Privacy Policy

1. Introduction & Data Controller

Black Ice ("we," "our," or "us") is committed to protecting your privacy and ensuring the security of your personal data. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our semantic infrastructure platform.

Data Controller: Black Ice
Contact: support@black-ice.ai

This policy applies to all users of our services, including our website, web application, and API services. By using our services, you acknowledge that you have read and understood this Privacy Policy.

2. Information We Collect

We collect the following categories of personal data:

• Account Information: Email address, name, and authentication credentials when you create an account.
• Registration Data: Email address and optional company name provided during sign-up.
• Usage Data: Information about how you interact with our services, including access times, pages viewed, and features used.
• Ontology Data: Terminology, concepts, relationships, and other semantic data you create within our platform.
• Technical Data: IP address, browser type, device information, and operating system.

3. Legal Basis for Processing

Under the EU General Data Protection Regulation (GDPR), we process your personal data based on the following legal grounds:

• Consent (Article 6(1)(a)): When you voluntarily provide your information, such as creating an account or subscribing to communications.
• Contract Performance (Article 6(1)(b)): To provide our services and fulfill our contractual obligations to you.
• Legitimate Interests (Article 6(1)(f)): For security, fraud prevention, service improvement, and analytics, where such interests are not overridden by your rights.
• Legal Obligation (Article 6(1)(c)): When required to comply with applicable laws and regulations.

4. How We Use Your Information

We use your personal data for the following purposes:

• Service Provision: To operate, maintain, and provide our semantic infrastructure platform.
• Communication: To send you important updates, respond to inquiries, and provide customer support.
• Security: To protect against unauthorized access, fraud, and other security threats.
• Improvement: To analyze usage patterns and improve our services, features, and user experience.
• Legal Compliance: To comply with applicable laws, regulations, and legal processes.

5. Data Sharing and Third Parties

We may share your personal data with:

• Service Providers: Trusted third parties who assist in operating our services (hosting, analytics, email delivery). These providers are contractually bound to protect your data.
• Legal Requirements: When required by law, court order, or governmental authority.
• Business Transfers: In connection with a merger, acquisition, or sale of assets, with appropriate safeguards.

We do not sell your personal data to third parties. We do not share your ontology data with other customers or use it for purposes other than providing our services to you.

6. AI & Model Training

We want this to be unambiguous, because it is one of the most common questions we receive from customers and their legal teams:

• No training on customer content: Customer ontology data — concepts, terms, market definitions, uploaded files, and prompts — is never used to train, fine-tune, or evaluate any machine learning or foundation model, whether operated by Black Ice or by a third party.
• No sharing for training: We do not sell, license, or otherwise make customer content available to any third party for model training purposes.
• Processing only on your instruction: Where an AI-assisted feature processes your content to produce a result for you, that content is used solely to return that result and is not retained by the model provider for training.
• Aggregate metrics only: We analyse anonymised, aggregated usage metrics (such as counts of concepts, markets, or exports) to operate and improve the service. These contain no customer ontology content.

This commitment is contractual, not merely a policy statement — it is written into our Data Processing Agreement, a countersigned copy of which is available on request for any paid workspace.

7. Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected:

• Account Data: Retained while your account is active and for up to 30 days after deletion request.
• Ontology Data: Retained for the lifetime of your workspace. On termination, cancellation, or downgrade you have 30 days to export your data, after which it is permanently deleted from production systems.
• Registration Data: Retained while your account is active and deleted within 30 days of an account deletion request.
• Backups: Encrypted backups run on a rolling 7-day point-in-time recovery window. Deleted data ages out of backups within 7 days of deletion from production.
• Usage Data: Retained in anonymized form for analytics purposes.
• Legal Records: Retained as required by applicable laws and regulations.

8. Your Rights Under GDPR

Under the GDPR (Articles 15-22), you have the following rights regarding your personal data:

• Right to Access (Article 15): Request a copy of the personal data we hold about you.
• Right to Rectification (Article 16): Request correction of inaccurate or incomplete data.
• Right to Erasure (Article 17): Request deletion of your personal data ("right to be forgotten").
• Right to Restrict Processing (Article 18): Request limitation of how we process your data.
• Right to Data Portability (Article 20): Receive your data in a structured, machine-readable format.
• Right to Object (Article 21): Object to processing based on legitimate interests or direct marketing.
• Rights Related to Automated Decision-Making (Article 22): Not be subject to decisions based solely on automated processing.

To exercise any of these rights, please contact us at support@black-ice.ai. We will respond within 30 days.

9. International Data Transfers

Your personal data may be transferred to and processed in countries outside the European Economic Area (EEA). When we transfer data outside the EEA, we ensure appropriate safeguards are in place:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• Adequacy decisions where applicable
• Binding Corporate Rules for intra-group transfers

Our Data Processing Agreement incorporates the EU Standard Contractual Clauses (Commission Implementing Decision 2021/914), Module Two (controller to processor). All customer ontology content is stored at rest in the EU (eu-central-1).

10. Security Measures

We implement appropriate technical and organizational measures to protect your personal data:

• Encryption of data in transit and at rest
• Regular security assessments and penetration testing
• Access controls and authentication mechanisms
• Employee training on data protection
• Incident response and breach notification procedures

11. Cookies and Local Storage

We use a minimal set of strictly necessary local storage and cookies that are exempt from consent under ePrivacy Article 5(3):

• Essential storage: Authentication session tokens that keep you signed in. Without these, login and protected pages cannot function.
• Preference storage: Your chosen theme, language, sidebar state, and "remember me" setting. These improve your experience but do not track you.

We do not set advertising cookies, third-party tracking cookies, cross-site profiling cookies, or analytics cookies. Usage insights are provided by the platform's built-in, cookieless analytics — no individual user is tracked, profiled, or identified across sessions.

If we ever introduce non-essential cookies in the future, we will display a consent banner and obtain your permission before any non-essential storage is written.

You can manage or clear local storage and cookies through your browser settings at any time. Clearing essential storage will sign you out and require you to authenticate again.

12. Updates to This Policy

We may update this Privacy Policy from time to time. When we make significant changes, we will notify you by:

• Posting the updated policy on our website with a new "Last Updated" date
• Sending an email notification to registered users
• Displaying a prominent notice within our application

13. Contact Information

If you have questions about this Privacy Policy or wish to exercise your rights, please contact us:

You also have the right to lodge a complaint with a supervisory authority in the EU Member State of your residence, place of work, or where an alleged infringement of the GDPR occurred.