III Privacy Notice

Irish law framework with applicable EU and UK protections

Inference Innovation Institute • A.Ri

Instinct’s public policies informed the subject outline only. The wording is original and adapted to III’s enterprise service. Irish law and Irish courts govern business disputes under the accompanying Terms; applicable EU and UK mandatory rights remain preserved.

The public enquiry service and contracted client environments have different permissions and data boundaries. Client delivery remains subject to separate signed agreements and processing arrangements.

Part A Privacy Notice

Effective date 25 October 2026 • Last updated 25 October 2026

1 Who we are and what this notice covers

A.Ri is provided by Inference Innovation Institute Ltd (formerly Muir Innovation Limited), trading as Inference Innovation Institute (“III”, “we”, “us”). Our registered office is 25 Martiou, 27, D. Michael Tower, Office 105A, Engomi, 2408 Nicosia, Cyprus. Contact us about personal data at ari.support@inferenceinnovation.ai or 25 Martiou, 27, D. Michael Tower, Office 105A, Engomi, 2408 Nicosia, Cyprus.This notice explains how we handle personal data when you visit www.inferenceinnovation.ai, sign up, send enquiries, communicate with our team or use our service. It applies under the EU General Data Protection Regulation and Ireland’s Data Protection Act 2018, together with the European Communities (Electronic Communications Networks and Services) (Privacy and Electronic Communications) Regulations 2011, as amended, where applicable. For UK activities, this includes the UK GDPR, Data Protection Act 2018 and applicable amendments. Reading this notice does not constitute consent to all processing.

We are the controller for our own enquiry, account, business relationship, billing and security administration. Where we process personal data within a contracted client environment solely on a client’s instructions, the client is normally the controller and III is its processor under a separate data processing agreement. That client’s privacy notice governs its own purposes. Roles depend on the actual activity, not just the contract label.

2 Information we collect and where it comes from

You provide your work email during signup and a one-time code to confirm control of that address. We do not need a phone number for signup. We may then request your name, organisation, role and enquiry. We do not request your date of birth. An email verification or matching email domain does not, by itself, authorise access to a client workspace.

We collect messages, documents and other information you choose to submit; your service preferences; support communications; records of requests, approvals and human referrals; and subscription or payment records if a paid service is agreed. A payment provider may process payment details under its own notice. Do not send passwords, authentication codes other than the requested signup verification, or full payment card details in conversations.

Our systems and suppliers may generate IP addresses, device and browser information, session identifiers, delivery information, error reports and security logs. The cookies we set are described in section 13.

Other sources may include an authorised colleague or employer, a referral partner, your selected messaging provider and systems expressly connected under a client agreement. If we obtain personal data indirectly, we provide the information required by law, normally within one month and earlier where required, unless a lawful exception applies. We identify the source or source category where applicable.

3 Data you should avoid submitting

Do not submit confidential client files, exact payroll, health information, criminal records or other sensitive personal data through the public enquiry service. If specialist client work requires such information, we establish the lawful basis, additional legal conditions, restricted access and retention arrangements before processing it in the agreed client environment. Unrequested sensitive information may be restricted or removed under our handling procedure.

Privacy purposes and permissions

4 Why we use personal data

We verify work email addresses, provide the requested conversation and manage accounts. Where you personally contract with us or ask us to take steps towards a contract, we rely on contractual necessity for processing needed for that purpose. For employees and other representatives of a business customer, we generally rely on our legitimate interests in communicating with that business and administering the relationship, after balancing those interests against individual rights.

We respond to enquiries, identify the appropriate III team, arrange human review and manage partnerships. Our basis is legitimate interests in responding and operating our business, or necessary pre-contract steps where applicable. Information needed to respond is mandatory for that interaction; optional information is identified as optional. Without a valid work email we cannot provide email verification; without appropriate work identity verification we cannot grant business access.

We protect the service, prevent misuse, investigate incidents and maintain operational records using legitimate interests in security and reliable operations. We meet accounting, tax, regulatory and legally binding disclosure requirements using the applicable legal obligation. We establish or defend legal claims using legitimate interests, with any additional conditions required for sensitive data.

We may use proportionate service telemetry and user feedback to improve reliability and usability. This does not authorise general model training on identifiable conversations or confidential client material. Optional analytics use consent where required. We record and respect your choice.

We use consent for optional promotional messages where required. Any business marketing carried out without consent must satisfy the applicable country’s rules and our documented legitimate-interest assessment. You may object to direct marketing at any time. Signup and requested service messages are not blanket permission for promotional campaigns.

5 SI assistance and human review

Our service uses Sovereign Intelligence (“SI”), including artificial intelligence as that term is used in law, to interpret requests, produce responses and route work. Responses can be inaccurate. Authorised III personnel may review a conversation to answer your request, check an escalation or investigate a service or security issue. They access information only for an authorised purpose.

The public service does not make solely automated decisions producing legal or similarly significant effects, such as deciding employment, credit or contractual eligibility. If a future service involves such decisions, we will assess the applicable EU and UK rules separately and provide the required notice, legal grounds and safeguards before introducing it. You can ask for human assistance at ari.support@inferenceinnovation.ai.

6 Training and separation of client information

We do not use identifiable enquiry content or confidential client content to train general or cross-client models. We require processing suppliers handling that content on our behalf to follow the same restriction. Any separately agreed development or fine-tuning for a particular client must specify its purpose, data permissions, legal basis, isolation controls and retention in writing before it starts.

Public enquiries are processed separately from contracted client environments. Information from one client environment is not used to answer another client’s requests or public enquiries. Truly anonymised aggregate service statistics may be used to improve operations; replacing a name with an identifier alone is not anonymisation.

Privacy sharing transfers and retention

7 Who receives information

We share necessary information with authorised III staff and contracted service providers for hosting, communications, SI inference, security, support and billing. Processors are subject to appropriate contracts and access controls. We may disclose information to professional advisers, regulators or courts where lawful and necessary, or to a business successor subject to appropriate safeguards and notice.

You can ask for details of our current providers, including the purpose, location and role of each, at ari.support@inferenceinnovation.ai. We do not sell personal data or provide confidential conversations to advertisers. We share a partnership enquiry with an external partner only with your permission or another specifically identified lawful basis; internal routing is limited to appropriate III personnel.

Optional WhatsApp and Microsoft Teams involve their own platform providers. They may process account, device, delivery and other information under their own terms and privacy notices, and can have independent controller roles. Choosing one of these channels does not grant III general access to your other chats or applications. We provide provider links and channel limitations before activation. Avoid sending sensitive client information over a public messaging channel.

8 International transfers

We identify processing and support locations in our client documentation and, on request, at ari.support@inferenceinnovation.ai. If personal data is transferred outside the EEA or UK to a destination requiring additional safeguards, we use a lawful mechanism appropriate to the originating regime. This may include an applicable adequacy decision, EU standard contractual clauses, the UK International Data Transfer Agreement or UK Addendum, together with the required transfer assessment and additional measures.

We do not assume that every transfer between the EU and UK, or to a third country, is automatically permitted. You may request information about the safeguards and a copy of applicable contractual protections, with confidential details redacted where appropriate, at ari.support@inferenceinnovation.ai. A sovereign service description is not a promise that every messaging, hosting or support activity stays in one country; any specific residency commitment is stated in the signed client agreement.

9 How long we keep information

We retain personal data only for the purposes described, the relevant legal requirements and proportionate records of security or disputes. Conversation session data in the public service is stored with a seven-day expiry and is then deleted automatically. Billing and contract administration records are kept for the period the applicable law or agreement requires.

When deletion is validly requested or a retention period ends, we aim to remove relevant live-system information within 30 days and allow residual backups to expire within 90 days. Backups remain restricted and are not reused for ordinary service delivery; if restored, applicable deletions are reapplied. Lawful holds or retention duties may delay deletion for the specific records concerned, and we explain any relevant exception.

Client workspace data follows the client agreement and processing schedule, including agreed export, deletion, backup and statutory evidence periods. Disconnecting an integration stops future authorised collection but does not itself erase already stored records. You or the client administrator can separately request deletion by emailing ari.support@inferenceinnovation.ai.

Privacy security rights and contact

10 Security and access

We apply measures appropriate to the risk, including role-based access, controlled client provisioning, authentication, logging, supplier assessment and encryption arrangements appropriate to the system. Precise safeguards for client delivery are specified in the security schedule. No system can guarantee absolute security. A security concern can be reported to ari.support@inferenceinnovation.ai. We investigate and make legally required notifications under the applicable controller and processor obligations.

Client access requires an authorised invitation, verification and permissions. A public account cannot be promoted into confidential client access merely by identifying a company domain. Human review and operational support are governed by the same client access boundaries.

11 Your privacy rights

Subject to the conditions in applicable law, you may request access, correction, erasure, restriction, portability and information about relevant recipients or safeguards. You may object to processing based on legitimate interests and may object to direct marketing at any time. If we rely on consent, you may withdraw it without affecting the lawfulness of earlier processing. Rights relating to automated decisions apply where the relevant legal criteria are met.

Contact ari.support@inferenceinnovation.ai to exercise rights. We may ask for proportionate information to verify identity, without collecting excessive documentation. We normally respond within one month, subject to permitted extensions or adjustments under applicable law, and explain any applicable limit or refusal. Requests are normally free; any fee or refusal must satisfy the legal criteria.

Where III acts as processor, we normally pass your request to the relevant client controller and assist it under our agreement. You can contact that controller directly using its privacy contact details.

12 Complaints

You can complain to us at ari.support@inferenceinnovation.ai. We acknowledge and investigate privacy complaints, tell you how they will be handled and communicate the outcome within the applicable legal timeframe. You can also complain to the supervisory authority for your habitual residence, place of work or alleged infringement in the EEA, or to the UK Information Commissioner at ico.org.uk.

Ireland’s supervisory authority is the Data Protection Commission, which can be contacted through dataprotection.ie. You need not complete our internal process before exercising an available regulatory complaint right.

13 Cookies voice features and children

We set two cookies, both strictly necessary to provide the service you request. ari_session keeps your conversation and sign-in state together; it is HttpOnly and expires after seven days. ari_booking lets you reopen and manage a booking you have made; it is HttpOnly and expires after seven days. We do not set analytics or advertising cookies. We do not treat acceptance of Terms as consent to any optional cookie.

The Voice button uses your browser’s built-in speech recognition (the Web Speech API). In some browsers, including Chrome, the browser sends your audio to its provider (for Chrome, Google) to be transcribed, under that provider’s own privacy notice. We receive only the text you send, and we do not record audio. The service is intended for adults acting in a business capacity and is not directed at children. We do not knowingly create accounts for under-18s; contact us if a child’s data has been submitted.

14 Changes to this notice

We publish the updated date and notify users of material changes in an appropriate way. New purposes are assessed for compatibility and lawful basis; where new consent or other safeguards are required, we obtain or establish them before processing. Continued use is not deemed consent to an otherwise unlawful new purpose.