Cicora Privacy Policy

Version dated 16 September 2026. This Policy applies from its publication date at /legal/en/privacy. It operates together with the Cicora Terms, Acceptable Use Rules, Refund Rules, Cookie Policy, and Data Controls. For an organisational order under which RIZZ TRADE processes personal data on the organisation customer's documented instructions, a separate data-processing agreement or addendum also applies; the general framework for that layer appears on Business Data.

1. Who is responsible and what this Policy covers

The controller of personal data for purposes determined independently by Cicora is RIZZ TRADE LLC, Republic of Uzbekistan, taxpayer ID 312432714, registration record 2944991 dated 15 September 2025, address: 3 Nukus Street, Abdulla Avloniy MFY, Mirobod District, Tashkent. For personal-data, deletion, security, or rights questions, contact support@cicora.ai or +998 90 051 48 40.

Cicora is RIZZ TRADE's own software service. It manages accounts, access, request routing, its own processing logic, history, billing, and support. Use of Cicora does not create an account, contract, or payment relationship with a model provider merely because that model is available in Cicora. A payment provider, app store, model provider, routing service, or other supplier processes data within its own role, applicable agreement, and applicable law.

This Policy applies to data processed when someone visits the website, registers for or uses the Cicora application or web service, works in a workspace, uses an API, contacts support, pays for an order, enables an optional feature, or interacts with a link published by a user. It does not replace the privacy policy of a third-party website, application, connector, payment method, or model provider.

Service availability in a particular country depends on applicable law, the selected Model, technology Route, and payment method. Russia is not a target market for Cicora. A page’s EN, UZ, or RU language does not itself mean that the service is offered in every country or that the same rights apply in all countries.

In this Policy:

• an Account is a Cicora user account;
• an Organisation and Workspace are an environment created by, or joined through, an authorised administrator;
• Request Materials are a prompt, context, file, media item, parameter, tool result, output, and other information needed to perform a particular feature;
• a Model Provider is the organisation whose model or technology tool is actually used by the selected route;
• the Model and Policy Registry is a reference page at /legal/en/model-policies linking to published model and technology-provider terms; it is not a list of the actual recipients of a particular user’s data;
• Personal Data means information relating to an identified or identifiable natural person under applicable law.

Where an Organisation uses Cicora for data about its personnel, customers, or other individuals, it may determine the purposes and material means of that processing. In that case, RIZZ TRADE may act as a processor on the Organisation's documented instructions to the extent of a separate B2B order and data-processing agreement. RIZZ TRADE remains an independent controller for its own necessary purposes: maintaining the Account and contract, billing, preventing abuse, security, legal compliance, and defending claims. The role follows the actual flow of data and the agreement, rather than a feature name.

2. Data we may receive and its sources

We apply a necessity principle: we do not request or use data that is not needed for a stated purpose. Do not send support a full card number, CVV, PIN, password, one-time bank code, or other access secret. Where an acquirer, wallet, or app store processes payment, that party receives the payment credentials; Cicora receives only the information needed to confirm an order, record a payment, resolve an error, or process a refund.

Optional device permissions, such as camera, photo, microphone, or file access, are requested only for a feature the user chooses and remain controlled through device settings. If a feature requires special, sensitive, or biometric-data processing, accepting this Policy is not by itself sufficient: the purpose, data, recipient, available safeguards, and legally required consent or other legal mechanism are disclosed before the feature starts.

The user is responsible for having the lawful basis, rights, and consents needed to upload material about another person, connect an external service, or instruct Cicora to act in an external system. This does not relieve RIZZ TRADE of its own responsibilities under applicable law, security obligations, and its applicable processing role.

3. Why we process data and the applicable basis

Processing purposes are identified in advance and are compatible with the reason the data was collected. Where applicable law uses the concept of a legal basis, we rely on one or more of the bases below. Consent does not replace a contract, legal obligation, or legitimate interest, and is not hidden in a mandatory purchase checkbox.

Private prompts, attachments, and outputs are used to provide, protect, and support Cicora. RIZZ TRADE does not use them to train its own general models or for optional advertising merely because a user accepted this Policy. A separate research, training, or other secondary-use programme, if offered, is accompanied before activation by disclosure of its purpose, data categories, term, recipients, effect of refusal, and the required consent/withdrawal mechanism.

4. Models, routing, files, and external features

4.1 Selected model and provider

Cicora may send the Request Materials needed for a request to the selected Model Provider or tool that actually performs the request. This can include a prompt, relevant context, file, technical parameters, and a part of the output where needed for the feature, security, or result verification. We transmit no more than is necessary for the particular request.

Before using a model, the user reviews its name, capabilities, and applicable conditions in the product card. The Model and Policy Registry helps locate technology providers’ published terms. It is a directory of external terms, not confirmation that every listed provider is included in a Cicora route or receives the user’s data. Information material to a particular request, including its recipient, data restrictions, and available settings, is disclosed through the feature card, settings, or relevant Order before processing to the extent required by law and agreement. For business processing, the actual processing schedule identifies recipients and international transfers.

Model Providers may have different rules for retention, logging, safety review, training, and deletion. Each route is governed by the conditions stated in its card and applicable provider rules. Zero-retention status, no-training status, a fixed processing country, or a stated deletion period applies only where it is expressly stated for the selected route. If automatic switching to a different route materially changes Request Material processing, Cicora discloses that before use and obtains a separate user choice where law or product settings require it. Circumventing applicable geographic, export, or protection restrictions is not permitted.

4.2 Files, cache, history, and memory

A file sent with a request may be processed only to the extent needed to perform that request, including format, security, and applicable-rule checks. If Cicora offers separate file storage, history, a project, memory, cache, or another saved object, the interface explains before activation what is saved, where it is visible in the Account/Workspace, how it can be deleted, and which retention criteria apply. Not every submitted item becomes a permanently saved object, and not every temporary cache is user history.

A technical cache may be used for a repeat request, performance, duplicate prevention, or security for the necessary period. It does not authorise independent use of the content. After deletion of a user object, residual copies can remain temporarily in backup or protected technical systems until their ordinary cycle; they do not return to ordinary use after deletion except where recovery is necessary on a lawful basis or in connection with an unresolved incident.

Do not upload a password, secret key, full payment credential, or another secret unless it is needed for a selected feature. Before uploading data about another person, medical, biometric, financial, or other sensitive data, confirm that you have the right to do so and that the selected route permits this processing. This notice does not replace separate legal, Organisation-contract, or provider-condition requirements.

4.3 Feedback, public links, and sharing materials

An output rating, problem report, or improvement proposal is voluntary. When a user submits feedback, Cicora may use the feedback itself and the related context the user expressly supplied to investigate, correct, secure, or improve the relevant feature. We do not treat the entire Account or all prior conversations as feedback merely because the user submitted one rating.

A public link or other shared access is created only by an express action of the user or authorised administrator. Before publication, Cicora shows which material will be available to recipients. Removing a link stops further delivery of it by Cicora but does not withdraw copies, screenshots, or data lawfully obtained by third parties. A user creates a public link only for material for which the user has a lawful basis and the necessary permissions.

4.4 Connectors, external Accounts, and actions

When a user connects an external service, Cicora receives only the access granted by that user or administrator. The external service may receive Request Materials, instructions, or results needed to perform an action, and Cicora may receive data returned by that service. That service processes data under its own rules. Before connecting, the user should review the scope of access, the external terms, and the authority to make the data available. Access can remain until it is disconnected in Cicora settings or with the external provider; where the interface supports disconnection, it is available without reconnecting.

If a feature can read a file, send a message, change external data, or take another action for a user, Cicora shows the nature of the action and does not present the result as a human action. The user is responsible for the permission granted, and Cicora applies limitations required by security, law, and the selected-route rules.

4.5 Workspaces and administrators

An Organisation administrator may invite and remove members, set roles, manage access, and view data and material to the extent that the role actually provides and that is disclosed before a user joins. The Organisation is responsible for lawfully informing its users about that access and obtaining the necessary grounds for processing their data. A user using a corporate email or Workspace should not assume that material in that environment is personal and inaccessible to the Organisation.

Where the Organisation and RIZZ TRADE have entered into a B2B order, administrator access, export, deletion, instructions, and data-subject requests are additionally governed by that order and the Business Data agreement. Cicora does not provide an administrator with more information than is permitted by the role, agreement, settings, and law.

5. Who receives data and when

We do not sell personal prompts, files, or outputs as a product and do not grant a third party the right to sell them merely because a user accepted this Policy. Each disclosure is limited by purpose and the recipient's legal role.

Data may be disclosed to these categories of recipients:

1. Model Providers and routing providers. They receive material necessary for the selected model or tool. Their separate conditions and material data characteristics are available in the Model and Policy Registry. 2. Technical suppliers. Hosting, storage, authentication, notifications, diagnostics, support, security, and similar suppliers may receive the minimum data required for their function. We use them under applicable agreements and law; their precise role depends on the actual service. 3. Payment participants and app stores. They receive information needed to process an operation, reconcile it, process a refund, or handle a dispute. The rules of the particular payment channel apply to that operation. 4. The Organisation and its administrators. For an Organisation Account/Workspace, to the extent of their lawful authority, role, settings, and agreement with Cicora. 5. Recipients selected by a user. For example, a public-link recipient or connected external service. The user is responsible for the chosen disclosure and respect for third-party rights. 6. Affiliates and successors. Only in connection with a reorganisation, asset transaction, financing, insolvency, or similar corporate event and subject to applicable notice, confidentiality, and data-protection obligations. 7. Authorities, courts, law enforcement, and other lawful recipients. Where disclosure is required by mandatory law, an enforceable request, or needed to protect rights, security, and prevent serious harm. Where law permits, we assess the request and notify the affected person or Organisation when notification does not create risk, violate law, or interfere with an investigation. 8. Recipients of de-identified or aggregated information. Only where data has actually been processed so it is not used for ordinary identification of a person and disclosure is consistent with law and the stated purpose.

The provider-terms directory does not replace information about actual data recipients. Information about the recipient for a particular request is disclosed through the relevant product, settings, and contractual documents; additional information may be requested at support@cicora.ai. The scope of disclosure follows applicable transparency duties, confidentiality, and security.

6. International processing and transfers

Data may be processed in Uzbekistan and in countries where the Model Providers, technical suppliers, or recipients selected by the user are actually located. The interface country, RIZZ TRADE's registration country, or document language does not identify every processing location.

Before an international transfer, Cicora applies the mechanism required by law: it assesses the parties' roles and the purpose of the transfer, uses contractual, organisational, or other permitted safeguards, and supplies separate disclosure or obtains consent where required. A general statement about international processing is not consent to every future transfer and does not replace consent that must be specific.

For corporate customers, an international-transfer mechanism, including a contractual addendum for the EEA, the United Kingdom, or Switzerland where required, is set out in the individual B2B agreement after the exporter, importer, data categories, countries, actual recipients, and applicable legal mechanism have been identified. A localisation or EU-only-processing regime applies only to a route for which it is expressly stated in the route card and agreement.

7. How long data is retained

We do not use one common retention period for all data. The period is determined by the purpose, feature setting, agreement, need to provide access/history, legal requirement, security, accounting, dispute, and ability to separate data from the person. Once the purpose ends, data is deleted, de-identified, or isolated unless further retention is required or permitted by law.

A Model Provider or external service may have its own retention period after lawful transmission of material to it. Cicora cannot state a single period on its behalf. The selected route's Registry information and the recipient's rules apply. Where a user seeks deletion at a third-party service, a separate request to that service may be needed; Cicora provides reasonable assistance within its role and agreement where applicable.

Confirmed Account deletion does not remove data that must be retained in a limited manner for billing, law, abuse prevention, security, an unresolved claim, or defence of rights. Such information is not used for ordinary personalisation, marketing, own general-model training, or restoring personal access without an independent lawful basis.

8. Security, incidents, and automated checks

We apply legal, organisational, and technical measures proportionate to risk: access is limited by business need; Accounts and systems are managed; functions and environments are separated where necessary; needed technical records are maintained; incidents are assessed; suppliers are reviewed; and authorised personnel are trained in applicable data-handling processes. A certification, particular encryption algorithm, data-centre country, or response period is an obligation of Cicora only where expressly stated in an applicable agreement, route card, or other published term.

No transmission or storage method guarantees absolute security. Users must protect their password and device, not share credentials, use official channels, and promptly report a suspected Account compromise to support@cicora.ai.

If we identify an incident that may affect Personal Data, we assess its nature and consequences, contain and investigate it, preserve available information, and notify the affected Organisation, individual, or supervisory authority where applicable law or agreement requires it. For corporate customer data, notification and assistance follow the applicable B2B agreement; timing follows applicable law, the agreement, and confirmed circumstances available about the incident.

Fraud, spam, malicious-code, control-bypass, and policy-violation protection may use automated signals and limited human review. This review serves security and compliance, rather than making a legally significant decision about a person. Where applicable law provides it, a user may request human review of a material Account restriction; law, security, and third-party rights can limit the information that may be disclosed.

9. Rights and data controls

Rights depend on the country of residence, user role, data nature, and applicable law. Where applicable, a user may request:

• confirmation of processing, access to data, and information about categories, sources, purposes, and recipients;
• correction of incomplete, inaccurate, or outdated data;
• deletion, de-identification, or cessation of processing where no continuing lawful basis exists;
• restriction of processing or objection to processing based on legitimate interest, including objection to direct marketing;
• portability of available data in an applicable and technically feasible format;
• withdrawal of consent for optional processing without affecting the lawfulness of earlier processing;
• information about international transfers to the extent law requires;
• review of a rights-request refusal and recourse to a competent data-protection authority or court where law provides that right.

To exercise a right, email support@cicora.ai with the subject “Cicora Data.” State the Account or another secure means of locating the record, the requested action, and a preferred response channel. Do not send a full card number, CVV, password, or bank code. We may request verification proportionate to the risk and authority so that data is not disclosed to another person. An authorised representative provides sufficient evidence of authority where law requires it and without creating an excessive barrier to the right.

We respond within the period set by applicable law. Where a request is complex, repetitive, concerns other persons' rights, protected commercial information, lawful retention, security, or Organisation materials, we may lawfully limit the response, request clarification, or extend the period, giving the reason where required. A refusal is not arbitrary; the user may seek review through the same contact. Exercising lawful privacy rights is not grounds for discrimination or degradation of the core service, except where processing is objectively necessary for the selected feature or law permits another result.

Regional supplements

EEA, United Kingdom, and Switzerland. Where GDPR, UK GDPR, Swiss law, or similar rules apply, a user may have rights of access, correction, deletion, restriction, objection, portability, and complaint to a competent authority. The legal bases used by Cicora appear in section 3. Requests are generally handled within one month after receipt of a request sufficient for verification; an extension is available only in circumstances provided by law and with notice. If a representative, DPO, or local supplement is required, it is made available before the relevant activity begins.

United States. A person covered by applicable state law may have rights to know/access, correct, delete, port data, act through an authorised agent, appeal a refusal, and opt out of sale, sharing, or targeted advertising as those terms are defined by that law. The application of a particular regime depends on state law and actual processing. Cicora does not use private prompts and attachments for third-party behavioural advertising. Where a particular regime requires a separate link, form, or Global Privacy Control handling, Cicora provides that mechanism for the relevant practice.

Republic of Korea. Where applicable Korean law applies, a user may have rights to access, correct, delete, suspend processing, withdraw consent, and receive information about overseas transfers to the extent set by law. Necessary local contact details and separate recipient disclosures are made available where required for Cicora's actual activity.

10. Children and age restrictions

The baseline age for Cicora is 13, but applicable law, selected model, country, app store, or feature can require a higher age. Where a particular route has a higher threshold, that threshold takes priority and access to that route is provided after the relevant condition is met. Cicora is not intended for a person under 13 without a lawful basis provided by law and a function that actually supports it.

Where a user has not reached the age at which they may independently accept the terms or give applicable consent, involvement of a parent or legal guardian is required. We do not ask a child to bypass an age restriction. A parent, representative, or other person who believes a child supplied data without the required basis may contact support@cicora.ai; we verify authority and review restriction or deletion under law, security, and applicable obligations.

11. Cookies, local storage, and data settings

On the public Cicora website, browser localStorage key cicora.site.locale retains only a language manually selected by the user until it is changed or site data are cleared. It does not operate in backend services, process Account or Request Materials, or enable analytics, advertising, or profiling. Other necessary technologies may be used for sign-in, session security, and basic settings where an enabled interface needs them. Optional analytics, advertising, personalisation, and similar technologies are governed by the Cookie Policy. That Policy also describes categories, the register of active technologies, ways to accept, reject, or change a choice, and rules for mobile SDKs/local storage.

Settings for history, memory, exports, deletion, feedback, external-service connections, and data use appear in Data Controls. Having that page does not mean every named control is already available: the interface and card of an enabled feature determine its specific control.

12. Changes, version, and contact

We update this Policy where the service, routes, actual processing practices, legal requirements, or user rights change. A new version is published with its date and version. For a material change in purposes, categories, recipients, rights, or method of processing, we give notice by the method required by law and agreement before it takes effect, unless an urgent change is caused by law, security, or abuse prevention. A new purpose that requires separate consent does not arise merely by publication of a new version.

The available language versions of this Policy are shown in the language selector. The language versions provide the same level of protection; no translation or technical link reduces mandatory user rights. For questions about data, security, a related model, international transfer, deletion, or rights, use support@cicora.ai or +998 90 051 48 40.