AI Ethics & Responsible Use Policy

PerplexAI.net
Effective Date: 14 August 2026
Last Updated: 14 August 2026

PerplexAI.net is an AI-services platform operated by Webnatics LTD. PerplexAI operates from Cyprus and is committed to processing personal data in accordance with the General Data Protection Regulation (EU) 2016/679 (“GDPR”) and applicable Cyprus data-protection requirements.

This page summarises our GDPR approach. Our Privacy Policy provides more detailed information about the personal data we collect, use, retain, share and protect.

1. Who GDPR Protections Apply To

GDPR protections apply to eligible individuals whose personal data is processed by PerplexAI, including website visitors, account holders, customers, business contacts, voice owners and others whose information may be submitted through the Services. Personal data may include account details, contact information, IP and device information, scripts, prompts, uploaded audio, voice recordings, voice samples, generated audio, custom-voice data, usage information, diagnostic data, transaction records and support communications.

2. Our Role: Controller and Processor

PerplexAI acts as a data controller when we decide the purposes and means of processing personal data for our own operations, such as website administration, account management, billing, security, fraud prevention, support, analytics, legal compliance and communications.

Where applicable, PerplexAI may act as a data processor when a business customer asks us to process scripts, audio, voice data or other personal data on its behalf and under its documented instructions. Enterprise and business customers may require a separate Data Processing Agreement (DPA) that defines the parties’ respective obligations.

3. GDPR Principles

We aim to process personal data in accordance with these GDPR principles:

• Lawfulness, fairness and transparency: we use data on a valid legal basis and explain our practices clearly.
• Purpose limitation: we use data for specified and legitimate purposes.
• Data minimisation: we collect and use only the data reasonably necessary for the relevant purpose.
• Accuracy: we take reasonable steps to keep data accurate and allow correction where appropriate.
• Storage limitation: we retain data only for as long as necessary or legally required.
• Integrity and confidentiality: we protect data with appropriate security measures.
• Accountability: we maintain responsibility for our data-protection obligations.

4. Lawful Bases for Processing

Depending on the processing activity, we may rely on one or more of the following GDPR legal bases:

• Contract: to create and administer an account, provide AI voice and text-to-speech services, process payment and deliver requested features.
• Consent: for optional cookies, direct marketing and specific voice-data processing where consent is required.
• Legal obligation: to meet tax, accounting, regulatory, court-order or other legal requirements.
• Legitimate interests: to secure our platform, prevent fraud and misuse, administer and improve services, protect users and establish, exercise or defend legal claims, where those interests do not override your rights.

Where special-category or biometric data is processed, we apply an appropriate additional GDPR condition where required.

5. Voice and Biometric Data

PerplexAI may process voice recordings, uploaded audio and voice samples where a user requests voice generation, custom voice creation, voice cloning or similar functionality. Not every audio recording is biometric data. Voice data may be biometric or special-category data only where it is processed by specific technical means for the purpose of uniquely identifying a natural person. PerplexAI does not use voice information to identify or authenticate an individual unless that purpose is expressly stated for a specific feature.

Where custom-voice technology creates technical representations, such as embeddings, we apply appropriate safeguards. Users must have the necessary rights, permissions, consent and lawful authority to submit or use another person’s voice. Where explicit consent is required, we will seek it. A user may withdraw applicable consent and request deletion of voice samples or custom-voice assets, subject to lawful retention needs and technical feasibility.

6. Your GDPR Rights

Subject to applicable conditions, you may have the right to:

• Request access to your personal data.
• Correct inaccurate or incomplete personal data.
• Request erasure of eligible personal data.
• Request restriction of certain processing.
• Object to certain processing, including direct marketing and some legitimate-interest processing.
• Receive eligible data in a portable format.
• Withdraw consent where processing relies on consent.
• Request information about certain automated decision-making.
• Lodge a complaint with a competent data-protection supervisory authority.

7. How to Exercise Your Rights

To submit a GDPR request, email support@staging.boutiqueq.com. Please provide your account email address or other information that allows us to identify the relevant account and request. Do not send unnecessary sensitive information. We may request reasonable identity verification to protect your data and prevent unauthorised requests. We generally respond to GDPR requests within one month of receipt. Where legally permitted, we may extend this period for complex or numerous requests and will notify you where required.

We may refuse or limit a request only where allowed by law, for example where we cannot verify identity, a legal retention obligation applies, another person’s rights would be affected or the request is manifestly unfounded or excessive. We will explain the outcome and available next steps where required.

8. Data Retention and Deletion

We retain personal data only for as long as necessary for the relevant purpose, including service delivery, security, contractual requirements and legal obligations. Different periods may apply to accounts, AI projects, scripts, voice samples, uploaded audio, generated audio, transaction records, support communications and security logs.

You may request deletion where GDPR gives you that right. Certain information may need to be retained for tax, accounting, fraud prevention, security, legal claims or other lawful purposes. Please see our Account & Data Deletion Policy for information about account, project, voice-sample and custom-voice deletion.

9. International Transfers

PerplexAI may use AI, cloud, hosting, analytics, payments, support and infrastructure providers operating outside Cyprus or the European Economic Area (EEA). Where personal data is transferred outside the EEA, we use an appropriate GDPR transfer mechanism where required, such as:

• A European Commission adequacy decision.
• Standard Contractual Clauses.
• Appropriate supplementary technical, contractual or organisational safeguards.

Further information about international transfers is available in our Privacy Policy.

10. Third-Party Processors and Sub-Processors

We may use third-party providers for AI voice processing, cloud hosting, storage, payments, authentication, analytics, customer support, communications and security. We disclose data only where reasonably necessary for authorised functions.

Where GDPR requires it, we maintain appropriate data-processing agreements with processors and ensure that sub-processors are handled under appropriate data-protection arrangements.

11. Data Security

We use reasonable technical and organisational safeguards designed to protect personal data. These may include encryption in transit and, where appropriate, at rest; access controls; secure authentication; infrastructure safeguards; logging and monitoring; data minimisation; backup protection; restricted internal access; vulnerability management and incident-response procedures.

No online service can guarantee absolute security. We continually assess and improve security measures according to risk and the nature of our Services.

12. Personal Data Breaches

If we suspect a personal-data breach, we assess the incident, contain and investigate it, and document the relevant facts and response. Where required by GDPR, we notify the competent supervisory authority without undue delay and notify affected individuals where a breach is likely to result in a high risk to their rights and freedoms.

13. Cookies and Consent

PerplexAI uses essential cookies and may use optional analytics, preference or marketing cookies. Where required, non-essential cookies are not activated before valid consent is obtained. Users can accept, reject or manage optional cookie categories and withdraw consent through the relevant cookie-preference tool. Please see our Cookie Policy for further details.

14. AI Processing and Automated Decisions

Our AI systems process scripts, prompts, voice samples, uploaded audio and selected settings to provide requested voice-generation and text-to-speech services. We may use automated safety and fraud-prevention checks to identify prohibited use, technical errors or suspicious activity.

PerplexAI does not use automated processing to make decisions that produce legal or similarly significant effects about an individual without appropriate safeguards and information required by law. Our Privacy Policy and relevant feature notices explain whether user content is used to train, evaluate or improve AI systems and whether an opt-out is available.

15. Data Protection by Design and Default

We aim to build privacy into the design and operation of PerplexAI. This includes collecting only necessary data, limiting internal access, using appropriate default privacy settings, applying secure development practices, reviewing new AI features for privacy risks and conducting a Data Protection Impact Assessment (DPIA) where legally required.

16. Updates to GDPR Practices

We may update this page when laws, AI technologies, processing activities, providers or platform features change. The Last Updated date will be revised when material changes are made. Where required, we will provide additional notice or seek consent before processing data for a new purpose.

17. Contact Us

For GDPR requests, privacy questions, voice-data concerns, consent withdrawal, data access, correction, portability or deletion requests, contact:

Company Name: Webnatics LTD
Website: https://staging.boutiqueq.com
Support Email: support@staging.boutiqueq.com
Info Email: info@staging.boutiqueq.com
Address: Voukourestiou 25, 3045 Limassol, Cyprus