Privacy Policy

PACIFIC FINANCIAL INTELLIGENCE PLATFORM — Effective: July 7, 2026

HERNS INC ("Company," "we," "us," or "our") operates the Pacific financial intelligence platform. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our application, API services, and related tools (collectively, the "Service").

1. Information We Collect

Account Information:

• Email address (used for authentication and OTP verification);
• Hashed password (we never store plaintext passwords);
• Account creation date and subscription status.

Usage Data:

• Queries submitted to the Pacific AI (processed in real-time, not permanently stored);
• Feature usage patterns (commands used, session duration);
• Device type and operating system.

Technical Data:

• IP address (for rate limiting and security);
• API request metadata (timestamps, endpoint accessed);
• Error logs for debugging purposes.

Payment Data:

• Payment processing is handled entirely by third-party platforms (Apple App Store, Microsoft Store, Square, or IBM Cloud). We do not store credit card numbers, bank account details, or other payment instruments.

2. How We Use Your Information

Purpose	Legal Basis
Provide and maintain the Service	Contractual necessity
Authenticate your identity	Contractual necessity
Process subscription billing	Contractual necessity
Send OTP verification emails	Contractual necessity
Prevent fraud and abuse	Legitimate interest
Improve AI model quality	Legitimate interest
Respond to support requests	Contractual necessity
Comply with legal obligations	Legal obligation

3. AI Conversation Data

Your conversations with Pacific's AI are:

• Processed in real-time through our secured API infrastructure;
• Not permanently stored on our servers after the session ends;
• Not sold to third parties;
• Not used for advertising or profiling;
• May be used in anonymized, aggregated form to improve model quality.

4. Data Sharing

We do not sell your personal information. We may share data with:

• Service Providers: MongoDB Atlas (database hosting), Brevo (email delivery), Cloudflare (CDN and security) — bound by data processing agreements;
• Payment Processors: Apple, Microsoft, Square, IBM — only subscription status, not conversation data;
• Law Enforcement: When required by law, court order, or governmental regulation;
• Business Transfers: In connection with a merger, acquisition, or sale of assets (with prior notice).

5. Data Security

We implement industry-standard security measures including:

• TLS/HTTPS encryption for all data in transit;
• Bcrypt hashing for passwords;
• JWT-based authentication with token expiration;
• Rate limiting to prevent brute-force attacks;
• Infrastructure secured behind Cloudflare tunnels.

No method of transmission over the Internet is 100% secure. While we strive to protect your information, we cannot guarantee absolute security.

6. Data Retention

• Account data: Retained while your account is active and for 30 days after deletion;
• Conversation data: Not permanently stored (real-time processing only);
• Technical logs: Retained for up to 90 days;
• Billing records: Retained as required by applicable tax and accounting laws.

7. Your Rights

Depending on your jurisdiction, you may have the right to:

• Access the personal data we hold about you;
• Correct inaccurate or incomplete data;
• Delete your account and associated data;
• Export your data in a portable format;
• Object to certain processing activities;
• Withdraw consent where processing is based on consent.

To exercise any of these rights, contact us at support@grrn.io. We will respond within 30 days.

8. Children's Privacy

The Service is not intended for individuals under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have collected data from a child under 18, we will promptly delete it.

9. International Data Transfers

Your data may be processed in the United States where our servers are located. By using the Service, you consent to the transfer of your information to the United States and acknowledge that data protection laws may differ from those in your jurisdiction.

10. Third-Party Links

The Service may contain links to third-party websites or services (e.g., financial data providers, news sources). We are not responsible for the privacy practices of these third parties. We encourage you to review their privacy policies.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email or in-app notification at least 14 days before taking effect. The "Effective" date at the top indicates the latest revision.

12. Contact Us

For questions or concerns about this Privacy Policy, contact:
HERNS INC — Data Protection
Email: support@grrn.io
Web: https://grrn.io