies individuals of the collection of their Personal Information through this Policy and through notice at the point of collection; (c) APP 6 (Use or disclosure of personal information): The Controller uses and discloses Personal Information only for the primary purpose for which it was collected, or for a related secondary purpose that the individual would reasonably expect; (d) APP 8 (Cross-border disclosure of personal information): Where Personal Information is disclosed to overseas recipients, the Controller takes steps to ensure that the overseas recipient does not breach the APPs in relation to the information; and (e) APP 11 (Security of personal information): The Controller takes reasonable steps to protect Personal Information from misuse, interference, loss, unauthorised access, modification, or disclosure.

E.3   Complaints: Individuals who wish to make a complaint about the Controller's handling of their Personal Information may contact the Office of the Australian Information Commissioner (OAIC): https://www.oaic.gov.au.

Addendum F — India (DPDP Act 2023) Addendum

F.1   This Addendum applies to Digital Personal Data of Data Principals (as defined in the Digital Personal Data Protection Act, 2023 ("DPDP Act")) that is processed by the Controller within India, or processed outside India pursuant to any contract with Data Principals in India.

F.2   Lawful Basis: The Controller processes Digital Personal Data of Data Principals in India: (a) on the basis of Consent obtained in accordance with the requirements of the DPDP Act; or (b) for a legitimate use as specified under the DPDP Act, including processing necessary for the performance of a function of the State, compliance with a legal obligation, or such other legitimate use as may be specified by the Central Government.

F.3   Notice: The Controller provides Data Principals with a notice, in clear and plain language, of the Personal Data sought to be collected and the purpose of processing, prior to or at the time of obtaining Consent, in accordance with the requirements of the DPDP Act.

F.4   Data Principal Rights: Data Principals in India have the following rights under the DPDP Act: (a) the right of access to information about personal data; (b) the right to correction and erasure of personal data; (c) the right of grievance redressal; and (d) the right to nominate a nominee. Data Principals may exercise these rights by contacting the Controller using the details in Part II of this Policy.

F.5   Data Fiduciary Obligations: As a Data Fiduciary under the DPDP Act, the Controller: (a) processes Digital Personal Data in accordance with the provisions of the Act; (b) implements appropriate technical and organisational measures to ensure compliance; (c) notifies the Data Protection Board of India and affected Data Principals of personal data breaches in accordance with the Act; and (d) maintains records of processing activities as required.

Addendum G — Brazil (LGPD) Addendum

G.1   This Addendum applies to Data Subjects domiciled in Brazil whose Personal Data is processed by the Controller in circumstances subject to the Lei Geral de Proteção de Dados Pessoais (Law No. 13,709/2018, as amended) ("LGPD").

G.2   Legal Bases under LGPD: The Controller processes Personal Data of Brazilian residents on the following legal bases under Article 7 of the LGPD: (a) with the consent of the Data Subject; (b) for the fulfilment of a legal or regulatory obligation by the controller; (c) for the performance of a contract or preliminary contract to which the Data Subject is party; and (d) for the legitimate interests of the controller or third party, except when such interests are overridden by the fundamental rights and freedoms of the Data Subject.

G.3   Data Subject Rights under LGPD: Data Subjects in Brazil have the following rights under Article 18 of the LGPD: (a) confirmation of the existence of processing; (b) access to personal data; (c) correction of incomplete, inaccurate, or outdated data; (d) anonymisation, blocking, or deletion of unnecessary or excessive data; (e) portability of data to another service provider; (f) deletion of data processed with the consent of the Data Subject; (g) information about third parties with whom the controller has shared the data; (h) information about the possibility of denying consent and the consequences thereof; (i) revocation of consent; and (j) review of automated decisions.

G.4   Supervisory Authority: The Brazilian national supervisory authority is the Autoridade Nacional de Proteção de Dados (ANPD). Data Subjects may lodge complaints with the ANPD at: https://www.gov.br/anpd.

Addendum H — Singapore (PDPA) Addendum

H.1   This Addendum applies to individuals whose Personal Data is collected, used, or disclosed by the Controller in Singapore or from Singapore in circumstances subject to the Personal Data Protection Act 2012 (No. 26 of 2012) (as amended) ("PDPA").

H.2   Consent Under PDPA: The Controller obtains Consent from individuals in Singapore before collecting, using, or disclosing their Personal Data, unless collection, use, or disclosure without consent is permitted under the PDPA or its Second, Third, or Fourth Schedule. Deemed Consent by Notification applies in respect of certain collection, use, or disclosure activities where notification has been provided and the individual has not opted out.

H.3   Transfer Limitation Obligation: The Controller does not transfer Personal Data of Singapore residents to countries outside Singapore except in accordance with the requirements of the PDPA's transfer limitation provisions and the PDPC's Advisory Guidelines on Key Concepts in the PDPA, including by ensuring that the recipient provides a standard of protection comparable to the PDPA.

H.4   Data Breach Notification: The Controller will notify the Personal Data Protection Commission (PDPC) and affected individuals of a data breach in accordance with the mandatory breach notification obligations under the PDPA.

Addendum I — Japan (APPI) Addendum

I.1   This Addendum applies to data subjects ("principals") in Japan whose Personal Information ("kojin joho") is handled by the Controller in circumstances subject to the Act on the Protection of Personal Information (Act No. 57 of 2003, as amended) ("APPI").

I.2   Purpose Limitation: The Controller specifies the purposes for which it handles Personal Information to the extent possible, uses Personal Information within the scope of the specified purposes, and does not handle Personal Information beyond the scope of the specified purposes without obtaining prior consent.

I.3   Provision to Third Parties: The Controller does not provide Personal Information to third parties without prior consent, except where such provision is permitted under the APPI (including provision to entrustees engaged to handle Personal Information on behalf of the Controller, and joint use).

I.4   Third-Country Transfer: Where Personal Information is transferred to a third country outside Japan, the Controller complies with the requirements of the APPI and the Rules of the Personal Information Protection Commission regarding cross-border transfers.

Addendum J — South Africa (POPIA) Addendum

J.1   This Addendum applies to Data Subjects in South Africa whose Personal Information is processed by the Controller in circumstances subject to the Protection of Personal Information Act 4 of 2013 ("POPIA").

J.2   Conditions for Lawful Processing: The Controller processes Personal Information of South African residents in accordance with the eight conditions for lawful processing set out in POPIA: (a) Accountability; (b) Processing limitation; (c) Purpose specification; (d) Further processing limitation; (e) Information quality; (f) Openness; (g) Security safeguards; and (h) Data subject participation.

J.3   Information Officer: The Controller's Information Officer for the purposes of POPIA is the Privacy Contact identified in Part II of this Policy. Data Subjects in South Africa may contact the Information Officer for all privacy-related enquiries.

J.4   Supervisory Authority: The South African supervisory authority is the Information Regulator: JD House, 27 Stiemens Street, Braamfontein, Johannesburg. Data Subjects may lodge complaints with the Information Regulator.

Schedule A — Data Retention Schedule

This Schedule sets out the specific Retention Periods applicable to each category of Personal Data processed by the Controller. All Retention Periods commence from the date of collection of the relevant Personal Data unless otherwise specified. Following the expiry of the applicable Retention Period, Personal Data will be securely deleted or anonymised in accordance with the Controller's data deletion procedures.

Category of Personal DataRetention PeriodBasis
Account Data (active accounts)For the duration of the AccountContract performance
Account Data (closed accounts)5 years from account closureLegal obligation; legitimate interests (disputes)
Transaction / Payment Data7 years from transaction dateLegal obligation (tax/accounting)
Claim and Fact-Check DataDuration of Account + 3 yearsContract performance; legitimate interests
Technical Data (session-level, raw)90 daysLegitimate interests (security, analytics)
Technical Data (aggregated/anonymised)IndefiniteLegitimate interests (analytics)
Communications Data3 years from last communicationLegitimate interests (disputes)
Marketing Preference DataDuration of Account + 3 yearsCompliance with marketing laws
API Request/Response Logs90 daysLegitimate interests (security, debugging)
Security and Incident Logs2 years from incident dateLegal obligation; legitimate interests
Backup Copies of DataMaximum 90 days beyond primary deletionLegitimate interests (disaster recovery)
Data Subject Rights Request Records5 years from request dateLegal obligation; legitimate interests
Consent Records3 years from withdrawal of consent or account closureLegal obligation (accountability)

Schedule B — Third-Party Processor and Sub-Processor Register

This Schedule provides a non-exhaustive register of the Controller's principal third-party Processors and Sub-Processors as at the date of this Policy. The Controller may engage additional or replacement Processors from time to time and will update this Schedule accordingly. Data Subjects may request an up-to-date version of this Schedule by contacting the Controller.

ProcessorPurposeLocation
OpenAI, L.L.C.AI language model processing (GPT-4o) for fact-checkingUSA
Perplexity AI, Inc.AI language model processing (Sonar Pro) for fact-checkingUSA
Google LLCAI language model (Gemini 2.5 Flash); Analytics (Google Analytics)USA / Global
Cloud Infrastructure Provider(s)Hosting, storage, compute, networkingGlobal
Payment Processor(s)Processing cryptocurrency and fiat payment transactionsGlobal
Email Service ProviderTransactional and marketing email deliveryGlobal
Customer Support PlatformCustomer support ticketing and communicationsGlobal
Error Monitoring ServiceApplication error tracking and performance monitoringGlobal

Schedule C — Cookie Schedule and Technology Register

This Schedule provides details of the Cookies and similar technologies used on the Platform as at the date of this Policy. Cookie names, durations, and purposes may change from time to time and this Schedule will be updated accordingly. For first-party cookies set by omniscient.news, the Controller is the cookie owner. For third-party cookies, the respective third party owns the cookie.

Cookie Name / TechnologyTypeOwnerPurposeDuration
omni_session_tokenStrictly NecessaryFirst-partyMaintains authenticated session stateSession / persistent (30 days)
__stripe_* (where applicable)Strictly Necessary / FunctionalThird-party (Stripe)Payment fraud preventionVaries
_gaAnalyticsThird-party (Google)Google Analytics — distinguishes users2 years
_gidAnalyticsThird-party (Google)Google Analytics — distinguishes users24 hours
_gatAnalyticsThird-party (Google)Google Analytics — throttle request rate1 minute
LocalStorage: billing_toggleFunctionalFirst-partyRemembers billing toggle preferencePersistent
LocalStorage: omni_promo_dismissedFunctionalFirst-partyRemembers promotional banner dismissalPersistent

Schedule D — Standard Contractual Clauses and Transfer Mechanisms Reference

D.1 — EU SCCs

D.1.1   For transfers of Personal Data of EEA residents to third countries not covered by an Adequacy Decision, the Controller relies primarily on the Standard Contractual Clauses for the transfer of personal data to third countries pursuant to Commission Implementing Decision (EU) 2021/914 of 4 June 2021 (the "2021 SCCs"), incorporating the Module 1 (Controller-to-Controller) and/or Module 2 (Controller-to-Processor) provisions as applicable to each transfer. The 2021 SCCs are available at: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32021D0914.

D.1.2   The Controller has incorporated the 2021 SCCs into its data processing agreements with AI model providers, cloud infrastructure providers, and other relevant Processors and Sub-Processors located in third countries.

D.2 — UK Transfer Mechanisms

D.2.1   For transfers of Personal Data of UK residents to third countries, the Controller relies on the International Data Transfer Agreement (IDTA) adopted by the UK Information Commissioner under section 119A of the DPA 2018, and/or the UK Addendum to the 2021 EU SCCs, as applicable. Copies of the IDTA and UK Addendum are available from the ICO's website at: https://ico.org.uk.

D.3 — Transfer Impact Assessments

D.3.1   The Controller has conducted Transfer Impact Assessments (TIAs) in respect of transfers to the United States of America, in particular in connection with transfers to AI model providers. These TIAs have taken into account the legal and regulatory framework applicable to data in the USA (including the potential application of the Foreign Intelligence Surveillance Act (FISA) and other surveillance legislation), the safeguards implemented by the relevant data importers, and any supplementary measures implemented by the Controller. On the basis of these TIAs, the Controller has determined that the SCCs, together with the supplementary measures described in Part X of this Policy, provide an effective level of protection for the transferred Personal Data.

Schedule E — Data Protection Impact Assessment Summary

The Controller has conducted, or is in the process of conducting, Data Protection Impact Assessments (DPIAs) / Privacy Impact Assessments (PIAs) in respect of the following processing activities. This Schedule contains high-level summaries of such assessments. Full DPIA/PIA reports are available upon request to the extent permitted by Applicable Law and by the Controller's confidentiality obligations.

E.1 — AI Model-Assisted Fact-Checking Processing

E.1.1   Description of Processing: Automated transmission of user-submitted content (claims, articles, headlines) to three independent AI language model providers (OpenAI, Perplexity AI, Google) for analysis, followed by automated aggregation of model outputs to generate a composite Trust Score and verdict.

E.1.2   Necessity and Proportionality Assessment: The processing is necessary for the delivery of the core Service. The AI Processing is limited to the content submitted for fact-checking and is not applied to the Data Subject's broader personal profile. The Controller does not use AI Processing outputs for purposes other than fact-checking and Trust Score generation. The use of three independent models rather than one is considered proportionate as it reduces the risk of any single model's errors or biases adversely affecting the output.

E.1.3   Risks Identified: (a) Risk that User Content submitted for fact-checking may contain sensitive Personal Data of the Data Subject or of third parties, which will then be transmitted to AI model providers; (b) Risk of AI model hallucination or inaccuracy affecting the quality of the fact-check output; (c) Risk of bias in AI model outputs affecting certain classes of content or certain groups of Data Subjects; (d) Risk of international transfer of Personal Data contained within User Content to AI model providers in the USA.

E.1.4   Measures to Mitigate Risks: (a) Users are informed through this Policy that submitted content is transmitted to AI model providers, enabling them to avoid submitting sensitive Personal Data where not necessary; (b) The Controller monitors the performance and accuracy of AI models and provides users with the ability to challenge or review outputs; (c) The use of multiple independent AI models reduces the risk of any single model's biases dominating the output; (d) Transfers to AI model providers in the USA are effected pursuant to 2021 EU SCCs and/or UK IDTA/Addendum, supplemented by Transfer Impact Assessments.

E.1.5   Conclusion: The Controller has determined that, on the basis of the identified risk mitigation measures, the residual risk to Data Subjects arising from this processing activity is not high and that a DPIA consultation with the relevant Supervisory Authority is therefore not required under Article 36 of the GDPR. The Controller will keep this assessment under review and will conduct a fresh assessment if the nature or scope of the processing changes materially.

E.2 — User Account and Payment Processing

E.2.1   Description of Processing: Collection and processing of Account Data, Transaction Data, and Payment Data in connection with the registration and administration of Accounts and the processing of payment transactions.

E.2.2   Necessity and Proportionality Assessment: Processing is strictly necessary for the performance of the contract between the Controller and the Data Subject. The Controller collects only the minimum Personal Data necessary for Account creation and payment processing. Payment credentials are handled exclusively by third-party payment processors and are not stored by the Controller.

E.2.3   Risks Identified: (a) Risk of unauthorised access to Account Data; (b) Risk of data breach exposing Transaction Data; (c) Risk of Payment Data misuse.

E.2.4   Measures to Mitigate Risks: (a) TLS encryption for all data in transit; (b) Encryption of sensitive data at rest; (c) Role-based access controls; (d) Multi-factor authentication; (e) Regular security testing; (f) PCI DSS-compliant payment processors.

E.2.5   Conclusion: Residual risk is not high. No Supervisory Authority consultation required.

11. Contact and Enquiries

For privacy-related questions, data deletion requests, Data Subject rights requests, or any other enquiry relating to this Policy or the processing of your Personal Data, please contact:

FieldValue
Business NameOmniscient AI
Doing Business AsOmniscient AI · MSJ News · Tokenised News
Founder / OwnerTanmaya Sharma
AddressE1/15 Model Town Delhi, Delhi 110009, India
Phone+91 87001 12582
Emailnewsroom@metaversestreetjournal.com
Websitehttps://omniscient.news
Response TimeWithin 30 calendar days of receipt of a valid request