1. Introduction

ai2bundle.co ("the Platform") is operated by Intellectus Universe Pte. Ltd., a Singapore incorporated private limited company in accordance with Singapore laws. This Security and Compliance Policy describes the technical and organizational measures implemented to protect user data processed through our AI-powered services, including App.ai2bundle.co and GlobalApp.ai2bundle.co.

2. Data Processed by the Platform

When users interact with the Platform, the following data may be processed:

• User-submitted text, documents, or files ("Input Content")

• AI-generated responses ("Output Content")

• Account credentials and authentication tokens (managed via Google OAuth)

• Usage metadata (model selected, token counts, timestamps)

The Platform does not store Input or Output Content on its own servers beyond the active session unless explicitly enabled by the user.

3. AI Provider Data Policies (For App.ai2bundle.co)

App.ai2bundle.co routes user requests to third-party AI model providers. Each provider's data handling is governed by their respective terms of service and privacy policies.

For Western-based providers, including those incorporated or operating principally in the United States, their published terms confirm that API-submitted data is not used for model training purposes, whether by contractual prohibition or by default platform policy.

For providers operating under other jurisdictions, user data submitted via API may be processed on servers located in various regions including China, Singapore, or the United States, subject to the laws and regulations applicable in those jurisdictions. These providers' data training practices are governed by their own terms and may be subject to change. Users are encouraged to review the relevant provider's privacy policy before use.

Users handling sensitive, confidential, legally privileged, or regulated material are encouraged to review the data jurisdiction and applicable legal framework of each AI model provider prior to submitting such content, and to select providers whose data residency and governance arrangements are appropriate for their specific compliance requirements.

4. AI Provider Data Policies (For GlobalApp.ai2bundle.co, ContentApp.ai2bundle.co, and ContractApp.ai2bundle.co)

These three apps route requests through a third-party AI gateway providers that operates under a Zero Data Retention policy. Input and Output logging is disabled at the account level. Requests are routed exclusively to AI model providers that have agreed not to retain or train on user data. No data training enforced across all third-party AI model providers.

5. Platform Infrastructure Security

The Platform's web interface and marketing pages are hosted by a reputable third-party web infrastructure provider that maintains industry-standard security certifications and compliance programmes.

The Platform's application layer — including user authentication, API processing, and backend functionality — is deployed on a globally distributed edge computing network, providing encrypted data transmission, access control, and protection against common network-layer threats.

6. Authentication and Access Control

• User authentication is handled via Google OAuth 2.0 — no passwords are stored by the Platform

• All sessions are managed via short-lived, cryptographically signed JWT tokens validated on every request

• Administrative access to Platform infrastructure is restricted to authorised personnel with multi-factor authentication (MFA) enabled

• API keys for third-party AI providers are stored as encrypted secrets and are never exposed client-side

7. Data Retention

The Platform retains user account records for the duration of the active account and for a reasonable period thereafter in accordance with applicable legal and regulatory obligations. Session tokens are short-lived and are not retained server-side following expiry. Input and Output Content submitted to AI models is not retained by the Platform beyond the active session. Usage metadata is retained for a limited period for operational and billing purposes. Payment records are retained as required by applicable law.

8. User Rights

The Platform complies with the Singapore Personal Data Protection Act (PDPA) and, where applicable to EU residents, the General Data Protection Regulation (GDPR). Users' rights under the PDPA and GDPR respectively are applicable and may be exercised by contacting us through the details set out in Section 12 of this Policy.

9. Incident Response

In the event of a confirmed data breach or material security incident, affected users will be notified in accordance with applicable law and without undue delay. Where the GDPR applies, notification to the relevant supervisory authority will be made within 72 hours of discovery where required. A post-incident summary will be made available to affected users upon request.

10. Third-Party Sub-Processors

The Platform engages the following third-party sub-processors for infrastructure and identity services:

Sub-processor - Purpose - Region - Certifications

Cloudflare, Inc. - Hosting, CDN, API gateway, authentication - USA (global edge) - SOC 2 Type II, ISO 27001, PCI DSS

Squarespace, Inc. - Website hosting - USA - SOC 2 Type II, PCI DSS

Google LLC - OAuth authentication - USA - SOC 2 Type II, ISO 27001

Note on AI Model Providers: Third-party AI model providers accessed through App.ai2bundle.co and GlobalApp.ai2bundle.co act as independent data processors or data controllers in respect of data submitted to their models. They are not sub-processors of Intellectus Universe Pte. Ltd. in the conventional sense, as their data handling is governed by their own terms of service, privacy policies, and applicable laws. Users are encouraged to review those terms before submitting sensitive content.

11. Infrastructure Security Certifications

The Platform's web interface is hosted on Squarespace, Inc., which maintains SOC 2 Type II certification, PCI DSS Level 1 compliance, and GDPR-compliant data handling practices. All connections to the Platform are encrypted using Transport Layer Security (TLS 1.2 or higher).

The Platform's application layer, including user authentication, API processing, and all backend functionality, is deployed on Cloudflare's global network via Cloudflare Workers and Cloudflare Pages. Cloudflare holds SOC 2 Type II, ISO/IEC 27001, and PCI DSS Level 1 certifications. All data transmitted through the application is encrypted in transit (TLS 1.3) and any data stored in Cloudflare infrastructure is encrypted at rest using AES-256 encryption. Cloudflare's enterprise DDoS mitigation and Web Application Firewall (WAF) are active on all Platform endpoints.

Copies of Cloudflare's certification reports are available at cloudflare.com/trust-hub.

12. Contact

For security-related enquiries, data subject requests, or questions regarding this Policy, please contact us at:

🌐 https://www.ai2bundle.co/contact

This Policy is reviewed periodically and updated to reflect changes in applicable law, platform infrastructure, or data processing practices. Continued use of the Platform following any update constitutes acceptance of the revised Policy.