Data Protection Policy

This Data Protection Policy ("Policy") establishes the technical and organizational measures implemented by Hermes AI, S.A.P.I. de C.V., commercially known as IcloneU ("IcloneU" or "We"), to protect the personal data and Platform Data ("Data") that IcloneU collects, processes, stores, and transmits in the course of providing its artificial intelligence-powered social media management and customer service platform (the "Platform"). This Policy complements our Privacy Notice and applies to all IcloneU operations, systems, and personnel.

This Policy has been designed to meet the requirements of applicable data protection legislation, including the Federal Law on Protection of Personal Data Held by Private Parties (Mexico), the General Data Protection Regulation (GDPR), the EU AI Act 2025, applicable U.S. state privacy laws, and the data security requirements of social media platform providers including Meta Platforms, Inc.

1. Scope and Applicability

This Policy applies to all Data processed by IcloneU, including but not limited to:

• Personal data of IcloneU clients and their end users, including data received from social media platforms (collectively "Platform Data");
• Data of IcloneU's own personnel and contractors;
• Data processed by IcloneU on behalf of its clients in its capacity as data processor; and
• Data processed by third-party service providers acting on IcloneU's instructions.

This Policy applies to all IcloneU systems, infrastructure, personnel, and subprocessors who access or process Data in connection with IcloneU's operations.

2. Data Classification

IcloneU classifies Data into the following categories to ensure appropriate protection measures are applied:

3. Data Storage and Infrastructure Security

3.1 Hosting Infrastructure

All IcloneU Platform Data is hosted exclusively within Google Cloud Platform (GCP) under an Infrastructure as a Service (IaaS) model. The primary infrastructure components are:

• Compute: Google Compute Engine instances running Windows Server 2022, operating within a secured GCP project.
• Database: SQL Server hosted on GCP Compute Engine, with data encrypted at rest and in transit.
• Secret Management: Google Cloud Secret Manager for all API keys, OAuth credentials, and sensitive configuration data.
• Load Balancer: Google Cloud Application Load Balancer with managed TLS certificates and security policies.
• Application Framework: .NET Core 9 with Blazor Server-side rendering (SSR).

No Platform Data is stored outside of IcloneU's controlled GCP environment, except for data explicitly transferred to authorized third parties as described in Section 8 of this Policy.

3.2 Encryption at Rest

IcloneU implements industry-standard encryption for all Data stored at rest, using a dual-layer approach that exceeds baseline regulatory requirements:

• Database-Level Encryption (TDE): SQL Server Transparent Data Encryption with AES-256 algorithm protects all database files, transaction logs, and backups. The TDE certificate is stored separately in Google Cloud Secret Manager with Google Cloud KMS-managed keys.
• Column-Level Encryption (Always Encrypted): Sensitive Platform Data fields, including PlatformUserId and UserAccessToken columns, are protected with SQL Server Always Encrypted using the AEAD_AES_256_CBC_HMAC_SHA_256 algorithm. This ensures data remains encrypted even from privileged database administrators.
• Secret Manager Encryption: All API credentials and secrets stored in Google Cloud Secret Manager are automatically encrypted at rest with AES-256 via Google-managed KMS keys, with certificate and private key components stored in separate secrets.

3.3 Encryption in Transit

All Data transmitted over public networks is protected using TLS 1.2 or greater encryption:

• TLS Protocol Enforcement: TLS 1.2 and TLS 1.3 are enforced across all internet-facing services. SSL v2, SSL v3, TLS 1.0, and TLS 1.1 are disabled. Independently validated by Qualys SSL Labs with an overall security grade of A+.
• Certificate Management: Google-managed SSL certificates with automatic renewal deployed via Google Cloud Load Balancer.
• HTTP to HTTPS Redirection: All HTTP traffic is automatically redirected to HTTPS via 301 Permanent Redirect.
• HSTS: HTTP Strict Transport Security headers with max-age=31536000 including subdomains, preventing protocol downgrade attacks.
• Security Headers: Full suite including Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, and Permissions-Policy, validated at A+ grade.
• Internal Communications: All server-to-server communications use encrypted SQL connections over WireGuard VPN; all API calls to third-party services occur exclusively over HTTPS/TLS.

4. Access Control and Authentication

4.1 Multi-Factor Authentication (MFA)

IcloneU enforces mandatory multi-factor authentication across all remote access points to systems processing Platform Data:

4.2 Principle of Least Privilege

Access to Data and systems is granted on a strict need-to-know basis:

• Only 2 administrators hold credentials to the GCP production project.
• Database access is restricted exclusively to authorized DBAs via WireGuard VPN.
• Remote Desktop access is limited to a single designated administrator.
• Service accounts operate under workload identity federation with no static credentials and minimum required permissions.
• Role-based access control (RBAC) limits Platform Data access within the application to authorized business users only.

4.3 Network Security Controls

• WireGuard VPN: Database server access requires authenticated WireGuard VPN tunnels using Curve25519 cryptographic key pairs. The database is completely unreachable from the internet without a valid pre-authorized cryptographic connection.
• IP-Restricted RDP: Remote Desktop Protocol access is restricted via GCP firewall rules to a single authorized IP address.
• GCP Firewall Rules: VPC firewall rules enforce network segmentation and restrict access to authorized IP ranges and services.
• Load Balancer Security Policies: The Google Cloud Application Load Balancer enforces security policies, DDoS protection, and CDN with security controls.

5. Data Flow and Processing

5.1 Platform Data Flow Architecture

IcloneU's Platform Data flows through the following controlled path:

• Ingress: Meta Graph API and WhatsApp Business API deliver data via HTTPS webhooks and OAuth 2.0 flows to IcloneU's GCP-hosted webhook endpoints and Graph API client.
• Processing: Data is processed server-side by the Blazor .NET Core 9 application servers within GCP Compute Engine. No Platform Data is processed client-side.
• Storage: Processed data is stored in the encrypted SQL Server database. Access tokens are stored with column-level encryption. API secrets are stored in Google Cloud Secret Manager.
• AI Processing: Message and comment content only (no PII) is transmitted to OpenAI API for AI-powered response generation, in compliance with the EU AI Act 2025. Generated responses are stored in the database. Aggregated and anonymized behavioral patterns may be used to improve IcloneU's AI systems, without accessing individual user content or client-specific library data.
• Egress: Authorized responses are transmitted back to social media platforms via their respective APIs over HTTPS. Email addresses obtained via Facebook Login are transmitted to Stripe API solely for payment account creation.

5.2 No Client-Side Token Storage

• All Meta API interactions are routed exclusively through the server.
• No access tokens are written to log files, browser storage, or temporary locations.
• App Secrets are never embedded in client-side code or transmitted to browsers or mobile applications.
• OAuth flows are implemented with server-side secret handling throughout.

5.3 Data Minimization

• Only email addresses obtained via Facebook OAuth are transmitted to Stripe for payment processing.
• Only message and comment content (no user PII) is transmitted to OpenAI API.
• No Platform Data is shared with analytics platforms, CRM systems, or business partners.
• All other Platform Data remains exclusively within IcloneU's GCP environment.

6. Audit Logging and Monitoring

6.1 Tamper-Resistant Audit Logging

• Immutable Logs: Google Cloud Audit Logs are write-only and cannot be modified or deleted by application code.
• Cryptographic Integrity: All logs are cryptographically signed by Google Cloud infrastructure.
• Centralized Repository: All audit events are aggregated in Google Cloud Logging and retained for a minimum of 90 days (configurable up to 3,653 days).
• Access Monitoring: Any access to log data is itself logged in Cloud Audit Logs.

6.2 Event Coverage

The audit logging system captures:

• Database Access Events: User authentication, SQL queries against Platform Data tables, connection events, and failed authentication attempts.
• Application-Level Events: API calls retrieving Platform Data, user sessions, data processing operations, email transmissions to Stripe, and administrative actions.
• System-Level Events: Service account activities, elevated permission usage, configuration changes, and network access to Platform Data repositories.
• Secret Access Events: All Google Cloud Secret Manager access events, logged with timestamp, user identity, and action performed.

6.3 Transfer Monitoring

• VPC Flow Logs monitor all egress traffic from Platform Data processing services.
• Automated whitelist monitoring triggers immediate alerts for any Platform Data transfer to non-authorized destinations.
• Volume and timing anomaly detection flags unusual data transfers.
• Critical alerts trigger an automated response within 15 minutes, including immediate blocking of unauthorized transfer attempts.

7. Meta App Secret and API Access Token Protection

7.1 App Secret Protection

Meta App Secrets and all related credentials are stored exclusively in Google Cloud Secret Manager with AES-256 encryption at rest. App Secrets are never exposed to client applications, not embedded in distributed code, and not returned in any network response to browsers or mobile apps.

7.2 API Access Token Protection

• User Access Tokens: Stored in Hermes.dbo.PlatformConnection.UserAccessToken column, protected with SQL Server Always Encrypted (AEAD_AES_256_CBC_HMAC_SHA_256) plus database-level TDE.
• Page Access Tokens: Stored in Hermes.dbo.AssistedAccount.AccessToken column with identical dual-layer encryption protection.
• Refresh Tokens: Protected with the same Always Encrypted configuration as access tokens.

All access tokens are processed exclusively server-side and never stored on client devices or written to log files.

8. Third-Party Service Providers

8.1 Authorized Data Sharing

8.2 Service Provider Requirements

All service providers processing Platform Data on IcloneU's behalf must:

• Process data solely at IcloneU's direction for the specified purpose;
• Comply with applicable Platform Terms and data protection legislation;
• Implement appropriate technical and organizational security measures;
• Delete data immediately upon termination of services; and
• Provide proof of compliance upon request.

9. Data Retention and Deletion

9.1 General Retention Principles

IcloneU retains Data only for as long as necessary to fulfill the purposes for which it was collected, or as required by law. Data is deleted:

• When it is no longer necessary for the declared business purpose;
• When the product or service through which it was collected ceases to operate;
• Upon request of the data subject (subject to applicable legal requirements);
• Upon account closure;
• As required by applicable law or competent authority; or
• When a social media platform requests deletion for user protection.

9.2 Platform Data Specific Requirements

• Upon termination of access to the relevant social media platform APIs;
• When platform APIs, permissions, or features are unused for 28 or more consecutive days;
• Immediately upon account deletion by the user; and
• No temporary caching of Platform Data occurs; no API request/response logging for Platform Data is performed.

9.3 Backup and Log Retention

Database backups are retained in accordance with operational and legal requirements. Audit logs are retained for a minimum of 90 days, with extended retention configurable up to 3,653 days. Backup files are subject to the same encryption controls as production data.

10. Incident Response

10.1 Security Vulnerability Reporting

IcloneU maintains a security vulnerability reporting system. Security incidents or vulnerabilities may be reported to: wecare@icloneu.ai.

10.2 Incident Response Procedures

In the event of a suspected or confirmed security incident involving Platform Data, IcloneU will:

11. International Data Transfers

11.1 EEA Data Transfers

For transfers of data from Ireland controlled by social media platforms to territories outside the European Economic Area without European Commission adequacy decisions, IcloneU complies with Standard Contractual Clauses (Module One — controller to controller transfers) as specified in European Commission Decision (EU) 2021/914. IcloneU acts as the data importer; the relevant social media platforms in Ireland are the data exporters. The competent supervisory authority is the Data Protection Commission in Ireland.

11.2 UK Data Transfers

For transfers of UK data controlled by social media platforms subject to UK GDPR to territories without UK adequacy decisions, IcloneU complies with the International Data Transfer Addendum to the EU Standard Contractual Clauses as approved by the UK Information Commissioner.

12. Compliance Monitoring and Audit

12.1 Internal Audits

• Monthly Reviews: Platform Data transfer pattern analysis, monitoring system effectiveness evaluation, alert threshold optimization, and security control validation.
• Quarterly Audits: Complete data flow diagram updates, third-party integration security assessments, penetration testing of transfer monitoring systems, and compliance gap analysis.
• Annual Reviews: Comprehensive review of this Policy, encryption key rotation, and assessment of new legal and regulatory requirements including updates to the EU AI Act and applicable state privacy laws.

12.2 External Audits

IcloneU acknowledges and agrees to social media platform audit rights:

• Platforms or their designated third-party auditors may conduct compliance audits up to once per calendar year.
• Additional audits are permitted when violations, legal requirements, change of control, or other necessary conditions exist.
• IcloneU will provide at least 10 business days' notice for scheduled audits unless immediate access is required.
• IcloneU will provide full cooperation, including physical and remote access to IT systems and records.
• Any non-compliance identified will be remedied as soon as reasonably practicable.
• Platform audit rights survive termination of platform access until one year after IcloneU demonstrates cessation of all Platform Data processing and deletion of all Platform Data.

12.3 Certifications

IcloneU provides requested certifications regarding compliance with applicable Platform Terms. All certifications are provided by authorized company representatives and are supported by documentation maintained for verification.

13. Personnel and Training

IcloneU ensures that all personnel with access to Data are subject to appropriate obligations of confidentiality and receive regular security awareness training. Access to production systems and Platform Data is restricted to personnel who require it for their specific role and who have acknowledged their data protection responsibilities.

Security awareness training is conducted at the following minimum frequency and covers the following topics:

• Frequency: At least once per year for all personnel with access to Platform Data, and upon onboarding for new team members.
• Platform Data handling: Correct procedures for processing, storing and transmitting Platform Data in accordance with this Policy.
• Incident response: How to identify, report and respond to security incidents, including the 72-hour notification requirement.
• Phishing and social engineering: Recognition and prevention of phishing attacks and social engineering attempts.
• Access control: Correct use of MFA, password management, and least privilege principles.
• EU AI Act compliance: Obligations related to the use of AI systems in data processing, including data minimization and transparency requirements.

Responsible party: The Chief Technology Officer (Javier Bertran) is responsible for ensuring security training is delivered, documented, and kept current with evolving threat landscapes and regulatory requirements.

14. Changes to This Policy

IcloneU reserves the right to modify this Policy at any time to reflect changes in our data protection practices, applicable legal requirements, or the requirements of social media platform partners. Material changes will be communicated to clients with at least 30 days' prior notice via email or Platform notification. Continued use of the Platform after such notice constitutes acceptance of the updated Policy.

15. Contact Information

Privacy Officer / Data Protection Contact

• Email: wecare@icloneu.ai · Subject: Data Protection Policy Inquiry
• Address: Hermes AI, S.A.P.I. de C.V., Calle Corbeta 21, Colonia Lomas del Chamizal, Cuajimalpa de Morelos, C.P. 05129, Mexico City, Mexico

For technical security matters, including reporting security vulnerabilities:

• Chief Technology Officer: Javier Bertran
• Email: privacy@icloneu.ai