Effective Date: September 14, 2025

Last Updated: September 14, 2025

This Privacy Policy (“Policy”) describes how EffortlessAI, LLC (“EffortlessAI,” “Company,” “we,” “our,” or “us”) collects, uses, shares, and protects information relating to individuals in connection with our websites, platforms, APIs, and artificial intelligence services (the “Service”). We are committed to protecting personal data and complying with applicable laws, including the General Data Protection Regulation (GDPR), the UK GDPR, the California Consumer Privacy Act as amended by the CPRA, the Children’s Online Privacy Protection Act (COPPA), and other relevant privacy frameworks.

1. Information We Collect

1.1 Account and Contact Information. We collect identifiers including name, email address, phone number, billing address, payment details, and company or organization information.

1.2 User Content and Inputs. We collect any data, text, prompts, files, or materials you submit (“User Content”). User Content may contain personal data if you choose to provide it. You must not submit sensitive categories of personal data unless expressly authorized.

1.3 AI-Generated Outputs. We may retain AI-generated outputs for quality control, auditing, troubleshooting, or improvement of the Service, subject to opt-out rights. You may opt out of your data being used to improve model performance. You can exercise this choice at www.effortlessai.com/privacy-choices or in your account under Account → Privacy → Model Improvement. API customers may set the header “X-Training-Opt-Out: true” to prevent training on submitted data.

1.4 Technical and Usage Data. We automatically collect IP addresses, device information, operating system, browser type, session activity, and diagnostic information.

1.5 Cookies and Tracking Technologies. We use cookies, pixels, and similar technologies for authentication, analytics, and advertising. See our Cookie Policy for details.

1.6 Voluntary Information. We collect information you provide voluntarily, such as customer support inquiries, survey responses, or feedback.

2. How We Use Information

We process data to deliver and maintain the Service; manage accounts; generate outputs; improve models (unless you opt out); communicate with you; ensure security; analyze usage; and comply with law. We will not use personal data for materially different, unrelated, or incompatible purposes without first obtaining consent.

Where you have not opted out, your User Content and outputs may be used for limited purposes of improving models, which may include (a) fine-tuning models to better reflect user interactions; and (b) system-level analytics to enhance accuracy, security, and performance. We do not sell training data. If you opt out, your content will not be used for model fine-tuning and will be excluded from future training runs.

2A. Data Minimization and Purpose Limitation
We collect only the minimum personal data necessary for the purposes described in this Privacy Policy. We do not process personal data in ways that are incompatible with those purposes without first obtaining your consent.

3. Legal Bases for Processing

Where the GDPR or similar laws apply, we rely on: (a) Consent; (b) Contractual necessity; (c) Legitimate interests (including improving models and preventing misuse); and (d) Legal obligations.

4. Automated Decision-Making and Profiling

EffortlessAI may use automated processing, including profiling, to provide outputs and insights. Where processing produces legal or similarly significant effects, you have the right to obtain meaningful information about the logic, request human review, contest the decision, and express your views. Residents of Virginia, Colorado, and Connecticut may exercise opt-out rights regarding profiling.

We maintain consent logs (timestamp, preference state, region, device signal) to demonstrate compliance and will prompt for re-consent upon material changes or after 12 months in jurisdictions that require fresh consent.

5. Data Sharing and Transfers

We share data with trusted service providers, as required by law, or in connection with mergers and acquisitions. Where data is transferred internationally, we rely on Standard Contractual Clauses (SCCs), the UK International Data Transfer Addendum (IDTA), or equivalent lawful mechanisms. A current list of sub-processors is maintained on our Sub-processors Page.

We implement supplementary measures, such as encryption in transit and at rest and strict access controls, and conduct transfer impact assessments for restricted transfers outside the EEA, Switzerland, or the UK.

6. Cookies and Tracking

We use cookies, pixels, and tracking technologies to authenticate users, analyze performance, and deliver advertising (where permitted by law and with consent). We honor Global Privacy Control (GPC) signals as valid opt-outs under CPRA. See our Cookie Policy for more detail.

Your Privacy Choices. You may exercise CPRA choices at /privacy-choices, including: (i) Do Not Sell or Share My Personal Information; and (ii) Limit the Use of My Sensitive Personal Information. We also honor browser-based Global Privacy Control (GPC) signals as opt-outs for sale/sharing.

We do not respond to browser “Do Not Track” signals. We do honor Global Privacy Control (GPC) signals as opt-outs of sale or sharing of personal information.
We do not offer financial incentives or price/service differences in connection with the collection, retention, sale, or sharing of personal information.

7. Data Retention

We retain account data for the life of your account plus three (3) years; billing and transaction data for seven (7) years; User Content and AI outputs for up to 365 days unless disabled; system logs for 12–24 months; and training data copies only if you have not opted out. Upon expiration, data is securely deleted or anonymized.

We determine retention periods based on (i) the nature of the data, (ii) the purpose of processing, (iii) applicable legal or contractual obligations, and (iv) security and fraud-prevention needs.

8. Your Rights

You may exercise rights of access, rectification, erasure, restriction, portability, objection, and withdrawal of consent. California residents have rights to know, delete, and opt out of sale or sharing (we do not sell data). Appeals of denied requests may be submitted within thirty (30) days to info@effortlessai.com. We respond to verified requests within 45 days, extendable by law.

In addition to the rights described above, you have the right to lodge a complaint with your local data protection authority if you believe our Processing of your Personal Data violates Applicable Data Protection Laws. EU/EEA residents may find their authority via the European Data Protection Board (https://edpb.europa.eu). UK residents may contact the Information Commissioner’s Office (ICO). U.S. residents may raise complaints with the Federal Trade Commission (FTC) or their state attorney general.

Residents of Virginia, Colorado, Connecticut, Utah, and Texas also have rights under state privacy laws, including the right to confirm Processing, access data, correct inaccuracies, request deletion, obtain a portable copy, and opt out of targeted advertising, profiling, or the sale of Personal Data. We will honor such requests in accordance with Applicable Data Protection Laws.

Verification. We verify consumer requests by matching at least two pieces of personal data, or three for sensitive or precise information, to data we maintain. We may also require a signed declaration. Authorized agents must provide written permission from the consumer, and we may verify the consumer’s identity directly.

Nevada Residents. Nevada residents may email info@effortlessai.com to opt out of the sale of covered information, though we do not sell personal information.

9. Security

We implement administrative, technical, and organizational measures consistent with industry standards, including encryption, access controls, logging, monitoring, and secure development practices. Our AI risk program aligns with NIST AI RMF and ISO/IEC 42001. While no system is completely secure, we take all reasonable measures to protect data.

10. Breach Notification

We will notify supervisory authorities within seventy-two (72) hours of becoming aware of a personal data breach and notify affected individuals and customers without undue delay, as required by law.

11. Children’s Data

The Service is not directed to individuals under eighteen (18). We do not knowingly collect personal data from children. If we discover collection from a child under thirteen (13) in the United States without verifiable parental consent, we will promptly delete the data.

12. Changes to This Policy

We may revise this Policy periodically. If changes are material, we will provide clear advance notice. Continued use of the Service constitutes acceptance.

In addition, EffortlessAI may make modifications as reasonably necessary to reflect changes in Applicable Laws or regulations, including without limitation data protection and artificial intelligence laws. Such modifications shall be effective upon posting, and continued use of the Service constitutes acceptance.

13. Contact Information

EffortlessAI, LLC — 81 Broadway St., Suite 201, Asheville, NC 28801 • info@effortlessai.com