We take your
privacy seriously.

This document is the exclusive property of o9 Solutions, Inc. and its subsidiary companies. Any unauthorized use of this document shall invite legal consequences.

Last Updated: 15.09.2026

1. Scope of this Notice
   1. This privacy notice explains how o9 Solutions, Inc. and its affiliates ("o9," "we," "us," or "our") collect, use, disclose, and protect personal data when you use the o9 AI mobile application (the "Services"). In this notice, individuals in the European Economic Area ("EEA") are referred to as "Data Subjects," and individuals in India are referred to as "Data Principals" as per the DPDPA 2023.
   2. This notice applies where we act as a data controller or data processor with respect to personal data captured through the o9 AI mobile application; in other words, where o9 Solutions, Inc. determines the purposes and means of that processing, or processes personal data on behalf of a Customer as a data processor or service provider.
   3. The services are primarily intended for business and enterprise use. If you access the services through your employer or another organization ("Customer"), that organization may have its own policies and agreements that also apply to your use of the Services. Where o9 processes personal data on behalf of a Customer as a data processor or service provider, the Customer determines the purposes and means of that processing, and the Customer's own policies may also apply to your personal data. You may need to contact your organization to exercise certain privacy rights.
   4. In this notice, "we," "us," and "our" refer to o9 Solutions, Inc. For more information about us, see Section 17.
2. How We Use Your Personal Data
   1. In this Section 2, we set out the general categories of personal data that we may process through the o9 AI mobile application, the source of that data where it was not obtained directly from you, the purposes for which we may process it, and the legal basis for the processing under the GDPR and the "certain legitimate uses" or consent basis under the DPDPA.
   2. We may process your account and profile data ("account data"), which may include your name, email address, organization or tenant information, and authentication information provided through your organization's identity provider. The source of the account data is you or your organization. The account data is processed for the purpose of operating the services, authenticating users, and maintaining the tenant access. The legal basis for this processing is consent OR our legitimate interests, namely the proper administration of the Services, OR the performance of a contract between you (or your organization) and us.
   3. We may process the content you submit to the o9 AI assistant ("AI content"), which may include messages and prompts that you type, questions and instructions submitted to the AI assistant, text generated from voice dictation, conversation history and threads, feedback you provide about AI responses, and files, documents, images, and photographs that you upload or attach to conversations. The source of AI content is you. AI content is processed for the purpose of generating the AI response you request, as described further in Section 3. The legal basis for this processing is consent OR the performance of a contract between you (or your organization) and us.
   4. We may process information you provide when you contact our support team, submit feedback, or otherwise communicate with o9 ("communications data"). Communications data is processed for the purpose of responding to you and maintaining records of those communications. The legal basis for this processing is consent OR our legitimate interests, namely the proper administration of our business and communications with users.
   5. We may process information collected automatically when you use the Services ("usage and device data"), which may include device model, operating system and version, application version, time zone, IP address, general application usage and interaction information, features used and screens accessed, crash reports, performance and diagnostic information, and push notification tokens where you enable notifications. The source of usage and device data is our application and diagnostic tooling. This data is processed for the purpose of operating, securing, troubleshooting, and improving the Services. The legal basis for this processing is our legitimate interests, namely monitoring and improving the Services, OR consent where required by applicable law.
   6. If you access the Services through an organization, we may receive information from your organization's identity and authentication providers ("organizational data"), including information necessary to authenticate you and determine your access to the organization's o9 tenant. The source of organizational data is your organization. This data is processed for the purpose of authenticating you and administering tenant access. The legal basis for this processing is the performance of a contract between your organization and us, OR our legitimate interests in securing the Services.
   7. The o9 AI mobile application does not intentionally collect precise geolocation information, biometric identifiers, or payment card information, unless specifically described to you at the time a particular feature is introduced.
   8. In addition to the specific purposes set out in this Section 2, we may process any of your personal data where necessary for compliance with a legal obligation to which we are subject, or in order to protect your vital interests or those of another natural person, including under DPDPA Section 7.
   9. Please do not supply any other person's personal data to us, unless we prompt you to do so.
3. AI Assistant and How Your Data Is Processed
   1. This Section explains what happens when you use the o9 AI assistant, including text input and voice dictation.
   2. When you type a message, prompt, question, or instruction into the o9 AI assistant, the content is sent to the o9 AI platform to process your request and generate an AI response. Depending on your organization's configuration and the applicable region, the o9 AI platform may route your message text to one or more third-party AI providers configured by o9, including OpenAI, Google Cloud Platform (GCP), Amazon Web Services (AWS), and Microsoft Azure. These providers process the information on behalf of o9 for purposes such as generating the AI response you request. o9 controls which AI provider and model may be used based on your organization's configuration, the applicable service, and the applicable region.
   3. Where applicable, o9 maintains contractual and technical measures governing the processing of data by these providers, including restrictions on their use of your content for purposes other than providing the requested AI functionality.
4. Voice Dictation and Speech Recognition
   1. If you choose to use voice dictation, the o9 AI mobile application uses speech recognition to convert your speech into text so that you can submit messages without typing.
   2. On iOS, the applicable Apple speech-recognition functionality may process your speech data in accordance with Apple's own privacy practices and the permissions presented by iOS.
   3. The o9 AI application sends the resulting text to the o9 AI platform to process your AI request. The o9 AI platform does not receive the original voice recording from this speech-recognition flow. The resulting text may subsequently be processed by the third-party AI providers described in Section 3, depending on your organization's configuration and region.
5. Files, Images, and Camera Captures
   1. When you upload a file, document, image, or camera capture to the o9 AI application, the content is uploaded to the o9 platform, which may provide the AI service with information necessary to process your request.
   2. The original file, image, or camera capture is not shared with third-party AI providers such as OpenAI, Google Cloud Platform, Amazon Web Services, or Microsoft Azure.
6. AI Data Processing Consent
   1. Before your first use of the AI assistant, the o9 AI mobile application may present an in-app disclosure describing how your AI messages are processed. The disclosure explains what information may be processed; that messages may be sent to the o9 AI platform; that message text may be processed by third-party AI providers used by o9; the third-party AI providers that may process the information; the purpose of the processing; and how to access this Privacy Notice.
   2. Where the application presents an AI data-processing consent screen, you may choose "I Agree" to acknowledge and consent to the described processing or choose "Cancel" and decline to use the AI assistant. If you decline, your message will not be submitted for that AI request. Your choice to decline AI processing does not prevent you from using other portions of the application that do not require the AI assistant, where applicable.
7. Purposes of Processing
   1. We use information collected through the Services to: provide access to the o9 AI application and platform; authenticate users; maintain accounts and tenant access; process AI requests and generate AI responses; maintain conversation history; and provide features requested by users and Customers.
   2. We use information to detect and prevent fraud, abuse, and unauthorized access; protect the security and integrity of our Services; diagnose technical problems and debug application issues; monitor application performance; and investigate crashes and errors.
   3. We use information to send service-related notifications, respond to support requests, and communicate important service or security information.
   4. We process information when necessary to comply with applicable laws and regulations, respond to lawful requests, protect our legal rights, enforce our agreements, and protect the safety and security of our users, Customers, and Services.
8. Sharing Your Personal Data with Others
   1. We may share information with the following categories of recipients when necessary to provide the Services:

• Third-party AI providers identified above process information on behalf of o9 where configured to provide AI functionality. o9 does not authorize these providers to use your AI messages for their own independent advertising or marketing purposes.
• We do not sell your personal information. We do not use your AI content to provide third-party advertising. We do not share your personal information with third parties for their own independent marketing purposes.
• We may also disclose your personal data where necessary for compliance with a legal obligation to which we are subject, to protect vital interests, or for the establishment, exercise, or defence of legal claims, whether in court proceedings or in an administrative or out-of-court procedure.

9. International Transfers of Your Personal Data
   1. o9 and its service providers, including the third-party AI providers described in Section 3, may process and store information in countries other than the country where you reside, including the United States and other countries in which o9 or its group companies and service providers operate.
   2. Transfers from the EEA are protected by appropriate safeguards. Transfers from India are made in accordance with the DPDPA 2023, and o9 does not transfer personal data to a country restricted by the Indian Government.
10. Retaining and Deleting Personal Data
    1. Personal data that we process for any purpose shall not be kept for longer than is necessary for that purpose. We will erase your personal data as soon as the specified purpose is served and the data is no longer necessary for any legal or business purpose.
    2. We retain AI conversation content, including messages, prompts, and conversation history, for up to 90 days from creation, after which it is deleted or de-identified, unless a longer period is required to comply with a legal obligation, resolve a dispute, or enforce our agreements.
    3. Other categories of personal data, including account data and diagnostic information, are retained for as long as reasonably necessary to provide and maintain the Services, fulfill the purposes described in this Notice, meet contractual obligations, comply with applicable legal obligations, resolve disputes, enforce our agreements, and protect the security and integrity of the Services. Retention periods may vary depending on the type of information, the Customer's configuration, contractual requirements, and applicable law.
    4. Notwithstanding the foregoing, we may retain your personal data where necessary for compliance with a legal obligation, or to protect your vital interests or those of another natural person.
11. Your Rights
    1. Depending on your location and applicable law, you may have rights regarding your personal information, including the right to access your personal information; correct inaccurate information; request deletion of personal information (the right to be forgotten); object to or restrict certain processing; withdraw consent where processing is based on consent; request portability of your information; lodge a complaint with an applicable data protection authority; and, for Data Principals in India, nominate another individual to exercise your rights in the event of death or incapacity.
    2. If your organization is the Customer or data controller for your use of the Services, you may need to submit privacy requests through your organization. o9 will assist the Customer as required under the applicable agreement and law.
    3. To exercise applicable privacy rights, contact us at [email protected].
    4. You must: provide accurate, complete, and up-to-date information when submitting personal data to us; refrain from impersonating another individual or submitting another person's personal data without authorization; refrain from making frivolous or malicious complaints; and exercise your rights of correction, erasure, or withdrawal of consent in good faith and not to disrupt or harass o9.
12. Security
    1. o9 maintains administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, use, alteration, disclosure, and destruction. These safeguards may include access controls, authentication mechanisms, encryption for data at-rest and data in-transit, monitoring and logging, security controls around infrastructure and applications, and organizational security procedures.
13. Children's Privacy
    1. The Services are intended for business and enterprise use and are not directed toward children. We do not knowingly collect personal information from children in violation of applicable law. If you believe that a child has provided personal information to us in circumstances where collection is not permitted, please contact us at [email protected].
14. Customer / Enterprise Data
    1. If you use the o9 AI mobile application through your employer or another organization, information you submit may belong to or be controlled by that organization. Your organization may manage your account; control access to the o9 AI environment; configure AI models or providers; establish data-retention requirements; access information within its o9 tenant where permitted by its agreement with o9; and establish additional policies governing your use of the Services.
    2. If your organization provides you access to the o9 AI mobile application, you should direct questions about how your organization's data is handled to your organization's privacy or IT administrator where appropriate.
15. Third-Party Services
    1. The Services may integrate with or use third-party services to provide functionality such as AI processing, crash reporting, push notifications, hosting and infrastructure, authentication, and security. These third-party providers may process information on behalf of o9 as described in this Notice and applicable agreements. Third parties may also have their own privacy policies governing information processed directly by their services.
16. Changes to This Privacy Notice
    1. We may update this Privacy Notice from time to time to reflect changes to our Services, our data-processing practices, applicable laws, third-party service providers, or our privacy and security practices. If we make material changes, we will provide notice as required by applicable law. The updated Privacy Notice will include a revised "Last Updated" date.
17. Our Details-Data Protection Officer-Grievance Redressal
    1. The o9 AI mobile application is owned and operated by o9 Solutions, Inc. We are a company registered in Dallas, Texas, United States of America, and our registered office is at 1501 LBJ Freeway, Suite 140, Dallas, TX 75234.
    2. Our European contact address is WTC Schiphol Airport (Tower A, Floor 7), Schiphol Boulevard 231, 1118 BH Schiphol, Netherlands.
    3. If you have any questions about this Privacy Notice or wish to raise a concern about how your personal data is handled, please contact us at [email protected]. We will address any concerns raised without undue delay.
    4. If we become aware of a data breach affecting your personal data, we will notify affected individuals and the applicable regulatory authorities without undue delay, as required by applicable law.