GNSAI Data Protection Policy
資料保護政策

1. Scope of Policy

This policy is an addendum to the Privacy Policy that encompasses all services provided by Gamenoodlesoup Limited, for which can be accessed at https://gamenoodlesoup.com/privacy. This Data Protection Policy will supersede the general Privacy Policy for where the purposes of the terms did overlap.

This policy applies to all users of the GNSAI services (including but not limited to GNSAI Platform at https://chat.ai.gns.hk, GNSAI Maths https://maths.ai.gns.hk, GNSAI Flow https://flow.ai.gns.hk, and the accompanying GNSAI mobile applications), published by Gamenoodlesoup and under the domain name of ai.gns.hk.

It governs the treatment of personal data and organisational data processed by our AI models, including text inputs, generated outputs, user interactions, and system metadata.

2. Organisational Data Boundary Principle

Our foundational privacy commitment is strict data isolation.

• Data Isolation: All data inputted, processed, and generated by users belonging to a specific organisation on the GNSAI platform is strictly segregated and remains securely within that organisation's defined environment.
• No Cross-organisational Sharing: Data from one organisation will never be shared with, accessible to, or used to train AI models for any other organisation or external entity.
• Model Training: Your organisational data is not used to train our base AI models for general use. Any customized model training or fine-tuning utilizing your data is restricted to your organisation's exclusive instance and benefit.

3. Exceptions for Maintenance and Debugging

While we strictly enforce organisational data boundaries, limited access by authorised GNSAI personnel may be required for essential platform operations.

• System Maintenance: Our engineering team may access system logs and anonymized usage metrics to monitor platform health, ensure uptime, and perform necessary updates.
• Debugging and Support: In the event of a technical issue or user-reported error, authorized personnel may temporarily access specific data instances to diagnose and resolve the problem.
• Strict Controls: This access is heavily restricted, logged, and granted only on a need-to-know basis to personnel bound by strict confidentiality agreements. Data accessed for debugging will not be retained longer than necessary to resolve the issue.

4. Data Security Measures

We employ robust technical and organisational security measures to protect your data against unauthorized or accidental access, processing, erasure, loss, or use.

• Encryption: Data is encrypted both in transit and at rest.
• Access Controls: We utilize multi-factor authentication, role-based access control (RBAC), and regular security audits to ensure only authorized users within your organisation can access your data.

5. Data Retention and Account Deletion

We do not keep personal data longer than is necessary to fulfill the purpose for which it is used. Your organisation retains full control over its data lifecycle under the following terms:

• Active Accounts: Data is retained as long as your organisation maintains an active account with GNSAI.
• 180-Day Inactivity Deletion: Organisations that remain completely inactive for a period of 180 consecutive days will be subject to automatic deletion. Upon this deletion, all associated organisational data, user inputs, and customised models will be securely and permanently erased from our systems. (Completely inactive organisation means the organisation is not under an active paid plan, not in a trial and not being actively engaged with our sales personnel.)
• Voluntary Deletion: Upon written request or account termination, we will securely delete all organisational data in accordance with our internal data destruction protocols.

6. User Rights

As a data subject, you possess specific rights regarding your personal information:

• Data Access and Correction: You have the right to request access to your personal data held by us, and to request a correction if you consider the data to be inaccurate.
• Processing Timeframes: We are committed to responding to valid Data Access Requests and Data Correction Requests within 30 days of receipt.
• Direct Marketing: We will not use your personal data for direct marketing purposes without your explicit and informed consent.

7. User Responsibilities

Organisations using GNSAI act as "Data Users" for the personal data they input into the platform. You are responsible for managing access permissions within your workspace, ensuring that the data you collect and input is obtained lawfully, and complying with your own obligations or other applicable data privacy laws.

8. Changes to This Policy

We may update this Data Protection Policy periodically to reflect changes in technology or legal requirements. We will notify organisations of any material changes via email or an in-platform announcement prior to the changes taking effect.

9. Contact Us

To exercise your data access or correction rights, or if you have any questions regarding this policy, please contact our Data Protection Officer at legal@gamenoodlesoup.com