PRIVACY POLICY

Version dated September 01, 2026 (Version 1.1)

This Privacy Policy (hereinafter referred to as the "Policy") defines the procedure for processing personal data of users of the AITRIQ Platform and constitutes an integral part of the Public Offer for the Provision of Services of AITRIQ LLP (hereinafter referred to as the "Offer"), posted at https://aitriq.com/en/public_offer/.

1. General Provisions

1.1. The personal data Operator is AITRIQ LLP (hereinafter referred to as the "Operator"), whose details are specified in Section 13 of the Offer.

1.2. This Policy has been developed in accordance with the Law of the Republic of Kazakhstan dated 21 May 2013 No. 94-V "On Personal Data and Their Protection" (hereinafter referred to as the "Personal Data Law"), the Digital Code of the Republic of Kazakhstan dated 9 January 2026 No. 255-VIII (hereinafter referred to as the "Digital Code"), the Law of the Republic of Kazakhstan dated 17 November 2025 No. 230-VIII "On Artificial Intelligence" (hereinafter referred to as the "Artificial Intelligence Law"), the Law of the Republic of Kazakhstan dated 24 November 2015 No. 418-V "On Cybersecurity", the Civil Code of the Republic of Kazakhstan and other regulatory legal acts of the Republic of Kazakhstan in the field of processing and protection of personal data.

1.3. This Policy applies jointly with the Offer and the User Agreement posted at https://aitriq.com/en/terms_of_use/. Use of the Platform constitutes the User's consent to the terms of this Policy; the procedure of acceptance coincides with the procedure of acceptance of the Offer established by Section 1 of the Offer.

1.4. This Policy applies to the personal data of the User, the User's representatives and the User's Clients whose data are received by the Platform through the communication channels and integrations connected by the User.

2. Terms and Definitions

2.1. Platform — the AITRIQ Platform within the meaning established by the Offer, constituting service software and an informatization object.

2.2. The terms "User", "User's Client", "Account", "Services", "AI Agent", "AI Message", "Partner", "Payment System" are used in the meanings established by the Offer. The terms "personal data", "personal data processing", "depersonalization", "anonymization", "masking", "cross-border transfer of personal data" are used in the meanings established by the Personal Data Law.

2.3. Controller — a person determining the purposes and content of personal data processing. With respect to the User's registration data, the Operator is the Controller; with respect to the personal data of the User's Clients, the User is the Controller.

2.4. Processor — a person processing personal data on behalf of the Controller. With respect to the personal data of the User's Clients, the Operator acts as the Processor.

2.5. Technical Data — automatically collected information not containing the content of correspondence: IP address, device type and parameters, browser type and version, operating system, session identifiers, system logs, error data, and data on interaction with the Platform interface.

2.6. Advertising Data — information on the sources of attraction of the User's Clients and on the effectiveness of the User's advertising campaigns, including identifiers of advertisements and campaigns, parameters of transitions and tags, information on the fact and time of contact, as well as data transmitted between the Platform and advertising systems within the integrations connected by the User, including conversion data interfaces of advertising platforms.

2.7. Identification Services — mechanisms for confirming the identity of the User upon registration and authorization on the Platform, including the OAuth protocol enabling sign-in through a third-party account (Google, Apple, Microsoft and others) without transferring the User's password to the Operator; confirmation of an email address; confirmation of a telephone number, including a WhatsApp number, by means of a one-time code.

2.8. Cookies — text files placed by the Platform on the device of the User or the User's Client to ensure authorization, security, saving of settings and analytics.

3. Categories and Sources of Personal Data

3.1. Registration and profile data of the User, provided voluntarily: surname, first name, patronymic, name of the organization (individual entrepreneur, limited liability partnership), business identification number (BIN), individual identification number (IIN), date of birth, email address, telephone number, WhatsApp number, Telegram username, position, field of activity, date of Account registration, as well as other information specified by the User in the Account profile or requested by the Operator for the fulfilment of legal requirements and the provision of Services.

Upon registration and authorization using Identification Services, the Operator additionally processes:
a) upon sign-in through a third-party account via the OAuth protocol — email address, name, profile photograph and other information within the scope of permissions granted by the User to the relevant service;
b) upon registration and authorization by telephone number, including WhatsApp number — telephone number, displayed profile name (where available and accessible), as well as technical information on the fact and time of confirmation of the number.

One-time confirmation codes are processed solely for the purposes of confirming that an email address or telephone number belongs to the User and recording the actions performed by the User.

3.2. User's Content transmitted while using the Platform: text and voice messages, files, documents, images, videos, integration data, results of interaction with AI Agents, as well as other materials and information the composition of which is determined by the functional capabilities of the communication channels and integrations connected by the User and which may change upon modification of such capabilities by their rightholders.

3.3. Personal data of the User's Clients received through the communication channels connected by the User (WhatsApp, Telegram, Instagram, Threads, TikTok, web chat and others). The Operator processes such data solely on behalf of the User, acting as a Processor.

3.4. Technical Data automatically collected while using the Platform (see clause 2.5), and Advertising Data (see clause 2.6) processed upon connection by the User of the relevant integrations.

3.5. Payment data. The Operator does not process or store the full bank card number, CVV/CVC codes, magnetic stripe data or other confidential payment information. Such data are processed by the Payment System (acquiring) on the secure page of its provider. The Operator receives and displays in the Platform interface the payment identifier, date, amount and status of the transaction, as well as masked details of the payment instrument (type of payment system and the last four digits of the card number) required by the User to identify the payment instrument used.

4. Legal Grounds and Purposes of Processing

4.1. Personal data are processed on the following legal grounds provided for by the Personal Data Law:
a) consent of the data subject provided in accordance with Articles 6–7 of the Personal Data Law, including through acceptance of the Offer;
b) performance of the contract concluded between the Operator and the User;
c) compliance with the requirements of the legislation of the Republic of Kazakhstan;
d) protection of the rights and legitimate interests of the Operator, including ensuring information security and preventing fraud;
e) processing of depersonalized data not allowing identification of the data subject.

4.2. Personal data are processed by the Operator for the following purposes:
a) registration of the User and provision of access to the functional capabilities of the Platform;
b) ensuring the operation of AI Agents, CRM functionality, integrations and other services of the Platform;
c) provision of technical support and sending to the User of service and information notifications;
d) maintenance of accounting and tax records, fulfilment of legal requirements;
e) ensuring information security and preventing fraud;
f) provision to the User of analytics on enquiries from the User's Clients, including analytics on the sources of their attraction and the effectiveness of the User's advertising campaigns;
g) improvement of the quality of Services, detection of technical failures, conduct of statistical and analytical research based on depersonalized data, including the creation of information and analytical reports and databases pursuant to clause 4.2.2 of the Offer;
h) development and improvement of artificial intelligence algorithms based on depersonalized data, excluding data obtained through Google APIs: such data is not used to create, train or improve artificial intelligence models (clause 6.4 of this Policy);
i) sending to the User of marketing and advertising communications on the basis of separate consent pursuant to clause 4.4.

4.3. With respect to the personal data of the User's Clients, the Operator acts as a Processor performing processing on behalf of the User, who is the person determining the purposes, content and methods of processing such data.

4.4. Marketing communications. The sending to the User of marketing and advertising communications is carried out solely on the basis of separate consent of the User granted upon registration of the Account or in the Account settings. The User has the right at any time to withdraw such consent by means of the Account settings or the unsubscribe function in a received message. Withdrawal of consent does not affect the provision of Services or the sending of mandatory service notifications.

4.5. Processing of personal data by artificial intelligence systems. The Platform provides the User with technical capabilities for processing messages and data using artificial intelligence systems. The composition of data submitted to such systems is determined by the settings of AI Agents, scenarios and text prompts specified by the User. The Operator does not determine which information the User submits to artificial intelligence systems and does not carry out any preliminary selection or verification thereof.

The User undertakes not to submit to the Platform excessive personal data or information the processing of which is not required to achieve the purposes determined by the User, and independently bears responsibility for the composition of data processed on the User's behalf.

4.6. Automated decisions. The Operator does not take, in respect of data subjects, decisions producing legal consequences or otherwise significantly affecting their rights and legitimate interests on the basis of solely automated processing of personal data.

Decisions in respect of the User's Clients generated using AI Agents are determined by the settings of the User. Where such a decision is taken without human involvement and affects the rights and legitimate interests of a person, such person has the right to be informed of the automated nature of the decision, to receive an explanation of its grounds without disclosure of the program code and model parameters, to raise an objection to automated processing and to demand review of the decision with human involvement. The procedure for exercising such rights is established by Section 8 of this Policy and by the User Agreement.

4.7. Validity period of consent. Consent to the collection and processing of personal data shall be valid for the term of the contract between the Operator and the User and the retention periods established by Section 7 of this Policy, but no longer than the period necessary to achieve the purposes of processing specified in clause 4.2. Upon expiry of such period, processing shall cease and the data shall be deleted or depersonalized.

5. Transfer of Personal Data to Third Parties and Cross-Border Transfer

5.1. The Operator transfers personal data to third parties only in the cases provided for by Articles 10–16 of the Personal Data Law, by this Policy, by the Offer, or with separate consent of the data subject. The transfer is carried out solely to the extent necessary to achieve the purposes of processing specified in Section 4.

The transfer of data of the User's Clients to the third parties specified in subclauses (a) and (c) of clause 5.2 is carried out to the extent that the User has connected the relevant communication channel, integration or functional capability of the Platform. The ground for such transfer is the instruction of the User expressed by connecting the relevant service. The Operator does not verify whether the User has obtained the consents of the User's Clients; the obligation to ensure lawful grounds for the processing and transfer of such data rests with the User in accordance with Section 6 of the Offer.

5.2. Categories of third parties to whom the Operator transfers personal and (or) technical data:
a) providers of artificial intelligence services, including developers and suppliers of large language models, both foreign and registered in the Republic of Kazakhstan — for processing the User's requests to the extent minimally necessary to generate responses of AI Agents. The Operator engages only providers whose terms do not permit the use of data submitted through their API to train or improve artificial intelligence models, and verifies this before engaging a provider. Data obtained through Google APIs is not transferred to providers that would use it to train models;
b) payment system providers (acquiring) — payment identifier, date, amount, status of the transaction;
c) operators of communication channels and integrations (WhatsApp Business Platform, Telegram Bot API, Instagram and Threads Messaging API, TikTok, Google API and others) — to the extent necessary for the functioning of the relevant integration;
d) advertising systems — to the extent necessary for the transfer of information on conversions and the effectiveness of the User's advertising campaigns, provided that the User has connected the relevant integration;
e) analytics services — depersonalized data for statistical analysis and improvement of the quality of Services;
f) cloud providers and contractors of the Operator engaged for technical support, development and ensuring the functioning of the Platform — subject to compliance with confidentiality and use of the data solely for the purposes agreed with the Operator;
g) state authorities of the Republic of Kazakhstan — within their competence and in the cases provided for by legislation;
h) other persons — only with the written consent of the data subject or on lawful grounds.

5.3. Cross-border transfer of personal data is carried out in accordance with subclause 1) of clause 3 of Article 16 of the Personal Data Law. The Operator minimizes the volume of data transferred outside the Republic of Kazakhstan and transfers only the information necessary for processing a specific request.

5.4. Third parties receiving personal data are obliged to ensure the necessary level of confidentiality and security thereof. The transfer of personal data to third parties is carried out via secure communication channels and (or) with the application of encryption.

6. Use of Google User Data

6.1. The Platform integrates with Google services (Google Drive, Google Sheets and Google Calendar) so that the User may add selected content to the AI Agent's knowledge base and schedule meetings with the User's Clients.

6.2. What data the Operator accesses. Google user data is accessed by the Operator only upon the User's explicit action and only within the permissions granted by the User (OAuth scopes):
a) Google Drive — access is limited to the files explicitly selected by the User through the Google file picker (drive.file scope); the Operator does not see or request any other files in the User's Drive;
b) Google Sheets — reading the contents of spreadsheets the User has selected through the Google file picker, within the drive.file permission granted for those files; the Operator does not request access to all of the User's spreadsheets;
c) Google Calendar — managing events to book meetings with the User's Clients (calendar.events scope) and checking availability (calendar.events.freebusy, calendar.calendarlist.readonly).

6.3. How the Operator uses this data. Data received from Google services is used solely to provide the features listed in clause 6.1. The Operator does not use Google user data for any other purpose.

6.4. Compliance with Google's policy. The Operator's use of information received from Google APIs adheres to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements. Specifically, the Operator:
a) does not transfer Google user data to third parties except as necessary to provide the feature, to comply with applicable law, or with the User's explicit consent;
b) does not use Google user data for serving advertisements;
c) does not allow humans to read Google user data, except with the User's explicit consent, for security purposes, to comply with applicable law, or where the data is aggregated and anonymized;
d) does not use Google user data to develop, train or improve generalized artificial intelligence or machine learning models, and does not transfer such data to third parties for those purposes, including the providers engaged pursuant to subclause (a) of clause 5.2.

6.5. Storage and revocation. Access tokens to Google APIs are stored encrypted and used server-side only by the Operator. The User may disconnect the Google account at any time in the Platform settings or revoke access on the Google Account page (https://myaccount.google.com/permissions). Upon disconnection, the Operator ceases calling Google APIs on the User's behalf.

7. Storage and Protection of Personal Data

7.1. Storage and processing of personal data is carried out in cloud infrastructure located within the territory of the Republic of Kazakhstan. The database containing personal data of citizens of the Republic of Kazakhstan is located within the territory of the Republic of Kazakhstan in accordance with the requirements of the Personal Data Law. The infrastructure is isolated and managed in accordance with the requirements of the digital legislation of the Republic of Kazakhstan and the legislation of the Republic of Kazakhstan on cybersecurity. Information on the infrastructure providers engaged by the Operator is provided to the User upon request.

7.2. Data retention periods:
a) User's Content (correspondence, files, voice messages, documents, images and other materials transmitted through the Platform) — for the entire term of the User's Account;
b) technical logs, system logs and security logs (audit logs) — 180 (one hundred and eighty) calendar days;
c) backups — 180 (one hundred and eighty) calendar days;
d) data of archived Accounts of the User — 12 (twelve) months from the moment of archiving in accordance with clause 8.16 of the Offer, after which they are deleted;
e) data of resources transferred to archived status upon downgrade of the User's Tariff are retained in accordance with clause 8.15 of the Offer — until restoration by the User or deletion of the Account;
f) data of a deleted Account — 90 (ninety) calendar days from the moment of deletion, after which they are deleted or depersonalized, unless their retention is required by the legislation of the Republic of Kazakhstan;
g) depersonalized data — indefinitely.

7.3. Upon expiry of the retention periods, the data are deleted or depersonalized in the established manner, except in cases where extension of the periods is required by the legislation of the Republic of Kazakhstan.

7.4. Security measures. The Operator applies a set of legal, organizational and technical protection measures, including:
— encryption of data in transit (TLS 1.2 and above);
— storage of passwords in encrypted form (bcrypt/argon2);
— masking and hashing of personal data during processing;
— segregation and control of access of the Operator's employees;
— maintenance of audit logs;
— regular backup;
— monitoring of security events;
— protection against DDoS attacks, SQL injections and other information security threats.

7.5. Access to personal data is granted only to those employees of the Operator for whom it is necessary for the performance of their official duties, subject to an obligation of confidentiality.

7.6. In the event of detection of unauthorized access to personal data, the Operator shall take measures to localize the incident and eliminate its consequences, shall notify the affected data subjects, as well as the authorized body in the field of personal data protection and other state authorities in the cases, manner and within the time limits established by the legislation of the Republic of Kazakhstan.

8. Rights of the Data Subject and Procedure for Enquiries

8.1. The data subject has the right to:
a) obtain from the Operator information on the processing of their personal data, including information on the existence of data, sources of receipt, purposes, methods, retention periods and legal grounds for processing, as well as on third parties to whom the data have been transferred;
b) demand clarification of their personal data in the event of incompleteness, inaccuracy or obsolescence thereof;
c) demand cessation of processing of personal data where it is carried out without lawful grounds;
d) demand deletion of their personal data, except in cases where retention thereof is mandatory in accordance with the legislation of the Republic of Kazakhstan or where the demand is not subject to fulfilment by virtue of clause 4 of Article 41 of the Digital Code;
e) demand restriction of processing of their personal data or depersonalization thereof in cases where deletion of the data is impossible by virtue of the requirements of the legislation of the Republic of Kazakhstan;
f) raise an objection to automated processing of their personal data and demand review of a decision taken on the basis of such processing with human involvement;
g) receive an explanation of the procedure for automated processing of their personal data, its possible consequences and the procedure for protection of their rights;
h) request export of their personal data in a structured machine-readable format;
i) withdraw consent to the processing of personal data, including separate consent to marketing communications;
j) appeal against the actions or omissions of the Operator to the authorized state body for the protection of personal data or to a court.

8.2. Procedure for submitting enquiries. Enquiries of data subjects shall be sent to the Operator by any of the following means: to the email address [email protected]; through the feedback form or other means of communication provided for by the Platform interface; by means of an electronic document management system; by postal item or by hand delivery to the address specified in Section 13 of the Offer. The enquiry must allow identification of the applicant and contain the substance of the demand.

8.3. The Operator shall consider the enquiry and provide a response or perform the requested action within 15 (fifteen) calendar days from the moment of its receipt, unless other time limits are provided for by the legislation of the Republic of Kazakhstan.

8.4. An objection to automated processing of personal data raised pursuant to subclause (f) of clause 8.1 of this Policy shall be considered within 3 (three) business days from the day of its receipt. The Operator shall notify the data subject of the results of the consideration.

8.5. Enquiries of the User's Clients. With respect to the personal data of the User's Clients, the person determining the purposes and content of processing is the User. Enquiries of the User's Clients concerning the content of a dialogue, the settings of an AI Agent, the composition of the data used and decisions generated by an AI Agent shall be sent to the User with whom such person has entered into communication and shall be considered by the User in the manner established by the User Agreement.

Where an enquiry of a User's Client has been received directly by the Operator, the Operator shall forward it to the relevant User and notify the applicant thereof. Enquiries concerning the general principles of functioning of the Platform and the artificial intelligence models applied shall be considered by the Operator independently.

8.6. Where retention of certain personal data is mandatory in accordance with the legislation of the Republic of Kazakhstan, such data shall be subject to blocking and used solely for the purposes provided for by law until expiry of the established retention periods, after which they shall be deleted or depersonalized.

8.7. The User undertakes not to transmit through the Platform excessive personal data or information of heightened sensitivity (identity documents, bank details, medical information and others) unless this is required for the purposes of processing determined by the User.

9. Cookies and Similar Technologies

9.1. The Platform uses Cookies and similar technologies (pixel tags, web beacons, local storage) for the purposes of:
— ensuring authorization and preserving the User's session;
— personalizing the interface and saving settings;
— ensuring security;
— conducting analytics of the use of the Platform.

9.2. Upon the first visit to the Operator's website and the first sign-in to the Platform, the User is shown a notification on the use of Cookies with a link to this Policy.

9.3. The User has the right to manage Cookies independently through browser settings. Disabling Cookies may limit the functional capabilities of the Platform.

10. Final Provisions

10.1. Relations not regulated by this Policy shall be governed by the provisions of the Offer, the User Agreement and the legislation of the Republic of Kazakhstan.

10.2. The Operator has the right to unilaterally amend this Policy by posting a new version on the Operator's website no later than 14 (fourteen) calendar days prior to the date of entry into force of the amendments. Amendments resulting from the requirements of legislation or of authorized state bodies may be introduced within a shorter period necessary to ensure compliance with such requirements. The User shall be notified of amendments in the manner provided for by Section 11 of the Offer. Continued use of the Platform after the entry into force of the amendments shall constitute consent to the new version of this Policy.

10.3. The applicable law, the procedure for dispute resolution and the procedure for exchange of legally significant communications are determined by Section 12 of the Offer. The details and contact information of the Operator are specified in Section 13 of the Offer. The address for enquiries on matters of personal data processing: [email protected].

10.4. Legal succession. In the event of reorganization of the Operator, including merger, accession, division, spin-off and transformation, as well as upon disposal of part or all of the Operator's assets, personal data may be transferred to a legal successor or acquirer.

Such transfer shall be carried out subject to simultaneous compliance with the following conditions:
a) the legal successor or acquirer assumes the obligations to comply with the terms of this Policy in respect of the transferred personal data;
b) the scope and purposes of processing of personal data do not change without obtaining separate consent of the data subjects;
c) the transfer is carried out in accordance with the requirements of the legislation of the Republic of Kazakhstan.

The Operator or its legal successor shall notify Users of a transfer that has taken place in the manner provided for by Section 11 of the Offer.

10.5. This Policy may be published in the Russian, Kazakh and English languages. In the event of discrepancies between the language versions, the Russian language version shall prevail.