Summary:

Data Collection: instantAIguru (and its hy-rag.com service and The School Guru site, theschoolguru.com) collects a wide range of data, including user conversations, geolocation data, network activity information, transaction history, contact details, device and browser cookies, and log data like IP addresses.

Usage of Data: The collected data is used to improve instantAIguru's natural language process models, applications, and services. This may include improving instantAIguru's conversational abilities and contextual understanding. This does not apply to data received from Google or Microsoft Workspace APIs, which is governed by “Calendar Integrations and Google Workspace Data” below and is never used to develop, train or improve any model.

Data Sharing: instantAIguru may disclose collected data to affiliates, vendors, service providers, law enforcement, and parties involved in transactions.

Privacy Concerns: The policy acknowledges certain privacy risks, such as the potential for sensitive user data to be used in training the language models used by related OpenAI's services, Google Generative AI, Amazon Bedrock, or Meta's Model API, as well as instantAIguru self-improving and related processes. instantAIguru takes steps to reduce personal information in training datasets before use. Data received from Google or Microsoft Workspace APIs is excluded from this entirely and never enters a training dataset.

Recommendations for Users: Users are advised to manage what information they input into instantAIguru, considering the possibility of data analysis by instantAIguru staff during research, development, and training. This does not extend to data received from Google or Microsoft Workspace APIs, which is not used for research, development or training.

Business Use: Companies are advised to use instantAIguru cautiously, especially regarding sensitive company data. Guidelines suggest securing instantAIguru accounts with strong, unique passwords and two-factor authentication.

instantAIguru is powered by OpenAI's models, Google Generative AI models, Amazon Bedrock models, and Meta's Model API models and therefore most/all of user data is likely shared with these providers large language models. This does not apply to data received from Google or Microsoft Workspace APIs, which is governed by “Calendar Integrations and Google Workspace Data” below and is never shared with any model provider. User is cautioned to review OpenAI's privacy policy at: https://openai.com/privacy/

Calendar Integrations and Google Workspace Data

Calendar integration is optional. When you connect a Google or Microsoft calendar, we access it only to display availability and to create, update or cancel appointments.

The use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Calendar data is handled exclusively by our deterministic scheduling engine. It is never sent to, processed by, or used to train any large language model or foundation model, including OpenAI, Google Generative AI and Amazon Bedrock. This applies to raw, aggregated and derived data alike. We do not transfer or sell calendar data and we do not use it for advertising.

We store only what is needed to manage the appointments we create: the event identifier, its time, a link to it, and the meeting title we generate. Access tokens are encrypted at rest. You can disconnect at any time, which revokes our access and deletes the stored tokens.

1. Personal information we collect

We collect personal information relating to you ("Personal Information") as follows:

Personal Information You Provide: We collect Personal Information if you create an account to use our Services or communicate with us as follows:

• Account Information: When you create an account with us, we will collect information associated with your account, including your name, contact information, account credentials, payment card information, and transaction history, (collectively, "Account Information").
• User Content: When you use our Services, we collect Personal Information that is included in the input, file uploads, or feedback that you provide to our Services ("Content").
• Communication Information: If you communicate with us, we collect your name, contact information, and the contents of any messages you send ("Communication Information").
• Social Media Information: We have pages on social media sites like Instagram, Facebook, Medium, X (formerly Twitter), YouTube and LinkedIn. When you interact with our social media pages, we will collect Personal Information that you elect to provide to us, such as your contact details (collectively, "Social Information"). In addition, the companies that host our social media pages may provide us with aggregate information and analytics about our social media activity.
• Other Information You Provide: We collect other information that you may provide to us, such as when you participate in our events or surveys or provide us with information to establish your identity (collectively, "Other Information You Provide").

Personal Information We Receive Automatically From Your Use of the Services: When you visit, use, or interact with the Services, we receive the following information about your visit, use, or interactions ("Technical Information"):

• Log Data: Information that your browser or device automatically sends when you use our Services. Log data includes your Internet Protocol address, browser type and settings, the date and time of your request, and how you interact with our Services.
• Usage Data: We may automatically collect information about your use of the Services, such as the types of content that you view or engage with, the features you use and the actions you take, as well as your time zone, country, the dates and times of access, user agent and version, type of computer or mobile device, and your computer connection.
• Device Information: Includes name of the device, operating system, device identifiers, and browser you are using. Information collected may depend on the type of device you use and its settings.
• Cookies: We use cookies to operate and administer our Services, and improve your experience. A "cookie" is a piece of information sent to your browser by a website you visit. You can set your browser to accept all cookies, to reject all cookies, or to notify you whenever a cookie is offered so that you can decide each time whether to accept it. However, refusing a cookie may in some cases preclude you from using, or negatively affect the display or function of, a website or certain areas or features of a website.
• Analytics: We may use a variety of online analytics products that use cookies to help us analyze how users use our Services and enhance your experience when you use the Services.
• Server-Side Analytics Architecture: Unlike most websites which load advertising and analytics scripts directly into your browser, we process analytics events through our own infrastructure (a Cloudflare Worker we operate at data.instantaiguru.com) before forwarding them to third-party measurement and advertising providers. This reduces third-party JavaScript exposure on your device, limits browser fingerprinting, and gives us greater control over what data is shared with which providers and when.

1A. Cookies We Use

We set first-party cookies in three categories, subject to your consent preferences (see "Consent Management" below):

• Strictly necessary: session continuity, counting a visit once, remembering your consent choices and your region's default consent rules, and recognizing your account relationship after you sign in. These hold random identifiers or a hashed identity, never plain-text personal data. They last up to 2 years.
• Analytics: an analytics identifier that lets us count your visits across sessions. Set with analytics consent; lasts up to 2 years.
• Advertising: the advertising click identifier that brought you to our site, so a later signup or purchase can be attributed to that ad. Set only with advertising consent; lasts up to 1 year.

Apart from one advertising partner's pixel, which loads only with advertising consent and sets that partner's own cookies, we do not load third-party advertising pixels in your browser. You can change your choices at any time through Cookie Preferences.

1B. Consent Management

Cookies and analytics events on this site are governed by a first-party consent management platform that we operate ourselves. Your default state depends on your location. In the EEA, the UK, Switzerland, and other prior-consent jurisdictions — and for any visitor we cannot geolocate — all non-essential cookies, analytics, and advertising are denied by default until you opt in via the cookie banner. In the United States and other opt-out jurisdictions, analytics and advertising measurement are enabled by default and you may opt out at any time using the banner's "Manage Preferences" controls or the "Do Not Sell or Share My Personal Information" link. Advertising measurement includes sharing measurement data with advertising measurement partners; opting out of the Advertising category — or using "Do Not Sell or Share," or a browser Global Privacy Control (GPC) signal — stops that sharing. You can change your preferences at any time.

Global Privacy Control: We honor the browser-level Global Privacy Control (GPC) signal. If your browser asserts GPC, we treat advertising-related categories (ad_storage, ad_user_data, ad_personalization) as denied regardless of cookie banner choices, consistent with California, Colorado, Connecticut, and other state-law requirements.

Google Analytics Consent Mode v2: When transmitting analytics events to Google Analytics, we include explicit consent flags (analytics_storage, ad_storage, ad_user_data, ad_personalization) per Google's Consent Mode v2 specification. This allows Google to model aggregate measurements rather than track individual users when you have not granted advertising consent.

Operational Analytics under Legitimate Interest: Even when you have not granted analytics consent, we process a minimal set of anonymized event data for operational measurement of product usage, funnel performance, and Core Web Vitals under GDPR Article 6(1)(f) legitimate interest. These cookieless events are forwarded to Google Analytics 4 with explicit "denied" Consent Mode v2 flags, so Google's modeling layer produces aggregate metrics without retaining individual identity.

The anonymized data includes page URL, event name, timestamp, country/region level geolocation, and a per-event random identifier. The following are explicitly excluded: personal information (email, name, account identifiers), cookie-derived identifiers (the analytics identifier and any advertising cookie or click identifiers), and session identifiers. These events are not forwarded to advertising measurement partners or business enrichment providers. You can object to this processing at any time at [email protected].

Onboarding under Contract Necessity: When you initiate signup or build flows on our site (entering your email, verifying via OTP, requesting a Guru build, submitting our contact form), we process the events necessary to provide that service under GDPR Article 6(1)(b), which covers performance of a contract or pre-contractual measures requested by you. These events include your email address (hashed before forwarding to analytics platforms), your first and last name (hashed), the domain you provided, the build status, and, where a step does not complete, which step stopped and the technical reason (for example an unfinished human verification check). Processing on this basis is independent of your cookie/analytics consent decisions, because the processing is necessary to deliver the service you have requested. We do not use this contract-necessity data for advertising or forward it to advertising measurement partners unless you have separately granted advertising consent.

2. How we use personal information

We may use Personal Information for the following purposes:

• To provide, administer, maintain and/or analyze the Services;
• To improve our Services and conduct research;
• To communicate with you; including to send you information about our Services and events;
• To develop new programs and services;
• To prevent fraud, criminal activity, or misuses of our Services, and to protect the security of our IT systems, architecture, and networks;
• To carry out business transfers; and
• To comply with legal obligations and legal process and to protect our rights, privacy, safety, or property, and/or that of our affiliates, you, or other third parties.

Email and Marketing Communications. When you submit our contact form or begin onboarding or signup on our site (for example, entering your email address, verifying via OTP, or requesting a Guru build), you are added to our email list and consent to receive related communications from us, including product updates, newsletters, and other marketing messages. Service and transactional emails (such as account, billing, and security notices) are sent as part of providing the Services. You may opt out of marketing emails at any time using the unsubscribe link included in every such email, or by emailing [email protected]; opting out of marketing does not stop transactional messages necessary to operate your account.

Aggregated or De-Identified Information. We may aggregate or de-identify Personal Information so that it may no longer be used to identify you and use such information to analyze the effectiveness of our Services, to improve and add features to our Services, to conduct research and for other similar purposes. In addition, from time to time, we may analyze the general behavior and characteristics of users of our Services and share aggregated information like general user statistics with third parties, publish such aggregated information or make such aggregated information generally available. We may collect aggregated information through the Services, through cookies, and through other means described in this Privacy Policy. We will maintain and use de-identified information in anonymous or de-identified form and we will not attempt to reidentify the information, unless required by law.

As noted above, we may use Content you provide us to improve our Services, for example to train the models that power instantAIguru.

3. Disclosure of personal information

In certain circumstances we may provide your Personal Information to third parties without further notice to you, unless required by the law:

• Vendors and Service Providers: To assist us in meeting business operations needs and to perform certain services and functions, we may provide Personal Information to vendors and service providers, including providers of hosting services, customer service vendors, cloud services, email communication software, web analytics services, and other information technology providers, among others. Pursuant to our instructions, these parties will access, process, or store Personal Information only in the course of performing their duties to us.
• Business Transfers: If we are involved in strategic transactions, reorganization, bankruptcy, receivership, or transition of service to another provider (collectively, a "Transaction"), your Personal Information and other information may be disclosed in the diligence process with counterparties and others assisting with the Transaction and transferred to a successor or affiliate as part of that Transaction along with other assets.
• Legal Requirements: We may share your Personal Information, including information about your interaction with our Services, with government authorities, industry peers, or other third parties (i) if required to do so by law or in the good faith belief that such action is necessary to comply with a legal obligation, (ii) to protect and defend our rights or property, (iii) if we determine, in our sole discretion, that there is a violation of our terms, policies, or the law; (iv) to detect or prevent fraud or other illegal activity; (v) to protect the safety, security, and integrity of our products, employees, or users, or the public, or (vi) to protect against legal liability.
• Affiliates: We may disclose Personal Information to our affiliates, meaning an entity that controls, is controlled by, or is under common control with instantAIguru. Our affiliates may use the Personal Information we share in a manner consistent with this Privacy Policy.
• Business Account Administrators: When you join a instantAIguru Enterprise or business account, the administrators of that account may access and control your instantAIguru account. In addition, if you create an account using an email address belonging to your employer or another organization, we may share the fact that you have an instantAIguru account and certain account information, such as your email address, with your employer or organization to, for example, enable you to be added to their business account.
• Other Users and Third Parties You Share Information With: Certain features allow you to display or share information with other users or third parties. For example, you may share instantAIguru conversations with other users via sharing features (like groups), links or send information to third-party applications via custom actions for GPTs. Be sure you trust any user or third party with whom you share information.

Categories of Recipients. Beyond the general vendors above, the following categories of recipients may receive Personal Information from us. Each is bound by its Data Processing Agreement, Standard Contractual Clauses where international transfers require them, or both. We maintain a current list of the companies in each category and will provide it on request at [email protected].

• Analytics providers: measure how our sites are used. They receive page and event data and an analytics identifier with your analytics consent, and only the anonymized events described in section 1B without it.
• Advertising measurement partners: attribute visits and conversions to the advertising campaigns that led to them, including connected-TV campaigns matched at the household level. With your advertising consent only, they may receive your IP address and browser type, the type, time and value of a page view or conversion, an advertising click identifier, and hashed identifiers (see below). With advertising consent, one of them also runs its own pixel in your browser (see section 1A).
• Infrastructure and security providers: deliver and protect our sites, including bot management, the invisible human check (Turnstile), and the server-side pipeline that processes our analytics. They receive request data such as your IP address and browser type.
• Business enrichment providers: identify the organization that owns the network a visit comes from, for B2B sales context. They receive your IP address, not your individual identity.
• AI model providers: power instantAIguru's conversational features, as disclosed in the summary above.

Hashed Identifiers Sent to Advertising Partners. When we transmit conversion or attribution data to advertising measurement partners, we apply one-way SHA-256 hashing to identifying fields (email address, first name, last name, and an internal external_id derived from your account domain) before transmission. The partner can match these hashes against its own hash of the same identifier (if it has one) for measurement and attribution, but cannot recover the underlying personal data from the hash. This implements the privacy-preserving "Enhanced Conversions" / "Conversions API" patterns the advertising platforms recommend.

4. Your rights

Depending on location, individuals may have certain statutory rights in relation to their Personal Information. For example, you may have the right to:

• Access your Personal Information and information relating to how it is processed.
• Delete your Personal Information from our records.
• Rectify or update your Personal Information.
• Transfer your Personal Information to a third party (right to data portability).
• Restrict how we process your Personal Information.
• Withdraw your consent, where we rely on consent as the legal basis for processing at any time.
• Object to how we process your Personal Information.
• Lodge a complaint with your local data protection authority.

You can exercise some of these rights through your instantAIguru account. If you are unable to exercise your rights through your account, please submit your request through [email protected].

A note about accuracy: Services like instantAIguru are powered by natural language models that generate responses by reading a user's request and, in response, predicting the words most likely to appear next. In some cases, the words most likely to appear next may not be the most factually accurate. For this reason, you should not rely on the factual accuracy of output from the AI models used by OpenAI. If you notice that instantAIguru related output contains factually inaccurate information about you and you would like us to correct the inaccuracy, you may submit a correction request through [email protected]. Given the technical complexity of how those models work, we may not be able to correct the inaccuracy in every instance, nor in a timely fashion. In that case, you may request that we remove your Personal Information from instantAIguru's output by filing your request with [email protected].

5. Additional U.S. state disclosures

The following table provides additional information about the categories of Personal Information we collect and how we disclose that information.

To the extent provided for by local law and subject to applicable exceptions, individuals may have the following privacy rights in relation to their Personal Information:

• The right to know information about our processing of your Personal Information, including the specific pieces of Personal Information that we have collected from you;
• The right to request deletion of your Personal Information;
• The right to correct your Personal Information; and
• The right to be free from discrimination relating to the exercise of any of your privacy rights.

We do not sell your Personal Information. With your advertising consent, we use advertising measurement partners to attribute visits and conversions to our campaigns and to reach people who have visited our sites, which some U.S. state laws may treat as "sharing" Personal Information for cross-context behavioral advertising. You can opt out at any time through the "Do Not Sell or Share My Personal Information" link or Cookie Preferences on our sites, and we honor the Global Privacy Control (GPC) signal as an opt-out for the browser or device that sends it. We don't process sensitive Personal Information for the purposes of inferring characteristics about a consumer.

Exercising Your Rights. To the extent applicable under local law, you can exercise privacy rights described in this section by submitting a request through [email protected].

Verification. In order to protect your Personal Information from unauthorized access, change, or deletion, we may require you to verify your credentials before you can submit a request to know, correct, or delete Personal Information. If you do not have an account with us, or if we suspect fraudulent or malicious activity, we may ask you to provide additional Personal Information and proof of residency for verification. If we cannot verify your identity, we will not be able to honor your request.

Authorized Agents. You may also submit a rights request through an authorized agent. If you do so, the agent must present signed written permission to act on your behalf and you may also be required to independently verify your identity and submit proof of your residency with us. Authorized agent requests can be submitted to [email protected].

Appeals. Depending on where you live, you may have the right to appeal a decision we make relating to requests to exercise your rights under applicable local law. To appeal a decision, please send your request to [email protected].

6. Children

Our Service is not directed to children under the age of 13. instantAIguru does not knowingly collect Personal Information from children under the age of 13. If you have reason to believe that a child under the age of 13 has provided Personal Information to instantAIguru through the Service, please email us at [email protected]. We will investigate any notification and if appropriate, delete the Personal Information from our systems. If you are 13 or older, but under 18, you must have permission from your parent or guardian to use our Services.

7. Links to other websites

The Service may contain links to other websites not operated or controlled by instantAIguru, including social media services ("Third Party Sites"). The information that you share with Third Party Sites will be governed by the specific privacy policies and terms of service of the Third Party Sites and not by this Privacy Policy. By providing these links we do not imply that we endorse or have reviewed these sites. Please contact the Third Party Sites directly for information on their privacy practices and policies.

8. Security and Retention

We implement commercially reasonable technical, administrative, and organizational measures to protect Personal Information both online and offline from loss, misuse, and unauthorized access, disclosure, alteration, or destruction. However, no Internet or email transmission is ever fully secure or error free. In particular, email sent to or from us may not be secure. Therefore, you should take special care in deciding what information you send to us via the Service or email. In addition, we are not responsible for circumvention of any privacy settings or security measures contained on the Service, or third-party websites.

We'll retain your Personal Information for only as long as we need in order to provide our Service to you, or for other legitimate business purposes such as resolving disputes, safety and security reasons, or complying with our legal obligations. How long we retain Personal Information will depend on a number of factors, such as the amount, nature, and sensitivity of the information, the potential risk of harm from unauthorized use or disclosure, our purpose for processing the information, and any legal requirements.

Specific retention periods by data category:

• Account Information: Retained for the lifetime of your account plus a reasonable grace period for dispute resolution and legal compliance after account deletion.
• User Content (conversations, inputs, file uploads): Retained per your account-level controls or until you request deletion through your account or via [email protected].
• Analytics Events: Retained in Google Analytics 4 for 14 months (the maximum on our property settings), after which event-level data is deleted automatically and only aggregated metrics remain.
• Server Logs: Retained for security and operational diagnostics for a period not exceeding twelve months absent a legal hold.
• Consent Records: Retained for the duration required to demonstrate compliance with applicable consent regulations (typically the cookie's 1-year lifetime, then refreshed on subsequent visits).

9. International users

By using our Service, you understand and acknowledge that your Personal Information will be processed and stored in our facilities and servers in the United States and may be disclosed to our service providers and affiliates in other jurisdictions.

Legal Basis for Processing. Our legal bases for processing your Personal Information include:

• Performance of a contract with you when we provide and maintain our Services. When we process Account Information, Content, and Technical Information solely to provide our Services to you, this information is necessary to be able to provide our Services. If you do not provide this information, we may not be able to provide our Services to you.
• Our legitimate interests in protecting our Services from abuse, fraud, or security risks; in measuring product usage, funnel performance, and Core Web Vitals as described in Section 1B (Consent Management); or in developing, improving, or promoting our Services, including when we train our models. This may include the processing of Account Information, Content, Social Information, and Technical Information.
• Your consent when we ask for your consent to process your Personal Information for a specific purpose that we communicate to you. You have the right to withdraw your consent at any time.
• Compliance with our legal obligations when we use your Personal Information to comply with applicable law or when we protect our or our affiliates', users', or third parties' rights, safety, and property.

Data Transfers. Where required, we will use appropriate safeguards for transferring Personal Information outside of certain countries. We will only transfer Personal Information pursuant to a legally valid transfer mechanism.

Data Protection Officer. You can contact our data protection officer at [email protected] in matters related to Personal Information processing.

10. Changes to the privacy policy

We may update this Privacy Policy from time to time. When we do, we will post an updated version on this page, unless another type of notice is required by applicable law.

11. How to contact us

Please contact [email protected] if you have any questions or concerns not already addressed in this Privacy Policy.