Privacy Policy

1. Information We Collect

1.1 Personal Information You Provide

We collect personal information that you voluntarily provide to us when you register for an account, subscribe to our Services, express an interest in obtaining information about us or our products, participate in activities on the Services, or otherwise contact us. This information may include:

• Account Data: Full name, email address, username, password (hashed), and profile information.
• Third-Party Integrations: If you choose to link or authenticate using a third-party account (e.g., Google, Discord), we may receive information from that provider, such as your name, email address, and profile picture, in accordance with the provider's privacy policies.
• User Contributions: Text prompts, image uploads, 3D scene data, and other creative inputs you submit to the Services for processing by our generative AI systems.
• Payment Data: Where you purchase Paid Features, we collect data necessary to process your payment (e.g., payment instrument number, billing address). Payment processing is handled by our PCI-DSS compliant third-party payment processors (e.g., Stripe). Symbiotic AI Ltd. does not store full payment card numbers.
• Communication Data: Records and contents of correspondence when you contact us, including via email, contact forms, or support tickets.

1.2 Information Collected Automatically

When you access the Services, we automatically collect certain technical and usage data, including but not limited to: IP address, browser type and version, operating system, device identifiers, referring URLs, pages visited, time spent on pages, and clickstream data. This information is collected via cookies, log files, and similar tracking technologies.

2. How We Process Your Information

We process your personal information for the following purposes, on the following legal bases:

• Performance of Contract: To provide, operate, and maintain the Services; to process transactions and manage your account.
• Legitimate Interest: To improve and personalise the Services; to conduct analytics; to detect and prevent fraud, abuse, and security incidents; to process de-identified and aggregated data for AI model improvement (see Section 2.1).
• Consent: To send you marketing communications (where applicable).
• Legal Obligation: To comply with applicable legal and regulatory requirements.

Automated Decision-Making: We do not subject you to decisions based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you (as defined under Article 22 of the UK GDPR).

2.1 AI Model Training & Improvement

Symbiotic AI Ltd. may process de-identified, anonymised, and aggregated User Contributions (such as text prompts and resulting 3D outputs) to refine, improve, and train Orio's generative AI models.

Privacy Safeguard: We do not use personally identifiable information (such as your name, email address, or account credentials) for the purpose of AI model training. All data used for training undergoes a strict de-identification and aggregation pipeline prior to ingestion to ensure that the resulting dataset cannot be re-identified or linked back to any individual user, meeting the highest regulatory thresholds for anonymisation under the UK GDPR.

Opt-Out: You may request that your User Contributions be excluded from AI training at any time by contacting us at legal@orio.games. We will process your request within one (1) month.

3. Disclosure of Your Information

We may disclose your personal information to the following categories of third parties for the purposes described above:

• Service Providers & Processors: We engage third-party vendors who perform services on our behalf. This includes cloud infrastructure providers (e.g., Google Cloud, AWS) receiving Account and User Contributions; payment processors (e.g., Stripe) receiving Payment Data; and analytics/email providers receiving Communication and Technical Data. These processors are contractually obligated to process your data only as instructed by us and to maintain stringent security measures.
• Business Transfers: In the event of a merger, acquisition, reorganisation, dissolution, bankruptcy, or other sale or transfer of some or all of Symbiotic AI Ltd.'s assets, your personal information may be among the assets transferred, subject to applicable data protection laws.
• Law Enforcement & Legal Obligations: We may disclose your information to government agencies, law enforcement, or private parties where we are legally required to do so to comply with applicable law, judicial proceedings, court orders, or legal process.
• Protection of Rights & Safety: We may disclose information where we believe it is necessary to investigate, prevent, or take action regarding potential violations of our Terms of Service, suspected fraud, security incidents, threats to the safety of any person, or illegal activities.

4. Cookies and Tracking Technologies

We and our third-party service providers use cookies, web beacons, pixels, and similar tracking technologies to automatically collect Technical and Usage Data when you interact with our Services. This helps us to:

• Essential/Strictly Necessary: Enable core platform functionality, such as keeping you logged in and securing your account.
• Performance/Analytics: Understand how users navigate the Services, measure performance, and identify technical issues (e.g., using Google Analytics).
• Functionality: Remember your preferences and settings across sessions.

Managing Cookies:You have the right to decide whether to accept or reject cookies. You can set or amend your web browser controls to accept or refuse cookies. If you choose to reject cookies, you may still use our Services, though your access to some functionality and areas may be restricted. For comprehensive details on managing cookies, please visit your browser's help menu or settings.

Do Not Track & Global Privacy Control:Some browsers offer a "Do Not Track" (DNT) or "Global Privacy Control" (GPC) feature. We recognise GPC signals as a valid request to opt-out of the sharing of personal information for cross-context behavioural advertising. However, as stated in Section 9, we do not engage in the sale or sharing of your personal information for such purposes.

5. Third-Party Links and Services

Our Services may contain links to third-party websites, plug-ins, APIs, and applications that are not operated or controlled by Symbiotic AI Ltd. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy statements or practices. When you leave our Services, we encourage you to read the privacy policy of every website or service you visit.

6. International Data Transfers

Your personal information may be transferred to, stored at, and processed in countries outside the United Kingdom that may not provide the same level of data protection. Where such transfers occur, Symbiotic AI Ltd. shall ensure that appropriate safeguards are in place, including the International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses (SCCs) approved by the UK Information Commissioner's Office, or other legally recognised transfer mechanisms under the UK GDPR.

7. Data Retention

We shall retain your personal information only for so long as is necessary to fulfil the purposes for which it was collected, including to satisfy any legal, regulatory, accounting, or reporting obligations. When we have no ongoing legitimate business need to process your personal information, we shall either securely delete or anonymise such information. In the event anonymisation is not technically feasible, we shall securely isolate your personal information from any further processing until deletion is possible.

8. Your Privacy Rights (UK & EU GDPR)

Under the UK GDPR and the Data Protection Act 2018 (and the EU GDPR for EU residents), you have the following rights with respect to your personal information:

• Right of Access: The right to request a copy of the personal information we hold about you.
• Right to Rectification: The right to request correction of inaccurate or incomplete personal information.
• Right to Erasure: The right to request deletion of your personal information, subject to certain legal exceptions.
• Right to Restriction: The right to request that we restrict the processing of your personal information in certain circumstances.
• Right to Object: The right to object to the processing of your personal information, including for AI training purposes.
• Right to Data Portability: The right to receive your personal information in a structured, commonly used, and machine-readable format.
• Right to Withdraw Consent: Where processing is based on consent, the right to withdraw consent at any time without affecting the lawfulness of processing prior to withdrawal.

To exercise any of these rights, please contact us at legal@orio.games. For your protection, we may require you to verify your identity before fulfilling your request. We shall respond to your request within one (1) month, as required by applicable law. You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk (or your local supervisory authority if residing in the EU).

9. US State Privacy Rights

If you are a resident of certain US states, including California, Virginia, Colorado, Connecticut, Utah, or Nevada, you may be entitled to additional rights regarding your personal information under applicable state comprehensive privacy laws (such as the CCPA/CPRA, VCDPA, CPA, CTDPA, and UCPA).

Categories of Sources: As required by the CCPA/CPRA, we confirm that we collect personal information from the following categories of sources: directly from you (e.g., registration, User Contributions), automatically from your device (e.g., cookies, usage data), and from third-party integrations (e.g., if you choose to authenticate via Google or Discord).

• Right to Know/Access: You have the right to request the specific pieces and categories of personal information we have collected, the categories of sources, the business or commercial purpose for collecting the data, and the categories of third parties to whom we disclose it.
• Right to Delete: You have the right to request the deletion of personal information we have collected from you, subject to certain exceptions.
• Right to Correct: You have the right to request the correction of inaccurate personal information we maintain about you.
• Right to Opt-Out of Sale or Sharing: We do not sell or share your personal information for cross-context behavioural advertising or monetary gain. Therefore, we do not offer a mechanism to opt-out, as the practice does not occur. We also do not sell or share the personal information of consumers under 16 years of age.
• Right to Limit Use of Sensitive Personal Information: We only collect sensitive personal information (such as account login credentials) as necessary to provide the Services, and we do not use it to infer characteristics about you.
• Non-Discrimination: We will not discriminate against you for exercising any of your privacy rights.

Nevada Residents: Under Nevada Revised Statutes Chapter 603A, you have the right to opt-out of the sale of certain covered information. Symbiotic AI Ltd. does not sell covered information.

To exercise your state-specific privacy rights, please submit a verifiable request to legal@orio.games.

Authorised Agents:You may designate an authorised agent to make a request on your behalf. We will require proof of the agent's authorisation and may still require you to verify your identity directly with us before processing the request.

10. Children's Privacy

The Services are not directed at children under the age of thirteen (13). Symbiotic AI Ltd. does not knowingly collect, solicit, or maintain personal information from children under 13. If we become aware that we have collected personal information from a child under 13, we shall take reasonable steps to delete such information promptly. If you believe that a child under 13 has provided us with personal information, please contact us immediately at legal@orio.games.

11. Security

Symbiotic AI Ltd. implements appropriate technical and organisational measures designed to protect the security of your personal information. However, no method of electronic transmission or storage is 100% secure, and we cannot guarantee absolute security. We encourage you to use strong, unique passwords and to notify us immediately of any suspected unauthorised access to your account.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. The updated version shall be indicated by an updated "Last Updated" date. Where material changes are made, we shall notify you at least thirty (30) days in advance via email or a prominent notice on the Services before the change becomes effective.

13. Contact Us

If you have questions, concerns, or complaints about this Policy, or if you wish to exercise any of your data protection rights, please contact us at: