Privacy Policy

PRIVACY POLICY

Last updated: October 6, 2026

This Privacy Notice for Acira AI LLC ("we," "us," or "our") describes how and why we might access, collect, store, use, and/or share ("process") your personal information when you use our services ("Services"), including when you:

Visit our website at https://www.acira.ai or any website of ours that links to this Privacy Notice
Use any application or tool of ours that links to this Privacy Notice
Use Acira AI. Acira AI LLC is a software-as-a-service (SaaS) platform that enables businesses and individuals to create, manage, and host AI-powered websites through a conversational interface. It provides website building, hosting, domain registration, and related digital services to customers worldwide.
Engage with us in other related ways, including any marketing or events

Questions or concerns? Reading this Privacy Notice will help you understand your privacy rights and choices. We are responsible for making decisions about how your personal information is processed. If you do not agree with our policies and practices, please do not use our Services. If you still have any questions or concerns, please contact us at legal@acira.ai.

Acira AI as a Platform Provider. Acira AI enables you to create and host websites that may collect personal data from your own website visitors (through forms, user accounts, and other features). This Privacy Notice applies to you as a user of our platform ("Platform User"). If you are a visitor to a website built on Acira AI, that website's owner is responsible for their own privacy practices and for informing you about how your data is collected and used. Acira AI acts as a data processor on behalf of website owners for visitor data collected through their websites. For basic visitor analytics data that the platform collects automatically, Acira AI and the website owner act as joint controllers — see our Data Processing Addendum for the details of this arrangement, including each party's responsibilities. For all other visitor data, Acira AI acts solely as a data processor on your behalf.

Agencies and White-Label. Some websites on our platform are created and managed by agencies through our Agency Program on behalf of their clients. If your website is created or managed by an agency, the staff of that agency can access your account and website data — including data collected from your website visitors — in order to build and operate your website, and the agency is responsible for its own privacy practices; depending on its arrangement with you, it acts as your processor or as a controller of that data (see Section 2.7 of our Data Processing Addendum). When you access the platform through an agency's white-label hostname, the interface may display the agency's branding, and some transactional or login emails relating to an agency-managed website may display the agency's branding, but Acira AI remains the platform provider and sender and this Privacy Notice continues to apply. See our Agency Terms and Data Processing Addendum.

Data Processing Addendum. If you use the Services and your website collects or processes personal data of individuals located in the European Economic Area (EEA), the United Kingdom, or Switzerland, or wherever else required by applicable data protection law (including US state privacy laws), our Data Processing Addendum (DPA) automatically applies to you and is incorporated into our Terms of Service by reference. You do not need to separately sign the DPA — it takes effect automatically upon your acceptance of our Terms of Service. The DPA sets out the terms under which we process personal data on your behalf, including our obligations regarding subprocessors, data security, and international data transfers.

This Privacy Notice may be translated into other languages for your convenience. In the event of any conflict or inconsistency between the English version and any translated version, the English version shall prevail, except where applicable law requires that the translated version apply or prevail, or that any inconsistency be resolved in your favor. For users located in Québec, the French version governs.

SUMMARY OF KEY POINTS

This summary provides key points from our Privacy Notice, but you can find out more details about any of these topics by clicking the link following each key point or by using our table of contents below to find the section you are looking for.

What personal information do we process? When you visit, use, or navigate our Services, we may process personal information depending on how you interact with us and the Services, the choices you make, and the products and features you use. Learn more about personal information you disclose to us.

Do we process any sensitive personal information? Some of the information may be considered "special" or "sensitive" in certain jurisdictions, for example your racial or ethnic origins, sexual orientation, and religious beliefs. We do not intentionally collect or process sensitive personal information. As a platform provider, we do not control what information website owners choose to collect from their visitors.

Do we collect any information from third parties? We may receive limited information from service providers that assist us in delivering our Services, such as payment confirmation data from our payment provider. We do not purchase personal information from data brokers or other third-party sources.

How do we process your information? We process your information to provide, improve, and administer our Services, communicate with you, for security and fraud prevention, and to comply with law. We may also process your information for other purposes with your consent. We process your information only when we have a valid legal reason to do so. Learn more about how we process your information.

In what situations and with which parties do we share personal information? We may share information in specific situations and with specific third parties. Learn more about when and with whom we share your personal information.

How do we keep your information safe? We have adequate organizational and technical processes and procedures in place to protect your personal information. However, no electronic transmission over the internet or information storage technology can be guaranteed to be 100% secure, so we cannot promise or guarantee that hackers, cybercriminals, or other unauthorized third parties will not be able to defeat our security and improperly collect, access, steal, or modify your information. Learn more about how we keep your information safe.

What are your rights? Depending on where you are located geographically, the applicable privacy law may mean you have certain rights regarding your personal information, including the right to lodge a data protection complaint directly with us. Learn more about your privacy rights.

How do you exercise your rights? The easiest way to exercise your rights is by emailing legal@acira.ai, or by contacting us. We will consider and act upon any request in accordance with applicable data protection laws.

Want to learn more about what we do with any information we collect? Review the Privacy Notice in full.

WHAT INFORMATION DO WE COLLECT?
HOW DO WE PROCESS YOUR INFORMATION?
WHAT LEGAL BASES DO WE RELY ON TO PROCESS YOUR INFORMATION?
WHEN AND WITH WHOM DO WE SHARE YOUR PERSONAL INFORMATION?
DO WE OFFER ARTIFICIAL INTELLIGENCE-BASED PRODUCTS?
HOW DO WE USE COOKIES AND SIMILAR TECHNOLOGIES?
INTERNATIONAL DATA TRANSFERS
HOW LONG DO WE KEEP YOUR INFORMATION?
HOW DO WE KEEP YOUR INFORMATION SAFE?
DO WE COLLECT INFORMATION FROM MINORS?
WHAT ARE YOUR PRIVACY RIGHTS?
CONTROLS FOR DO-NOT-TRACK AND GLOBAL PRIVACY CONTROL
DO UNITED STATES RESIDENTS HAVE SPECIFIC PRIVACY RIGHTS?
DO OTHER REGIONS HAVE SPECIFIC PRIVACY RIGHTS?
DO WE MAKE UPDATES TO THIS NOTICE?
HOW CAN YOU CONTACT US ABOUT THIS NOTICE?
HOW CAN YOU REVIEW, UPDATE, OR DELETE THE DATA WE COLLECT FROM YOU?

1. WHAT INFORMATION DO WE COLLECT?

Personal Information You Disclose to Us

In Short: We collect personal information that you provide to us.

We collect personal information that you voluntarily provide to us when you register on the Services, express an interest in obtaining information about us or our products and Services, when you participate in activities on the Services, or otherwise when you contact us.

Personal Information Provided by You. The personal information that we collect depends on the context of your interactions with us and the Services, the choices you make, and the products and features you use. The personal information we collect may include the following:

Email addresses
Names
Phone numbers (if you choose to provide one)

Content You Create and Upload. When you use our Services, we store the content you create, upload, or provide through our platform, including:

Website content, templates, and design assets you create using our tools
Files and media you upload (such as images, videos, and documents)
Conversations and messages you exchange with our AI assistants
Database records and structured content you create for your websites

Social Media and External Platform Data. During website setup, you may direct us to import content from external platforms such as Facebook, Instagram, Google Maps, or Yelp. When you do, we collect and store publicly available business information from those platforms, including business descriptions, ratings, reviews, photos, addresses, phone numbers, and operating hours. This data is used to help build your website and is retained as part of your website content.

Social media profile URLs you provide (such as links to your Facebook page, Instagram profile, Google Maps listing, or Yelp page) are stored as part of your website configuration.

Billing and Subscription Data. When you subscribe to a plan or purchase services, we collect and maintain records of your subscription status, plan details, purchase history, and invoicing information.

Sensitive Information. We do not intentionally collect or process sensitive personal information (such as racial or ethnic origin, religious beliefs, health data, or sexual orientation). However, as a platform provider, we do not control what information website owners choose to collect from their visitors through forms and other interactive features. Website owners are solely responsible for ensuring their data collection practices comply with applicable laws, including obtaining any required consents for sensitive data.

Payment Data. If you choose to make purchases, payment is processed by our third-party payment provider acting as Merchant of Record, currently Sold through Link, LLC ("Link"), an affiliate of Stripe. Your payment details (such as your payment instrument number and the associated security code) are collected and stored directly by that provider, not by us; we receive only limited transaction and billing information. You may find Stripe's privacy notice, which covers these purchases, here: Stripe Privacy Policy.

Technical Data. When you access our Services, we automatically collect certain technical information, including your Internet Protocol (IP) address, browser type and version, operating system, and general geographic location (country and region-level, derived from your IP address). This information is used to maintain the security and operation of our Services, for troubleshooting, and for our internal analytics and reporting purposes. We also store your IP address in connection with account creation and authentication events for security, rate-limiting, and fraud prevention purposes, and alongside each active login session so that you can review and revoke your connected devices. We maintain platform error and diagnostic logs that may include technical identifiers such as IP addresses, request paths, and error details, and each website's own diagnostic log (shown on its Logs page), which may include request paths and error details, to support troubleshooting and platform reliability; see Section 8 for how long we keep them.

Referral and Attribution Data. When you create an account, we may record referral and marketing attribution data, such as how you discovered or arrived at our Services (for example, a campaign or referral source). This attribution data is stored with your account and retained for the duration of your account. If you arrive via a paid advertisement, an ad click identifier from the URL may be sent back to the advertising platform, together with limited conversion details, to measure conversion performance (see "Ad Conversion Measurement" in Section 4); where we store such click identifiers, they are retained for the period set out in Section 8. Attribution data is not used for targeted advertising or profiling.

We also record when you accept or are presented with our Terms of Service, including a timestamp and the version accepted, for compliance record-keeping purposes. We track general activity timestamps (such as the date of your last login or interaction) to manage account status, detect inactivity, and provide service features.

Information Collected via Email. If you contact us by email, we may automatically create an account on your behalf using the email address and name from your email headers. We also detect the language of your message to provide responses in your preferred language.

Temporary Accounts on Our Website. When you start a conversation with our AI assistant on our website before signing up, we create a temporary account for you, recording the IP address it was created from, your country, language, and time zone, and any campaign or ad click identifier in the page address. A temporary account that is not verified is deleted automatically after the period set out in Section 8.

All personal information that you provide to us must be true, complete, and accurate, and you must notify us of any changes to such personal information.

Information from Service Providers

We may receive limited information from third-party service providers that help us deliver our Services. For example, our payment provider may notify us of the status of a transaction, our email delivery provider may inform us of undeliverable messages, or our web data collection services may return publicly available information you requested. This information is used solely to maintain and improve our Services.

2. HOW DO WE PROCESS YOUR INFORMATION?

In Short: We process your information to provide, improve, and administer our Services, communicate with you, for security and fraud prevention, and to comply with law. We process the personal information for the following purposes listed below. We may also process your information for other purposes only with your prior explicit consent.

We process your personal information for a variety of reasons, depending on how you interact with our Services, including:

To facilitate account creation and authentication and otherwise manage user accounts. We may process your information so you can create and log in to your account, as well as keep your account in working order.
To deliver and facilitate delivery of services to the user. We may process your information to provide you with the requested service.
To respond to user inquiries/offer support to users. We may process your information to respond to your inquiries and solve any potential issues you might have with the requested service.
To send administrative information to you. We may process your information to send you details about our products and services, changes to our terms and policies, and other similar information.
To fulfill and manage your orders. We may process your information to fulfill and manage your orders, payments, returns, and exchanges made through the Services.
To ensure platform safety and integrity. We may use automated systems to detect spam, moderate content, and prevent abuse or misuse of our Services. Learn more about this in "Do We Offer Artificial Intelligence-Based Products?"
To provide human review on paid plans. For Pro and Business plans, members of our team may access and review your website's design and presentation, and make adjustments such as visual or layout fixes. Staff access is limited to those who require it for this purpose and is subject to confidentiality obligations.
To generate file descriptions. When you upload files such as images and documents, we may use AI to generate descriptive metadata to improve accessibility and organization of your content.
To send you product recommendations based on your usage. We may analyze your usage of platform features and services to send you personalized suggestions about features, tools, or plan capabilities that may be relevant to you.
To provide relevant product recommendations based on your website. We may analyze the general characteristics of your website (such as your industry or business type) to send you personalized suggestions about platform features, resources, or services that may be relevant to your business. We do not share this information with third parties for their marketing purposes.
To measure marketing effectiveness. We may process referral and attribution data associated with your account to understand how users discover our Services and to evaluate the effectiveness of our marketing efforts. This may include transmitting ad click identifiers back to advertising platforms to report conversion events. This data is not used for targeted advertising or profiling.
To showcase platform examples. We may use screenshots, names, or descriptions of websites created through the Services in our marketing materials, homepage, and promotional content to demonstrate platform capabilities. You may opt out of this use at any time by contacting us at legal@acira.ai.
To save or protect an individual's vital interest. We may process your information when necessary to save or protect an individual's vital interest, such as to prevent harm.

3. WHAT LEGAL BASES DO WE RELY ON TO PROCESS YOUR INFORMATION?

In Short: We only process your personal information when we believe it is necessary and we have a valid legal reason (i.e., legal basis) to do so under applicable law, like with your consent, to comply with laws, to provide you with services to enter into or fulfill our contractual obligations, to protect your rights, or to fulfill our legitimate business interests.

If You Are Located in the EU or UK

The General Data Protection Regulation (GDPR) and UK GDPR require us to explain the valid legal bases we rely on in order to process your personal information. As such, we may rely on the following legal bases to process your personal information:

Consent. We may process your information if you have given us permission (i.e., consent) to use your personal information for a specific purpose. You can withdraw your consent at any time. Learn more about withdrawing your consent.
Performance of a Contract. We may process your personal information when we believe it is necessary to fulfill our contractual obligations to you, including providing our Services or at your request prior to entering into a contract with you.
Legitimate Interests. We may process your personal information when we believe it is reasonably necessary to achieve our legitimate business interests, provided those interests do not override your interests or fundamental rights and freedoms. For example, we may process your information to ensure platform safety, detect fraud, or improve our Services.
Legal Obligations. We may process your information where we believe it is necessary for compliance with our legal obligations, such as to cooperate with a law enforcement body or regulatory agency, exercise or defend our legal rights, or disclose your information as evidence in litigation in which we are involved.
Vital Interests. We may process your information where we believe it is necessary to protect your vital interests or the vital interests of a third party, such as situations involving potential threats to the safety of any person.

Legal Basis Mapping

The following table maps each processing activity to its primary legal basis under the GDPR:

Processing Activity	Legal Basis
Account creation and authentication	Performance of a Contract
Providing and delivering the Services	Performance of a Contract
Processing payments and subscriptions	Performance of a Contract
Responding to support inquiries	Performance of a Contract
Sending administrative and service-related emails	Performance of a Contract
File processing (conversion, optimization)	Performance of a Contract
AI-powered website creation and editing	Performance of a Contract
AI content generation and translation	Performance of a Contract
Platform analytics (aggregated)	Legitimate Interests
Marketing attribution and effectiveness measurement	Legitimate Interests
Platform safety and content moderation	Legitimate Interests
Human review of paid-plan websites	Performance of a Contract
Fraud prevention and security (IP logging)	Legitimate Interests
Spam detection	Legitimate Interests
Error and diagnostic logging	Legitimate Interests
Compliance with legal obligations (law enforcement, DMCA)	Legal Obligations
CSAM detection and reporting	Legal Obligations
Protecting vital interests	Vital Interests
Product recommendations based on feature usage	Legitimate Interests
Industry-based product recommendations	Legitimate Interests
Showcasing user websites in marketing materials	Legitimate Interests
Marketing communications	Consent

If You Are Located in Canada

We may process your information if you have given us specific permission (i.e., express consent) to use your personal information for a specific purpose, or in situations where your permission can be inferred (i.e., implied consent). You can withdraw your consent at any time.

In some exceptional cases, we may be legally permitted under applicable law to process your information without your consent — for example, for fraud detection and prevention, to comply with a subpoena, warrant, or court order, where collection is clearly in the interests of an individual and consent cannot be obtained in a timely way, or in the other circumstances permitted by PIPEDA and applicable provincial privacy legislation.

4. WHEN AND WITH WHOM DO WE SHARE YOUR PERSONAL INFORMATION?

In Short: We may share information in specific situations described in this section and/or with the following third parties.

We may need to share your personal information in the following situations:

Business Transfers. We may share or transfer your information in connection with, or during negotiations of, any merger, sale of company assets, financing, or acquisition of all or a portion of our business to another company.
Agencies. If your website is created or managed through our Agency Program, the managing agency and its authorized staff can access your account and website data (including data collected from your website visitors) in order to build and operate your website. The agency is responsible for its own privacy practices; depending on its arrangement with you, it acts as your processor or as a controller of that data (see Section 2.7 of our Data Processing Addendum). See our Agency Terms.

Service Providers

We use the following categories of third-party service providers to help us deliver our Services. Your information may be processed by these providers in accordance with their respective privacy policies:

Cloud Infrastructure and Edge Network. We use cloud infrastructure and edge-network providers for services including content delivery, edge computing, website hosting, data storage, email delivery, domain registration, content moderation, and other services. Your data may be processed across multiple geographic regions through these providers. Where a website is subject to our EU data residency measures, see Section 7.1 of our Data Processing Addendum.
Payment Processing. We use Stripe Managed Payments as our payment provider, with its affiliate Sold through Link, LLC ("Link") acting as Merchant of Record to process payments, manage subscriptions, and handle billing. See Stripe's privacy policy.
AI and Machine Learning. We use AI service providers as described in "Do We Offer Artificial Intelligence-Based Products?"
Web Data Collection. When you use features that gather publicly available information from the web (such as importing content for your website, asking our AI assistant to read a web page, capturing screenshots of web pages, or tracking search engine keyword rankings), we may use third-party web data collection and browser rendering services to retrieve this publicly accessible data on your behalf.
Ad Conversion Measurement. When you arrive at our Services through a Google Ads advertisement and later create a website or subscribe, we send Google the ad click identifier from that visit and limited details of the conversion (such as its type, time and value), so we can measure how our advertising performs. We do not send your name, email address, or IP address. Google processes this data as our service provider under its restricted data processing terms, and we do not permit it to be used to build advertising profiles or to personalize ads. See Google's privacy policy.
Business Email. Emails you send to our team addresses (such as legal@acira.ai) are hosted by our business email provider.
File Processing. We use third-party file conversion services to convert files you upload into formats suitable for web delivery. We may also use AI services to generate descriptive metadata for uploaded files (such as image alt text) to improve accessibility.

The providers that process data on our platform, with their purposes and locations, are listed in our Data Processing Addendum. You can ask us for the names of the other recipients of your personal information by emailing legal@acira.ai.

5. DO WE OFFER ARTIFICIAL INTELLIGENCE-BASED PRODUCTS?

In Short: We offer products, features, or tools powered by artificial intelligence, machine learning, or similar technologies.

As part of our Services, we offer products, features, or tools powered by artificial intelligence, machine learning, or similar technologies (collectively, "AI Products"). These tools are designed to enhance your experience and provide you with innovative solutions. This Privacy Notice describes how we handle your data when you use the AI Products within our Services.

Use of AI Technologies

We provide the AI Products through third-party service providers ("AI Service Providers"). We use multiple providers for text generation, image generation, and content safety, including cloud-based AI inference services and image generation APIs. These providers may host and run a variety of open-source and proprietary AI models on their infrastructure to deliver our Services. A complete list of current AI Service Providers is available in our Data Processing Addendum. As outlined in this Privacy Notice, your input, output, and personal information will be shared with and processed by these AI Service Providers to enable your use of our AI Products for purposes outlined in "What Legal Bases Do We Rely On to Process Your Information?" You must not use the AI Products in any way that violates the terms or policies of any AI Service Provider.

Our AI Products

Our AI Products are designed for the following functions:

AI-powered website creation and editing through conversational interfaces
AI translation of website content
AI-assisted content generation and copywriting
Image generation for websites
AI inference requested by the code of websites created through our platform (for example, to power a chatbot the website builds)

How We Process Your Data Using AI

All personal information processed using our AI Products is handled in line with our Privacy Notice and our agreements with third parties.

What data is shared with AI Service Providers. To deliver our AI Products, we may share the following information with our AI Service Providers:

Your name, email address, and language preference (to personalize responses)
Your conversation messages and history with our AI assistants
Website content, templates, and design data you are working on
Files you upload (such as images, documents, and videos) for analysis or processing, and images you ask us to edit
Records from your website's databases, when you ask our AI assistant to read or act on them
Content your website's own code sends for AI inference, which may include personal data of your website's visitors

We share only the data necessary to fulfill the specific AI-powered function you are using.

Your data is not used for AI training. We do not use your personal information, content, conversations, or any data you provide through our Services to train, fine-tune, or improve AI models, and our agreements with our AI Service Providers prohibit them from using the data we send them to train their models. Your data is processed solely to deliver the Services you request.

AI-Generated Content Transparency

Content generated through our AI tools (including website text, images, and translations) is produced by artificial intelligence. Websites created through our platform may include AI-generated content. Our conversational interface is powered by AI, and users interact with an AI assistant, not a human agent.

Automated Decision-Making

We use automated systems in the following ways that may affect your use of our Services:

Content Moderation. Files you upload may be automatically analyzed using automated image moderation services and AI-based safety review to detect content that violates our policies (such as harmful or illegal material). Files that are flagged may be rejected or removed.
Website Content Review. When websites are published through our platform, their content may be automatically reviewed using AI-based safety models to detect violations of our content policies (such as explicit content, hate speech, scams, or illegal material). Websites that are flagged may be subject to review or restriction.
Safety and Abuse Prevention. We may automatically flag or restrict accounts or content that appear to violate our Terms of Service, based on patterns of activity.

These automated processes are used to protect the safety and integrity of our platform. If you believe an automated decision has been made about you in error, you may contact us to request a human review at legal@acira.ai.

6. HOW DO WE USE COOKIES AND SIMILAR TECHNOLOGIES?

In Short: We use cookies solely for essential platform functionality, not for tracking or advertising.

Cookies We Use

We use a limited number of strictly necessary cookies to operate our Services:

Login Cookie. A strictly necessary login cookie keeps you signed in (it expires after 30 days).
Payment Provider Cookies. Our payment provider's embedded checkout sets its own cookies for fraud prevention, under its privacy policy.

These cookies are strictly necessary for the provision of the Services you have requested, such as account login and payment. We do not use cookies for analytics, advertising, or tracking purposes on our platform.

Browser Local Storage

We use your browser's local storage for preferences such as language selection and interface layout settings.

Analytics and Tracking

We do not use cookies for analytics or tracking purposes on our platform.

Third-Party Cookies

We do not allow third-party advertising cookies on our platform. The only third-party cookies are those set by our payment provider's embedded checkout, described above.

Third-Party Links

Our Services may contain links to third-party websites, services, or resources that are not owned or controlled by us. We are not responsible for the privacy practices, content, or data collection of any third-party websites or services. We encourage you to review the privacy policies of any third-party websites you visit. This Privacy Notice applies solely to information collected through our Services.

7. INTERNATIONAL DATA TRANSFERS

In Short: Your data may be transferred to and processed in countries other than your own.

Our Services are operated using infrastructure providers with a global presence. Your personal information may be transferred to, stored, and processed in countries outside of your country of residence, including the United States, where our primary operations are based.

How We Transfer Data

Cloud Infrastructure. Our cloud computing and data storage providers operate data centers in multiple regions worldwide. Your data may be processed in any region where our infrastructure providers maintain facilities.
Edge Network. Our content delivery and edge computing provider processes requests at network locations around the world to provide fast and reliable service. Websites hosted through our platform are served from the nearest edge location to the visitor, meaning request data is initially processed in whatever country the visitor is located in before being routed to our primary infrastructure.
EU Data Residency. Where a website is subject to our EU data residency measures, see Section 7.1 of our Data Processing Addendum.

Safeguards for International Transfers

When your personal information is transferred outside your country of residence, we ensure that appropriate safeguards are in place to protect your data, including:

For transfers from the EEA, UK, or Switzerland: We rely on Standard Contractual Clauses (SCCs) approved by the European Commission, or other legally recognized transfer mechanisms, to ensure your data receives an adequate level of protection.
For transfers from Canada: We ensure that your personal information receives a comparable level of protection as required under the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy legislation. We rely on contractual commitments with our service providers that require them to protect your data to a standard consistent with Canadian privacy law.
Service provider agreements: We enter into data processing agreements with our service providers that require them to protect your personal information in accordance with this Privacy Notice and applicable law.

For details on our data transfer mechanisms and supplementary measures, please refer to our Data Processing Addendum. Our transfer impact assessment is available on request. If you would like more information about the specific safeguards applied to transfers of your data, please contact us at legal@acira.ai.

8. HOW LONG DO WE KEEP YOUR INFORMATION?

In Short: We keep your information for as long as necessary to fulfill the purposes outlined in this Privacy Notice unless otherwise required by law.

We will only keep your personal information for as long as it is necessary for the purposes set out in this Privacy Notice, unless a longer retention period is required or permitted by law (such as tax, accounting, or other legal requirements). No purpose in this notice will require us to keep your personal information for longer than the period of time in which users have an account with us, except for the limited records identified in the table below that we keep for a fixed period after your account is deleted.

Retention Periods

The following table describes how long we retain different categories of data:

Data Category	Retention Period
Account information (name, email, phone)	Duration of your account
Temporary accounts (unverified)	Up to 30 days after creation if not verified
Conversations with our AI assistant (via app)	Duration of your account
Conversations with our AI assistant (via email)	Up to 6 months from last activity
Website content, templates, and databases	Duration of the associated website
Files and media uploads	Duration of the associated website
Deployment history and backups	Duration of the associated website
Billing and payment records	Duration of your account; our Merchant of Record (Link, an affiliate of Stripe) maintains its own records in accordance with applicable financial regulations
IP addresses recorded for rate-limiting and abuse prevention	Up to 7 days
IP address of an active login session (shown to you under connected devices)	Until that session is revoked or expires
IP address at account creation	Duration of your account (for fraud prevention)
Ad click identifiers	Up to 90 days
Referral and marketing attribution (e.g., campaign source)	Duration of your account
Platform analytics	Retained in aggregated or anonymized form (see "Anonymized and Aggregated Data" below)
Platform error and diagnostic logs	Up to 90 days
Your website's own diagnostic log (Logs page)	Up to 90 days, including after the website is deleted
Activity log of actions taken on your account and websites	Up to 1 year, including after account deletion
Record of emails we sent you (address, subject, delivery status)	Up to 1 year, including after account deletion, to evidence delivery and handle complaints
Emails you send to our automated addresses (such as chat@, abuse@, and domains@)	Up to 90 days, including after account deletion
Temporary processing files (file conversions, raw crawled data)	Up to 24 hours
Processed results of web data collection (imported business information, retrieved web pages)	Up to 30 days (content you add to your website is kept as website content)

Retention periods for personal data collected from your website's visitors (such as form submissions and session data) are set out in Section 12 of our Data Processing Addendum, which is the authoritative retention schedule for visitor data.

Account Deletion

You may request deletion of your account at any time through your account settings or by contacting our AI assistant. Upon requesting deletion:

Your account will be scheduled for deletion after the grace period described in our Terms of Service, during which you may cancel the request.
After the grace period, your account and all associated data — including website content, files, conversations, analytics, and any other records tied to your account — will be permanently and irreversibly purged from our systems, except for the limited records the table above identifies as kept after account deletion, which are deleted when their retention period ends.
Active subscriptions will be canceled and any applicable refunds processed in accordance with our terms.

Inactive Website Deletion

Free-plan websites without a custom domain may be deleted after a period of inactivity, after prior notice to you, as described in our Terms of Service. The website and all associated data are then deleted as described above.

Data Associated with Websites

When a website is deleted, all associated data (including content, files, analytics, domain configurations, and visitor data) is permanently removed following the same deletion process, except for the logs and records the table above identifies as kept after deletion.

Post-Deletion Retention

After deletion is complete, billing and payment records stored on our platform are deleted, except where we must keep them for legal, tax, or accounting purposes. Our Merchant of Record (Link, an affiliate of Stripe) independently maintains its own transaction records in accordance with applicable financial regulations, PCI DSS requirements, and its own data retention policies. We do not retain your personal information for marketing or profiling purposes after account deletion.

When we have no ongoing legitimate business need to process your personal information, we will either delete or anonymize such information, or, if this is not possible (for example, because your personal information has been stored in backup archives), then we will securely store your personal information and isolate it from any further processing until deletion is possible. Deleted data may remain in our service providers' backups for up to 30 days before it is permanently erased.

Anonymized and Aggregated Data

Where we retain anonymized or aggregated data after account or website deletion, such data has been irreversibly transformed so that it can no longer identify you, either directly or in combination with other data. Anonymized data is no longer considered personal information under applicable data protection laws and is therefore not subject to data subject access, correction, or deletion requests. We may use anonymized and aggregated data indefinitely for analytics, reporting, and service improvement purposes.

9. HOW DO WE KEEP YOUR INFORMATION SAFE?

In Short: We aim to protect your personal information through a system of organizational and technical security measures.

We have implemented appropriate and reasonable technical and organizational security measures designed to protect the security of any personal information we process. These measures include:

Encryption of data in transit using TLS/HTTPS
Encryption of data at rest
Access controls and authentication for all internal systems
Periodic review of our security measures and our providers' security documentation
Least-privilege access policies for our team and automated systems; staff access to user websites is limited to what the task at hand requires (including access performed as part of our human review service on paid plans)

However, despite our safeguards and efforts to secure your information, no electronic transmission over the Internet or information storage technology can be guaranteed to be 100% secure, so we cannot promise or guarantee that hackers, cybercriminals, or other unauthorized third parties will not be able to defeat our security and improperly collect, access, steal, or modify your information. Although we will do our best to protect your personal information, transmission of personal information to and from our Services is at your own risk. You should only access the Services within a secure environment.

Data Breach Notification

If a breach of security affecting your personal information is likely to result in a high risk to you, or where the law otherwise requires, we will notify you without undue delay, by email or, if that is not possible, by other reasonable means. We will tell you about the nature of the breach, the likely consequences, the measures we are taking in response, and steps you can take to protect yourself. We will notify the relevant supervisory authorities where applicable law requires it.

10. DO WE COLLECT INFORMATION FROM MINORS?

In Short: We do not knowingly collect data from or market to children under 18 years of age or the equivalent age as specified by law in your jurisdiction.

We do not knowingly collect, solicit data from, or market to children under 18 years of age or the equivalent age as specified by law in your jurisdiction, nor do we knowingly sell such personal information. By using the Services, you represent that you are at least 18 or the equivalent age as specified by law in your jurisdiction. If we learn that personal information from users less than 18 years of age or the equivalent age as specified by law in your jurisdiction has been collected, we will deactivate the account and take reasonable measures to promptly delete such data from our records. If you become aware of any data we may have collected from children under age 18 or the equivalent age as specified by law in your jurisdiction, please contact us at legal@acira.ai.

11. WHAT ARE YOUR PRIVACY RIGHTS?

In Short: Depending on your state of residence in the US or in some regions, such as the European Economic Area (EEA), United Kingdom (UK), Switzerland, and Canada, you have rights that allow you greater access to and control over your personal information. You may review, change, or terminate your account at any time, depending on your country, province, or state of residence.

In some regions (like the EEA, UK, Switzerland, and Canada), you have certain rights under applicable data protection laws. These may include the right (i) to request access and obtain a copy of your personal information; (ii) to request rectification or erasure; (iii) to restrict the processing of your personal information; (iv) if applicable, to data portability; (v) not to be subject to automated decision-making; (vi) to object to processing based on our legitimate interests (such as product recommendations and marketing measurement) and, at any time, to direct marketing; and (vii) if you are in the United Kingdom, to lodge a data protection complaint directly with us (see "Lodging a Data Protection Complaint With Us" below). If a decision that produces legal or similarly significant effects is made solely by automated means, we will inform you, explain the main factors, and offer a simple way to request human review. You can make such a request by contacting us by using the contact details provided in the section "How Can You Contact Us About This Notice?" below.

We will consider and act upon any request in accordance with applicable data protection laws.

Lodging a Data Protection Complaint With Us (United Kingdom)

If you are located in the United Kingdom, you have the right under Section 164A of the Data Protection Act 2018 (as inserted by the Data (Use and Access) Act 2025) to lodge a data protection complaint directly with us, as the controller, before or instead of contacting the Information Commissioner's Office (ICO). This includes complaints about how we have handled a data protection rights request (such as a request for access, correction, or deletion), the impact of a data breach on you, or any other way in which we process your personal information. You do not need to use any legal terms or cite any specific law for your complaint to be valid.

To make a data protection complaint, contact our UK representative, Prighter, at https://app.prighter.com/portal/acira, or email us at legal@acira.ai using the subject line "Data Protection Complaint." Please tell us what the complaint is about and, where relevant, what outcome you are seeking (for example, an explanation, a correction, or a change to how we process your information).

When you submit a data protection complaint, we will:

Acknowledge receipt of your complaint within 30 days;
Investigate your complaint and take appropriate steps to resolve it without undue delay, keeping you informed of progress where the matter is likely to take time; and
Notify you of the outcome of your complaint, including an explanation of the steps we took and any action we have taken in response, once we have reached a decision.

If you are not satisfied with our response, or you would prefer to contact the regulator directly, you may complain to the UK Information Commissioner's Office (ICO).

If you are located in the EEA or Switzerland and you believe we are unlawfully processing your personal information, you have the right to complain to your supervisory authority — your Member State data protection authority (EEA) or the Federal Data Protection and Information Commissioner (Switzerland).

If we are relying on your consent to process your personal information, which may be express and/or implied consent depending on the applicable law, you have the right to withdraw your consent at any time. You can withdraw your consent at any time by contacting us by using the contact details provided in the section "How Can You Contact Us About This Notice?" below or updating your preferences.

However, please note that this will not affect the lawfulness of the processing before its withdrawal nor, when applicable law allows, will it affect the processing of your personal information conducted in reliance on lawful processing grounds other than consent.

Opting Out of Marketing and Promotional Communications

You can unsubscribe from our marketing and promotional communications at any time by clicking on the unsubscribe link in the emails that we send, or by contacting us using the details provided in the section "How Can You Contact Us About This Notice?" below. You will then be removed from the marketing lists. However, we may still communicate with you — for example, to send you service-related messages that are necessary for the administration and use of your account, to respond to service requests, or for other non-marketing purposes.

Notification Delivery

We send transactional notifications by email for important account and service events (such as authentication, billing, domain management, and website status updates). If your email address generates a permanent delivery failure (hard bounce) or a spam complaint, we will automatically disable routine email notifications to your account to protect our email delivery reputation and comply with email service provider requirements. You can re-enable notifications at any time through your account settings or by contacting our AI assistant. Please note that while routine notifications are disabled, you may miss some communications about your account. We send deletion warnings even if you have turned off routine notifications.

Account Information

If you would at any time like to review or change the information in your account or terminate your account, you can:

Upon your request to terminate your account, we will deactivate or delete your account and information from our active databases. However, we may retain some information in our files to prevent fraud, troubleshoot problems, assist with any investigations, enforce our Terms of Service and/or comply with applicable legal requirements.

If you have questions or comments about your privacy rights, you may email us at legal@acira.ai.

12. CONTROLS FOR DO-NOT-TRACK AND GLOBAL PRIVACY CONTROL

Do-Not-Track

Most web browsers and some mobile operating systems and mobile applications include a Do-Not-Track ("DNT") feature or setting you can activate to signal your privacy preference not to have data about your online browsing activities monitored and collected. At this stage, no uniform technology standard for recognizing and implementing DNT signals has been finalized. As such, we do not currently respond to DNT browser signals or any other mechanism that automatically communicates your choice not to be tracked online. If a standard for online tracking is adopted that we must follow in the future, we will inform you about that practice in a revised version of this Privacy Notice.

Global Privacy Control (GPC)

Global Privacy Control (GPC) is a browser-level signal that communicates your preference to opt out of the sale or sharing of your personal information.

Acira AI does not sell your personal information, does not share your personal information for cross-context behavioral advertising, and does not engage in targeted advertising. As such, there is no sale or sharing activity to opt out of, and GPC-enabled browsers experience no difference in functionality on our platform. We do not use tracking cookies for advertising. The only advertising-related processing we perform is measuring the performance of our own Google Ads campaigns, as described in Section 4, which Google performs as our service provider and which is not a sale, sharing, or targeted advertising. Our platform processes your data solely to provide the Services you have requested.

Should our practices ever change in a way that makes an opt-out applicable, we will honor GPC signals as valid opt-out requests to the extent required by applicable law.

13. DO UNITED STATES RESIDENTS HAVE SPECIFIC PRIVACY RIGHTS?

In Short: Depending on the state where you live, you may have rights regarding your personal information. We honor the requests described below wherever you live in the United States.

Several US states have comprehensive privacy laws, which apply to businesses above certain size or data-volume thresholds. Whether or not such a law applies to us, you may ask us to confirm whether we process your personal information, to access it or receive a copy of it, to correct it, or to delete it, as described in "How Can You Review, Update, or Delete the Data We Collect from You?" We will not discriminate against you for making such a request. We may need to verify your identity before acting on a request, and we will use the information you provide for verification only for that purpose. If we decline your request, you may appeal by emailing us at legal@acira.ai, and we will explain our decision in writing.

We do not sell your personal information or share it for cross-context behavioral advertising, and we do not use it for targeted advertising (see "Controls for Do-Not-Track and Global Privacy Control"). The categories of personal information we collect, their sources, and the purposes for which we use and disclose them are described in Sections 1, 2, and 4, and how long we keep them in Section 8.

Nevada Residents

Under Nevada Revised Statutes Chapter 603A, Nevada consumers have the right to direct a business to not sell their covered information. As stated elsewhere in this Privacy Notice, we do not sell your personal information to third parties. If you are a Nevada resident and wish to submit a verified request to opt out of any future sale of your covered information, should our practices ever change, please contact us at legal@acira.ai with the subject line "Nevada Opt-Out Request."

14. DO OTHER REGIONS HAVE SPECIFIC PRIVACY RIGHTS?

In Short: You may have additional rights based on the country you reside in.

Australia and New Zealand

We collect and process your personal information under the obligations and conditions set by Australia's Privacy Act 1988 and New Zealand's Privacy Act 2020.

If you do not wish to provide the personal information necessary for the applicable purpose, it may affect our ability to provide our services, in particular:

Offer you the products or services that you want
Respond to or help with your requests
Manage your account with us
Confirm your identity and protect your account

At any time, you have the right to request access to or correction of your personal information. You can make such a request by contacting us by using the contact details provided in the section "How Can You Review, Update, or Delete the Data We Collect from You?".

If you believe we are unlawfully processing your personal information, you have the right to submit a complaint about a breach of the Australian Privacy Principles to the Office of the Australian Information Commissioner and a breach of New Zealand's information privacy principles to the Office of the New Zealand Privacy Commissioner.

Brazil

If you are located in Brazil, we process your personal data in accordance with the Lei Geral de Proteção de Dados (Law No. 13.709/2018, the "LGPD"). We rely on the legal bases set out in Article 7 of the LGPD, which correspond to the legal bases described in "What Legal Bases Do We Rely On to Process Your Information?" above (including performance of a contract, compliance with legal obligations, our legitimate interests, and your consent).

As a data subject under the LGPD, you have the right to obtain: confirmation of the existence of processing; access to your personal data; correction of incomplete, inaccurate, or outdated data; anonymization, blocking, or deletion of unnecessary or excessive data or data processed in noncompliance with the LGPD; portability of your data; deletion of personal data processed with your consent; information about the public and private entities with which we have shared your data; information about the possibility of denying consent and the consequences of denial; and revocation of consent.

You can exercise these rights by contacting us at legal@acira.ai. If you believe your rights under the LGPD have been violated, you also have the right to lodge a complaint with the Brazilian National Data Protection Authority (Autoridade Nacional de Proteção de Dados — ANPD).

Canada (Quebec)

For the purposes of Quebec's Act respecting the protection of personal information in the private sector, the person in charge of the protection of personal information at Acira AI is our privacy officer, who can be reached at legal@acira.ai. Quebec residents may exercise the rights described in this Privacy Notice by contacting us and may lodge a complaint with the Commission d'accès à l'information du Québec.

Republic of South Africa

If you are unsatisfied with the manner in which we address any complaint with regard to our processing of personal information, you can contact the office of the regulator, the details of which are:

The Information Regulator (South Africa)

General enquiries: enquiries@inforegulator.org.za
Complaints (complete POPIA/PAIA form 5): PAIAComplaints@inforegulator.org.za & POPIAComplaints@inforegulator.org.za

15. DO WE MAKE UPDATES TO THIS NOTICE?

In Short: Yes, we will update this notice as necessary to stay compliant with relevant laws.

We may update this Privacy Notice from time to time. The updated version will be indicated by an updated "Last updated" date at the top of this Privacy Notice. If we make a material change, we will email a summary of it to the address associated with your account before it takes effect. If a change is fundamental — for example, a new purpose for processing your personal information, a new category of recipients, or a new transfer of your personal information to another country — we will tell you well in advance, so that you can object or, where we rely on your consent, withdraw it. Corrections and clarifications take effect when posted.

16. HOW CAN YOU CONTACT US ABOUT THIS NOTICE?

If you have questions or comments about this notice, please contact us at:

Acira AI LLC
11500 S Eastern Ave, Suite 150
Henderson, NV 89052
United States

Phone: 888-389-1189
Email: legal@acira.ai

Representative

We value your privacy and your rights as a data subject and have therefore appointed Prighter Group with its local partners as our privacy representative and your point of contact for the following regions:

United Kingdom (UK)
European Union (EU)
Türkiye (Turkey)

Prighter gives you an easy way to exercise your privacy-related rights (e.g. requests to access or erase personal data). If you want to contact us via our representative, Prighter, or make use of your data subject rights, please visit the following website: https://app.prighter.com/portal/acira

Based on our current assessment under Article 14 of the Swiss Federal Act on Data Protection, we have not designated a representative in Switzerland. If you are located in Switzerland, you can contact us directly using the details above.

17. HOW CAN YOU REVIEW, UPDATE, OR DELETE THE DATA WE COLLECT FROM YOU?

Based on the applicable laws of your country or state of residence in the US, you may have the right to request access to the personal information we collect from you, request details about how we have processed it, correct inaccuracies, or delete your personal information. You may also have the right to withdraw your consent to our processing of your personal information. These rights may be limited in some circumstances by applicable law.

Data Portability. If you wish to receive a copy of your personal information, you may submit a request and we will provide it in a structured, machine-readable format within the timeframes required by applicable law.

Account Deletion. You can request account deletion directly through your account by speaking with our AI assistant, or by contacting us.

To request to review, update, export, or delete your personal information, please contact: legal@acira.ai.