Privacy, Data Protection and AI Governance Policy

1. Executive Summary

IntivaX Inc. (“IntivaX”, “we”, “our”, or “us”) is committed to protecting customer information, respecting user rights, maintaining transparent data practices, and implementing responsible artificial intelligence governance across its products and services.

IntivaX provides enterprise software capabilities that may include CRM, ERP, workflow automation, analytics, integrations, mobile access, customer management, document handling, commercial operations, artificial intelligence assistance, and business process automation.

This Privacy, Data Protection and AI Governance Policy describes how IntivaX accesses, collects, uses, shares, stores, secures, transfers, retains, deletes, and governs information processed through its mobile applications, web applications, APIs, integrations, AI-enabled features, and related digital services.

2. Corporate Information

3. Scope of This Policy

This policy applies to all users, customers, administrators, authorized personnel, partners, and visitors who access or interact with IntivaX services, including:

• IntivaX mobile applications published in app marketplaces, including Google Play.
• IntivaX web applications, portals, dashboards, and administrative interfaces.
• APIs, SDKs, webhooks, and system integrations.
• AI-enabled features, automation tools, recommendations, summaries, and assistants.
• Customer support, onboarding, training, implementation, and professional services.
• Future products, modules, and services released under the IntivaX brand.

When IntivaX is used by an organization, the organization may be the primary controller of Customer Data and determines what information is uploaded, configured, processed, retained, and deleted within its IntivaX environment.

4. Core Data Protection Principles

Privacy by Design

Privacy considerations are intended to be incorporated into the design, development, deployment, and operation of IntivaX products and services.

Security by Default

IntivaX seeks to apply reasonable security safeguards, access controls, and operational measures by default to protect customer environments and user information.

Transparency

IntivaX aims to clearly explain what data is collected, how it is used, who it may be shared with, and what rights may be available to users and customers.

Customer Ownership

Customer Data remains owned by the customer or the organization that provided it. IntivaX processes Customer Data to provide and improve contracted services, not to sell such data.

Responsible Artificial Intelligence

IntivaX applies responsible AI principles, including human oversight, security, transparency, proportionality, and restrictions on the use of Customer Data for AI model training.

5. Definitions

6. Categories of Data We May Collect

The data collected depends on the product configuration, customer environment, user role, enabled modules, integrations, and permissions granted.

7. Information We Do Not Intentionally Collect

Unless specifically configured by a customer with a lawful basis and appropriate permissions, IntivaX does not intentionally collect:

• Biometric identifiers or biometric templates.
• Genetic data.
• Protected health information or medical records.
• Information about children under the age of 13.
• Religious beliefs, political opinions, or trade union membership.
• Precise geolocation tracking for consumer profiling.
• Payment card numbers directly through IntivaX systems, unless handled by certified third-party payment providers.

8. Legal Bases for Processing

Where applicable, IntivaX may process Personal Data under one or more of the following legal bases:

• Performance of a contract: to provide services requested by customers and users.
• Legitimate interests: to secure, maintain, improve, and operate enterprise software services.
• Consent: where consent is required for specific processing activities.
• Legal obligation: to comply with applicable laws, regulations, audits, court orders, or governmental requests.
• Protection of rights and security: to detect, prevent, or respond to fraud, misuse, security incidents, and unauthorized access.

9. Authentication and Account Access

IntivaX currently supports or may support several authentication methods depending on customer configuration:

• Username and password authentication.
• Google Login.
• Single Sign-On (SSO).
• Enterprise identity providers through standards such as OAuth, OpenID Connect, or SAML where implemented.
• Session tokens, access tokens, refresh tokens, and security cookies.
• Multi-factor authentication as part of the security roadmap or customer configuration.

Users are responsible for keeping credentials secure and reporting suspected unauthorized access to their organization administrator or IntivaX support contact.

10. Mobile Application Permissions

The IntivaX mobile application may request permissions only when required for business functionality, user-requested actions, security, or service delivery.

11. How We Use Data

IntivaX may use data to:

• Provide, operate, maintain, and improve the platform.
• Deliver CRM, ERP, workflow, analytics, reporting, AI, and automation functionality.
• Authenticate users and manage account access.
• Enable customer-authorized integrations and API connections.
• Process business records submitted by customers and users.
• Send operational, administrative, security, and service communications.
• Provide customer support, implementation, onboarding, training, and troubleshooting.
• Monitor performance, availability, reliability, and technical quality.
• Detect, prevent, investigate, and respond to fraud, misuse, unauthorized access, and security incidents.
• Generate analytics, insights, recommendations, summaries, or automation suggestions.
• Comply with legal, regulatory, contractual, accounting, tax, and audit obligations.
• Protect the rights, property, safety, and security of IntivaX, customers, users, and third parties.

12. Artificial Intelligence Governance

IntivaX may provide artificial intelligence features designed to support productivity, automation, decision support, data classification, business insights, content generation, summarization, recommendations, or workflow assistance.

Human Oversight

AI outputs are intended to support users, not replace professional judgment. Users should review AI-generated outputs before making business, legal, financial, operational, or customer-impacting decisions.

Transparency

Where practical, IntivaX aims to identify AI-enabled features and provide appropriate information about their purpose, limitations, and intended use.

Accuracy and Limitations

AI systems may generate incomplete, inaccurate, outdated, or inappropriate results. Customers and users are responsible for validating outputs before relying on them.

Security and Access Controls

AI-enabled features are subject to applicable customer permissions, access controls, and role-based restrictions within IntivaX.

Responsible Use

Users must not use IntivaX AI features to generate unlawful, harmful, deceptive, infringing, discriminatory, or abusive content, or to violate the rights of others.

13. AI Training Restrictions and Customer Data Protection

IntivaX does not use Customer Data, customer records, business documents, files, prompts, conversations, CRM data, ERP data, support tickets, or integration data to train public AI models, shared AI models, foundation models, or third-party AI systems.

When IntivaX integrates with AI providers such as OpenAI or Anthropic, such integrations are intended to process customer-authorized requests for the purpose of delivering AI functionality. IntivaX will seek to configure such services in a manner consistent with enterprise data protection expectations and this policy.

Customer Data remains the property of the customer. IntivaX may process Customer Data to provide contracted services, troubleshoot issues, secure the platform, and support customer-requested functionality, but not to train public or shared AI systems.

14. Integrations and Third-Party Services

IntivaX may integrate with third-party platforms when authorized by customers or administrators. Current or planned integrations may include, among others:

• Google Workspace.
• Microsoft 365.
• SAP.
• Salesforce.
• WhatsApp.
• OpenAI.
• Anthropic.
• Stripe.
• Twilio.

Integrations are activated based on customer configuration, permissions, credentials, and business requirements. Data shared through integrations is governed by customer settings, the applicable third-party provider terms, and the customer’s own internal policies.

15. Subprocessors and Service Providers

IntivaX may use subprocessors and service providers to deliver infrastructure, hosting, analytics, authentication, AI processing, communications, payments, monitoring, support, and security services.

IntivaX may update its subprocessor list as services evolve, new integrations are added, or infrastructure changes occur.

16. Security Program

IntivaX applies reasonable administrative, technical, and organizational safeguards designed to protect data from unauthorized access, alteration, loss, misuse, disclosure, or destruction.

Encryption

IntivaX uses secure transmission protocols such as TLS for data in transit. Encryption at rest may be used where applicable depending on service configuration, storage layer, and infrastructure capability.

Access Controls

Access controls may include role-based permissions, administrative restrictions, authentication policies, least-privilege principles, and customer-managed user roles.

Logging and Audit Trails

IntivaX may maintain logs and audit trails to support security monitoring, troubleshooting, compliance, operational integrity, and incident investigations.

Monitoring

IntivaX may monitor service performance, security events, availability, system health, errors, and suspicious activity.

Backups and Disaster Recovery

IntivaX may maintain backup systems and disaster recovery procedures designed to support service continuity, data restoration, and operational resilience.

Personnel and Administrative Controls

Access to internal systems and customer environments is intended to be limited to authorized personnel and service providers with a legitimate business need.

17. AWS Infrastructure and Multi-Region Operations

IntivaX currently uses Amazon Web Services (AWS) as its cloud infrastructure provider.

Specific hosting locations may depend on customer configuration, infrastructure design, availability requirements, regulatory considerations, and service evolution.

18. International Data Transfers

Because IntivaX operates as a cloud-based enterprise software provider, information may be processed, stored, accessed, or transferred in jurisdictions where IntivaX, its customers, affiliates, service providers, or subprocessors operate.

These jurisdictions may include the United States, Mexico, Colombia, and other countries where IntivaX infrastructure, customers, or service providers are located.

Where required, IntivaX seeks to apply appropriate safeguards for international data transfers, which may include contractual protections, access controls, security measures, data processing terms, or other mechanisms recognized by applicable law.

19. Compliance and Governance Roadmap

IntivaX aligns its privacy, security, and governance practices with recognized enterprise standards and regulatory frameworks.

Unless expressly stated in a separate written agreement or certification, references to readiness or roadmap do not mean IntivaX is currently certified under that standard.

20. Data Retention

IntivaX retains data for as long as necessary to provide services, comply with legal obligations, maintain security, resolve disputes, enforce agreements, support audits, and operate business records.

21. Security Incident and Breach Response

If IntivaX becomes aware of a security incident that may affect Customer Data or Personal Data, IntivaX may take steps to:

1. Assess the nature and scope of the incident.
2. Contain and mitigate potential harm.
3. Investigate affected systems, data, users, and environments.
4. Apply corrective actions and security improvements where appropriate.
5. Notify affected customers, users, authorities, or other parties where required by law or contract.
6. Document the incident and response actions.

Notification timing and content may depend on the applicable law, customer agreement, nature of the incident, risk level, and available information.

22. User Rights and Data Subject Requests

Depending on applicable law and the user’s location, users may have rights regarding their Personal Data. These rights may include:

• Right to access Personal Data.
• Right to correct inaccurate information.
• Right to request deletion.
• Right to restrict processing.
• Right to object to certain processing.
• Right to data portability.
• Right to withdraw consent where processing is based on consent.
• Right not to be discriminated against for exercising privacy rights.

Enterprise Customer Environments

If a user accesses IntivaX through an employer, customer, or organization, privacy requests may need to be submitted to the organization administrator. IntivaX may refer such requests to the relevant customer because the customer may act as the controller of the data.

GDPR Rights

For users covered by the General Data Protection Regulation, rights may include access, rectification, erasure, restriction, portability, objection, and the right to lodge a complaint with a supervisory authority.

CCPA / CPRA Rights

For California residents, rights may include the right to know, access, delete, correct, and exercise privacy rights without discrimination. IntivaX does not sell Personal Data.

23. Google Play Data Safety and Mobile App Disclosure

This section is intended to support transparency for mobile app marketplace requirements, including Google Play privacy policy and data safety expectations.

24. Data Deletion Procedure

Users may request access, correction, or deletion of Personal Data by contacting privacy@intivax.com.

1. Submission: The user submits a request through the privacy contact email or an approved customer support channel.
2. Verification: IntivaX or the customer may verify the identity and authority of the requester.
3. Evaluation: The request is reviewed against legal, contractual, security, audit, and enterprise account obligations.
4. Execution: Data is deleted, anonymized, corrected, exported, or restricted where permitted and technically feasible.
5. Confirmation: Confirmation may be provided when appropriate and legally permitted.

Some information may be retained when required for legal compliance, accounting, tax, security, audit, fraud prevention, dispute resolution, backup lifecycle management, or contractual obligations.

25. Children’s Privacy

IntivaX is designed for business, professional, and enterprise use. It is not directed to children under the age of 13, and IntivaX does not knowingly collect Personal Data from children under 13.

If IntivaX becomes aware that Personal Data from a child under 13 has been collected without appropriate authorization, IntivaX may take reasonable steps to delete such information.

26. Governing Law

This policy is issued by IntivaX Inc., a Delaware corporation. Unless otherwise required by applicable law or a separate customer agreement, this policy is governed by the laws applicable to IntivaX Inc. and its operations.

Customer agreements, data processing agreements, order forms, or enterprise contracts may contain additional terms that apply to specific customers, products, jurisdictions, or services.

27. Version History

28. Contact Information

For privacy requests, data deletion requests, legal inquiries, or questions about this policy, please contact: