Privacy Policy

Effective date: May 4, 2026

Quick summary (not legally binding — the full policy below is what governs). Subindex AI collects personal information only when you provide it (account signup, contact forms, file submissions, support requests, etc.). When you submit data for AI-assisted research, we send it to third-party AI and search providers to generate your results — these providers are listed in the Third-Party AI and Data Providers section below, with links to their own privacy policies. We retain submitted content for up to one year, do not sell your data, and do not use your submissions to train AI models. You can request access to, correction of, or deletion of your personal information at any time by emailing eliyahu@eliyahu.ai.

This Privacy Policy describes the methods and purposes by which Subindex AI, Inc. and its wholly-owned subsidiaries (referred to as "Subindex AI," "we," "us," and "our") collect, process, and store information pertaining to individuals and users of our website, subindex.ai ("Website") and our AI-assisted research services. The information presented in this Privacy Policy includes the following topics:

  • Notice & Consent
  • Collection of Personal Information
  • Network Activity
  • Cookies (and Analytics)
  • AI Processing of User Data
  • Third-Party AI and Data Providers
  • Research
  • Marketing
  • Recruitment
  • Children's Online Privacy Protection
  • Transfer of Personal Information
  • Data Subject Rights
  • Exercising Your Rights
  • California Consumers' Privacy Rights
  • Security
  • Data Retention
  • International Data Transfers
  • How to Contact Us
  • Changes to This Privacy Policy

Subindex AI is a global company and works with sponsor organizations to ensure compliance with all applicable global and local data privacy requirements. This includes, but is not limited to, the Regulation (EU) 2016/679 (the General Data Protection Regulation, or GDPR) and its adoption into UK law through the Data Protection Act 2018. Additionally, Subindex AI recognizes the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA). Subindex AI is not a "Covered Entity" under the U.S. Health Insurance Portability and Accountability Act (HIPAA). However, Subindex AI may process protected health information ("PHI") subject to HIPAA requirements through contractual agreements with partner organizations, including instances where Subindex AI acts as a "Business Associate" as defined under HIPAA. Robust data privacy controls are in place throughout Subindex AI to ensure that the highest applicable standards of data privacy laws are met.

Notice & Consent

We collect and retain personal information in accordance with a relevant legal basis under data protection laws. We will inform individuals of the legal basis for processing their data (for example, consent, contractual necessity, legal obligation, or legitimate interest). If the legal basis is consent, we will provide appropriate information about how the data will be used and obtain the individual's explicit consent. This consent can be withdrawn at any time. If consent is withdrawn and it was the only legal basis for processing, we will stop processing that data (except in certain limited circumstances as allowed by law).

Where consent is not the legal basis for processing, Subindex AI may still choose to seek consent as a best practice or due to regulatory requirements (for instance, in research contexts), even if we also have another legal basis to continue processing the data. In such cases, we will clarify to individuals that although we are seeking consent, we may continue to use the data if another legal basis applies, even if consent is later withdrawn.

Collection of Personal Information

Subindex AI collects personal information only when an individual provides it to us directly. This can occur through actions such as registering on our Website, completing forms or sending emails, applying for job vacancies, placing orders for products or services, making inquiries or requests, volunteering for research, or similar situations in which an individual chooses to provide information. All personal information collected is stored in our secure databases and remains with Subindex AI or with data processors/servers acting on our behalf (and under our instruction). We do not pass an individual's personal information on to third parties for their own use without proper consent from the individual or unless legally required.

Network Activity

In general, you are not required to provide personal information just to use our Website. However, like most websites, certain information about your network activity is collected automatically for security and statistical purposes. This information may include the name of your Internet service provider, the website that referred you to our Website, the pages that you visit on our Website, and your device's IP address. This data could potentially be used to identify you, but we do not use it for that purpose. Instead, we use network activity data in aggregate form for statistical analysis (for example, to understand overall user traffic patterns), all while maintaining the anonymity of individual users.

In cases where personal information is provided to third parties to enable services you requested (or for other purposes you authorize), we rely on technical and organizational measures to ensure that all applicable data security regulations are followed. For example, your IP address may be logged by our systems for security monitoring and performance measurement, but it is retained for only a limited period (currently, IP logs are kept for approximately 4 weeks) and solely for those purposes.

Cookies

Cookies are small text files that are stored in a website visitor's browser cache. We use cookies to recognize your browser and optimize our Website's performance and usability. The data collected via cookies is not used to determine your personal identity. Most browsers are configured to accept cookies automatically, but you can adjust your browser settings to refuse cookies or to alert you when a cookie is being placed on your computer. Please note that if you disable cookies, some features of our Website may not function properly.

Google Analytics

We use Google Analytics to analyze user activity in order to improve our Website. Google Analytics uses cookies to collect information such as how often users visit the site, which pages they visit, and how they interact with page elements. We use this aggregated data to gain insights into site usage and to improve the functionality and user experience of the Website. Google Analytics operates independently from Subindex AI and has its own privacy policy, which we encourage you to review for information on how Google processes data. If you wish, you can opt out of Google Analytics tracking by installing a browser add-on provided by Google (for example, the Google Analytics Opt-out Browser Add-on).

Processing of Personal Information

Subindex AI will retain control and responsibility for any personal information you provide to us. We may store or process some data on servers located in jurisdictions outside of your home country (for example, in the United States), where data protection laws may differ from those in your jurisdiction. In all such cases, Subindex AI ensures that appropriate safeguards are in place. For instance, when personal information is processed in another country, we require that the data processor in that country protects the information to the same standards that apply under the laws of your country. These safeguards may include, as applicable, standard contractual data protection clauses, binding corporate rules, or an adequacy decision by relevant authorities.

AI Processing of User Data

If you submit files or other data to Subindex AI for processing (for example, by uploading text, tables, or documents and providing your email address to receive results), we will use automated tools to process that data for the purpose of delivering the service you requested. Subindex AI utilizes a number of third-party artificial intelligence model providers, web search providers, and scholarly data providers to analyze your submitted content, retrieve relevant information, and generate outputs. These third-party service providers may change from time to time, but in all cases they are bound to process your data only for our instructed purposes and to maintain adequate data protection standards. By using our AI-powered services, you acknowledge that your data will be transmitted to these third-party processors (which may be located in other countries, including the United States) solely to carry out the requested analysis.

Any processing of personal information through these AI services is fully automated. Importantly, this automated processing does not involve any profiling or automated decision-making that produces legal or similarly significant effects on you – it is used only to provide you with the requested analysis or information. Subindex AI does not use the content you submit to make decisions about you, and we do not profile individuals based on their submissions.

Subindex AI will retain a copy of the data you submit, as well as any resulting output, on our secure cloud storage (such as Amazon Web Services S3). We retain this data for up to one year, unless a longer retention period is required or permitted by law, or unless you request that we delete it sooner. We keep these submissions for purposes of facilitating any follow-up services you request, for debugging and troubleshooting our systems, and for improving the robustness of our tools (for example, by testing our algorithms on a variety of inputs to ensure they perform well). We implement industry-standard security measures to protect data stored on our cloud servers, including encryption of data at rest and in transit, as well as access controls to ensure that only authorized personnel can access your files.

We will not use or share the content of your submissions for any purposes other than those described above, unless we obtain your consent or are otherwise legally permitted to do so. In particular, we do not use your submitted content to train our own or third-party machine learning models. Our agreements with our AI service providers, and our routing configurations where applicable, stipulate that they will not use your data for their own purposes (such as improving their algorithms) without our permission.

Finally, if you provide an email address in connection with these services, we will use that email to send you the results of the processing or to communicate with you about your request. We may ask you to verify your email address to ensure that information is sent to the correct recipient. Any communications containing your results or personal data will be sent only to the email address you have provided (and confirmed).

Third-Party AI and Data Providers

To deliver our services, Subindex AI transmits portions of your submitted content to the following third-party providers. We have selected each provider based on its data handling practices and configure our integrations to minimize data exposure where possible. Each provider operates under its own privacy policy, which we encourage you to review:

  • Anthropic — large language model APIs. Privacy policy: <https: data-preserve-html-node="true"//www.anthropic.com/legal/privacy>
  • OpenAI — large language model APIs. Privacy policy: <https: data-preserve-html-node="true"//openai.com/policies/row-privacy-policy/>; API/enterprise data handling commitments (including that API content is not used for training by default): <https: data-preserve-html-node="true"//openai.com/enterprise-privacy/>
  • Perplexity — research and search APIs. Privacy policy: <https: data-preserve-html-node="true"//www.perplexity.ai/hub/legal/privacy-policy>
  • Google Cloud Vertex AI — large language model APIs hosted on Google Cloud. Privacy notice: <https: data-preserve-html-node="true"//cloud.google.com/terms/cloud-privacy-notice>
  • Google AI Studio API (Gemini API) — large language model APIs from Google. Privacy policy: <https: data-preserve-html-node="true"//policies.google.com/privacy>; additional API terms: <https: data-preserve-html-node="true"//ai.google.dev/gemini-api/terms>
  • OpenRouter — large language model routing service. We configure our OpenRouter integration to route requests only to provider endpoints that maintain an explicit Zero Data Retention (ZDR) policy, meaning your prompt and completion content is not retained by the underlying model provider. Privacy policy: <https: data-preserve-html-node="true"//openrouter.ai/privacy>; ZDR documentation: <https: data-preserve-html-node="true"//openrouter.ai/docs/guides/features/zdr>
  • Exa — web search and content retrieval API. Privacy policy: <https: data-preserve-html-node="true"//exa.ai/privacy-policy>
  • OpenAlex (operated by OurResearch / Impactstory, Inc.) — open scholarly metadata and search API. Queries to OpenAlex consist of search terms and identifiers about scholarly works, not personal data you submit. Privacy policy: <https: data-preserve-html-node="true"//openalex.org/OpenAlex_privacy_policy.pdf>
  • Semantic Scholar (operated by The Allen Institute for Artificial Intelligence, AI2) — open scholarly metadata and search API. Queries to Semantic Scholar consist of search terms and identifiers about scholarly works, not personal data you submit. Privacy policy: <https: data-preserve-html-node="true"//allenai.org/privacy-policy>

The set of providers above may change over time as we add, remove, or substitute services. Material changes will be reflected in this Privacy Policy. In all cases, we contractually require — or rely on documented provider policies for — protections consistent with this Privacy Policy.

Research

Individuals who wish to volunteer for research studies or activities with Subindex AI may be given the opportunity to register their interest. With the individual's consent, we may collect and maintain a database of personally identifiable information provided by the volunteer solely for the purpose of contacting them about relevant study opportunities (e.g., to recruit volunteers for specific research projects). Volunteers can choose to revoke their consent and withdraw from our research contact list at any time, as described above in the Notice & Consent section.

Subindex AI uses personal information collected from research participants to conduct scientific and health-related research aimed at improving healthcare and outcomes. As a research organization, Subindex AI has a legitimate interest in using information related to participants' health and care for research studies (when participants have agreed to take part in those studies). In practice, this means that when you act as a research subject, Subindex AI will use your data collected during the study in whatever ways are necessary to conduct and analyze the research.

Please note that certain data subject rights may be limited during a research study. For example, a participant's rights to access, change, or move their information might be restricted if fulfilling those requests could compromise the integrity of the research (we need to manage information in specific ways for research to remain reliable and accurate). If a participant withdraws from a study, Subindex AI will keep the information that has been gathered up to that point, but will not collect any new information going forward. To safeguard participants' privacy, we strive to use the minimum personally identifiable information necessary for our research purposes.

If you have volunteered for research and have concerns about how Subindex AI is handling your personal information, you may contact our Data Protection Officer (or equivalent privacy official) to investigate the issue. We will attempt to resolve any research-related privacy concerns. If you are not satisfied with our response, or if you believe we are processing your personal information unlawfully in the research context, you have the right to lodge a complaint with the appropriate data protection authority (for example, the UK Information Commissioner's Office (ICO) in the United Kingdom, or the Federal Trade Commission (FTC) in the United States, as applicable).

Marketing

If you provide us with your contact details (such as an email address) for direct marketing purposes, and you give consent for us to use it, we will send you communications about the latest news, updates, and information about Subindex AI. We will only retain minimal, non-sensitive contact information needed to carry out this marketing purpose. We will not share your contact details with third parties for their own marketing use without informing you and obtaining any necessary consent. You have the right to opt out of our marketing communications at any time – each marketing email will contain an unsubscribe link, or you can contact us directly to be removed from our marketing list.

Recruitment

If you apply for a job at Subindex AI (or otherwise engage with us regarding employment opportunities), we will process your personal information for purposes related to recruitment and hiring. This may include using your information to evaluate your application, to contact you about the recruitment process, to schedule interviews, and to facilitate any hiring decisions. We process job applicant data based on our legitimate interest in finding qualified candidates for our roles (and, where applicable, as necessary to potentially enter into an employment contract with you).

Subindex AI utilizes a third-party recruitment management system called TrackStar to organize and manage applications. Applicant data may be stored on TrackStar's servers for the duration of the recruitment process and in accordance with our retention policies. (TrackStar's own privacy policy can provide more details on how they protect applicant data.)

If you consent to it, Subindex AI may also consider you for job opportunities other than the specific one you applied for – for example, if we think you might be a good fit for a different position. With your consent, we can keep your profile data in our central recruitment database and reach out about such opportunities.

In some cases, we may collect your professional information from publicly available sources or third parties – for example, from job boards or through recruitment agencies – if we believe you could be suitable for an open position at Subindex AI. This information might include your name, contact details, and resume/CV. If we reach out to you based on such information, we will give you the option to let us know if you're interested (or not) in pursuing the opportunity. Any personal data gathered in this way will be used solely for recruitment purposes.

Subindex AI will use and share Personal Information about applicants and employees only in ways that are consistent with the purposes for which the information was originally collected or subsequently authorized by the individual. We take reasonable steps to ensure that personal information is accurate, complete, and up-to-date for its intended use.

Payment Processing

Payments for credits are processed by Stripe, Inc. acting as our payment processor. We do not store full payment card numbers on our servers; payment card information is collected and stored by Stripe under their own privacy and security practices. Stripe's privacy policy is available at <https: data-preserve-html-node="true"//stripe.com/privacy>. We receive limited transactional information from Stripe (such as the last four digits of your card, transaction amount, and time) for the purpose of operating your account, providing receipts, and resolving billing inquiries.

Children's Online Privacy Protection

Protecting children's privacy is extremely important to us. Our Website and services are not intended for children under 13 years of age, and we do not knowingly collect or process personal information from anyone under 13 without the verifiable consent of a parent or legal guardian. If we learn that we have inadvertently collected personal information from a child under 13 without proper consent, we will delete that information as soon as possible. If a parent or guardian has provided consent for a child's use of our Website, they have the right to review the information provided by the child and/or request that it be deleted at any time.

Transfer of Personal Information

When we transfer personal information to any third party, we do so in a manner consistent with the principles of notice and consent described above. If Subindex AI discloses personal information to an external third party (for example, a service provider), we will either: (i) ensure that the third party is subject to privacy obligations that align with the principles of this Privacy Policy (for instance, by verifying they adhere to a recognized data protection framework), or (ii) establish a contractual agreement with that third party requiring them to provide the same level of data protection as we do.

If we transfer your personal information outside of the European Economic Area (EEA) (or other regions with data transfer restrictions), we will make sure that one of the following conditions is met: (a) the destination country has been deemed to provide an "adequate" level of protection for personal data by the relevant authority (for example, the European Commission has issued an adequacy decision for that country), or (b) we have put in place appropriate safeguards to protect your data, such as a contract incorporating standard data protection clauses approved for use by the European Commission (or other competent authority), or binding corporate rules within our organization.

For any onward transfer of your personal information (meaning if a third party processes data on our behalf and then transfers it further), Subindex AI will remain responsible and liable under this Privacy Policy and applicable law if the subsequent third party fails to protect your information, unless we can prove we are not responsible for the event giving rise to the damage.

Please be aware that any personal information you submit for publication on our Website or through our services (for example, posting on a public forum or a comment section) may become publicly available around the world. We cannot prevent others from viewing or misusing personal information that you have made public in such a manner, so please exercise caution when deciding to disclose any personal information in public areas of our Website.

Data Subject Rights

Under applicable data protection laws (such as the GDPR and similar regulations), individuals have certain rights regarding their personal information. Please note that these rights are not absolute and may be subject to conditions or legal exceptions. In particular, we may need to verify your identity before fulfilling your request, and we may decline requests that are unfounded or excessive. We might also refuse a request if complying would adversely affect the rights and freedoms of others. Subject to these considerations, your rights include:

  • Right to Access: You have the right to ask us to confirm whether we are processing your personal information and, if so, to obtain a copy of the personal information we hold about you, as well as information on how we use it. We will provide the first copy of your data free of charge, but may charge a reasonable fee for additional copies if requested.
  • Right to Rectification: If any of your personal information held by Subindex AI is inaccurate or incomplete, you have the right to have it corrected or completed without undue delay.
  • Right to Erasure: You have the right to request that we delete your personal information without undue delay in certain circumstances. These include, for example, when the information is no longer necessary for the purposes for which it was collected, if you withdraw consent (where the processing was based on consent) and no other legal basis applies, if you object to processing and we have no overriding legitimate grounds to continue, or if we unlawfully processed your personal information. Note that this right is subject to general exclusions (for instance, we may retain data as needed to comply with legal obligations or to establish, exercise, or defend legal claims).
  • Right to Restrict Processing: You have the right to ask us to limit the processing of your personal information in certain situations. This right is available, for example, if you contest the accuracy of your data (for a period enabling us to verify it), if the processing is unlawful but you prefer restriction over deletion, if we no longer need the data but you need us to keep it for the establishment, exercise, or defense of legal claims, or if you have objected to our processing and are awaiting verification of whether our legitimate grounds override yours. When processing is restricted, we will still store your personal information but will not use it for other purposes without your consent or unless required for legal reasons.
  • Right to Object: You can object to our processing of your personal information when such processing is based on our legitimate interests (or those of a third party) or on a task carried out in the public interest, and your objection is based on grounds relating to your particular situation. We will then stop processing the data unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms, or unless the processing is required for us to establish or defend legal claims. Additionally, you have an unconditional right to object at any time to the processing of your personal information for direct marketing purposes. If you exercise this right, we will cease using your data for marketing. You may also object to processing of your data for scientific or historical research or statistical purposes on grounds relating to your particular situation, unless the processing is necessary for a task carried out for reasons of public interest.
  • Right to Data Portability: For personal information that you have provided to us, and where we are processing that information by automated means on the legal basis of your consent or a contract with you, you have the right to obtain it in a structured, commonly used, and machine-readable format. You also have the right to request that we transmit this data to another data controller, where technically feasible, without hindrance.
  • Right to Withdraw Consent: If we are processing your personal information based on your consent, you are entitled to withdraw that consent at any time. If you do so, we will stop the processing that was based on consent. Withdrawal of consent does not affect the lawfulness of any processing carried out before you withdrew consent.
  • Right to Complain: If you believe that our handling of your personal information infringes applicable data protection laws, you have the right to lodge a complaint with a supervisory authority. For example, in the UK you can contact the Information Commissioner's Office (ICO); in an EU country, you can contact your national or local data protection authority; and in the United States, you can contact the Federal Trade Commission (FTC) or your state's Attorney General's office.

Exercising Your Rights

If you wish to exercise any of these rights, you may contact us by sending a written request. The simplest way is to email us at eliyahu@eliyahu.ai with your request. You may also reach out by mail using the contact information provided in the How to Contact Us section below. Please include "Privacy Rights Request" in the subject line or correspondence, and clearly indicate which right(s) you wish to exercise and any relevant details.

We will respond to your request within the time frame required by law. In general, for requests under GDPR or similar laws, we will respond within one month of receiving your request (with the possibility of a reasonable extension, if needed, which we will communicate to you). For requests under the CCPA/CPRA (California law), we will respond within 45 days of receipt (with the possibility of a 45-day extension, if necessary).

Before fulfilling your request, we may need to ask for additional information to verify your identity (to ensure that we do not disclose or modify someone else's information improperly). For example, we might ask you to confirm some details we already have on file, or to provide a copy of an ID. If you are making a request through an authorized agent, we will require proof of that agent's authority to act on your behalf. We will not discriminate against you for exercising any of your privacy rights.

California Consumers' Privacy Rights

In addition to the rights outlined above, California residents have specific privacy rights under the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA). Please note that certain data collected for clinical research trials is exempt from CCPA/CPRA; however, the CCPA/CPRA does apply to personal information collected in other contexts (for example, information collected for job applications, employment, or when you use our Website and services in California).

California residents have the following rights with respect to their personal information:

  • Right to Know: You have the right to request that we disclose to you the following information about our data collection and data disclosures in the 12-month period preceding your request:
    • The categories of personal information we have collected about you.
    • The categories of sources from which the personal information was collected.
    • The categories of third parties to whom we disclosed personal information.
    • The business or commercial purpose for collecting your personal information.
    • The specific pieces of personal information that we have collected about you.
  • Right to Delete: (With certain exceptions) you have the right to request that we delete personal information we have collected from you. Once we receive and confirm a verifiable deletion request, we will delete (and direct our service providers/contractors to delete) your personal information from our records, unless an exemption applies. Please note that we may deny deletion requests if retaining the information is necessary for us or our service providers to complete a transaction or provide a service you requested, to detect security incidents or protect against malicious activity, to comply with legal obligations, or for certain other internal and lawful purposes as permitted by CCPA/CPRA.
  • Right to Correct: You have the right to request that we correct any inaccurate personal information we maintain about you. Upon receiving a verifiable request, we will use commercially reasonable efforts to correct the information as directed by you, taking into account the nature of the information and the purposes of processing.
  • Right to Opt-Out of Sale/Sharing: You have the right to opt out of the sale of your personal information, or the sharing of your personal information for cross-context behavioral advertising. However, Subindex AI does not sell personal information, and we do not share personal information in a manner that would be considered a "sale" or "sharing" under CCPA/CPRA. Because we do not engage in these practices, the opt-out right is not applicable to our operations.
  • Right to Limit Use of Sensitive Personal Information: You have the right to limit our use or disclosure of your sensitive personal information (as defined by California law) if we were to use it for purposes beyond those necessary to perform the services or provide the goods you request, or as otherwise permitted by law. At this time, Subindex AI does not use sensitive personal information for any purpose that would trigger this right beyond what is necessary to provide our services or as required by law.
  • Right to Non-Discrimination: You have the right not to receive discriminatory treatment from us for exercising any of your rights under CCPA/CPRA. We will not deny you goods or services, charge you a different price, or provide a different level or quality of services just because you exercised your privacy rights. (However, if you request the deletion of data that is necessary for us to provide a service, we may need to discontinue that service; we will inform you if that is the case so you can make an informed decision.)

Verification of Requests: If you are a California resident making a request to know, delete, or correct, we will need to verify your identity (and California residency) before acting on your request. We may ask you to provide information that matches data we already have (for instance, details of a recent transaction or interaction with us) or request a copy of a government-issued ID, in order to ensure we are dealing with the correct individual. If you use an authorized agent to submit a request on your behalf, we will require proof of the agent's authorization (for example, a signed permission from you). Absent such proof, we reserve the right to refuse the request.

We aim to respond to verifiable consumer requests within 45 days of receipt. If we need more time (up to an additional 45 days, for a maximum total of 90 days), we will inform you of the reason and extension period in writing within the initial 45-day period. Any personal information collected from you in connection with verifying or fulfilling your request will be used solely for that purpose and will be deleted after the request has been processed, in accordance with CCPA requirements.

Security

Subindex AI takes reasonable and appropriate precautions to protect personal information from loss, misuse, unauthorized access, disclosure, alteration, and destruction. We employ a variety of security measures to safeguard data, including technical measures such as encryption (both in transit and at rest, where applicable), firewalls, and secure server infrastructure. We also implement organizational measures, like strict access controls, so that employees and contractors only access personal data on a need-to-know basis for legitimate business purposes. We continuously review and update our security practices to maintain the confidentiality, integrity, and availability of personal information under our control.

Data Retention

Subindex AI retains personal information only for as long as is necessary to fulfill the specific purposes for which it was collected, and to comply with our legal or contractual requirements. This means that we will keep your data no longer than is justified by the reason it was collected. For example, if you submit content (such as files or text) for our AI services, we may retain that content for up to one year to allow for any follow-up processing you request, to debug or improve our services, or to use as test inputs to ensure our tools remain robust. We may retain data for longer periods if required by law, to protect our legal rights (such as in connection with litigation), or for other legitimate business purposes. In those cases, we will, where feasible, either isolate and securely store the data or maintain it in an archived form that limits access to only what is necessary for the stated purposes.

Once personal information is no longer needed for the purposes for which it was collected (and we are not legally required to retain it), we will either securely delete the information or anonymize it so that it can no longer be associated with an identifiable individual.

International Data Transfers

Subindex AI is based in the United States, and the personal information we collect and process is generally stored and processed in the United States. If you are located in the European Economic Area (EEA), the United Kingdom, Switzerland, or another jurisdiction with cross-border data transfer restrictions, your personal information may be transferred to, stored in, and processed in the United States or in other countries where our service providers operate.

Where we transfer personal information from the EEA, the UK, or Switzerland to the United States or to other countries that have not received an adequacy decision from the relevant authority, we rely on appropriate safeguards as required by applicable law. In particular, we rely on the Standard Contractual Clauses (SCCs) approved by the European Commission (and the equivalent UK International Data Transfer Addendum) in our agreements with service providers and other recipients of such data. Where additional safeguards are required (for example, supplementary measures following the Schrems II decision), we apply them as appropriate.

If you have questions about how we transfer personal information internationally, or would like to request a copy of the safeguards we use, please contact us using the information in the How to Contact Us section below.

How to Contact Us

Questions, comments, or complaints regarding the collection and processing of your personal information by Subindex AI can be directed to our team as follows:

Elliot Greenblatt – Founder, Subindex AI, Inc. 222 Concord Ave, Unit 1, Cambridge, MA 02138, USA Email: eliyahu@eliyahu.ai

We welcome your inquiries and will do our best to address any concerns you have about your privacy or this Privacy Policy.

Changes to This Privacy Policy

We may update or amend this Privacy Policy from time to time. When we make changes, we will also revise the "Effective Date" at the top of this document to indicate when the changes take effect. For any material changes to this Privacy Policy, we will provide prominent notice – for example, by posting an updated notice on our Website or via other appropriate communication channels – so that you are made aware of the changes. We encourage you to review this Privacy Policy periodically to stay informed about how we are protecting your information.