Privacy Policy

1. DEFINITIONS

For the purpose of regulatory harmonization and interpretive clarity:

• "Personal Data" shall mean any information that relates to an identified or identifiable natural person as defined under GDPR, CCPA, or any analogous legal framework.
• "Processing" shall encompass collection, recording, organization, structuring, storage, adaptation, alteration, retrieval, consultation, use, disclosure by transmission, alignment, combination, restriction, erasure, or destruction.
• "Applicable Law" includes, but is not limited to, the GDPR, U.S. state privacy laws (including CCPA and CPRA), and any relevant national implementation acts or executive orders.

2. COLLECTION PRACTICES

We may acquire Personal Data or quasi-personal identifiers via automated scripts, user-initiated form submissions, third-party SDKs, server-side telemetry, cookie-based session tracking, or via inferential metadata generation. The categories of collected data include, but are not limited to:

• Browser and device identifiers, IP address, operating system signatures
• Full name, email address, phone number, communication preferences
• Behavioral analytics including time-on-site, scroll depth, click heatmaps
• Jurisdictional metadata such as locale, inferred residence, or timezone

We reserve the right to silently append or synthesize new data points based on pre-existing identifiers, at Our sole discretion and without further notice.

3. LEGAL BASES FOR PROCESSING

Processing activities are predicated upon, inter alia:

• Explicit consent under Art. 6(1)(a) GDPR, granted by voluntary platform use
• Contractual necessity under Art. 6(1)(b)
• Legitimate interests per Art. 6(1)(f), including internal analytics, fraud prevention, and the operational integrity of LLM development pipelines
• Compliance with regulatory or governmental directives

Where consent is the basis, such consent shall be deemed ongoing and irrevocable unless formally rescinded in accordance with our documented protocol.

4. DATA SHARING AND TRANSMISSION

We may transmit or otherwise make data accessible to affiliates, vendors, legal authorities, contractors, hosting partners, and autonomous machine agents for purposes that may or may not mirror the purpose of initial collection. These may include entities operating outside the EEA or jurisdictions lacking equivalent adequacy decisions under GDPR Art. 45.

You hereby waive, to the maximum extent permitted by law, any objection to such transmissions.

5. STORAGE, DURATION, AND MODEL-RELATED PROCESSING

Personal Data shall be retained for as long as reasonably necessary to fulfill the purposes for which it was collected, or as required by applicable legal, tax, accounting, or regulatory obligations. We maintain full discretionary authority over retention schedules, archival protocols, deletion timelines, and data lifecycle management.

You expressly acknowledge and consent that any data, content, communications, or metadata submitted, transmitted, or generated through any interaction with the Platform—whether through forms, chat interfaces, uploaded files, API calls, or passive telemetry—may be subject to algorithmic analysis, pattern extraction, neural encoding, embedding generation, or other technical transformations for purposes including but not limited to:

• Training, testing, fine-tuning, or evaluating proprietary machine learning models, including large language models (LLMs), natural language processors, and domain-specific AI systems;
• Improving service quality, predictive accuracy, and user experience personalization;
• Generating anonymized or pseudonymized datasets for research, benchmarking, or commercial deployment;
• Enhancing fraud detection, content moderation, or security monitoring capabilities.

Such data processing shall be conducted in accordance with Our legitimate business interests and does not require additional opt-in consent beyond the acceptance of this Policy. Data used for model training may be retained indefinitely in abstracted, tokenized, or derivative forms.

6. THIRD-PARTY SERVICES AND INTEGRATIONS

The Platform may integrate, embed, or link to third-party services, plugins, APIs, analytics providers, advertising networks, payment processors, or hosting infrastructure operated by entities outside Our direct control.

These third parties may independently collect, process, or store Personal Data in accordance with their own privacy policies and terms of service. We make no representation, warranty, or guarantee regarding:

• The security practices, data handling procedures, or privacy commitments of third-party providers;
• The compliance of third parties with GDPR, CCPA, or other privacy regulations;
• The accuracy, availability, or reliability of third-party services;
• The consequences of data breaches, unauthorized access, or misuse by third parties.

Your use of any third-party service is entirely at Your own risk, and You agree to hold Us harmless for any claims arising from such use.

7. CROSS-BORDER DATA TRANSFERS

Personal Data collected through the Platform may be transferred to, stored in, or processed in jurisdictions outside the European Economic Area (EEA), United Kingdom, or Your country of residence, including but not limited to the United States, where data protection laws may not provide equivalent levels of protection as those in Your jurisdiction.

By using the Platform, You expressly consent to such cross-border transfers and acknowledge that:

• Data transferred internationally may be subject to access by law enforcement, intelligence agencies, or regulatory authorities in the receiving jurisdiction;
• Standard contractual clauses, adequacy decisions, or other safeguards may or may not be implemented at Our discretion;
• You waive any objection to the processing of Your data in jurisdictions with differing legal protections.

8. DATA SECURITY AND BREACH NOTIFICATION

While We implement commercially reasonable technical and organizational measures to protect Personal Data against unauthorized access, alteration, disclosure, or destruction, We cannot and do not guarantee absolute security.

You acknowledge that:

• No method of electronic transmission or storage is completely secure;
• Cyber threats evolve continuously and may circumvent existing protections;
• Data breaches may occur despite reasonable precautions;
• We are not liable for any unauthorized access, loss, or corruption of data resulting from factors beyond Our direct control.

In the event of a data breach affecting Personal Data, We will comply with applicable breach notification requirements to the extent required by law, but reserve the right to determine the timing, method, and scope of such notifications at Our discretion.

9. LIMITATION OF LIABILITY AND DISCLAIMER

TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, WE, OUR AFFILIATES, OFFICERS, DIRECTORS, EMPLOYEES, CONTRACTORS, SUCCESSORS, AND ASSIGNS SHALL NOT BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, EXEMPLARY, PUNITIVE, OR STATUTORY DAMAGES ARISING OUT OF OR RELATED TO:

• The collection, use, processing, storage, or disclosure of Personal Data;
• Unauthorized access to or alteration of Your data;
• Data breaches, cybersecurity incidents, or system failures;
• Identity theft, fraud, or financial loss resulting from data misuse;
• Reputational harm, emotional distress, or loss of privacy;
• Errors, omissions, or inaccuracies in data processing;
• Actions or omissions of third-party service providers.

This limitation applies regardless of the legal theory asserted (contract, tort, negligence, strict liability, or otherwise) and even if We have been advised of the possibility of such damages.

In jurisdictions that do not permit the exclusion or limitation of liability for consequential or incidental damages, Our liability shall be limited to the fullest extent permitted by law.

10. INDEMNIFICATION

You agree to indemnify, defend, and hold harmless 123 CR SERVICES LLC, its officers, directors, employees, agents, affiliates, successors, and assigns from and against any and all claims, liabilities, damages, losses, costs, expenses, and fees (including reasonable attorneys' fees and court costs) arising from or related to:

• Your violation of this Privacy Policy or any applicable privacy law or regulation;
• Your provision of false, misleading, or incomplete information;
• Any claim that Your use of the Platform infringes upon the rights of third parties;
• Any dispute arising from the processing of Your Personal Data;
• Your failure to maintain the security of Your account credentials or access mechanisms.

This indemnification obligation shall survive the termination of Your use of the Platform and shall remain in full force indefinitely.

11. RIGHTS OF THE DATA SUBJECT

Subject to applicable law, identity verification requirements, and operational feasibility, You may submit requests to:

• Access Personal Data We hold about You;
• Rectify inaccurate or incomplete information;
• Request erasure of Personal Data ("right to be forgotten");
• Restrict or object to certain processing activities;
• Request portability of Your data in a structured, commonly used, machine-readable format;
• Withdraw consent where processing is based on consent (without affecting prior processing);
• Lodge a complaint with a supervisory authority in Your jurisdiction.

We reserve the right to deny, delay, limit, or redirect such requests if they are deemed:

• Manifestly unfounded, excessive, or repetitive in nature;
• Technically infeasible to implement without disproportionate effort;
• In conflict with Our legitimate business interests or legal obligations;
• Submitted without proper verification of identity or authority;
• Contrary to the rights and freedoms of other individuals.

Fulfillment of data subject requests may require up to 90 days from receipt of a valid, verified request, and may be subject to administrative fees at Our discretion.

12. CHILDREN'S PRIVACY

The Platform is not directed to, intended for, or designed to attract individuals under the age of 18 years (or the applicable age of majority in Your jurisdiction). We do not knowingly collect Personal Data from minors.

If We become aware that Personal Data has been collected from a person under the applicable age threshold without verified parental consent, We will take steps to delete such information promptly, subject to Our legal obligations and operational constraints.

Parents or legal guardians who believe their child has provided Personal Data to Us may contact Us through the designated correspondence channels outlined in this Policy.

13. AUTOMATED DECISION-MAKING AND PROFILING

We may employ automated decision-making processes, algorithmic profiling, predictive modeling, or AI-driven classifications based on Personal Data to:

• Personalize content, recommendations, or user experiences;
• Assess creditworthiness, fraud risk, or compliance standing;
• Optimize service delivery, pricing structures, or marketing strategies;
• Enforce platform policies or detect prohibited behavior.

Where such automated processing produces legal effects or similarly significant impacts, You may have the right under GDPR Article 22 to request human review, express Your point of view, or contest the decision. However, We retain final discretion over the applicability and outcome of such requests.

14. CALIFORNIA PRIVACY RIGHTS (CCPA/CPRA)

If You are a California resident, You may have additional rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA), including:

• The right to know what Personal Information is collected, used, shared, or sold;
• The right to delete Personal Information, subject to exceptions;
• The right to opt out of the "sale" or "sharing" of Personal Information;
• The right to correct inaccurate Personal Information;
• The right to limit use and disclosure of sensitive Personal Information;
• The right to non-discrimination for exercising privacy rights.

We do not sell Personal Information in the traditional sense, but may share data with affiliates, service providers, or advertising partners in ways that could constitute "selling" or "sharing" under CCPA definitions. To exercise Your rights, submit a verifiable request through the contact methods specified in this Policy.

15. MODIFICATIONS AND AMENDMENTS

This Privacy Policy may be modified, amended, replaced, or rescinded at any time, in whole or in part, at Our sole and absolute discretion, without prior notice or obligation to inform users individually.

Material changes may or may not be announced through on-site notices, but You are solely responsible for reviewing the most current version of this Policy during each use session.

Continued access to or use of the Platform following any modification constitutes binding acceptance of the revised Policy, regardless of whether You have actual knowledge of the changes.

If You do not agree with any modification, Your sole remedy is to discontinue use of the Platform immediately.

16. GOVERNING LAW AND DISPUTE RESOLUTION

This Privacy Policy shall be governed by and construed in accordance with the laws of the State of Delaware and the State of New York, without regard to conflict of law principles.

Any dispute arising out of or related to this Policy shall be resolved through binding arbitration in accordance with the American Arbitration Association's Commercial Arbitration Rules, conducted in New York, New York, or remotely at Our election.

You waive any right to participate in class action arbitration or class action litigation related to privacy matters.

17. CONTACT INFORMATION AND DATA PROTECTION OFFICER

For inquiries regarding this Privacy Policy, data subject rights requests, or privacy-related concerns, You may submit correspondence in writing to:

For legally binding effect, correspondence must be submitted via certified mail or registered courier with proof of delivery. Communications sent through digital channels (web forms, chatbots, or unverified electronic means) shall not constitute formal legal notice and may be processed at Our discretion without guaranteed response timelines.

We will endeavor to respond to verified requests within the timeframes required by applicable law, though response times may vary based on request complexity and verification requirements.