Privacy Policy

This Privacy Policy describes how TukaSolutions LLC, a Pennsylvania, USA limited liability company ("TukaSolutions", "we", "us"), handles personal information in connection with this website and the TukaSolutions CortexAI platform, a private business-to-business AI workflow platform for document-heavy operations, legal and immigration work, financial teams, chat, agents, integrations, voice and forms (the "Service").

We act in two distinct roles, and this policy treats them separately:

• Website and business relationship data. For information collected through this website and our direct business communications, we generally act as the controller (or equivalent term under applicable law).
• Customer Content. For documents, prompts, outputs, connected data, voice data and other content that a business customer submits to or processes through the Service, we generally act as a processor or service provider on the customer's behalf. The customer's own privacy notice and our agreement with that customer, including any Data Processing Addendum, govern that processing.

Information you provide on this website

• Contact, demo request and quiz or assessment submissions, including the responses you choose to enter.
• Business identifiers such as name, work email, phone number, company, job title and industry.
• Communications you send us, including emails and meeting notes relating to your inquiry.

Information collected automatically

• Technical and log data such as IP address, browser type, device information, pages requested, referring URL, timestamps and security events (for example, rate-limiting or abuse-prevention signals).

Customer Content processed through the Service

• Documents, prompts, AI outputs, workflow records and data from systems a customer chooses to connect, and voice recordings or transcripts only where a customer has configured voice features. We process this content on the customer's instructions.

We use personal information for the following purposes. Where laws such as the GDPR or UK GDPR apply, we rely on the lawful bases indicated:

• Responding to inquiries, demos and assessments — steps at your request prior to a contract, or our legitimate interest in responding to business inquiries.
• Providing, supporting and securing the Service — performance of a contract with the customer, and legitimate interests in operating a secure service.
• Security, fraud and abuse prevention, and troubleshooting — legitimate interests and, where applicable, legal obligations.
• Business communications about our offerings — legitimate interests or, where required, your consent, which you may withdraw at any time.
• Compliance, record-keeping and the establishment or defense of legal claims — legal obligations and legitimate interests.

Access to personal information is limited to personnel and service providers who need it for these purposes, and to the minimum reasonably necessary.

Consistent with our public commitment, your data is not used to train AI models. We do not use Customer Content to train or improve general-purpose AI models.

"Processing" is different from "training." To deliver the Service, Customer Content may be sent to AI models for analysis and generation, and data may be transmitted to or retrieved from third-party systems that the customer has authorized through connectors or integrations. That processing occurs to perform the customer's requested tasks. Which model providers and hosting arrangements are used can vary by deployment and configuration.

We do not sell personal information. We may share information:

• With service providers that host, secure, support or operate the website and Service under contractual obligations. The specific provider inventory depends on deployment and will be made available as described in our agreements.
• With third-party systems and model providers that a customer authorizes or configures.
• When required by law, legal process or governmental request, or to protect rights, safety and security.
• In connection with a merger, acquisition, financing, reorganization or sale of assets, subject to appropriate confidentiality protections.
• With your direction or consent.

This website may load resources such as fonts, images or logos from external hosts. When your browser requests those resources, the host may receive your IP address and standard browser information. The website may also use browser storage (such as local storage) to remember interface preferences. We do not describe this website as tracking-free; you can limit such storage and requests through your browser settings.

We retain personal information only as long as reasonably necessary for the purposes described, taking into account the nature of the information, the status of the business relationship, security needs, contractual commitments and legal requirements.

Customer Content is retained, exported and deleted according to the customer's agreement and instructions. Deleted data may persist for a limited period in backups until they are overwritten, and may be retained longer where required by law or legal hold, in which case it is kept isolated from active use.

Depending on where you live, you may have rights to access, correct, delete or obtain a copy of your personal information, to object to or restrict certain processing, to withdraw consent, and to opt out of certain disclosures. Where applicable law provides a right to appeal a decision on your request, you may do so by replying to our response. You may also have the right to lodge a complaint with a data protection or other supervisory authority.

We will not discriminate against you for exercising your rights. We may need to verify your identity before acting, and authorized agents may need to provide proof of authority.

If your information is Customer Content held on behalf of one of our business customers, please contact that customer directly. If we receive such a request, we will route it to the relevant customer as our agreements require.

To make a request, contact privacy@tukatek.com.

We use administrative, technical and organizational measures designed to protect personal information, appropriate to the nature of the data and risks involved. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

TukaSolutions is based in the United States, and information may be processed in countries other than where you reside. Where applicable law requires a transfer mechanism, we will implement an appropriate safeguard for that transfer. Such safeguards are not assumed to apply automatically and are identified in the relevant agreement.

The website and Service are intended for businesses and are not directed to children. We do not knowingly solicit personal information directly from children. Customer Content may contain information about minors, for example in a customer's immigration case records; the customer is responsible for the lawful basis and any required permissions for that processing. If you believe a child has directly provided information to us through this website, contact us and we will take appropriate steps.

We may update this policy from time to time. We will post the updated version with a revised date and, where changes are material, provide additional notice as appropriate.

TukaSolutions LLC, Pennsylvania, USA. Privacy and legal contact: privacy@tukatek.com. See also our Terms of Service.