ISTARI — PRIVACY POLICY

DRAFT — for attorney review. Not yet effective.

Istari Biotech LLC, a Pennsylvania limited liability company ("Istari," "we") operates the Istari platform. This policy describes what we collect and why.

1. Data we collect

• Account data: name, email, organization, role — to operate your account.
• Workspace content: documents, data, and files you upload or create (including XLS datasets for PD reports) — to provide the Service. You own this data.
• Usage data: audit-trail events (who did what, when) required for workspace integrity and, on the Validated tier, regulatory controls.
• Billing data: processed by Stripe; we do not store card numbers.
• AI processing: content you submit to AI features is sent to our AI subprocessor (Anthropic) for inference and is not used to train models.

2. How we use it

To provide, secure, and improve the Service; to communicate about your account; to comply with law. We do not sell personal data.

3. Subprocessors

Hosting infrastructure, Anthropic (AI inference), Resend (email), Stripe (billing). Current list available on request.

4. Retention and deletion

We retain data while your account is active and per Section 3.4 of the Terms of Service. Audit-trail records on Validated workspaces are retained per the agreed retention period and cannot be deleted earlier by design.

5. Your rights

You may request access, correction, export, or deletion of your personal data at [contact]. We respond within thirty (30) days.

6. Security

Encryption in transit and at rest, tenant-isolated workspaces, and tamper-evident audit controls on the Validated tier. No system is perfectly secure; report concerns to [contact].

7. Changes

We will post material changes here with an updated date. Continued use after changes take effect constitutes acceptance.

Draft prepared 2026-10-07. Requires review and finalization by counsel before publication or use.