PRIVACY POLICY

Last updated February 11, 2026

Introduction
Welcome to Clarity (the “Service”), provided by A Brilliant Way Inc. (“we,” “us,” or “our”). This Privacy Policy explains how we collect, use, share, and protect your information when you use the Service. Our core philosophy is Data Sovereignty: we believe your data is a liability, not an asset for us to harvest. We operate on a “Zero-Retention” architecture for generative inputs, as described in detail below.This Policy applies to all users of the Service regardless of location. If you are located in the European Economic Area (“EEA”), United Kingdom, Switzerland, California, or another jurisdiction with specific privacy legislation, please review the jurisdiction-specific provisions in Section 10.

Information We Collect
2.1 Account Information. When you create an account and establish your initial credit balance, we collect your email address and authentication credentials (stored in hashed form).

2.2 Payment Information. All financial transactions (initial credit purchases and top-ups) are processed by our third-party payment processors: Stripe, Inc., PayPal and Paddle.com Market Limited. We receive a transaction confirmation and the last four digits of your payment method from these processors. We do not receive or store full credit card numbers, CVVs, or bank account numbers on our servers.

2.3 User Content (The Zero-Retention Standard). User Content includes the text, prompts, and files you submit for Peer Review.

• In-Transit Processing. When you submit User Content, it is encrypted in transit (TLS 1.3) and transmitted to our orchestration servers, which route it to one or more upstream AI model providers solely for the purpose of generation and verification. During an active session, User Content may reside temporarily in encrypted memory on our orchestration servers and in the processing pipelines of our upstream model providers.
• Post-Session Deletion. When your session ends (either by explicit closure or after 30 minutes of inactivity), all User Content is purged from our orchestration servers, including from volatile memory, application-level caches, and any temporary storage. This deletion is performed programmatically and is irreversible.
• User-Elected Retention. If you explicitly elect to save a session to your personal history, that session’s content is stored in encrypted form on our servers and is retained until you delete it or close your account, whichever occurs first.
• Exclusions. Our Zero-Retention Standard applies to our systems only. Once User Content is transmitted to an upstream AI model provider, that provider’s data handling is governed by the enterprise agreements described in Section 4. We do not operate CDN edge caches, backup systems, or other persistence layers that retain User Content beyond the active session window.

2.4 Usage Data. We collect the following telemetry data to optimize the performance of the Intelligent Routing engine:

• API response latency (measured in milliseconds, not attributable to individual users)
• System error rates, uptime metrics, and routing path performance
• Feature usage frequency (e.g., how often the Revision Protocol is invoked, aggregated across all users)

This data is aggregated and stripped of direct identifiers (email, account ID, IP address) before storage. We do not attempt to re-identify aggregated usage data. Usage data is retained for 18 months from the date of collection, after which it is permanently deleted.

3. How We Use Your Information
We use the information described in Section 2 for the following purposes:

• Service Delivery. To provide the Peer Review, Revision Protocol, and Intelligent Routing services.
• Account and Billing Management. To manage your Wallet, credit balance, and transaction history.
• Fraud Prevention. To detect and prevent abuse, including velocity monitoring through our Burst Shield system.
• Service Improvement. To analyze aggregated usage data (as defined in Section 2.4) for the purpose of improving system performance, reliability, and routing efficiency.
• Communications. To send you transactional emails related to your account (e.g., low-balance alerts, policy change notifications). We do not send marketing emails.
• Legal Compliance. To comply with applicable laws, regulations, and legal processes.

No Training Clause. Clarity is an orchestration layer. We do not operate proprietary foundation models. We do not use your User Content to train, fine-tune, or improve any machine learning model, whether owned by us or by any third party. We enforce this commitment through enterprise-level data processing agreements with every upstream model provider in our roster (see Section 4), each of which contains explicit contractual prohibitions on using Customer Data for model training or improvement. We audit compliance with these agreements on an annual basis.

4. Data Sharing and Subprocessors
We do not sell, rent, or trade your personal data. We share data only with the following categories of recipients:

4.1 AI Model Providers. User Content is transmitted to third-party AI model providers solely for the purpose of generation and verification. As of the date of this Policy, our provider roster includes Anthropic, DeepSeek, Groq, OpenAI, OpenRouter, and xAI. Each provider is bound by an enterprise data processing agreement that prohibits the use of your data for model training. We do not disclose which specific models are used within each provider’s platform. When we add a new provider to our roster, we will notify users via email at least 14 days before the new provider begins processing User Content. If you object to a new provider, you may close your account and receive a refund of your remaining credit balance.

4.2 Payment Processors. Transaction data is shared with Stripe, Inc., PayPal and Paddle.com Market Limited solely to facilitate the purchase and management of credits.
4.3 Infrastructure Providers. We host our orchestration servers on Vercel. This provider processes data on our behalf under a data processing agreement that includes confidentiality, security, and data deletion obligations.

4.4 Legal Requirements. We may disclose your information if required to do so by law, including in response to a subpoena, court order, or other legal process issued by a court of competent jurisdiction in any applicable jurisdiction, or if we reasonably believe disclosure is necessary to comply with applicable law, protect the rights or safety of any person, or prevent fraud. Where legally permitted, we will notify you before making such a disclosure.

4.5 Business Transfers. In the event of a merger, acquisition, or sale of all or a portion of our assets, your information may be transferred to the acquiring entity. We will notify you via email before your information becomes subject to a different privacy policy.

5. International Data Transfers
A Brilliant Way Inc. is based in the United States. If you access the Service from outside the United States, your information will be transferred to, stored, and processed in the United States. If you are located in the EEA, United Kingdom, or Switzerland, we rely on the European Commission’s adequacy decision for the EU-U.S. Data Privacy Framework, or, where applicable, Standard Contractual Clauses (SCCs) approved by the European Commission, to provide appropriate safeguards for the transfer of your personal data. You may request a copy of the applicable transfer mechanism by contacting us at privacy@abrilliantway.com.

6. Data Retention
We retain different categories of data for different periods: