Once data is no longer needed, we securely delete or irreveribly anonymize it.

2. Non-Personal Data Collection & Usage

2.1 Non-Personal Data We Collect

We may collect anonymized or aggregated non-personal data, directly or via third-party

analytics tools (PostHog), including:

• Usage patterns and interaction data

• Device type and operating system

• Browser type and version

• AI performance metrics and error rates

• Platform load and performance statistics

2.2 How We Use Non-Personal Data

• Improving AI model performance and service quality

• Enhancing platform security and reliability

• Generating anonymized insights for business development and product roadmap

decisions

• Monitoring system health and observability (via Vercel Observability and PostHog)

3. Privacy by Default

Coraltalk AI enforces privacy by default across its architecture:

• Minimum data collection: Only data necessary to deliver the Services is collected

• Encryption at rest: All data stored in MongoDB Atlas is encrypted using AES-256

(WiredTiger Encrypted Storage Engine)

• Encryption in transit: All data transmitted uses TLS 1.2 or higher — enforced across all

services

• Access controls: Role-based access control (RBAC) ensures only authorized personnel

can access personal data

• No AI training on user data: Customer data is never used to train or fine-tune AI models

• Secure file storage: Files and voice recordings are stored in AWS S3 with SSE-S3

encryption and accessed only via short-lived presigned URLs

• Keyless AWS access: Coraltalk uses OIDC Federation to access AWS — no static

credentials are stored

• MFA enforced: Multi-factor authentication is required for all administrative access to

production systems

4. Compliance with Data Protection Laws

4.1 GDPR Compliance

If you are located in the European Economic Area (EEA), you have the following rights under the General Data Protection Regulation (GDPR):

• Right to access — request a copy of your personal data held by Coraltalk

• Right to rectification — request correction of inaccurate or incomplete data

• Right to erasure — request permanent deletion of your data (subject to legal retention

requirements)

• Right to data portability — request transfer of your data in a machine-readable format

• Right to withdraw consent — withdraw consent at any time without affecting the

lawfulness of prior processing

• Right to restrict or object — object to or restrict certain types of processing

To exercise any of these rights, contact: adhi@coraltalk.com. We will respond within 30 days.

4.2 COPPA Compliance (United States)

Coraltalk AI is not designed for or directed at children under the age of 13. We do not knowingly collect personal data from children under 13 without verifiable parental consent. If we become aware that a child under 13 has provided personal data without parental consent, we will promptly delete that data. If you believe a child under 13 has submitted personal data to us, please contact adhi@coraltalk.com

4.3 EU Digital Services Act (DSA) Compliance

In accordance with the EU Digital Services Act (DSA), Coraltalk AI ensures:

• Transparency in AI-generated responses and content

• Clear content moderation policies for platform interactions

• User rights to report and appeal content decisions

4.4 CCPA Compliance (California, USA)

California residents have the following rights under the California Consumer Privacy Act

(CCPA):

• Right to know what personal data is collected, used, shared, or sold

• Right to delete personal data (subject to legal exceptions)

• Right to opt out of the sale of personal data — Coraltalk does not sell personal data

• Right to non-discrimination for exercising CCPA rights

To exercise CCPA rights, contact: adhi@coraltalk.com.

4.5 PIPEDA Compliance (Canada)

For users in Canada, Coraltalk AI complies with the Personal Information Protection and

Electronic Documents Act (PIPEDA). This includes obtaining meaningful consent for data

collection, limiting use to stated purposes, and providing access to personal data upon request..

5. Third-Party Data Processing & Sub-Processors

Coraltalk AI uses the following authorized sub-processors to deliver the Services. All sub-processors are contractually bound to comply with applicable data protection regulations: