Platform Privacy Policy

Plain-language summary: We're transparent about what we collect, how we use it, and what your rights are. The full text below is the legally-binding version. If anything seems unclear, email legal@junkdna.ai.

1. Scope

This Platform Privacy Policy describes how JunkDNA AI, Inc. handles personal data within the JunkDNA.AI service (the "Platform"). It is separate from the Website Privacy Policy, which governs the public-facing site.

2. Data We Process

The Platform processes the personal data you authorize us to propagate — typically: name, current and prior addresses, contact information, and per-institution identifiers (account numbers, member numbers, etc., as needed for routing). We use minimization: we hold only what is necessary to authenticate, route, and audit the updates you direct.

3. Architectural Principles

We do not centrally store bulk copies of your sensitive personal data. Instead, we hold encrypted pointers, hardware-backed keys, and the cryptographic provenance records needed to authorize and audit each update. Your data is encrypted in transit and at rest, with hardware-backed key storage, and is propagated only to institutions you have explicitly authorized.

4. How We Use Personal Data

(a) To execute the propagation transactions you authorize; (b) to maintain audit trails for security, compliance, and your benefit; (c) to detect and prevent fraud and abuse; (d) to communicate with you about your account; (e) to comply with legal obligations.

5. Sharing With Institutions

The whole point of the Platform is to share authorized updates with the institutions you specify. Each share is logged, signed, and revocable. We do not share with institutions you have not authorized.

6. Service Providers

We use vetted service providers (cloud hosting, encryption-key management, email delivery, monitoring) under written confidentiality and data-protection agreements (DPAs). We require them to meet at least our security standards.

7. Your Rights

You have rights to: access all personal data we hold, correct inaccuracies, delete your data (subject to legal-hold exceptions), export a portable copy, revoke any institution's authorization, and object to specific processing. Exercise these rights from your account dashboard or by emailing privacy@junkdna.ai.

8. Compliance Frameworks

The Platform is engineered to comply with HIPAA (where healthcare data is in scope), GLBA (financial data), CCPA / CPRA (California), GDPR (EU), PIPEDA (Canada), and similar regimes. We continuously update our compliance posture as new requirements come into effect.

9. International Transfers

If we transfer personal data internationally, we use Standard Contractual Clauses (SCCs) or other lawful transfer mechanisms.

10. Data Retention

We retain personal data for as long as your account is active. After account termination, we delete personal data within 90 days, except for cryptographic audit records that we retain for 7 years for fraud-prevention and legal-compliance purposes.

11. Security Incidents

If we become aware of a security incident affecting your personal data, we will notify you without undue delay, consistent with applicable law.

12. Children's Privacy

The Platform is not directed at minors. Accounts may only be opened by individuals 18 or older.

13. Changes

We may update this policy; material changes will be communicated at least 30 days in advance.

14. Contact

Privacy questions? Email privacy@junkdna.ai or our DPO at dpo@junkdna.ai.