1.General Provisions
1.1.This Personal Data Processing Policy (the “Policy”) governs legal relations in the field of personal data protection and processing between Verdo Technologies LLP, BIN 250940030897, address: Republic of Kazakhstan, Astana, Nura District, 46/1 Turan Avenue, postcode Z05T0E9 (the “Company”) and the User.
1.2.This Policy has been developed in accordance with Law of the Republic of Kazakhstan No. 94-V of 21 May 2013 “On Personal Data and Their Protection”, and also takes into account the provisions of the European Union General Data Protection Regulation (GDPR) with regard to interaction with foreign nationals.
1.3.The “User” means a legally capable individual aged 18 or over who has completed registration or authorization on the Company’s Website or in its Mobile Application.
1.4.The “Website” means the internet resource headora.ai (including all domain name levels, including api.headora.ai), as well as the official cross-platform Mobile Application “Headora”.
1.5.The “Vector Memory Profile” (Cross-Model Memory) means a technological function of the Service that automatically extracts, structures, compresses and vectorizes context, facts and data from the User’s dialogues for the purpose of automatically carrying them over between third-party AI models.
2.User Consent and Data Collection
2.1.The User consents to the terms of this Policy by entering registration data (e-mail, phone number, name) in the designated field on the Website or in the Application and then clicking the “Sign up”, “Get code”, “Top up balance”, “Send request” button or their equivalents.
2.2.Clicking the said buttons constitutes the User’s consent to the collection and processing of their personal data and Vector Memory Profile in accordance with Article 8 of the Law of the Republic of Kazakhstan “On Personal Data and Their Protection”, as well as consent to cross-border data transfer to the extent specified in clause 4.2.
2.3.The Company collects the following data: surname, first name, e-mail address, contact phone number, user ID, IP address, cookies, as well as arrays of text, audio and video data submitted by the User to the chat interface as requests (prompts).
2.4.The Company also collects anonymous usage events to improve the Service: which screens are opened and which features are used, the platform and version of the Application. Events are linked to a random installation identifier and, after sign-in, to the user ID; they contain no message or request content, e-mail, phone number or other contact data. Such events are stored for no longer than 13 months and are deleted together with the account.
3.Purposes of Data Processing
3.1.The Company uses personal data and context data for the purposes of:
- identifying the User, maintaining the balance of the internal settlement unit “Energy” (⚡) and providing access to the AI models presented in the Service catalog;
- ensuring the operation of cross-model memory (vectorization and compression of context);
- providing technical support to Users in the Kazakh and Russian languages;
- performing settlements, integrating with payment services and issuing closing documents for limited liability partnerships (TOO) and sole proprietors (IP) in the Republic of Kazakhstan.
4.Data Security and Storage Location
4.1.In accordance with the legislation of the Republic of Kazakhstan, personal data of citizens of the Republic of Kazakhstan are collected and processed using databases physically located in the territory of the Republic of Kazakhstan.
4.2.To generate a response, the request text and the related memory context are transmitted to the provider of the selected AI model (OpenAI, Anthropic, Google, DeepSeek and others) — directly or through a technical aggregator partner, including outside the Republic of Kazakhstan — only to the extent technically necessary for the response. The User’s registration data (name, e-mail, phone) are not transmitted to providers; the User identifier is transmitted as an irreversible hash. The User is advised not to include personal data of third parties in requests without their consent.
4.3.The Company does not use the User’s requests and Vector Memory Profiles to train AI models and connects models via application programming interfaces (APIs) on provider terms that exclude training on the transmitted data. Vector Memory Profiles are isolated within the User’s account.
5.Withdrawal of Consent and Destruction of Data
5.1.The User may at any time withdraw consent to data processing or request the deletion of their Vector Memory Profile by sending a request to the e-mail address support@headora.ai. The User may also delete the memory of an individual project on their own — in the application.
5.2.The Company undertakes to destroy the User’s personal data and vector memory indexes within 7 (seven) business days from receipt of the request.