Privacy Policy

1 Who We Are

Crizac Limited ("Crizac", "we", "us", "our") is a company incorporated in the United Kingdom. Crizac is listed on BSE and NSE. We operate the Crizac Ai Studio platform, including the LLM Citation Intelligence product (Model II) and the AI-Conducted Compliance Interview product (Model I).

We are the data controller for personal data processed through our platform and services. Our registered office is in the United Kingdom.

2 Data We Collect

We collect information in the following categories:

• Identity & Contact Data: Name, email address, job title, institution name, phone number when provided.
• Account Data: Access credentials, session tokens, usage preferences, and security settings.
• Platform Usage Data: Prompts submitted to LLM Citation Intelligence, results viewed, reports generated, timestamps, and interaction logs.
• Lead & Enquiry Data: Information submitted through interest or access request forms.
• Technical Data: IP address, browser type and version, device identifiers, operating system, referral URLs, and page interaction data.
• Communication Data: Records of correspondence with us, including support requests and feedback.

We do not collect sensitive special-category personal data (such as health, biometric, or religious data) unless specifically required for a contracted compliance service and disclosed separately.

3 How We Use Your Data

We use your data to:

• Provide, operate, and improve the Crizac Ai Studio platform and its products.
• Process access requests, onboard institutional partners, and manage accounts.
• Deliver LLM Citation Intelligence reports and analysis to authorised users.
• Send service communications, product updates, and important notices.
• Respond to enquiries and provide customer support.
• Conduct research and development to improve AI model performance (using anonymised or aggregated data only).
• Comply with applicable laws, regulations, and legal obligations.
• Detect, prevent, and address fraud, security incidents, and abuse of our platform.

We will not use your personal data for automated decision-making that produces significant legal effects without appropriate human oversight and disclosure.

4 Legal Basis for Processing

Under UK GDPR, we rely on the following legal bases:

• Contract: Processing necessary to perform our agreement with you or your institution.
• Legitimate Interests: Operating and improving our services, preventing fraud, and communicating with prospective clients — where these interests are not overridden by your rights.
• Legal Obligation: Complying with applicable UK and international laws.
• Consent: For optional communications such as product newsletters and marketing updates. You may withdraw consent at any time.

5 Sharing of Data

We do not sell your personal data. We may share data with:

• Service Providers: Cloud infrastructure, database hosting (Supabase), email delivery, and analytics providers operating under appropriate data processing agreements.
• AI Model APIs: When you submit prompts, queries are processed by third-party large language model APIs (including OpenAI, Anthropic, Google, Perplexity, xAI, and DeepSeek). These providers have their own data policies; prompt data is transmitted solely to generate the service output.
• Institutional Clients: Where we operate services on behalf of an institution, results and reports are shared with authorised personnel of that institution.
• Legal Authorities: Where required by law, court order, or to protect our rights.

All third-party processors are subject to contractual obligations consistent with this policy and applicable data protection law.

6 Data Retention

We retain personal data for as long as necessary to fulfil the purposes for which it was collected, including for the duration of any contractual relationship, and for a period after to meet legal and regulatory obligations.

• Account and platform usage data: retained for the duration of your active account, plus up to 3 years.
• Lead and enquiry data: retained for up to 2 years from last contact.
• Legal and financial records: retained for up to 7 years in accordance with UK regulatory requirements.

After the applicable retention period, data is securely deleted or anonymised.

7 Your Rights

Under UK GDPR you have the following rights in respect of your personal data:

• Access: Request a copy of the data we hold about you.
• Rectification: Request correction of inaccurate or incomplete data.
• Erasure: Request deletion of your data where there is no overriding legitimate purpose for retention.
• Restriction: Request that we restrict processing of your data in certain circumstances.
• Portability: Receive data you have provided in a structured, machine-readable format.
• Objection: Object to processing based on legitimate interests or for direct marketing.
• Withdraw Consent: Withdraw consent at any time where processing is consent-based.

To exercise any of these rights, please contact us at the address below. We will respond within 30 days. You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk.

8 Cookies

We use cookies and similar technologies on our platform for the following purposes:

• Essential cookies: Required for authentication, session management, and platform security.
• Analytics cookies: To understand how users interact with our platform (anonymised where possible).
• Preference cookies: To remember your settings and preferences.

You can manage cookie preferences through your browser settings. Disabling essential cookies may affect platform functionality.

9 International Data Transfers

Some of our service providers and AI model APIs may process data outside the United Kingdom. Where such transfers occur, we ensure appropriate safeguards are in place, including standard contractual clauses approved by the ICO or reliance on adequacy decisions.

Specifically, LLM API queries may be processed in the United States and other jurisdictions. By using LLM Citation Intelligence, you acknowledge this cross-border processing for the purpose of generating your requested output.

10 Contact Us

For privacy-related enquiries, data subject requests, or to report a concern, please contact us:

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on our platform and, where appropriate, by email. The effective date at the top of this document will reflect the date of the most recent revision.