This Privacy Policy explains how Innovablast B.V. (“Innovablast”, “we”, “us”, or “our”), a company registered in the Netherlands (KVK: [pending registration]), collects, uses, and protects your personal data when you use Splixia (“the Service”).

We act as the data controller for the personal data described in this policy. For questions or to exercise your rights, contact us at info@innovablast.com.

1. Data We Collect

1.1 Account Data

When you create an account, we collect:

• Email address
• Name or nickname (optional)
• Password (hashed via AWS Cognito — never stored in plaintext)
• Language and timezone preferences

1.2 Content Data

When you use the Service, we store the content you create and provide:

• Activities— your messages and the AI's responses
• Memory — personal facts and preferences the AI retains across sessions
• Facets — AI persona configurations and access rules
• Tools — custom JavaScript tool code and MCP connector configurations

1.3 Usage Data

We automatically collect:

• Device type, operating system, and browser
• IP address
• Feature usage patterns and interaction timestamps
• Credit consumption and billing events
• Error logs and performance metrics

1.4 Payment Data

Payment card details are collected and processed directly by Stripe. We receive only a transaction reference, the last four digits of your card, and billing status. We never see or store your full card number.

1.5 Embedding Data

To enable semantic search across memories and tools, we generate vector embeddings — numerical representations of your content. These are stored alongside the original data and deleted when the original content is deleted.

1.6 Data We Do Not Collect

We do not collect biometric data, genetic data, health data, religious or political affiliation, sexual orientation, or precise geolocation. We do not track you across other websites or apps.

2. How We Use Your Data

3. AI Processing

3.1 How It Works

When you send a message in an activity, Splixia assembles a context package — your message, relevant memories, facet personality, tool definitions, and conversation history — and sends it to a third-party AI model provider for processing. The provider generates a response, which we return to you. Your conversation history is stored in our database, not with the AI provider.

3.2 AI Model Training

WE DO NOT USE YOUR CONTENT TO TRAIN, FINE-TUNE, OR IMPROVE ANY AI MODEL. Your activities, messages, memories, and all other content are used solely to provide the Service to you. We select AI providers whose API terms prohibit using customer inputs for model training.

3.3 AI Model Providers

We encourage you to review each provider's policies directly. Provider availability and models may change over time.

3.4 MCP Connectors and Custom Tools

When you connect external services via MCP (Model Context Protocol) or create custom tools that make outbound HTTP requests, your data may be sent to those external services. You control which connectors and tools are enabled, and you are responsible for understanding the data handling practices of third-party services you connect.

4. Data Sharing

We share your personal data only with the service providers necessary to operate Splixia. We do not sell your data. We do not share your data with advertisers.

We may also share data when required by law, court order, or governmental authority, or to protect the rights, safety, or property of Innovablast, our users, or the public.

5. Memory

Splixia's memory system is a distinctive feature that stores personal facts, preferences, and observations about you to provide a persistent, personalized experience across sessions. Given its sensitivity, we want to be transparent about how it works:

• Personal and private. Memory is stored at the account level. It is never shared with other users, repository members, or team collaborators.
• You have full control. You can view, edit, pin, and delete individual memories at any time. You can also delete all memories at once.
• Automatic lifecycle. Memories that are not accessed naturally decay in strength over time and are eventually pruned from the system. Pinned memories are exempt from decay.
• Consolidation. Periodically, related memories may be merged into a single consolidated entry using AI processing. The original fragments are deleted after consolidation.
• Facet scoping. Memories can be associated with specific facets. A facet-scoped memory is only visible when that facet is active.

6. Shared Repositories

When you join a shared repository, other members can access the content within that repository according to their role (Owner, Admin, Member, Viewer). This includes activities, facets, and tools within the repository.

Your personal memory is never part of a repository and is never visible to other members. If you leave a shared repository, content you contributed remains in the repository.

7. Data Retention

When you delete your account, we delete all your personal data within 30 days, except where retention is required by law (e.g., payment records).

8. Data Security

We implement technical and organizational measures to protect your data:

• Encryption in transit — TLS 1.2+ on all connections
• Encryption at rest — S3 server-side encryption for stored files
• Authentication — AWS Cognito with 12-character minimum passwords; tokens stored in platform secure enclaves (Keychain on macOS/iOS, EncryptedSharedPreferences on Android)
• Tenant isolation — all database queries are scoped by account ID, preventing cross-user data access
• Input validation — all API endpoints validate requests against typed schemas before processing
• Prompt injection protection — user inputs are scanned for injection patterns; external tool results are isolated with untrusted data boundaries
• Sandbox isolation — custom tool code runs in a restricted VM with no access to system APIs, filesystem, or network internals
• SSRF protection — all outbound requests are validated against blocked hosts and private IP ranges
• Rate limiting — WAF and API Gateway throttling in production to prevent abuse and DDoS
• Secrets management — all credentials stored in AWS Secrets Manager with least-privilege IAM access

9. International Data Transfers

Our primary infrastructure is hosted in the EU (AWS eu-west-2, London). Your content data (activities and memories) is stored in the EU. However, when your data is sent to AI model providers for processing, it may be transferred to the United States or other countries.

For transfers outside the EU/EEA, we rely on:

• The EU-U.S. Data Privacy Framework (for certified US providers)
• Standard Contractual Clauses (SCCs) approved by the European Commission

10. Automated Decision-Making and Profiling

10.1 AI Processing

When you use Splixia, your inputs are processed by AI models that generate automated outputs (text responses, tool actions). These outputs are generated algorithmically, not by a human. You have full control over whether to use, modify, or discard any AI output.

10.2 No Automated Decisions with Legal Effects

We do not use automated processing, including profiling, to make decisions that produce legal effects or similarly significantly affect you (GDPR Art. 22). Specifically:

• AI model selection, credit pricing, and feature gating are determined by your subscription tier — not by profiling or automated assessment of your behavior
• Account suspension or termination decisions involve human review
• Billing is based on transparent credit rules, not algorithmic personalization of pricing

10.3 Memory as Profiling

Splixia's memory system could be considered a form of profiling under GDPR Art. 4(4), as it builds a profile of your preferences and facts over time. However:

• Memory is used solely to personalize your AI interactions — not for advertising, scoring, or decisions about access
• You have full control: you can view, edit, delete, and disable memory at any time
• Memory is never shared with third parties or other users
• The legal basis for memory processing is contract performance (Art. 6(1)(b)) — it is a core feature of the Service you subscribe to

11. Your Rights

Under the General Data Protection Regulation (GDPR), you have the following rights:

To exercise any of these rights, email info@innovablast.com. We will respond within 30 days as required by GDPR. If your request is complex, we may extend this by an additional 60 days with notice.

Supervisory Authority

You have the right to lodge a complaint with a data protection authority. Our lead supervisory authority is:

Autoriteit Persoonsgegevens (AP)
autoriteitpersoonsgegevens.nl

12. Children

Splixia is not intended for anyone under 18 years of age. We do not knowingly collect personal data from children. Under the Dutch UAVG (Uitvoeringswet AVG), the age of digital consent in the Netherlands is 16. Regardless, our Service requires users to be 18+. If you believe a child has created an account or provided us with personal data, contact us at info@innovablast.com and we will delete the data and account promptly.

13. Cookies

We use cookies and similar technologies on our website and in the Service. For full details on which cookies we use, how to manage your preferences, and your consent options, see our Cookie Policy.

14. Changes to This Policy

We may update this Privacy Policy from time to time. For material changes, we will notify you via email or an in-app notification at least 30 days before they take effect. The “last updated” date at the top reflects the most recent revision.

15. Contact

For privacy-related questions or to exercise your data rights:

Innovablast B.V.
Triangelweg 9
2992 GR Barendrecht, The Netherlands
KVK: [pending registration]
BTW-id: [pending registration]
Phone: +31 6 14314377
Email: info@innovablast.com