Data Protection Policy

This Data Protection Policy ("Policy") establishes the technical and organizational measures implemented by Hermes AI, S.A.P.I. de C.V., commercially known as IcloneU ("IcloneU" or "We"), to protect the personal data and Platform Data ("Data") that IcloneU collects, processes, stores, and transmits in the course of providing its artificial intelligence-powered social media management and customer service platform (the "Platform"). This Policy complements our Privacy Notice and applies to all IcloneU operations, systems, and personnel.

This Policy has been designed to meet the requirements of applicable data protection legislation, including the Federal Law on Protection of Personal Data Held by Private Parties (Mexico), the General Data Protection Regulation (GDPR), the EU AI Act 2025, applicable U.S. state privacy laws, and the data security requirements of social media platform providers including Meta Platforms, Inc.

1. Scope and Applicability

This Policy applies to all Data processed by IcloneU, including but not limited to:

• Personal data of IcloneU clients and their end users, including data received from social media platforms (collectively "Platform Data");
• Data of IcloneU's own personnel and contractors;
• Data processed by IcloneU on behalf of its clients in its capacity as data processor; and
• Data processed by third-party service providers acting on IcloneU's instructions.

This Policy applies to all IcloneU systems, infrastructure, personnel, and subprocessors who access or process Data in connection with IcloneU's operations.

2. Data Classification

IcloneU classifies Data into the following categories to ensure appropriate protection measures are applied:

3. Data Storage and Infrastructure Security

3.1 Hosting Infrastructure

All IcloneU Platform Data is hosted exclusively within Google Cloud Platform (GCP) under an Infrastructure as a Service (IaaS) model. The primary infrastructure components are:

• Compute: Google Compute Engine instances running Windows Server 2022, operating within a secured GCP project.
• Database: SQL Server hosted on GCP Compute Engine, with data encrypted at rest and in transit.
• Secret Management: Google Cloud Secret Manager for all API keys, OAuth credentials, and sensitive configuration data.
• Load Balancer: Google Cloud Application Load Balancer with managed TLS certificates and security policies.
• Application Framework: .NET Core 9 with Blazor Server-side rendering (SSR).

No Platform Data is stored outside of IcloneU's controlled GCP environment, except for data explicitly transferred to authorized third parties as described in Section 8 of this Policy.

3.2 Encryption at Rest

IcloneU implements industry-standard encryption for all Data stored at rest, using a dual-layer approach that exceeds baseline regulatory requirements:

• Database-Level Encryption (TDE): SQL Server Transparent Data Encryption with AES-256 algorithm protects all database files, transaction logs, and backups. The TDE certificate is stored separately in Google Cloud Secret Manager with Google Cloud KMS-managed keys.
• Column-Level Encryption (Always Encrypted): Sensitive Platform Data fields, including PlatformUserId and UserAccessToken columns, are protected with SQL Server Always Encrypted using the AEAD_AES_256_CBC_HMAC_SHA_256 algorithm. This ensures data remains encrypted even from privileged database administrators.
• Secret Manager Encryption: All API credentials and secrets stored in Google Cloud Secret Manager are automatically encrypted at rest with AES-256 via Google-managed KMS keys, with certificate and private key components stored in separate secrets.

3.3 Encryption in Transit

All Data transmitted over public networks is protected using TLS 1.2 or greater encryption:

• TLS Protocol Enforcement: TLS 1.2 and TLS 1.3 are enforced across all internet-facing services. SSL v2, SSL v3, TLS 1.0, and TLS 1.1 are disabled. Independently validated by Qualys SSL Labs with an overall security grade of A+.
• Certificate Management: Google-managed SSL certificates with automatic renewal deployed via Google Cloud Load Balancer.
• HTTP to HTTPS Redirection: All HTTP traffic is automatically redirected to HTTPS via 301 Permanent Redirect.
• HSTS: HTTP Strict Transport Security headers with max-age=31536000 including subdomains, preventing protocol downgrade attacks.
• Security Headers: Full suite including Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, and Permissions-Policy, validated at A+ grade.
• Internal Communications: All server-to-server communication takes place within the private network, which accepts no connections from the internet; all API calls to third-party services occur exclusively over HTTPS/TLS.

4. Access Control and Authentication

4.1 Multi-Factor Authentication

Administrative access to every system that processes Platform Data is tied to a corporate identity managed under a single organization on the icloneu.ai domain, with two-step verification enforced as a mandatory organization-level policy. No user can disable it or authenticate without it.

• Cloud infrastructure: All administrative access — web console, API, and command line — authenticates through those corporate identities under the mandatory two-step verification policy.
• Secret management: Access to platform secrets is authorized through the same corporate identities and IAM roles, and therefore inherits the same requirement. Application credentials are never stored in source code or in versioned configuration files.
• Source code repositories: Source code is held in private repositories with two-factor authentication enforced at the organization level; members without a second factor are automatically removed and cannot access the code.
• Remote server access: Servers do not expose the remote administration port to the internet — a default-deny rule applies to all sources. Access is exclusively through an identity-aware access proxy, which authenticates the corporate identity, with mandatory two-step verification, before establishing a tunnel to the server. Every session is recorded in immutable audit logs.
• Database: The database has no public exposure: no ingress rule permits connections to the database port from the internet, and it is reachable only from within the private network. Human access occurs exclusively from the production host, itself reachable only through the identity-aware access proxy under mandatory two-step verification. Database credentials are used solely by the application and are held in secret management.

4.2 Principle of Least Privilege

• Access to Data and systems is granted on a strict need-to-know basis, limited to the personnel whose function requires it.
• Service accounts operate with the minimum permissions required for their function.
• Role-based access control limits Platform Data access within the application to authorized business users only.

4.3 Network Security Controls

• No public administrative surface: Neither the remote administration port nor the database port accepts connections from the internet; a default-deny rule applies to all sources.
• Identity-aware access proxy: Administrative tunnels are established only after the corporate identity is authenticated with two-step verification, and each session is recorded.
• Firewall rules: VPC firewall rules enforce network segmentation and restrict access to authorized ranges and services.
• Load balancer security policies: The Google Cloud Application Load Balancer enforces security policies, DDoS protection, and CDN with security controls.

5. Data Flow and Processing

5.1 Platform Data Flow Architecture

IcloneU's Platform Data flows through the following controlled path:

• Ingress: Meta Graph API and WhatsApp Business API deliver data via HTTPS webhooks and OAuth 2.0 flows to IcloneU's GCP-hosted webhook endpoints and Graph API client.
• Processing: Data is processed server-side by the Blazor .NET Core 9 application servers within GCP Compute Engine. No Platform Data is processed client-side.
• Storage: Processed data is stored in the encrypted SQL Server database. Access tokens are stored with column-level encryption. API secrets are stored in Google Cloud Secret Manager. Knowledge-library content is additionally chunked, embedded, and stored in the managed vector database identified in Section 8.1, which holds both the embeddings and the indexed text of each chunk.
• AI Processing: Conversation content — the messages, comments, and voice notes exchanged on the channels the client connects, together with the client's knowledge-library content and the conversation context the Digital Clone needs in order to answer — is transmitted to IcloneU's AI providers for response generation, audio transcription, and semantic retrieval, in compliance with the EU AI Act 2025. Message content is transmitted as the end user wrote it: where an end user chooses to include Personal Data in a message — a name, a telephone number, an address — that data is transmitted together with the message. IcloneU does not transmit access tokens, OAuth secrets, credentials, or payment card data to any AI provider. Generated responses are stored in the database. Aggregated and anonymized behavioral patterns may be used to improve IcloneU's AI systems, without accessing individual user content or client-specific library data.
• Egress: Authorized responses are transmitted back to social media platforms via their respective APIs over HTTPS. Email addresses obtained via Facebook Login are transmitted to Stripe API solely for payment account creation.

5.2 No Client-Side Token Storage

• All Meta API interactions are routed exclusively through the server.
• No access tokens are written to log files, browser storage, or temporary locations.
• App Secrets are never embedded in client-side code or transmitted to browsers or mobile applications.
• OAuth flows are implemented with server-side secret handling throughout.

5.3 Data Minimization

• Only email addresses obtained via Facebook OAuth are transmitted to Stripe for payment processing.
• Transmissions to AI providers are limited to what the Digital Clone needs in order to produce a response: conversation content, the client's knowledge-library content, and the conversation context described in Section 5.1. Platform access tokens, OAuth secrets, credentials, and payment data are never transmitted to them.
• IcloneU does not filter or redact message bodies before transmitting them for AI processing. Message content therefore reaches AI providers as the end user wrote it, including any Personal Data the end user chose to include — see Section 8.3.
• No Platform Data is shared with analytics platforms, CRM systems, or business partners.
• All other Platform Data remains within IcloneU's GCP environment, save for the managed vector database in Section 8.1, which holds knowledge-library chunks on IcloneU's behalf.

6. Audit Logging and Monitoring

6.1 Audit Logging

• Immutable infrastructure logs: Google Cloud Audit Logs record administrative activity across the GCP project. They are written by Google Cloud infrastructure, cannot be modified or deleted by application code, and are retained under Google Cloud's managed retention for audit logs.
• Access monitoring: Access to log data is itself recorded in Cloud Audit Logs.
• Application logging: Application events are collected in IcloneU's centralized logging service, which is reachable only from within the production environment and is not exposed to the internet.

6.2 Event Coverage

The audit logging described above captures:

• Administrative and system events: administrative access to the GCP project, service-account activity, elevated permission usage, configuration changes, and access to Google Cloud Secret Manager, each recorded with timestamp and identity.
• Remote access sessions: every administrative session established through the identity-aware access proxy described in Section 4.
• Application events: application-level activity recorded in the centralized logging service, including errors, integration calls, and processing outcomes.

IcloneU does not currently operate statement-level auditing of database queries. Database access is instead constrained by the network and identity controls in Section 4, which prevent any connection to the database from outside the production environment.

6.3 Control of Egress Destinations

The external destinations to which Platform Data may be sent are fixed by the application's configuration and enumerated in Section 8.1. IcloneU maintains an automated check in its build pipeline that fails when a provider is reachable from the code without a corresponding entry in Section 8.1, so a new destination cannot ship without this Policy being updated in the same change.

IcloneU does not currently operate network-level egress anomaly detection, nor automated alerting on transfers to destinations outside that set. The control described above is preventive rather than detective.

7. Meta App Secret and API Access Token Protection

7.1 App Secret Protection

Meta App Secrets and all related credentials are stored exclusively in Google Cloud Secret Manager with AES-256 encryption at rest. App Secrets are never exposed to client applications, not embedded in distributed code, and not returned in any network response to browsers or mobile apps.

7.2 API Access Token Protection

• User Access Tokens: Stored in Hermes.dbo.PlatformConnection.UserAccessToken column, protected with SQL Server Always Encrypted (AEAD_AES_256_CBC_HMAC_SHA_256) plus database-level TDE.
• Page Access Tokens: Stored in Hermes.dbo.AssistedAccount.AccessToken column with identical dual-layer encryption protection.
• Refresh Tokens: Protected with the same Always Encrypted configuration as access tokens.

All access tokens are processed exclusively server-side and never stored on client devices or written to log files.

8. Third-Party Service Providers

8.1 Authorized Data Sharing

AI providers process this content solely to return a result to IcloneU. IcloneU selects and configures its AI providers so that Platform Data is not used to train their models, and does not authorize any provider to use Platform Data for any purpose other than providing its service to IcloneU. Where a provider's terms would otherwise permit such use, IcloneU exercises the opt-out that provider makes available, or does not route Platform Data to it. Retention at each provider is limited to what that provider's terms allow for processing the request and for abuse monitoring.

The table above is a complete list of every provider to which IcloneU may route Platform Data, not a snapshot of a particular day's configuration. IcloneU selects among the listed providers according to the task, the language, the model best suited to a request, and provider availability; a given account's traffic may reach some of them and not others. Because every provider IcloneU may use is already named here, changing which of them handles a request is not the engagement of a new subprocessor for purposes of Section 13.3 of the Terms of Use. Adding a provider that does not appear in this table is, and follows the notice procedure set out in that Section.

8.2 Service Provider Requirements

All service providers processing Platform Data on IcloneU's behalf must:

• Process data solely at IcloneU's direction for the specified purpose;
• Comply with applicable Platform Terms and data protection legislation;
• Implement appropriate technical and organizational security measures;
• Delete data immediately upon termination of services; and
• Provide proof of compliance upon request.

8.3 Personal Data Contained in Conversation Content

End users write freely to the channels a client connects. IcloneU neither controls nor attempts to predict what an end user chooses to include in a message: a message may contain a name, a telephone number, an address, an order reference, or any other Personal Data. That content is transmitted to the AI providers listed in Section 8.1 as part of ordinary response generation.

IcloneU therefore does not represent that content transmitted for AI processing is free of Personal Data, and does not currently offer automatic detection or redaction of Personal Data within message bodies. What IcloneU does commit to is the following:

• Only the content and context needed to generate a response is transmitted, as described in Sections 5.1 and 5.3;
• Structured credentials held by IcloneU that are not needed to generate a response — access tokens, OAuth secrets, credentials, and payment data — are never transmitted to AI providers;
• AI providers act as subprocessors under contract, and IcloneU configures each of them so that the content is not used to train their models — exercising the opt-out a provider makes available, or not routing content to that provider — and authorizes none of them to use it for any purpose other than returning a result to IcloneU;
• Contact records maintained on a client's behalf — described in Section 12 of the Privacy Policy — remain within IcloneU's environment. What is transmitted for AI processing is limited to the conversation context described in Section 5.1, together with any contact field the client itself chooses to include in a prompt, automation, or message template it configures;
• Content transmitted for AI processing is subject to the retention and deletion rules in Section 9, including deletion on account closure; and
• The client, as data controller for its own end users, remains responsible for informing those end users that their messages are processed by artificial intelligence, as set out in the AI Use Policy.

9. Data Retention and Deletion

9.1 General Retention Principles

IcloneU retains Data only for as long as necessary to fulfill the purposes for which it was collected, or as required by law. Data is deleted:

• When it is no longer necessary for the declared business purpose;
• When the product or service through which it was collected ceases to operate;
• Upon request of the data subject (subject to applicable legal requirements);
• Upon account closure;
• As required by applicable law or competent authority; or
• When a social media platform requests deletion for user protection.

9.2 Platform Data Specific Requirements

• Upon termination of access to the relevant social media platform APIs;
• When platform APIs, permissions, or features are unused for 28 or more consecutive days;
• Immediately upon account deletion by the user; and
• No temporary caching of Platform Data occurs; no API request/response logging for Platform Data is performed.

9.3 Backup and Log Retention

Database backups are retained in accordance with operational and legal requirements. Google Cloud Audit Logs are retained under Google Cloud's managed retention for audit logs; application logs in the centralized logging service are retained in accordance with operational requirements. Backup files are subject to the same encryption controls as production data.

10. Incident Response

10.1 Security Vulnerability Reporting

IcloneU maintains a security vulnerability reporting system. Security incidents or vulnerabilities may be reported to: wecare@icloneu.ai.

10.2 Incident Response Procedures

In the event of a suspected or confirmed security incident involving Platform Data, IcloneU will:

11. International Data Transfers

11.1 EEA Data Transfers

For transfers of data from Ireland controlled by social media platforms to territories outside the European Economic Area without European Commission adequacy decisions, IcloneU complies with Standard Contractual Clauses (Module One — controller to controller transfers) as specified in European Commission Decision (EU) 2021/914. IcloneU acts as the data importer; the relevant social media platforms in Ireland are the data exporters. The competent supervisory authority is the Data Protection Commission in Ireland.

11.2 UK Data Transfers

For transfers of UK data controlled by social media platforms subject to UK GDPR to territories without UK adequacy decisions, IcloneU complies with the International Data Transfer Addendum to the EU Standard Contractual Clauses as approved by the UK Information Commissioner.

12. Compliance Monitoring and Audit

12.1 Internal Audits

• Monthly Reviews: Platform Data transfer pattern analysis, monitoring system effectiveness evaluation, alert threshold optimization, and security control validation.
• Quarterly Audits: Complete data flow diagram updates, third-party integration security assessments, penetration testing of transfer monitoring systems, and compliance gap analysis.
• Annual Reviews: Comprehensive review of this Policy, encryption key rotation, and assessment of new legal and regulatory requirements including updates to the EU AI Act and applicable state privacy laws.

12.2 External Audits

IcloneU acknowledges and agrees to social media platform audit rights:

• Platforms or their designated third-party auditors may conduct compliance audits up to once per calendar year.
• Additional audits are permitted when violations, legal requirements, change of control, or other necessary conditions exist.
• IcloneU will provide at least 10 business days' notice for scheduled audits unless immediate access is required.
• IcloneU will provide full cooperation, including physical and remote access to IT systems and records.
• Any non-compliance identified will be remedied as soon as reasonably practicable.
• Platform audit rights survive termination of platform access until one year after IcloneU demonstrates cessation of all Platform Data processing and deletion of all Platform Data.

12.3 Certifications

IcloneU provides requested certifications regarding compliance with applicable Platform Terms. All certifications are provided by authorized company representatives and are supported by documentation maintained for verification.

13. Personnel and Training

IcloneU ensures that all personnel with access to Data are subject to appropriate obligations of confidentiality and receive regular security awareness training. Access to production systems and Platform Data is restricted to personnel who require it for their specific role and who have acknowledged their data protection responsibilities.

Security awareness training is conducted at the following minimum frequency and covers the following topics:

• Frequency: At least once per year for all personnel with access to Platform Data, and upon onboarding for new team members.
• Platform Data handling: Correct procedures for processing, storing and transmitting Platform Data in accordance with this Policy.
• Incident response: How to identify, report and respond to security incidents, including the 72-hour notification requirement.
• Phishing and social engineering: Recognition and prevention of phishing attacks and social engineering attempts.
• Access control: Correct use of MFA, password management, and least privilege principles.
• EU AI Act compliance: Obligations related to the use of AI systems in data processing, including data minimization and transparency requirements.

Responsible party: The Chief Technology Officer (Javier Bertran) is responsible for ensuring security training is delivered, documented, and kept current with evolving threat landscapes and regulatory requirements.

14. Changes to This Policy

IcloneU reserves the right to modify this Policy at any time to reflect changes in our data protection practices, applicable legal requirements, or the requirements of social media platform partners. Material changes will be communicated to clients with at least 30 days' prior notice via email or Platform notification. Continued use of the Platform after such notice constitutes acceptance of the updated Policy.

15. Contact Information

Privacy Officer / Data Protection Contact

• Email: wecare@icloneu.ai · Subject: Data Protection Policy Inquiry
• Address: Hermes AI, S.A.P.I. de C.V., Calle Corbeta 21, Colonia Lomas del Chamizal, Cuajimalpa de Morelos, C.P. 05129, Mexico City, Mexico

For technical security matters, including reporting security vulnerabilities:

• Chief Technology Officer: Javier Bertran
• Email: privacy@icloneu.ai