PRIVACY POLICY

Last updated October 26, 2026

This Privacy Notice for ORIVEN HOLDINGS LLC (doing business as Texeno) ("we," "us," or "our"), describes how and why we might access, collect, store, use, and/or share ("process") your personal information when you use our services ("Services"), including when you:

• Visit our website at https://texeno.com or any website of ours that links to this Privacy Notice
• Engage with us in other related ways, such as contacting us for help

Questions or concerns? Reading this Privacy Notice will help you understand your privacy rights and choices. We are responsible for making decisions about how your personal information is processed. If you do not agree with our policies and practices, please do not use our Services. If you still have any questions or concerns, please contact us at [email protected].

SUMMARY OF KEY POINTS

This summary provides key points from our Privacy Notice, but you can find out more details about any of these topics by clicking the link following each key point or by using our table of contents below to find the section you are looking for.

What personal information do we process? When you visit, use, or navigate our Services, we may process personal information depending on how you interact with us and the Services, the choices you make, and the products and features you use. Learn more about personal information you disclose to us.

Do we process any sensitive personal information? Some of the information may be considered "special" or "sensitive" in certain jurisdictions, for example your racial or ethnic origins, sexual orientation, and religious beliefs. We do not process sensitive personal information, except that if you ask to withdraw a cash reward we process your identity document and your face to verify your identity (see "Identity Verification" in section 1).

Do we collect any information from third parties? Some, yes: the sign-in service you choose (such as Google or GitHub) or your school or organization, if you sign in through them; people who report content to us; our payment processor, which gives us a code that identifies your card without its number; and, if you verify your identity to withdraw a cash reward, our identity-verification provider, which tells us the result of the check and the name and country on your document.

How do we process your information? We process your information to provide, improve, and administer our Services, communicate with you, for security and fraud prevention, and to comply with law. We may also process your information for other purposes with your consent. We process your information only when we have a valid legal reason to do so. Learn more about how we process your information.

Do we check content for illegal material? Yes. We use automated tools, including hash matching against databases of known child sexual abuse material, to detect and prevent illegal content. A match may lead to the content being removed, the account being suspended and a report to child-protection organizations and the authorities, as the law requires. Learn more about content safety.

In what situations and with which types of parties do we share personal information? We may share information in specific situations and with specific categories of third parties. Learn more about when and with whom we share your personal information.

How do we keep your information safe? We have adequate organizational and technical processes and procedures in place to protect your personal information. However, no electronic transmission over the internet or information storage technology can be guaranteed to be 100% secure, so we cannot promise or guarantee that hackers, cybercriminals, or other unauthorized third parties will not be able to defeat our security and improperly collect, access, steal, or modify your information. Learn more about how we keep your information safe.

What are your rights? Depending on where you are located geographically, the applicable privacy law may mean you have certain rights regarding your personal information. Learn more about your privacy rights.

How do you exercise your rights? The easiest way to exercise your rights is by visiting https://texeno.com/app/settings/account, or by contacting us. We will consider and act upon any request in accordance with applicable data protection laws.

Want to learn more about what we do with any information we collect? Review the Privacy Notice in full.

TABLE OF CONTENTS

1. WHAT INFORMATION DO WE COLLECT?

2. HOW DO WE PROCESS YOUR INFORMATION?

3. WHAT LEGAL BASES DO WE RELY ON TO PROCESS YOUR PERSONAL INFORMATION?

4. WHEN AND WITH WHOM DO WE SHARE YOUR PERSONAL INFORMATION?

5. DO WE USE COOKIES AND OTHER TRACKING TECHNOLOGIES?

6. HOW DO WE HANDLE YOUR SOCIAL LOGINS?

7. IS YOUR INFORMATION TRANSFERRED INTERNATIONALLY?

8. HOW LONG DO WE KEEP YOUR INFORMATION?

9. HOW DO WE KEEP YOUR INFORMATION SAFE?

10. DO WE COLLECT INFORMATION FROM MINORS?

11. WHAT ARE YOUR PRIVACY RIGHTS?

12. CONTROLS FOR DO-NOT-TRACK FEATURES

13. DO UNITED STATES RESIDENTS HAVE SPECIFIC PRIVACY RIGHTS?

14. DO WE MAKE UPDATES TO THIS NOTICE?

15. HOW CAN YOU CONTACT US ABOUT THIS NOTICE?

16. HOW CAN YOU REVIEW, UPDATE, OR DELETE THE DATA WE COLLECT FROM YOU?

1. WHAT INFORMATION DO WE COLLECT?

Personal information you disclose to us

We collect personal information that you voluntarily provide to us when you register on the Services, express an interest in obtaining information about us or our products and Services, when you participate in activities on the Services, or otherwise when you contact us.

Personal Information Provided by You. The personal information that we collect depends on the context of your interactions with us and the Services, the choices you make, and the products and features you use. The personal information we collect may include the following:

• names
• email addresses
• passwords
• contact preferences
• your language preference
• contact or authentication data
• billing addresses
• documents, files, comments and chat messages you create or upload
• settings and lists you save, such as tags, your personal dictionary and the web addresses of files you link
• if you answer them, what describes you (for example student or researcher) and how you found us

Sensitive Information. We do not process sensitive information, except in one case: if you ask to withdraw a cash reward, we process your identity document and your face to verify your identity, as described under "Identity Verification" below.

Identity Verification. If you ask to withdraw a cash reward from our referral program, we ask you to verify your identity first, so that one person can withdraw on one account. For this we use an authorized third-party identity verification service that acts on our behalf. It shows you a page where you photograph an identity document and take a live selfie, reads and checks the document, checks that the selfie shows a live person, compares your face with the photo on the document, and tells us the result. The service processes your document images, your face (including the comparison) and the data printed on the document. Face data can be biometric data, and in some places it is sensitive data. We ask for it only for this purpose, only for people who ask to withdraw cash, and only when you start the check. By starting the check you agree to this processing; you can stop at any time, and you can use the Services fully without verifying: you only cannot withdraw cash.

What we keep from the check. We keep the result (verified, declined, in review, expired or a duplicate), the name and the issuing country shown on your document, the date, and a non-reversible code derived from the document so that the same document cannot verify a second account. We do not keep the document number, the images or your face data. If our staff verify you by other means, we keep the name they recorded, who recorded it and why.

What the verification service keeps. The service stores the check (the images, the selfie, the data read from the document and its decision) and deletes it 12 months after the check. We ask it to delete its copy sooner when you delete your account or when our staff reset your check. It handles this data under its own privacy terms.

Why, and on what basis. We do this to pay a reward to a real person once, to prevent fraud and duplicate payments, and to meet our legal duties for payments. Our basis is your consent for the face data, and our legitimate interest in preventing fraud for the rest.

Payment Data. You enter your card details into our payment processor's secure fields, not ours. The processor handles and stores the card number and security code; we keep the card's brand and last four digits, your plan and your receipts.

Organization Accounts. If you use Texeno as a member of a team or through your school or another organization, its administrators can see your name, email address and role, and information such as the storage you use, when you joined and the actions recorded in its audit log. If you sign in through your organization's sign-in service, it may send us your name and email address. Where you use Texeno under an agreement between your organization and us, your organization's own privacy notice may also apply.

Records of Our Staff's Actions. When our staff act on your account, for example to give or take back platform credit, to warn you under our fair-use rules, or to limit, suspend or close an account, we keep a record of what was done, when, and the reason they gave.

Abuse-Prevention Records. So that one person gets one refund in 12 months and one trial, and cannot open a new account after we suspended or closed theirs for breaking our Terms, we keep a non-reversible code made from your email address (in a standard form, so that variants of the same address match), the date and the kind of record. For refunds and trials we also keep a code from our payment processor that identifies the card without revealing its number. We keep a refund record for 12 months, a trial record for 2 years and the record of a suspended or closed account for 3 years or until we lift the suspension, also after your account is deleted. Our basis is our legitimate interest in preventing fraud and abuse.

Social Media Login Data. We may provide you with the option to register with us using your existing third-party account details. If you choose to register in this way, we will collect certain profile information about you from the social media provider, as described in the section called "HOW DO WE HANDLE YOUR SOCIAL LOGINS?" below.

Content Safety. To detect and prevent illegal content, especially child sexual abuse material, we use automated tools on the files stored in the Services, the documents we compile and the templates in our gallery, including hash matching: we compare digital fingerprints of content with databases of known child sexual abuse material, some of them kept by child-protection organizations, which receive fingerprints, not your files. If content matches known material, or we find other seriously illegal content, we may block it, suspend the account it came from, and keep the content and related account information (such as the name and email address on the account and the times and IP addresses of its recent sign-ins), encrypted, as evidence, and we report it, as the law requires, to child-protection organizations and the authorities. Anyone can report content to us, in the Services or on our report page. We keep the report, what it points to and, if the reporter gives them, their name and email address, and we use them to handle the report and to answer the reporter. Our staff review reports and may remove content or restrict an account; when we do, we generally tell the person affected what we decided, why, and how to contest it, unless the law or the safety of others prevents it. We do this to meet our legal obligations, including reporting duties under United States law and the rules on illegal content of the EU Digital Services Act and the UK Online Safety Act, and on the basis of our legitimate interest in keeping our Services and the people who use them, especially children, safe.

All personal information that you provide to us must be true, complete, and accurate, and you must notify us of any changes to such personal information.

Information automatically collected

We automatically collect certain information when you visit, use, or navigate the Services. This information does not reveal your specific identity (like your name or contact information) but may include device and usage information, such as your IP address, browser and device characteristics, operating system, language preferences, referring URLs, device name, country, location, information about how and when you use our Services, and other technical information. This information is primarily needed to maintain the security and operation of our Services, and for our internal analytics and reporting purposes.

Like many businesses, we also collect information through cookies and similar technologies.

The information we collect includes:

• Log and Usage Data. Log and usage data is service-related, diagnostic, usage, and performance information our servers automatically collect when you access or use our Services and which we record in log files. Depending on how you interact with us, this log data may include your IP address, device information, browser type, and settings and information about your activity in the Services (such as the date/time stamps associated with your usage, pages and files viewed, searches, and other actions you take such as which features you use), device event information (such as system activity, error reports (sometimes called "crash dumps"), and hardware settings).
• Error Reports. When something goes wrong in our software, a diagnostic report is sent to a third-party error monitoring processor. A report contains technical information such as the type and location of the error, the date and time, your browser, operating system and device type, the address of the page without query parameters or private link codes, and an approximate location derived from your connection. We configure the processor not to store your IP address, and we do not deliberately send it your name, email address, cookies or the contents of your documents. Reports are kept for up to 90 days.
• Analytics Data. With your consent, we use Google Analytics, a web analytics service provided by Google LLC, to help us understand how visitors find and use the public pages of our Services. Google Analytics is not loaded, and no data is sent to Google, unless you accept analytics in the cookie banner shown on these pages. If your browser sends a Global Privacy Control signal, we treat it as a refusal. Once you accept, it collects, through cookies and similar technologies, the address and title of the page you view, the page that referred you, the date and time of your visit, your browser type and language, operating system, device type and screen size, your interactions with the page, a randomly generated identifier stored in a cookie, and an approximate location (country and city) derived from your IP address, which is not stored in full. We do not provide Google with your name, your email address, your account details or the contents of your documents, and we do not load Google Analytics inside your account, on sign-in pages or on pages opened from a private link. We remove a referral code from the page address as soon as we have read it, so it is not sent to Google. Google acts as our service provider in processing this data, and we have configured it to retain the data for no longer than fourteen (14) months. Google may also process this data for its own purposes in accordance with its Privacy Policy, available at https://policies.google.com/privacy. Our legal basis for this processing is your consent. You may refuse it in the cookie banner, and you may withdraw it at any time by choosing "Cookie settings" in the footer of our website; withdrawing stops further collection and deletes the Google Analytics cookies, but does not affect collection that took place before. You may also block or delete cookies in your browser settings, or install the Google Analytics opt-out browser add-on, available at https://tools.google.com/dlpage/gaoptout.
• Session Recording Data. With your consent, we use Microsoft Clarity, a behavioral analytics service provided by Microsoft Corporation, to see how visitors use the public pages of our Services. Clarity is not loaded, and no data is sent to Microsoft, unless you accept analytics in the cookie banner shown on these pages. If your browser sends a Global Privacy Control signal, we treat it as a refusal. Once you accept, it records how you use the page (clicks, taps, scrolling and mouse movement, the page address and the page as it appears), together with your device, browser, screen size, language, an approximate location (country and city) derived from your IP address, which is not stored in full, and a random identifier kept in cookies, so that we can replay a visit and draw heatmaps. Before anything leaves your browser, Clarity masks what is personal: anything you type or choose in a form field, numbers and email addresses are replaced on your device and are never sent to Microsoft, and the document editor and PDF viewer are masked as well. The data Clarity collects is pseudonymous, not anonymous: it is linked to a random identifier, not to your account. We do not use Clarity's features for identifying visitors, and we do not attempt to identify anyone from this data. We do not provide Microsoft with your name, your email address, your account details or the contents of your documents, and we do not load Clarity inside your account, on sign-in pages, on the report form or on pages opened from a private link. Microsoft acts as our service provider in processing this data, we turn off its advertising signals, and the data is kept for no longer than thirteen (13) months. Our legal basis for this processing is your consent. You may refuse it in the cookie banner, and you may withdraw it at any time by choosing "Cookie settings" in the footer of our website; withdrawing stops further recording and deletes the Clarity cookies, but does not affect recording that took place before.
• Sign-up Protection Data. To keep automated programs from creating accounts, the page where you create an account with your email address uses Google reCAPTCHA, a service provided by Google LLC. If you are in the European Economic Area, the United Kingdom or Switzerland, we load it only if you allow it in the notice on that page. If you decline, nothing is loaded from Google, and you can sign up with a third-party sign-in account instead. Elsewhere it loads when the page opens, because of our legitimate interest in keeping the Services safe from abuse. To tell which case applies we use the approximate country derived from your IP address by the content delivery and security network in front of our Services; if that cannot be worked out, we ask. When reCAPTCHA loads, your browser loads it from Google. Google receives your IP address, your browser and device information, the address of the page, the cookies already set for google.com, and information about how you interact with the page, and uses them to decide whether you are a person; Google may set cookies of its own for this. When you submit the form, your IP address and the response from the check are sent to Google to validate it. We do not receive the data Google collects, only whether the check passed. reCAPTCHA is not loaded on the sign-in page or on the other pages of our Services. We also refuse sign-ups with disposable email addresses and limit how many accounts can be created from one IP address in an hour. Where we ask, we remember your choice in a cookie named texeno_captcha, for up to six months. You can change it at any time with "Cookie settings" at the bottom of that page. If you withdraw, we stop loading reCAPTCHA, but cookies Google has already set stay until they expire or you delete them in your browser. Where we ask, our basis is your consent. Google's use of this data is governed by Google's Privacy Policy and Terms of Service.
• Product Email Data. If you agree to receive product emails from us (news about new features and other news about our Services), we keep your email address on our mailing list with our email provider (see section 4), with a record of how and when you agreed: by saying yes when we ask, after you create your account or in the app, or by turning on "Product news" in Settings > Notifications. We also record when you stop them. With your separate consent ("Let us see when you open them" in Settings > Notifications), our email provider may record whether you open a product email (through a small image in the email) and which links in it you click; we use this to learn which news interests our users. Links in our emails may also carry a campaign tag, which is used to count visits per email, not to identify you (see section 5). You can turn this tracking off at any time in the same place, and it stops with your product emails.
• Referral Data. If you take part in our referral program, we keep a personal referral code for you; who you referred and who referred you, as a status and dates (our staff can see who is connected to whom, but we never show a referrer the name or email address of a person they referred, and we do not tell a person who referred them); the rewards you earned or received and their status; and a ledger of the credit you earned and spent. If you open a referral link, a cookie holds the code from that link (see section 5). To protect the program from abuse we also keep, on each referral, a standardised form of the referred person's email address, so that we can see whether two accounts belong to the same person, and the result of an automated check of the network the sign-up came from. For that check we process your IP address when you claim a referral and compare it with reference data on high-risk networks; we keep only a pseudonymised, non-reversible representation of the address and the result, not the address itself, and we do not share the address with anyone for this check beyond the content delivery and security network that already handles visitor traffic (see section 4). We keep them for a limited period (30 days by default) and then erase them. We also compare the domain of an email address with lists of disposable email providers. We use these data to decide whether a referral qualifies for a reward and to prevent abuse of the program, on the basis of our legitimate interest in preventing fraud and, for giving you the reward itself, to perform our contract with you. These checks are automated. A referral that fails one may be held for a person on our staff to review, or may not earn a reward; this affects only the reward, never your account or your access to the Services. You can ask for a person to review a decision by writing to [email protected].
• Connected Services. If you connect a cloud storage, code hosting or reference management service to your account, we exchange the project files you choose to sync with it, and keep the access it grants, encrypted, until you disconnect it. Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
• AI Assistants You Connect. If you connect an AI assistant (such as ChatGPT or Claude) to your account, we keep a record of the app, the access you granted and when it was connected and last used, until you disconnect it or delete your account. What the assistant receives is described in section 4.
• Device Data. We collect device data such as information about your computer, phone, tablet, or other device you use to access the Services. Depending on the device used, this device data may include information such as your IP address (or proxy server), device and application identification numbers, location, browser type, hardware model, Internet service provider and/or mobile carrier, operating system, and system configuration information.

2. HOW DO WE PROCESS YOUR INFORMATION?

We process your personal information for a variety of reasons, depending on how you interact with our Services, including:

• To facilitate account creation and authentication and otherwise manage user accounts. We may process your information so you can create and log in to your account, as well as keep your account in working order.
• To deliver and facilitate delivery of services to the user. We may process your information to provide you with the requested service.
• To respond to user inquiries/offer support to users. We may process your information to respond to your inquiries and solve any potential issues you might have with the requested service.
• To send administrative information to you. We may process your information to send you details about our products and services, changes to our terms and policies, and other similar information.
• To fulfill and manage your orders. We may process your information to fulfill and manage your subscription orders and payments, including refunds, made through the Services.
• To enable user-to-user communications. We may process your information if you choose to use any of our offerings that allow for communication with another user.
• To protect our Services. We may process your information as part of our efforts to keep our Services safe and secure, including fraud monitoring and prevention.
• To keep illegal content off our Services. We may process your information to detect, prevent and report child sexual abuse material and other illegal content, to handle reports and complaints, and to meet our legal obligations (see "Content Safety" in section 1).
• To run our referral program. If you take part in our referral program, we may process your information to work out whether a referral qualifies for a reward, to give you the reward, to keep a record of it, and to prevent abuse of the program, including with the automated checks described in section 1.
• To send you product emails. We may send you emails about new features and other news about our Services if you agreed to receive them (see "Product Email Data" in section 1). Each product email includes a link to unsubscribe. Unsubscribing does not stop the emails about your account, your projects, your orders and our policies.
• To identify usage trends. We may process information about how you use our Services to better understand how they are being used so we can improve them.
• To decide where and to whom we advertise. If you answer the two optional questions we ask once after you create your account (what describes you and how you found us), we keep your answers with your account and count them, with how many of those accounts start a trial or pay, to decide where to advertise and to whom. Our staff see these counts and each account's answers, and we do not share your answers with advertisers or anyone else. You can skip both questions. Our basis is our legitimate interest in understanding who uses our Services and how they find them.
• To save or protect an individual's vital interest. We may process your information when necessary to save or protect an individual’s vital interest, such as to prevent harm.

3. WHAT LEGAL BASES DO WE RELY ON TO PROCESS YOUR INFORMATION?

If you are located in the EU or UK, this section applies to you.

The General Data Protection Regulation (GDPR) and UK GDPR require us to explain the valid legal bases we rely on in order to process your personal information. As such, we may rely on the following legal bases to process your personal information:

• Consent. We may process your information if you have given us permission (i.e., consent) to use your personal information for a specific purpose. You can withdraw your consent at any time. Learn more about withdrawing your consent.
• Performance of a Contract. We may process your personal information when we believe it is necessary to fulfill our contractual obligations to you, including providing our Services or at your request prior to entering into a contract with you.
• Product Emails. Our basis for sending product emails, and for recording when you open them and which links in them you click, is your consent (given separately for the emails and for this tracking), which you can withdraw at any time (see withdrawing your consent).
• Legitimate Interests. We may process your information when we believe it is reasonably necessary to achieve our legitimate business interests and your interests and fundamental rights and freedoms do not override those interests. For example, we may process your personal information for some of the purposes described in order to:
• Analyze how our Services are used so we can improve them to engage and retain users
• Diagnose problems and/or prevent fraudulent activities
• Protect our referral program from abuse, with the automated checks described in section 1, and keep the records needed to enforce its limits
• Detect and prevent illegal content, especially child sexual abuse material, keep the evidence and records this needs, and meet reporting duties under the laws of other countries that apply to us, such as United States law
• Legal Obligations. We may process your information where we believe it is necessary for compliance with our legal obligations, such as to cooperate with a law enforcement body or regulatory agency, exercise or defend our legal rights, disclose your information as evidence in litigation in which we are involved, or handle reports of illegal content and explain our decisions about them.
• Vital Interests. We may process your information where we believe it is necessary to protect your vital interests or the vital interests of a third party, such as situations involving potential threats to the safety of any person.

If you are located in Canada, this section applies to you.

We may process your information if you have given us specific permission (i.e., express consent) to use your personal information for a specific purpose, or in situations where your permission can be inferred (i.e., implied consent). You can withdraw your consent at any time.

In some exceptional cases, we may be legally permitted under applicable law to process your information without your consent, including, for example:

• If collection is clearly in the interests of an individual and consent cannot be obtained in a timely way
• For investigations and fraud detection and prevention
• For business transactions provided certain conditions are met
• If it is contained in a witness statement and the collection is necessary to assess, process, or settle an insurance claim
• For identifying injured, ill, or deceased persons and communicating with next of kin
• If we have reasonable grounds to believe an individual has been, is, or may be victim of financial abuse
• If it is reasonable to expect collection and use with consent would compromise the availability or the accuracy of the information and the collection is reasonable for purposes related to investigating a breach of an agreement or a contravention of the laws of Canada or a province
• If disclosure is required to comply with a subpoena, warrant, court order, or rules of the court relating to the production of records
• If it was produced by an individual in the course of their employment, business, or profession and the collection is consistent with the purposes for which the information was produced
• If the collection is solely for journalistic, artistic, or literary purposes
• If the information is publicly available and is specified by the regulations
• We may disclose de-identified information for approved research or statistics projects, subject to ethics oversight and confidentiality commitments

4. WHEN AND WITH WHOM DO WE SHARE YOUR PERSONAL INFORMATION?

Vendors, Consultants, and Other Third-Party Service Providers. We may share your data with third-party vendors, service providers, contractors, or agents ("third parties") who perform services for us or on our behalf and require access to such information to do that work. We have contracts in place with our third parties, which are designed to help safeguard your personal information. This means that they cannot do anything with your personal information unless we have instructed them to do it. They will also not share your personal information with any organization apart from us. They also commit to protect the data they hold on our behalf and to retain it for the period we instruct.

We use third-party error monitoring processors to find and fix errors in our software. They receive the error reports described in section 1 and store them in the European Union.

To keep automated programs from creating accounts, the page where you create an account with your email address uses Google reCAPTCHA, provided by Google LLC (in the European Economic Area, the United Kingdom and Switzerland, only if you allow it). It receives the data described under "Sign-up Protection Data" in section 1.

To check identity for cash withdrawals, we use authorized identity verification services. They receive the images of your identity document, your selfie and the data read from the document (see "Identity Verification" in section 1).

With your consent, we use Google Analytics, a web analytics service provided by Google LLC, to analyze how visitors use the public pages of our Services. Google receives the analytics data described under "Analytics Data" in section 1 and processes it on our behalf.

With your consent, we also use Microsoft Clarity, a behavioral analytics service provided by Microsoft Corporation, to see how visitors use the public pages of our Services. Microsoft receives the data described under "Session Recording Data" in section 1 and processes it on our behalf.

We send our emails, including product emails, through an email service provider that stores the data in the European Union. It receives your email address and the content of each email, and records whether the email was delivered, so that we can fix delivery problems. For product emails it also receives the record described under "Product Email Data" in section 1, and, with your consent, records the opens and clicks described there. We generally do not use the emails about your account, your projects, your orders and our policies to measure whether you open them.

To detect known child sexual abuse material, we compare fingerprints of content with databases kept by child-protection organizations; they receive the fingerprints, not your files. Where the law requires, we report child sexual abuse material and the related account information to child-protection organizations and the competent authorities, and we may share information with law enforcement or other authorities when the law requires it or to protect someone's safety.

The categories of third parties we may share personal information with are as follows:

• Cloud Computing Services
• Payment Processors
• User Account Registration & Authentication Services
• Website Hosting Service Providers
• Content Delivery and Security Services
• Error Monitoring and Diagnostic Services
• Email Delivery Services
• Identity Verification Services (only if you ask to withdraw a cash reward)
• Analytics and Bot-Prevention Services (only where you allow them)
• Child-Protection Organizations and Authorities (for content safety, as described in section 1)
• Code Hosting Services (only if you link a repository)
• Cloud Storage and Reference Management Services (only if you connect one)
• AI Assistant Providers (only if you connect one)

A current list of the processors that handle your personal information is available on request at [email protected].

We also may need to share your personal information in the following situations:

• Business Transfers. We may share or transfer your information in connection with, or during negotiations of, any merger, sale of company assets, financing, or acquisition of all or a portion of our business to another company.
• Services You Connect. When you connect a cloud storage, code hosting or reference management service, we send it the project files you choose to sync, at your request.
• AI Assistants You Connect. If you connect an AI assistant to your account, it can, at your request and within the access you grant, read and change your projects (including their files, compile results, history and comments), see your name and email address, and give you a link to download a compiled document (anyone who has that link can use it once, for a short time, without signing in). The assistant's provider handles what it receives under its own terms and privacy policy, not this one. You can disconnect an assistant at any time in Settings > Integrations.
• Other Users. Your projects, comments and chat messages are visible only to you and the people you invite or give a link to; they can see your name, your cursor and what you add while you work together. Anyone who has a link you share can open what it points to. We do not make your content public.
• Your Organization. If you are a member of a team or use Texeno through your school or another organization, its administrators can see the information described under "Organization Accounts" in section 1.

5. DO WE USE COOKIES AND OTHER TRACKING TECHNOLOGIES?

We may use cookies and similar tracking technologies (like web beacons and pixels) to gather information when you interact with our Services. Some online tracking technologies help us maintain the security of our Services and your account, prevent crashes, fix bugs, save your preferences, and assist with basic site functions.

We use the cookies and similar browser storage the Services need to work: to keep you signed in (a session that lasts up to 90 days) and to complete sign-in securely; to carry a sign-in or the connection of another service through its steps (short-lived cookies, kept for up to 24 hours); while access to the site is limited by a password, to remember that you entered it (30 days); to remember choices such as your workspace, how your projects and panes are laid out, notices you closed, your editor preferences and your language (a cookie named texeno_locale), each kept for up to one year; and to remember your cookie choice (a cookie named texeno_consent, kept for up to six months). If you tick "Remember me" when you sign in, the sign-in page can remember your email address. The editor also keeps changes you have not yet saved in your browser's storage, so that you can keep working offline. If you open a referral link, we store the code from that link in a cookie named texeno_ref for up to 30 days, so that we can credit the person who shared the link if you sign up. The cookie holds only that code, is not used for advertising or analytics, and is deleted once you sign up and the code is claimed, or when the code cannot be used. It is set when you open the link, but in the European Economic Area, the United Kingdom and Switzerland only if you allow it in our cookie banner; withdrawing that choice deletes it. If you open our website from a link that carries a campaign tag (for example a link in one of our social media posts), or arrive from another website, a first-party cookie named texeno_src holds that tag, or the name of that website (for example perplexity.ai, never the page you came from), for up to 30 days. The cookie holds only that, never an identifier, is not used for advertising, is not shared with anyone, and is deleted once you sign up or sign in. If you create an account within that time, we keep it with your account so that we can count how many sign-ups each of our posts, campaigns and referring websites brings; our staff see these counts per tag, not a list of who came from where. Like the referral cookie, in the European Economic Area, the United Kingdom and Switzerland it is set only if you allow it in our cookie banner, and withdrawing that choice deletes it. Our content delivery and security network may also set cookies for security. The page where you create an account with your email address loads Google reCAPTCHA (in the European Economic Area, the United Kingdom and Switzerland, only if you allow it), which can set cookies of its own on google.com; where we ask, we remember your choice in a cookie named texeno_captcha, kept for up to six months (see "Sign-up Protection Data" in section 1). In addition, only if you accept analytics in our cookie banner, we use Google Analytics, a web analytics service provided by Google LLC, to help us understand how visitors use the public pages of our Services (see "Analytics Data" in section 1). Google Analytics uses cookies named _ga and _ga_ followed by a code, which store a randomly generated identifier that allows visits from the same browser to be recognized and counted, and which expire after up to two years. You may refuse analytics cookies, or withdraw your consent at any time, by choosing "Cookie settings" in the footer of our website; withdrawing deletes these cookies. If your browser sends a Global Privacy Control signal, we treat it as a refusal of analytics and of the referral and sign-up source cookies, and the cookie banner shows it. We do not use advertising cookies, we do not use Google Analytics for advertising or remarketing purposes, and we do not permit third parties to place advertising trackers on our Services. Likewise, only if you accept analytics, Microsoft Clarity uses cookies named _clck and _clsk, which store a randomly generated identifier and link the pages of one visit into a single recording and expire after up to one year and one day, and it sets cookies of Microsoft's own (such as CLID and MUID) on its domains. Withdrawing consent deletes ours. We do not use Clarity for advertising.

You can refuse or delete cookies in your browser settings, but the Services will not work without the cookies that keep you signed in.

6. HOW DO WE HANDLE YOUR SOCIAL LOGINS?

Our Services offer you the ability to register and log in using your third-party account details. Where you choose to do this, we will receive certain profile information about you from your social media provider. The profile information we receive may vary depending on the social media provider concerned, but will usually include your name, email address and profile picture. We keep only your name and email address; we do not keep the picture.

We will use the information we receive only for the purposes that are described in this Privacy Notice or that are otherwise made clear to you on the relevant Services. Please note that we do not control, and are not responsible for, other uses of your personal information by your third-party social media provider. We recommend that you review their privacy notice to understand how they collect, use, and share your personal information, and how you can set your privacy preferences on their sites and apps.

7. IS YOUR INFORMATION TRANSFERRED INTERNATIONALLY?

Our servers are located in Germany, France and Spain. Regardless of your location, please be aware that your information may be transferred to, stored by, and processed by us in our facilities and in the facilities of the third parties with whom we may share your personal information (see "WHEN AND WITH WHOM DO WE SHARE YOUR PERSONAL INFORMATION?" above), including facilities in the United States, and other countries.

If you are a resident in the European Economic Area (EEA), United Kingdom (UK), or Switzerland, then these countries may not necessarily have data protection laws or other similar laws as comprehensive as those in your country. However, we will take all necessary measures to protect your personal information in accordance with this Privacy Notice and applicable law.

European Commission's Standard Contractual Clauses:

We have implemented measures to protect your personal information, including by using the European Commission's Standard Contractual Clauses for transfers of personal information between our group companies and between us and our third-party providers. These clauses require all recipients to protect all personal information that they process originating from the EEA or UK in accordance with European data protection laws and regulations. Our Standard Contractual Clauses can be provided upon request. We have implemented similar appropriate safeguards with our third-party service providers and partners and further details can be provided upon request.

Our error monitoring processors may be located in the United States. They store our error reports in the European Union, but their personnel in the United States may be able to access them. These transfers rely on the provider's participation in the EU-U.S. Data Privacy Framework (and the equivalent arrangements for the United Kingdom and Switzerland) where that applies and, where it does not, on the European Commission's Standard Contractual Clauses and the equivalent mechanisms for the United Kingdom and Switzerland.

Google LLC, the provider of Google Analytics, is likewise a company located in the United States, and the analytics data it receives may be transferred to, stored and processed in the United States. Google relies on the EU-U.S. Data Privacy Framework and, where that does not apply, on the European Commission's Standard Contractual Clauses to safeguard these transfers.

Microsoft Corporation, the provider of Microsoft Clarity, is likewise a company located in the United States, and the data it receives may be transferred to, stored and processed in the United States. Microsoft relies on the EU-U.S. Data Privacy Framework and, where that does not apply, on the European Commission's Standard Contractual Clauses to safeguard these transfers.

The same applies to the data Google receives through reCAPTCHA: it may be transferred to, stored and processed in the United States, on the same basis.

Content-safety checks and reports (see section 4) may involve child-protection organizations and authorities in Canada and the United States, to which we send what the check or the report needs. If you connect an AI assistant, what it receives at your request may be processed wherever its provider operates, under the provider's own terms.

8. HOW LONG DO WE KEEP YOUR INFORMATION?

We will only keep your personal information for as long as it is necessary for the purposes set out in this Privacy Notice, unless a longer retention period is required or permitted by law (such as tax, accounting, or other legal requirements). In practice this means for as long as you have an account. If you receive product emails, your address stays on our mailing list until you unsubscribe or delete your account; after you stop them we keep your address on a list of people not to email, so that we respect your choice, and the record of your consent, so that we can show it. Your mailing-list entry and your consent records are deleted with your account. If you delete your account (Settings > Account), we delete your personal workspace and its projects, and team workspaces where you are the only member, and we end the access of services you connected. In projects that remain, the comments, chat messages and version history you wrote stay, without your name, and a team's audit log keeps the name it recorded. Notifications and mentions of you that other people received lose your name. Any subscription stops renewing; the period you already paid for is not refunded. If you took part in our referral program, your referral code, rewards and credit ledger are deleted with your account, and unused credit is lost. Where a referral record has to be kept so that the limits of the program still hold (for example the record that a person you referred signed up), the identifiers in it are removed and only what is needed to enforce those limits is kept. We also keep a pseudonymised, non-reversible representation of your email address, and nothing else about you, for a short period (42 days by default), so that deleting an account and signing up again cannot be used to earn a referral; we then delete it. If you verified your identity to withdraw a cash reward, we delete the result of the check, your name and your country when you delete your account, and we ask the identity verification service to delete its copy then; otherwise it deletes its copy 12 months after the check. A withdrawal we paid keeps the amount, the date, the payment method, our payment reference and a non-reversible code of the document, because we need them to pay once for each person and for our accounts. If you connect an AI assistant, the record of that connection is deleted when you disconnect it or delete your account. When you delete your account, our record of our staff's actions on it keeps only what was done, when and by which staff member, without your name, your email address or the reasons given. Records of warnings and measures under our fair-use rules are kept that way for as long as we need them to enforce our Terms. Abuse-prevention records are kept for the periods given in section 1, also after your account is deleted. Fingerprints of content are kept for as long as we need them to check that content, generally while it is stored with us. Evidence kept for a moderation case, and the related account information, is deleted at once if the case is dismissed, 6 months after the case is closed if we acted without reporting it to an authority, and 1 year after the report if we reported it, even if the account has been deleted. Reports and our moderation decisions are kept for as long as we need them to handle complaints, meet our legal obligations and protect our Services. While a case about your account or your content is open, you cannot delete your account or the reported projects and files, and we keep the reported content until the case is closed.

When we have no ongoing legitimate business need to process your personal information, we will either delete or anonymize such information, or, if this is not possible (for example, because your personal information has been stored in backup archives), then we will securely store your personal information and isolate it from any further processing until deletion is possible.

9. HOW DO WE KEEP YOUR INFORMATION SAFE?

We have implemented appropriate and reasonable technical and organizational security measures designed to protect the security of any personal information we process. However, despite our safeguards and efforts to secure your information, no electronic transmission over the Internet or information storage technology can be guaranteed to be 100% secure, so we cannot promise or guarantee that hackers, cybercriminals, or other unauthorized third parties will not be able to defeat our security and improperly collect, access, steal, or modify your information. Although we will do our best to protect your personal information, transmission of personal information to and from our Services is at your own risk. You should only access the Services within a secure environment.

10. DO WE COLLECT INFORMATION FROM MINORS?

We do not knowingly collect, solicit data from, or market to children under 18 years of age or the equivalent age as specified by law in your jurisdiction, nor do we knowingly sell such personal information. By using the Services, you represent that you are at least 18 or the equivalent age as specified by law in your jurisdiction. If we learn that personal information from users less than 18 years of age or the equivalent age as specified by law in your jurisdiction has been collected, we will deactivate the account and take reasonable measures to promptly delete such data from our records. If you become aware of any data we may have collected from children under age 18 or the equivalent age as specified by law in your jurisdiction, please contact us at [email protected].

11. WHAT ARE YOUR PRIVACY RIGHTS?

In some regions (like the EEA, UK, Switzerland, and Canada), you have certain rights under applicable data protection laws. These may include the right (i) to request access and obtain a copy of your personal information, (ii) to request rectification or erasure; (iii) to restrict the processing of your personal information; (iv) if applicable, to data portability; and (v) not to be subject to automated decision-making. If a decision that produces legal or similarly significant effects is made solely by automated means, we will inform you, explain the main factors, and offer a simple way to request human review. In certain circumstances, you may also have the right to object to the processing of your personal information. You can make such a request by contacting us by using the contact details provided in the section "HOW CAN YOU CONTACT US ABOUT THIS NOTICE?" below.

We will consider and act upon any request in accordance with applicable data protection laws.

If you are located in the UK and are unhappy with how we have handled your personal information, you can make a complaint directly to us. This is in addition to the rights you have under the UK General Data Protection Regulation and the Data Protection Act 2018.

How to contact us:

• Email: [email protected]
• Post: See "HOW CAN YOU CONTACT US ABOUT THIS NOTICE?"

What happens after you complain

• We will acknowledge your complaint within 30 days of receiving it.
• We will investigate without unjustifiable or excessive delay.
• We will keep you informed of progress and explain the outcome.

If you are not happy with our final response, you can refer your complaint to the Information Commissioner's Office, the UK supervisory authority.

• Website: ico.org.uk/make-a-complaint
• Helpline: 0303 123 1113
• Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

If you are located in the EEA or UK and you believe we are unlawfully processing your personal information, you also have the right to complain to your Member State data protection authority or UK data protection authority.

If you are located in Switzerland, you may contact the Federal Data Protection and Information Commissioner.

Product emails: You can stop our product emails at any time, free of charge, with the unsubscribe link in each one, by turning off "Product news" in Settings > Notifications, or by writing to [email protected]. You also have the right to object at any time to our use of your information to send you product emails, and we will stop.

Withdrawing your consent: If we are relying on your consent to process your personal information, which may be express and/or implied consent depending on the applicable law, you have the right to withdraw your consent at any time. You can withdraw your consent at any time by contacting us by using the contact details provided in the section "HOW CAN YOU CONTACT US ABOUT THIS NOTICE?" below or updating your preferences.

Account Information

If you would at any time like to review or change the information in your account, get a copy of your personal information or terminate your account, you can do so in Settings > Account ("Download your data" gives you a copy of the personal information in your account, such as your profile, your preferences, including your language, your notifications and the reports you sent us), or contact us using the contact details provided.

Upon your request to terminate your account, we will deactivate or delete your account and information from our active databases. However, we may retain some information in our files to prevent fraud, troubleshoot problems, assist with any investigations, enforce our legal terms and/or comply with applicable legal requirements.

Cookies and similar technologies: Most Web browsers are set to accept cookies by default. If you prefer, you can usually choose to set your browser to remove cookies and to reject cookies. If you choose to remove cookies or reject cookies, this could affect certain features or services of our Services.

If you have questions or comments about your privacy rights, you may email us at [email protected].

12. CONTROLS FOR DO-NOT-TRACK FEATURES

California law requires us to let you know how we respond to web browser DNT signals. Because there currently is not an industry or legal standard for recognizing or honoring DNT signals, we do not respond to them at this time.

Global Privacy Control. We do honor Global Privacy Control (GPC). If your browser sends it, we treat it as a refusal of analytics and of the referral and sign-up source cookies, and our cookie banner shows that the signal was applied.

13. DO UNITED STATES RESIDENTS HAVE SPECIFIC PRIVACY RIGHTS?

Categories of Personal Information We Collect

We may also collect other personal information outside of these categories through instances where you interact with us in person, online, or by phone or mail in the context of:

• Receiving help through our customer support channels;
• Participation in customer surveys or contests; and
• Facilitation in the delivery of our Services and to respond to your inquiries.

Sources of Personal Information

How We Use and Share Personal Information

Will your information be shared with anyone else?

We may disclose your personal information with our service providers pursuant to a written contract between us and each service provider. Learn more about how we disclose personal information in the section, "WHEN AND WITH WHOM DO WE SHARE YOUR PERSONAL INFORMATION?"

We may use your personal information for our own business purposes, such as for undertaking internal research for technological development and demonstration. This is not considered to be "selling" of your personal information.

• Category A. Identifiers
• Category B. Personal information as defined in the California Customer Records law
• Category D. Commercial information
• Category F. Internet or other electronic network activity information

The categories of third parties to whom we disclosed personal information for a business or commercial purpose can be found under "WHEN AND WITH WHOM DO WE SHARE YOUR PERSONAL INFORMATION?"

Your Rights

• Right to know whether or not we are processing your personal data
• Right to access your personal data
• Right to correct inaccuracies in your personal data
• Right to request the deletion of your personal data
• Right to obtain a copy of the personal data you previously shared with us
• Right to non-discrimination for exercising your rights
• Right to opt out of the processing of your personal data if it is used for targeted advertising (or sharing as defined under California’s privacy law), the sale of personal data, or profiling in furtherance of decisions that produce legal or similarly significant effects ("profiling")

Depending upon the state where you live, you may also have the following rights:

• Right to access the categories of personal data being processed (as permitted by applicable law, including the privacy law in Minnesota)
• Right to obtain a list of the categories of third parties to which we have disclosed personal data (as permitted by applicable law, including the privacy law in California, Delaware, and Maryland)
• Right to obtain a list of specific third parties to which we have disclosed personal data (as permitted by applicable law, including the privacy law in Minnesota and Oregon)
• Right to obtain a list of third parties to which we have sold personal data (as permitted by applicable law, including the privacy law in Connecticut)
• Right to review, understand, question, and depending on where you live, correct how personal data has been profiled (as permitted by applicable law, including the privacy law in Connecticut and Minnesota)
• Right to limit use and disclosure of sensitive personal data (as permitted by applicable law, including the privacy law in California)
• Right to opt out of the collection of sensitive data and personal data collected through the operation of a voice or facial recognition feature (as permitted by applicable law, including the privacy law in Florida)

Global Privacy Control. If your browser sends a Global Privacy Control signal, we treat it as a request to opt out: we do not load analytics and do not set the referral and sign-up source cookies.

How to Exercise Your Rights

Request Verification

Appeals

California "Shine The Light" Law

14. DO WE MAKE UPDATES TO THIS NOTICE?

We may update this Privacy Notice from time to time. The updated version will be indicated by an updated "Last updated" date at the top of this Privacy Notice. If we make material changes to this Privacy Notice, we may notify you either by prominently posting a notice of such changes or by directly sending you a notification. We encourage you to review this Privacy Notice frequently to be informed of how we are protecting your information.

15. HOW CAN YOU CONTACT US ABOUT THIS NOTICE?

ORIVEN HOLDINGS LLC

8 The Green, Ste A

Dover, DE 19901

United States

16. HOW CAN YOU REVIEW, UPDATE, OR DELETE THE DATA WE COLLECT FROM YOU?