Privacy Policy

This Privacy Policy ("Policy") explains how Noreason.ai and its affiliates (collectively, "Noreason.ai," "we," "our," or "us") collect, use, disclose, and protect Personal Data of individuals who access or use our website, platform, or services (collectively, the "Services"), including our Human Attention Modeling platform at noreason.ai.

By using the Services or otherwise engaging with Noreason.ai, you acknowledge that you have read and understood this Policy. Where processing is based on consent, your continued use of the Services constitutes consent to the use of your Personal Data as described herein.

We are committed to processing your data lawfully, fairly, and transparently. If you have questions, please contact us at [email protected].

1. Definitions and Scope

(a) Key Definitions

"Personal Data" means any information relating to an identified or identifiable individual, including name, email address, IP address, device identifiers, and behavioral or attention data that can reasonably identify a person. In certain jurisdictions this may be referred to as "Personal Information."

"Human Attention Data" or "Attention Data" means data collected or inferred about how a user allocates cognitive focus, visual attention, or engagement — including but not limited to gaze patterns, dwell time, scroll behavior, interaction sequences, and click-path data — processed to build Noreason.ai's Human Attention Models.

"Human Attention Models" means the proprietary AI models developed by Noreason.ai that are trained on Attention Data to understand, predict, and simulate human cognitive attention patterns.

Other capitalized terms have the meanings given in our Terms of Service available at noreason.ai/terms.

(b) Scope

This Policy applies when Noreason.ai acts as a data controller. It does not apply when we process Personal Data on behalf of enterprise or business customers acting as data controllers — those relationships are governed by a separate Data Processing Addendum.

2. Categories of Personal Data We Collect

(a) Data You Provide Directly

Account & Contact Information

When you create an account, we collect your name, email address, phone number, billing address, and account preferences.

AI Content and Attention Input & Output Data

We process data, text prompts, reference images, videos, audio, likenesses, and assets you submit to our platform as Input, and the outputs generated for you by our models and AI content generation tools (including predictions, synthetic images, videos, and media files).

Attention & Behavioral Signals

To provide our Human Attention Modeling services, we collect signals related to how you and your end-users engage with content. This may include eye-tracking data, gaze coordinates, fixation duration, scroll depth, mouse movement patterns, click sequences, dwell time, and session interaction logs. Depending on your jurisdiction and the nature of collection, some of this data may constitute biometric or sensitive data under applicable law.

Profile Information

You may provide professional background, intended use cases, and preferences when onboarding. If you publish models or results within our platform, associated profile information may be visible to other users.

Feedback & Communications

When you contact us, respond to surveys, or engage with our support team, we collect your name, email, the content of communications, and any attachments you submit.

Payment Details

Payment processing is handled by our third-party processor, Stripe. We do not directly store full card details. Stripe collects your name, billing address, and payment method. Please review Stripe's privacy policy at stripe.com/privacy.

Verification Information

We may request verification of identity or age as permitted by applicable law, which may include date of birth, a copy of a government-issued ID, or proof of address.

(b) Data We Collect Automatically

Cookies and Tracking Technologies

We and our third-party partners use cookies, pixel tags, SDKs, and similar technologies to collect information about your use of the Services. See Section 7 for details and your choices.

Location Data

We infer your approximate location from your IP address. Where required by law, we will seek your consent before doing so.

Device & Technical Information

We collect IP address, browser type and version, operating system, device identifiers, screen resolution, and mobile advertising identifiers.

Usage Data

We collect information about how you interact with our platform — pages visited, features used, time spent, actions taken, error events, and session metadata.

(c) Data from Third Parties

Third-Party Login Providers

If you register or log in via Google, LinkedIn, or similar OAuth providers, we receive your name, email, username, and profile picture from that provider.

Service Providers & Data Partners

We may receive data from third-party service providers for identity verification, KYC/AML compliance, and data enrichment purposes.

Publicly Available Data

We may incorporate publicly available data to train and benchmark our Human Attention Models where permitted by applicable law.

3. How We Use Your Personal Data

The table below sets out the purposes for which we process your Personal Data, the data used, and the legal basis where required under applicable law.

Purpose	Description	Data Used	Legal Basis
Providing Services	Operating and delivering Noreason.ai Human Attention Modeling services you request.	Account data, input/output, usage data	Contract performance
Attention & Behavioral Data Processing	Processing attention signals (gaze, interaction patterns, engagement data) to build and refine Human Attention Models.	Attention data, interaction logs, behavioral signals	Contract performance; Legitimate interests
Model Training & Improvement	Training, developing, and improving our AI models, algorithms, and platform features. Free Tier content (prompts, uploads, and outputs) is processed for training by default with no opt-out. Pro and Team Tier content is strictly excluded from model training by default.	Prompts, uploaded assets, generated outputs, interaction data, behavioral patterns	Legitimate interests; Contract performance; Consent (where required)
Account Management	Creating and managing your account, authentication, and account preferences.	Name, email, account details	Contract performance
Communications & Support	Responding to inquiries, providing technical support, and sending service-related notices.	Contact details, support content	Legitimate interests; Contract
Marketing Communications	Sending promotional content, newsletters, and product updates to prospective and current users.	Name, email, preferences	Consent
Advertising & Retargeting	Running paid campaigns on Google Ads, Meta, and LinkedIn — including search ads with conversion pixels and retargeting visitors who interacted with the Services. Measurement of campaign performance.	Online identifiers (cookie IDs, device IDs, IP address), browsing behavior on the Services, conversion events	Consent (EEA, UK, Switzerland); Legitimate interests (elsewhere, subject to opt-out)
Marketing Profile Building	Building audience segments and look-alike audiences from visitor behavior on the Services for use in advertising and retargeting.	Cookie IDs, browsing patterns, source/referrer, interest signals	Consent (EEA, UK, Switzerland); Legitimate interests (elsewhere, subject to opt-out)
Attention & Behavioral Profile Generation	Generating account-level attention and engagement profiles from content uploaded to Soma — e.g., recurring drop-off points, hook patterns, pacing tendencies — to power product features and benchmarks.	Attention data, interaction logs, content metadata tied to your account	Contract performance; Consent (where attention data is biometric under applicable law)
Audience Demographic Inference	Where you submit video or imagery to Soma/Maya, our models may infer aggregated demographic and attention signals about the audiences depicted in the content (age range, gender presentation, emotional response). These inferences may constitute biometric or sensitive data under some laws — see §12.	Visual content you upload, derived demographic and emotional signals	Explicit Consent (per §12)
Third-Party AI Processing	Content you upload to Soma/Maya may be transmitted to third-party AI providers (e.g., OpenAI, Anthropic, and image/video model providers) under enterprise agreements that prohibit those providers from training their models on your content.	Uploaded content (text, images, video), prompts, derived outputs	Contract performance
Billing & Payments	Processing payments, managing subscriptions, and maintaining financial records.	Billing info, transaction data	Contract performance
Fraud Prevention & Safety	Detecting, preventing, and investigating fraud, abuse, and unauthorized access.	Usage data, device info, IP address	Legitimate interests; Legal obligation
Analytics & Understanding Usage	Understanding how our platform is used to identify trends, fix errors, and improve product features. Deployed via Google Tag Manager.	Usage logs, behavioral signals, cookies	Legitimate interests (global); Consent (EEA, UK, Switzerland)
Legal & Compliance	Complying with applicable laws, regulations, court orders, and responding to lawful governmental requests.	Any data as required	Legal obligation; Legitimate interests
Aggregate Data Generation	Generating anonymized or aggregated data sets for research, benchmarking, and product development.	De-identified data	Legitimate interests

(a) Human Attention Modeling — Additional Detail

Noreason.ai's core services involve processing Attention Data to build and refine our Human Attention Models. This includes: (i) collecting behavioral and interaction signals as you and your end-users engage with digital content; (ii) using proprietary AI methods to identify patterns in cognitive attention; and (iii) generating predictions, heatmaps, or other attention-based outputs.

We process this data to perform our contract with you. Where Attention Data constitutes biometric data under applicable law (such as gaze-tracking data in certain U.S. states or the EU), we will seek your explicit consent and comply with applicable biometric data obligations before processing.

(b) Model Training

We use de-identified and aggregated Attention Data and interaction data to train, test, and improve our Human Attention Models. Our training practices are designed to remove or substantially reduce data that could reasonably identify any individual. We do not use Personal Data to profile or target consumers for advertising purposes in connection with model training.

(c) Content Moderation

We reserve the right to review inputs and outputs to maintain platform integrity, prevent fraud, and ensure compliance with our Acceptable Use Policy. In certain circumstances, we may share inputs or outputs with third-party content moderation partners. Users found in violation of our Acceptable Use Policy may have their accounts suspended or terminated.

4. How We Share Your Personal Data

We do not sell Personal Data to data brokers, and we do not knowingly sell or share Personal Data of individuals under 18. However, our use of advertising and analytics partners means that some sharing of online identifiers may constitute a "sale" or "share" of Personal Data under U.S. state privacy laws such as the CCPA / CPRA — see §8(b) for how to opt out. We may share Personal Data as follows:

Affiliates

We may share your Personal Data with current or future affiliates of Noreason.ai for any purposes described in this Policy.

Vendors and Service Providers

We share data with trusted third-party vendors who support our operations, including cloud hosting, data analysis, payment processing, content moderation, customer support, security, and email delivery.

Advertising and Measurement Partners

We share online identifiers (cookie IDs, device IDs, hashed email, IP address) and event data with advertising platforms — including Google Ads, Meta (Facebook/Instagram), and LinkedIn — to run retargeting, search, and measurement campaigns. This sharing is gated by the cookie banner: ad-storage stays denied until you click "Accept All" worldwide; EEA / UK / Swiss visitors additionally gate analytics. We do not transmit Attention Data or uploaded content to advertising partners.

Third-Party AI Providers

To deliver AI content generation and attention prediction outputs, prompts and content you upload (text, images, video) may be transmitted to third-party AI model providers — including OpenAI, Anthropic, Stability AI, and Midjourney. These providers act as our sub-processors under strict enterprise agreements that: (i) restrict use of your data solely to providing the requested output; and (ii) strictly prohibit training their models on your content, prompts, or assets.

Co-Marketing and Affiliate Partners

We participate in co-marketing arrangements and partner-referral programs. We may share lead information (name, email, role, source) and conversion events with partners who refer users to us, or with whom we run joint campaigns. Where required, this sharing only occurs with your consent.

Enterprise Customers

If you are an end-user of an enterprise customer's deployment of our platform, we may share relevant data with that customer as described in their data processing agreement with us.

Third-Party Integrations

If you connect Noreason.ai to third-party tools or authorize data sharing with third-party platforms, we will share data as directed by you. Please review the privacy practices of any third party before connecting.

Legal Requirements

We may disclose your Personal Data to law enforcement agencies, regulatory bodies, courts, or public authorities if required or appropriate to comply with legal obligations, protect the rights or safety of individuals, or enforce our Terms of Service.

Corporate Transactions

We may disclose or transfer Personal Data in connection with a merger, acquisition, restructuring, sale of assets, or similar corporate transaction. We will notify you as required by law if such a transfer occurs.

With Your Consent

We may share your Personal Data with other third parties where you have provided explicit consent, including for co-hosted events or partner referrals.

5. International Data Transfers

Noreason.ai maintains servers and infrastructure primarily in the United States. If you are located outside the United States, your Personal Data will be transferred to and processed in the United States, which may have data protection laws different from those in your country.

Where we transfer Personal Data outside your country of residence, we apply appropriate safeguards, which may include:

• Standard Contractual Clauses approved by relevant authorities (e.g., EU SCCs for EEA transfers);
• Transfers to countries deemed adequate by relevant authorities;
• Binding Corporate Rules or other approved transfer mechanisms; or
• Your explicit consent to the transfer

International Data Transfer Recipients:

Recipient Category	Countries	Purpose	Data Types
Cloud service providers (e.g., AWS, Google Cloud)	United States	Infrastructure, storage, and security	Account data, behavioral data, usage logs
Payment processors (e.g., Stripe)	United States	Payment processing and billing	Name, billing address, payment details
Analytics platforms (e.g., Google Analytics, Mixpanel)	United States	Usage analytics and product improvement	IP address, device info, browsing behavior
Advertising platforms (Google Ads, Meta, LinkedIn)	United States	Retargeting, search advertising, conversion measurement, look-alike audience building	Online identifiers (cookie IDs, device IDs, hashed email), IP address, browsing and conversion events
Third-party AI providers (e.g., OpenAI, Anthropic, Stability AI, Midjourney)	United States	Processing content to generate AI content and attention outputs	Uploaded content (text, images, video), prompts, derived outputs
Customer support tools (e.g., Intercom, Zendesk)	United States	Customer service and technical support	Contact details, support conversations

For more information about our international transfer mechanisms, or to obtain a copy of applicable safeguards, contact us at [email protected].

6. Data Retention

We retain your Personal Data only for as long as necessary to fulfill the purposes described in this Policy, comply with legal obligations, resolve disputes, and enforce our agreements. When determining retention periods, we consider the type of data, the nature of our relationship, legal requirements, and applicable statutes of limitations.

Specific retention guidelines:

• Account data is retained for the duration of your account and for up to 3 years after account closure, unless a longer period is required by law.
• Attention Data and Human Attention Model training data derived from your interactions is retained for no more than 3 years after your last interaction with our platform, except as required by law.
• Biometric data (where collected) is retained only for the period necessary for its stated purpose or until 3 years after the end of our relationship with you, whichever is sooner.
• Uploaded media files (images, videos, audio, prompts) and generated AI outputs are securely stored and retained for the duration of your active account, and will be deleted within thirty (30) days of your account deletion request, subject to standard system backup schedules.
• Payment records are retained as required by applicable tax and accounting laws.
• De-identified or aggregated data may be retained indefinitely as it no longer constitutes Personal Data.

7. Cookies and Tracking Technologies

We and our third-party partners use cookies, pixel tags, SDKs, and similar technologies to collect information about your device and online activity. This data helps us operate the Services, measure how the site is used, and (where you have consented) serve relevant marketing. Tag deployment is coordinated through Google Tag Manager.

Types of Cookies We Use

Strictly Necessary

Essential for the Services to function (e.g., authentication, session management, bot detection). These cannot be disabled.

Performance & Analytics

Help us understand how users interact with our platform, identify usage trends, and diagnose issues. These include tools like Google Analytics 4 deployed via Google Tag Manager. The data we collect is limited to aggregate usage signals (pages visited, features used, error events, approximate location derived from IP).

We treat performance & analytics cookies as an essential operating tool globally — they are enabled by default and the legal basis is our legitimate interest in maintaining and improving the Services. Exception for EEA, UK, and Swiss visitors: in line with the ePrivacy Directive, UK PECR, and revFADP, analytics cookies are not set for you until you accept them on the consent banner. You can change your mind at any time via the "Cookie preferences" link in the footer.

Independent of our banner, you can opt out of Google Analytics globally at tools.google.com/dlpage/gaoptout.

Targeting & Marketing

We deploy retargeting and conversion pixels from Google Ads, Meta (Facebook/Instagram), and LinkedIn via Google Tag Manager. These pixels do three things: (i) show ads to people who previously visited the Services on those networks, (ii) measure when an ad click led to a signup or other conversion, and (iii) build look-alike audiences from visitor behavior to find users similar to existing customers. We may also share lead and conversion data with co-marketing or affiliate partners who refer users to us.

Targeting & marketing cookies are always consent-gated — they stay off worldwide until you click "Accept All" on the consent banner. Choosing "Accept Necessary" leaves them off and prevents any data flow to advertising partners.

Your Cookie Choices

• Consent Manager: A consent banner is shown on first visit. You may update your preferences at any time via the "Cookie preferences" link in the footer.
• Browser Settings: Most browsers allow you to block or delete cookies. Note that disabling cookies may impair certain Services features.
• Global Privacy Control (GPC): We honor GPC signals as opt-out requests for targeting and marketing cookies.
• Do Not Track: Our Services do not currently respond to DNT browser signals.

8. Your Privacy Rights

(a) General Rights

Depending on your location, you may have the following rights regarding your Personal Data:

• Access: Receive confirmation of processing and request a copy of your Personal Data.
• Correction: Request correction of inaccurate or incomplete data. Most profile data can be edited in account settings.
• Deletion: Request deletion of your account and associated Personal Data, including Attention Data tied to your account. Where deletion is not feasible (e.g., backup systems), we will anonymize the data.
• Restriction: Request that we restrict processing of your data in certain circumstances.
• Objection: Object to processing based on legitimate interests, including profiling.
• Portability: Request transfer of your Personal Data to another organization in a structured, machine-readable format.
• Withdraw Consent: Withdraw any consent you have given at any time. Withdrawal does not affect prior lawful processing.
• Opt Out of Training: You may opt out of the use of your Personal Data for model training at any time via the Privacy Controls in your account settings. The opt-out applies prospectively.
• Unsubscribe: Opt out of marketing emails by clicking 'Unsubscribe' in any email or by contacting us at [email protected].

To exercise any of these rights, please contact us at [email protected] or use the privacy request form available at noreason.ai/privacy-request. We may verify your identity before processing your request. We will respond within the timeframe required by applicable law.

You may also have the right to lodge a complaint with a supervisory authority in your country of residence, place of work, or where an alleged violation occurred.

(b) U.S. State Residents

Residents of California, Colorado, Connecticut, Virginia, Utah, Oregon, Montana, Texas, and other states with comprehensive privacy laws have the following additional rights:

Sale and Targeted Advertising Opt-Out

Our use of advertising and measurement partners (Google Ads, Meta, LinkedIn) and our co-marketing / affiliate-referral arrangements do involve sharing online identifiers and event data with third parties for cross-context behavioral advertising and look-alike audience building. Under the CCPA/CPRA and most U.S. state privacy laws, this constitutes a "sale" or "sharing" of Personal Data even though no money changes hands directly for the data itself.

The categories of Personal Data that may be sold or shared in this way include: online identifiers (cookie IDs, device IDs, hashed email, IP address), internet activity (pages visited, click events, conversion events), and inferences drawn from that activity. We do not sell or share Attention Data, biometric data, content you upload to Soma / Maya, or contact details to advertising partners.

How to opt out:

• Click "Accept Necessary" on the consent banner, or use the "Cookie preferences" link in the footer to revisit your choice at any time. This prevents any data flow to advertising and measurement partners.
• Send a Global Privacy Control (GPC) signal — we honor GPC as a valid opt-out request for targeted advertising.
• Email [email protected] or use noreason.ai/privacy-request to submit a Do Not Sell / Do Not Share request.

We do not knowingly sell or share Personal Data of individuals under 18 years of age, and we do not sell Personal Data to data brokers under any state's definition.

Authorized Agents

Residents of applicable states may designate an authorized agent to submit privacy requests on their behalf. We may require documentation confirming the agent's authority.

(c) EEA, UK, and Swiss Residents

If you are located in the European Economic Area, United Kingdom, or Switzerland, the legal bases for our processing are described in Section 3 above. You have the rights listed in Section 8(a) under the GDPR or applicable national law.

Where required, we will enter into Standard Contractual Clauses for international data transfers. You have the right to lodge a complaint with your national data protection authority.

(d) Indian Residents

In addition to the rights in Section 8(a), you have the right to nominate another individual to exercise your privacy rights in the event of your death or incapacity, and the right to raise a grievance with us about our data processing practices.

9. Third-Party Services and Links

Our Services may contain links to third-party websites, tools, or services we do not operate. This Policy does not apply to such third parties. We encourage you to review the privacy policies of any third-party service before providing your Personal Data.

10. Data Security

We implement reasonable and appropriate technical, administrative, and organizational security measures to protect your Personal Data against unauthorized access, disclosure, alteration, and destruction. Our security practices are reviewed regularly and may include encryption in transit and at rest, access controls, and security monitoring.

No method of electronic transmission or storage is completely secure. While we strive to protect your Personal Data, we cannot guarantee absolute security. If you become aware of a security issue, please contact us at [email protected].

11. Children's Privacy

Our Services are intended for individuals 18 years of age and older. We do not knowingly collect, process, or store Personal Data from anyone under 18. If you are under 18, do not submit any Personal Data through our Services.

If we learn that we have inadvertently collected Personal Data from a person under 18, we will promptly delete it. To report such a concern, contact us at [email protected].

12. Biometric and Sensitive Data

Certain features of Noreason.ai's Human Attention Modeling platform involve processing data that constitutes biometric data or sensitive data under applicable laws. This includes:

• Attention and gaze signals collected as you or your end-users interact with content — treated as biometric identifiers under, among others, Illinois BIPA, Texas CUBI, and the EU GDPR.
• Audience demographic inference — when you submit video or imagery to Soma / Maya, our models may infer aggregated demographic and emotional signals (age range, gender presentation, emotional response) about the people depicted in that content. These inferences may constitute biometric, sensitive, or "consumer health" data under laws including the Washington My Health My Data Act, California's CCPA/CPRA sensitive data category, the EU GDPR Article 9, and similar regimes.
• Character reference and face swapping assets — reference images, videos, and facial likenesses uploaded for custom character profiles, face swapping, or generated content are processed as biometric and sensitive data. Users must secure all required explicit consents from depicted individuals before uploading or generating their likeness.

Where we collect or generate biometric or sensitive data, we will: (i) provide a separate notice and obtain explicit opt-in consent before processing; (ii) use the data only for the purposes described in that notice; (iii) not sell or profit from biometric data, and not share it with advertising partners; (iv) not use it to make decisions about a specific identified individual depicted in customer content; and (v) retain the data only as long as needed for its stated purpose, or a maximum of 3 years after our relationship ends, whichever is sooner.

We do not use Attention Data, audience demographic inferences, or other biometric data to make inferences about protected characteristics such as race, religion, health status, or political views, and we do not link these signals back to identified end-users depicted in customer content. Aggregated outputs (heatmaps, retention curves, demographic distributions) are produced at the audience level, not the individual level.

If you are uploading content to Soma / Maya that depicts identifiable individuals, you represent and warrant that you have obtained any consent required from those individuals before submission, including any explicit biometric-data consent required by Illinois BIPA, Texas CUBI, Washington MHMDA, the EU GDPR, or other applicable law.

13. Updates to This Policy

We may update this Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will notify you of material changes by posting a prominent notice on our website, sending an email notification, or as otherwise required by law. The 'Effective Date' at the top of this Policy indicates when it was last updated.

We encourage you to review this Policy periodically to stay informed about how we protect your Personal Data.

14. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our processing of your Personal Data, please contact our Privacy Team:

Email: [email protected]

We aim to respond to all privacy-related inquiries within 30 days, or within the timeframe required by applicable law, whichever is shorter. We may ask you to verify your identity before processing your request.