Privacy Policy

This Privacy Policy explains how FerrisCapital LLC, the provider of the Airis platform (“Airis”, “we”, “us”), handles personal data.Airis is a business-to-business service used by organizations and their personnel.

Our role depends on the data:

• As a processor. When we process personal data contained in Customer Data on behalf of a customer organization — for example, data your Agents access through connected accounts — the customer is the controller and determines the purposes of processing. That processing is governed by our agreement with the customer and its data processing addendum (DPA).
• As a controller. When we handle account, contact, billing, and usage data to operate and improve the Service, we act as the controller. This Policy describes that processing.

Account and contact data. Names, work email addresses, organization details, role, and authentication identifiers provided through our third-party authentication provider.

Usage and device data. Logs, telemetry, feature usage, metering records of model calls, IP address, browser and device information, and diagnostics used to operate, secure, and improve the Service.

Billing data. Plan, invoices, and transaction records. Payment card details are handled by our payment processor; we do not store full card numbers.

Customer Data and connected-account data. Content, messages, files, and prompts you submit, and data your Agents access from accounts you connect (such as email, messaging, code, and file storage). We process this on your behalf as a processor.

Support and communications. Information you provide when you contact us for support or correspond with us.

We use personal data to:

• provide, maintain, secure, and operate the Service;
• authenticate users, provision Agents, and enforce access controls;
• meter usage, bill, and prevent fraud and abuse;
• provide support and communicate with you about the Service, including service and security notices;
• monitor, troubleshoot, and improve performance, reliability, and safety;
• comply with legal obligations and enforce our agreements.

To power Agents, the Service routes prompts and relevant Customer Data to third-party service providers acting as our subprocessors. These providers process the data to return Output and are contractually bound to confidentiality and security obligations.

We do not use Customer Data to train generally available foundation models, and we direct the service providers that process Customer Data on our behalf not to train their models on Customer Data submitted through the Service, except where a customer directs otherwise. We use aggregated and de-identified operational data to monitor and improve the Service.

Where the GDPR or similar laws apply to our processing as a controller, we rely on: performance of a contract (to provide the Service); our legitimate interests (to secure, operate, and improve the Service and prevent abuse); compliance with legal obligations; and, where required, consent. Where we process personal data as a processor, we do so on the documented instructions of the customer controller.

We share personal data only as described here:

• Subprocessors and service providers that support the delivery of the Service, such as hosting and infrastructure, AI processing, payment, communications, analytics, and support — bound by contract to protect the data and use it only to provide their services to us;
• Within your organization, consistent with the access controls you configure;
• Legal and safety, when required by law or legal process, or to protect rights, safety, and the integrity of the Service;
• Business transfers, in connection with a merger, acquisition, financing, or sale of assets, subject to this Policy.

We do not sell personal data, and we do not share it for cross-context behavioral advertising.

We use a vetted set of subprocessors to deliver the Service, including providers of hosting and infrastructure, AI processing, payment, and communications. We require subprocessors to meet appropriate security and confidentiality obligations. A current list of subprocessors is available on request at support@airiscloud.com.

We retain personal data for as long as needed to provide the Service and for legitimate business and legal purposes, such as maintaining security, resolving disputes, and complying with legal obligations. Customer Data is retained according to our agreement with the customer; following termination, it may be exported within the window described in the Terms of Service and then deleted in the ordinary course, subject to standard backup cycles and legal requirements.

We maintain administrative, technical, and organizational measures designed to protect personal data appropriate to the nature of the data and the risks involved. No method of transmission or storage is completely secure, however, and we cannot guarantee absolute security.

We may process and store personal data in the United States and other countries where we or our subprocessors operate. Where we transfer personal data across borders in a manner subject to data-protection law, we rely on appropriate safeguards, such as the European Commission’s Standard Contractual Clauses, to protect the data.

Depending on where you are located, you may have rights to access, correct, delete, or port your personal data, to object to or restrict certain processing, and to withdraw consent. Residents of California and certain other U.S. states have rights to know, delete, and correct personal information, and to opt out of its sale or sharing — which we do not do.

Because much of the data we process is on behalf of a customer organization, if your data was provided by an organization using Airis, please direct your request to that organization; we will assist it as a processor. Otherwise, contact us at support@airiscloud.com. We will not discriminate against you for exercising these rights, and we may need to verify your identity before responding.

We use cookies and similar technologies that are strictly necessary to authenticate sessions, maintain security, and remember preferences, as well as limited analytics to understand and improve how the Service is used. You can control cookies through your browser settings; disabling necessary cookies may affect how the Service functions.

The Service is intended for business use by adults and is not directed to children. We do not knowingly collect personal data from individuals under 18. If you believe a child has provided us personal data, please contact us so we can delete it.

We may update this Privacy Policy from time to time. If we make material changes, we will provide reasonable notice, such as by posting the updated Policy with a new effective date or notifying you through the Service. Your continued use of the Service after the change takes effect indicates your acknowledgment of the updated Policy.

For questions about this Policy or our privacy practices, contact support@airiscloud.com. Airis is operated by FerrisCapital LLC.