Privacy Policy

Last updated: October 27, 2026

Anifold ("we", "us", or "our") respects your privacy. This Policy explains how we handle personal information when you visit our website, contact us, or use our safety environments and data, custom models and agents, evaluation and training services, and Safe Recursive Intelligence (SRI) platform. It also explains how you can exercise your rights.

1. Scope and Our Role

This Policy applies to the Anifold website and services that expressly refer to it. An order, service agreement, data processing agreement, or service-specific notice may further describe processing purposes, scope, retention, and responsibilities. More specific terms apply to the activities they cover without limiting rights provided by applicable law.

We act as a controller, or the equivalent under applicable law, when we determine the purposes and means of processing personal information for website operations, business communications, and customer relationship management. When we process training, evaluation, or agent execution data on a customer's behalf, we follow that customer's lawful instructions and our agreement. If a customer submitted your information through our services, please contact that customer first. We assist with requests as required by applicable law and our agreement.

2. Information We Process

If you contact us or discuss a potential engagement, we may process the name, work email, company, role, contact details, business requirements, and correspondence you provide. Please submit only information necessary for your inquiry or engagement.

To deliver website access, troubleshoot problems, and maintain security, the website and its hosting infrastructure may process IP addresses, browser and device information, request times, requested paths, error records, and security logs. The specific information depends on the features and deployment involved.

For training, evaluation, model, or platform services, we may process prompts, conversations, uploaded files, datasets, model outputs, evaluation settings, scores, agent trajectories, tool-call records, and execution logs within the agreed service scope. Such materials do not necessarily contain personal information. Any portion that identifies or relates to an identifiable individual is subject to applicable personal information requirements. Processing is limited to the actual service and customer instructions.

3. Purposes and Legal Bases

We use information as necessary to respond to inquiries, discuss engagements, perform service agreements, deliver environments and data, carry out authorized training and evaluation, provide support, secure systems, prevent abuse, and comply with applicable legal obligations. Depending on the activity and applicable law, we rely on consent, necessity for a contract with you or steps you request before entering one, legal obligations, or another permitted basis. Where applicable law recognizes legitimate interests, we rely on that basis only where those interests are not overridden by your rights and interests.

Where consent or separate consent is legally required, we obtain it through the appropriate process. Before using personal information for an incompatible new purpose, we provide the notice and obtain the authorization required by law.

4. Customer Data, Training, and Safety Research

Data submitted for custom training, capability evaluation, red teaming, or safety alignment is used within the corresponding service terms and authorization. Customers are responsible for ensuring lawful sourcing and necessary permissions, and should remove unrelated personal information, credentials, and confidential material wherever possible.

Unless a customer expressly authorizes it or we otherwise agree in writing, we do not use the customer's non-public prompts, conversations, files, model outputs, or execution trajectories to train general-purpose models for other customers or include them in externally supplied training datasets. Customer-specific post-training is distinct from that general-purpose training; data use, model delivery, and rights to results are governed by the relevant agreement.

Safety research and evaluation may involve attack examples, malicious agent trajectories, or harmful content. A research purpose does not remove privacy obligations. Where personal information is involved, its sourcing, use, and disclosure must have an applicable legal basis and safeguards appropriate to the risk.

5. Cookies and Similar Technologies

The website or a service may use cookies, local storage, or similar technologies to maintain sessions, remember necessary preferences, or support security functions. If we enable non-essential analytics or tracking that requires consent, we provide the relevant notice and choice before activation. You can manage cookies and storage through browser settings, although doing so may affect some features.

6. Sharing and Disclosure

We may provide necessary information to hosting, cloud infrastructure, technical support, or security providers and professional advisers subject to confidentiality duties. Where providers process personal information on our behalf, appropriate terms restrict their purposes and scope and require relevant safeguards. If a service uses third-party models or tools, the applicable service documents or specific notices should explain the data flows and responsibilities.

We may disclose necessary information when required by law or valid legal process, or where legally necessary to protect relevant rights. If a merger, reorganization, or business transfer involves personal information, we provide legally required notice and require the recipient to continue applicable protections. We do not sell personal information or use non-public customer service data for third-party advertising. We provide additional notice and obtain consent or separate consent for sharing where required by law.

7. Storage, International Processing, and Retention

Storage and processing locations depend on the service and deployment arrangements. Where cross-border transfers are restricted by applicable law, we complete the required notice, consent, assessment, contractual, or other procedures. Customers with data residency requirements should establish them in the service agreement before submitting data.

We retain personal information only as long as necessary for the processing purpose, relevant agreements, and legal obligations. Retention decisions consider the service duration, data type, processing risk, dispute-resolution needs, and statutory requirements. When the purpose ends, we delete or anonymize information in accordance with applicable law and agreements. Information that must legally be retained or cannot yet be removed from backups is restricted in use and remains protected.

8. Security

We apply technical and organizational measures appropriate to the information and risk, including system-appropriate access management, protections for transmission or storage, logging, and incident response. No online service can guarantee absolute security. If a personal information incident occurs, we take remedial action and provide notifications and reports as required by applicable law.

9. Your Rights and Requests

Subject to applicable law, you may request access, a copy, correction, completion, or deletion of personal information; restriction of or objection to particular processing; withdrawal of consent; and legally available portability or other rights. Withdrawing consent does not affect the lawfulness of prior processing based on it. Legal duties, others' rights, or other statutory exceptions may limit a request, in which case we explain the applicable reason.

Submit requests to [email protected]. We may request proportionate identity verification to protect information and respond within the period required by applicable law. You may also lodge a complaint with a competent supervisory authority.

10. Minors

Our website and enterprise training services are not directed to minors. If you believe a minor has supplied personal information without necessary authorization, contact us so we can investigate and take appropriate action under applicable law. We comply with guardian-consent requirements where applicable.

11. Third-Party Services and Policy Changes

Our website may link to third-party services. Independently provided third-party services have their own privacy rules; this Policy does not replace their notice obligations.

We may revise this Policy to reflect business or legal changes and update the date on this page. For material changes to personal information processing, we provide appropriate notice and obtain renewed consent where required. A policy update alone does not authorize new processing that legally requires your consent.

12. Contact Us

For questions about this Policy, personal information processing, or your rights, contact [email protected]. Customers with an Anifold service agreement may also use the privacy or service contacts specified in that agreement.