Welcome to Oregon Coast AI's Privacy Policy

We use your personal data to deliver core AI functionalities, manage accounts, personalize experiences (with your control), develop new features, monitor performance, and provide customer support.

A significant use of data (your inputs, AI outputs, feedback, usage data, public/licensed data) is for developing, training, validating, and improving our AI models. This enhances accuracy, safety, and capabilities. We are transparent about this and aim to provide controls where feasible. De-identification or anonymization is used for broader training where appropriate.

We use your contact information for service announcements (policy updates, security alerts), responding to inquiries, and sending marketing communications (with consent/opt-out).

Information is used to protect rights and safety, detect/prevent fraud, abuse, security incidents, and enforce our Terms of Service.

We may process data to comply with laws, regulations, court orders, respond to lawful requests, and establish/exercise/defend legal rights.

Aggregated or de-identified data may be used for internal R&D, analyzing usage patterns, exploring new AI techniques, and improving service design.

Beyond the above, we use personal data for any other specific purpose for which we obtain your explicit, unambiguous consent. OCPA prohibits retroactive changes to privacy notices for new AI training uses without fresh, affirmative consent.

We engage third-party providers for functions like cloud hosting, payment processing, analytics, customer support, and AI tools. We share data only as necessary, with contracts obligating them to protect it and use it only for specified purposes.

We may disclose data to comply with law, legal process, protect rights/safety, or address fraud/security issues.

If involved in a merger, acquisition, or sale of assets, your data may be transferred. We will notify you if it becomes subject to a different policy. OCPA excludes this from "sale" if original privacy choices are honored.

We share data with other third parties only with your explicit, opt-in consent for that specific purpose.

We may share data that cannot reasonably identify an individual for statistical analysis, research, etc. We won't attempt re-identification.

Information you share publicly (e.g., in forums) is not subject to these privacy restrictions. Be careful what you disclose publicly.

OCPA grants Oregon residents the right to request a list of specific third parties to whom we've disclosed their personal data or any personal data. We maintain records for this. This requires meticulous data flow mapping and vendor management, especially for AI systems involving complex data pipelines. Outputs from our AI models, if linkable to personal data and shared, could fall under this.

To exercise your rights, submit a verifiable consumer request via:

• Email: [email protected]
• Online Privacy Portal: [Link to Portal, if available - currently placeholder]
• Toll-Free Telephone Number: 1-800-XXX-XXXX [Placeholder - OCPA requires two methods, one of which must be similar to usual interaction method]

We will take reasonable steps to verify your identity before processing your request, possibly requiring information to match our records. This info is used solely for verification. If we can't verify, we may deny the request and inform you why.

We confirm receipt within 10 business days and aim to respond substantively within 45 calendar days. If more time is needed (up to an additional 45 days), we'll inform you. Responses are free, typically once per 12-month period. Excessive requests may incur a fee or be declined.

Oregon consumers may use an authorized agent. We'll require proof of authorization and may verify your identity directly.

If we decline your request, we'll explain why and how to appeal. We respond to appeals within 45 days (extendable by 60 days). If an appeal is denied, we'll provide info on contacting the Oregon AG.

OCPA requires recognizing universal opt-out signals (like GPC) for sale/targeted advertising by Jan 1, 2026. We are working towards implementing support and will provide more info as the date approaches.

We implement a comprehensive security program to protect your data from unauthorized access, use, disclosure, alteration, or destruction, though no system is 100% secure.

We employ "reasonable administrative, technical, and physical security measures" consistent with OCPA and OCIPA. This includes written policies, employee training, risk assessments, vendor management, encryption, access controls, network security, secure software development, vulnerability management, audit logs, and physical security.

AI-Specific Security Considerations:

Model security, adversarial attack mitigation, data integrity for training/inference, secure AI pipelines, and alignment with frameworks like NIST AI RMF.

In case of a data breach materially compromising personal information, we comply with Oregon laws (OCIPA), notifying affected residents and the Oregon AG as required, typically within 45 days for breaches affecting over 250 Oregon consumers.

We retain data only as long as reasonably necessary for its collected purpose, considering service provision, legal/regulatory obligations, dispute resolution, and COPPA requirements. We follow purpose limitation and data minimization principles.

• User Inputs/Outputs: May be retained for interaction history and short-term operational needs. For longer-term training, data may be de-identified, aggregated, or retained with explicit consent.
• Feedback Data: May be retained longer (e.g., up to 10 years by some) for model improvement.
• AI-Generated Content in Accounts: Retained as long as account is active or until you delete it, subject to overall policies.
• Training Datasets: Subject to their own lifecycle management.

We clearly communicate different retention schedules and provide user controls where feasible.

Once no longer required and legal retention periods expire, data is securely disposed of (irreversible deletion or anonymization) to prevent unauthorized access.

Our Services are AI-powered. For example, our AI helps generate creative text by analyzing prompts and predicting continuations, and it can analyze data to offer insights. We ensure descriptions of AI capabilities are accurate and not misleading, aligning with FTC and Oregon AG guidance.

If AI is used for profiling or automated decisions with "legal or similarly significant effects" (per OCPA), we will provide clear notice, meaningful information about the logic involved (without disclosing trade secrets), and your right to opt-out (for Oregon residents).

We acknowledge potential AI bias and work to mitigate it. Our approach includes diverse/representative training data (where feasible), bias detection/mitigation techniques, compliance with anti-discrimination laws (like Oregon Equality Act), human oversight for high-risk applications, and guidance from ethical AI frameworks (NIST AI RMF, OECD AI Principles). We aim for proactive prevention of discriminatory outcomes.

We believe in human oversight for AI applications with significant impact or complex judgments. This may involve human review of AI outputs, involvement in training/fine-tuning, and protocols for human intervention.

As required by OCPA, we conduct DPAs for processing activities with "heightened risk of harm," including targeted advertising, processing sensitive data, sale of personal data, and certain types of profiling. The Oregon AG considers using personal data to train AI models as likely requiring a DPA. DPAs weigh benefits against risks and inform safeguards.

Our Services are not directed to, and we do not knowingly market to, children under 13. We do not knowingly collect personal information from children under 13 without verifiable parental consent. Appropriate age verification will be used if services could appeal to under-18s.

If we ever collect data from a known child under 13, it will only be after verifiable parental consent. Parents will receive direct notice of our practices. Under OCPA, data from a known child under 13 is "Sensitive Data" requiring verifiable parental consent for processing.

OCPA provides additional protections. We will not process data of a known consumer aged 13-15 for targeted advertising, sale of personal data, or significant profiling without their explicit opt-in consent. This requires robust age-gating and consent management if services are accessible to minors.

Parents of children under 13 can review, request deletion of, or refuse further collection/use of their child's data. We use FTC-approved methods for verifiable parental consent. Contact [email protected] if you believe a child has provided data without requisite consent.

Data may be transferred to our servers or data centers in the U.S. or other countries, and to our third-party service providers globally.

We comply with applicable data protection laws for international transfers. Safeguards may include adequacy decisions, Standard Contractual Clauses (SCCs), or your explicit consent in limited circumstances, ensuring an adequate level of protection.

We update the "Effective Date" at the top. For material changes (significantly altering data use or your rights), we provide more prominent notice (e.g., on our Site, via email). OCPA requires consent for changes in processing purposes. If using previously collected data for new AI training not originally disclosed, we will seek fresh, affirmative consent.

We maintain an archive of previous versions. Request a copy via [email protected].