ILLA Privacy Policy

1. Application and Brand Identity

Application name. ILLA.

Developer and operator. Illa Labs, Inc.

Google OAuth verification context. This is the privacy policy for the ILLA application submitted for Google OAuth and Google Sign-In verification by Illa Labs, Inc.

Website and policy domain. This Privacy Policy is published at https://illa.io/privacy on the illa.io domain operated by Illa Labs, Inc.

2. What This Policy Covers

This Policy covers our handling of personal information for all users of our Services, including end users and developers. Our Services may link to third-party websites and applications whose privacy practices we do not control. We encourage you to review those third parties’ privacy policies.

3. Personal Information We Collect

Personal Identifiers. Email address, phone number, and similar identifiers you provide when creating an account or contacting us.

Device and Technical Information. Browser type, IP address, device identifiers, screen resolution, and similar technical data.

Usage Information. Pages visited, navigation paths, time spent on pages, date and time of use, and links clicked.

Digital Asset Wallet Addresses. Public wallet addresses and associated transaction history for digital assets you use with the Services.

User Content and Inputs. Prompts, transaction instructions, and other content you submit through the Services, including conversational inputs processed by our AI features.

Developer Integration Data. If you access our Services via API, SDK, or MCP server: API keys, usage metrics, integration configurations, and request logs.

Inferences. Inferences drawn from the information above.

4. How We Collect Personal Information

Directly from you — when you create an account, use our Services, or contact us.

Automatically — via cookies, web server logs, and similar technologies when you interact with our Site or Services.

From third-party services — if you connect third-party wallets, identity providers, or platforms, we may receive information they share with us subject to their own privacy policies.

From other sources — analytics providers, fraud prevention providers, and publicly available sources.

5. AI Services and Logging

Our Services use AI and natural language processing to interpret instructions and facilitate financial transactions.

Third-Party AI Providers. We use third-party AI providers to power certain features. Information you submit through these features may be processed by those providers under their respective data processing agreements.

Logging. We maintain logs of interactions for service delivery, debugging, security monitoring, and fraud prevention. Logs may contain your inputs, transaction parameters, and system responses. Access is limited to authorized personnel and retention periods follow our operational and legal requirements.

6. Cookies and Tracking Technologies

We use cookies and similar technologies for core site functionality and analytics. Required cookies enable the site to function properly — you can remove them via browser settings, but some features may not work.

We may use third-party analytics tools (e.g., Google Analytics) to understand how users interact with our Services. For information on opting out: https://tools.google.com/dlpage/gaoptout.

7. How We Use Personal Information

Providing Services — processing transaction instructions, resolving intent, executing plans, authenticating accounts, and maintaining the Services.

Communication — security advisories, responding to support requests, and service updates.

Analytics — understanding usage patterns and improving our products.

Security and Fraud Prevention — detecting and preventing malicious or illegal activity.

Legal Obligations — complying with applicable laws and regulations, and defending legal claims.

8. How We Share Personal Information

We do not sell your personal information. We may share it with:

Service Providers — cloud infrastructure, identity providers, AI providers, analytics, and security vendors under appropriate data processing agreements.

Business Affiliates — affiliated companies where necessary to provide the Services.

Business Transfers — in the event of a merger, acquisition, or similar transaction.

Law Enforcement — to comply with legal obligations, respond to lawful requests, or cooperate with law enforcement.

Enforcement of Rights — to enforce our Terms of Service and protect our rights, safety, or property.

9. Minors

We do not knowingly collect personal information from individuals under 18. If you believe we have, contact us at: [email protected]

10. Data Security

We use administrative and technological safeguards to protect your information. However, no method of transmission over the Internet is completely secure, and we cannot guarantee absolute security.

11. Data Retention

We retain personal information only as long as necessary for the purposes in this Policy or as required by law. Factors include the length of our relationship with you, legal obligations, and our legal position regarding applicable statutes of limitations.

12. Your Privacy Rights

Depending on your jurisdiction, you may have the right to: access, correct, delete, or port your personal information; restrict or object to certain processing; and withdraw consent. Limitations may apply under applicable law.

To submit a request: [email protected]

13. California Residents

Under the CCPA/CPRA, California residents may request disclosure of personal information collected, its sources and purposes, and third parties with whom it has been shared. You may request deletion or correction, opt out of sharing, and exercise these rights without discrimination.

We do not sell personal information as defined under California law and have not done so in the preceding 12 months.

To exercise your rights: [email protected]. We respond to verifiable requests within 45 days (extendable by 45 days with notice). Limited to two requests per 12-month period.

14. EU and UK Residents

We are the data controller. Under the GDPR and UK GDPR, you have the right to access, correct, delete, restrict, port, or object to the processing of your personal information.

Legal Bases for Processing: Performance of contract; compliance with legal obligations; legitimate interests (improving Services, managing our relationship with you); and consent, which may be withdrawn at any time.

To exercise your rights: [email protected]. You also have the right to lodge a complaint with your local data protection authority.

15. Updates to This Policy

We may update this Policy periodically. Material changes will be notified through our website. Continued use of the Services after changes constitutes acceptance.

16. Contact

For questions about this Policy: [email protected]

17. Google Sign-In and Google User Data

This Section 17 specifically governs Google user data collected through Google Sign-In or connected Google services for ILLA and controls over any broader statements elsewhere in this Policy about analytics, subprocessors, affiliates, or business transfers.

If you choose to sign in with Google or connect Google services to ILLA, we may receive Google user data that you authorize through the Google OAuth consent screen, including your Google account email address, basic profile information, profile photo, locale, and a Google account identifier needed to authenticate you and link your Google account to ILLA.

We use Google user data only to authenticate you, create or link your ILLA account, maintain your session, provide the Google-enabled features you request, secure the Services, and improve user-facing functionality. We do not use Google user data for targeted advertising, data brokerage, credit or lending decisions, or training generalized AI or machine learning models.

We do not sell Google user data. We share Google user data only with service providers and subprocessors that help us operate ILLA on our behalf, and only when necessary to provide or secure the Services you request. We do not disclose Google user data to third parties for their own advertising or marketing purposes.

Except as expressly described in this Section 17, Google user data is not used or disclosed under the more general data-use and data-sharing statements elsewhere in this Policy.

We protect Google user data using HTTPS/TLS in transit, access controls, audit logging, and other administrative and technical safeguards designed to limit access to authorized personnel and service providers with a need to know.

We retain Google user data only for as long as needed to provide the Services, troubleshoot security or abuse issues, comply with legal obligations, and enforce our agreements. If you request deletion of your account or disconnect Google sign-in, we will delete or de-identify associated Google user data within a reasonable period unless we are required to keep it by law.

You can revoke ILLA's access to your Google account at https://myaccount.google.com/permissions and you can contact us at [email protected] to request deletion or ask questions about Google user data handling.