Terms of Service

Last Updated: January 1, 2025 · Effective Date: January 1, 2025

Welcome to Luxyra AI. These Terms of Service ("Terms") govern your access to and use of Luxyra AI's website, platform, and services. By accessing our services, you agree to be bound by these Terms. If you disagree, please discontinue use immediately.

1. Acceptance of Terms

By accessing luxyra.ai or entering into a service agreement with Luxyra AI, Inc., you confirm that you are at least 18 years old, have the legal authority to bind yourself or your organization, and agree to these Terms and our Privacy Policy in their entirety.

2. Description of Services

Luxyra AI provides artificial intelligence consulting, development, and deployment services including but not limited to: custom AI/ML model development, AI agent design and deployment, LLM fine-tuning, predictive analytics, computer vision systems, AI integration services, and strategic AI consulting. Specific deliverables and service specifications are defined in individual Statement of Work ("SOW") documents executed between the parties.

3. Account Registration & Client Portal

To access the Luxyra AI client portal, you must create an account with accurate, complete information. You are responsible for maintaining the confidentiality of your credentials and for all activities under your account. You must notify us immediately of any unauthorized access at security@luxyra.ai.

4. Payment Terms

Fees are as specified in your SOW or selected pricing plan. Invoices are due within 30 days of issuance unless otherwise agreed. Late payments accrue interest at 1.5% per month. Luxyra AI reserves the right to suspend services on accounts more than 45 days past due. All fees are exclusive of applicable taxes, which are your sole responsibility.

5. Intellectual Property

Unless explicitly transferred in your SOW, Luxyra AI retains ownership of all underlying technology, frameworks, tools, models, and methodologies used in delivering services. Client-specific deliverables (as defined in the SOW) become your property upon full payment. You grant Luxyra AI a license to use your data and systems solely as necessary to provide the services.

6. Confidentiality

Both parties agree to maintain the confidentiality of all Confidential Information received from the other party, using at least the same degree of care as they use to protect their own confidential information (but no less than reasonable care). This obligation survives termination of these Terms for a period of five (5) years.

7. Data & AI Model Usage

You represent and warrant that you have all necessary rights to provide any data to Luxyra AI for use in our services. You agree not to provide data that infringes third-party rights, violates applicable law, or contains personal health information without appropriate HIPAA safeguards in place. AI models trained on your data will not be used to train models for other clients without your explicit written consent.

8. Prohibited Uses

You agree not to use our services to: build systems designed to deceive, harm, or manipulate people; generate illegal content; circumvent security measures; develop weapons or surveillance systems without lawful authorization; violate any applicable law or regulation; or reverse engineer our proprietary systems. Violation may result in immediate termination without refund.

9. Warranties & Disclaimers

Luxyra AI warrants that services will be performed with professional skill and care. We do not warrant that AI systems will be error-free or achieve any specific performance outcomes not expressly guaranteed in your SOW. AI systems are probabilistic in nature; no AI company can guarantee 100% accuracy, and commercial results depend on factors outside our control.

10. Limitation of Liability

To the maximum extent permitted by law, Luxyra AI's aggregate liability for any claims arising from or related to these Terms shall not exceed the fees paid by you in the twelve (12) months preceding the claim. We are not liable for indirect, incidental, special, or consequential damages, including lost profits or data loss.

11. Indemnification

You agree to indemnify, defend, and hold harmless Luxyra AI, its officers, directors, employees, and agents from any claims, damages, losses, or expenses (including reasonable attorneys' fees) arising from your use of our services, your violation of these Terms, or your violation of any third-party rights.

12. Term & Termination

These Terms remain in effect until terminated. Either party may terminate a service engagement with 30 days' written notice unless otherwise specified in the SOW. Luxyra AI may terminate immediately for material breach, non-payment, or prohibited use. Upon termination, your right to use our services ceases and outstanding fees become immediately due.

13. Governing Law & Disputes

These Terms are governed by the laws of the State of New York, USA, without regard to conflict of law principles. Any disputes shall be resolved through binding arbitration under JAMS rules in New York City, except that either party may seek injunctive relief in any court of competent jurisdiction.

14. Modifications

We reserve the right to modify these Terms at any time. Material changes will be communicated via email or prominent notice on our website with at least 30 days' advance notice for existing clients. Continued use of our services constitutes acceptance of the modified Terms.

Cookie Policy

Last Updated: January 1, 2025 · Effective Date: January 1, 2025

This Cookie Policy explains how Luxyra AI, Inc. uses cookies and similar tracking technologies on luxyra.ai and our client portal. By using our website, you consent to our use of cookies in accordance with this policy.

1. What Are Cookies?

Cookies are small text files stored on your device when you visit a website. They serve various functions, including remembering your preferences, analyzing site usage, and enabling certain features. Similar technologies include web beacons, pixel tags, local storage, and session storage.

2. Types of Cookies We Use

Strictly Necessary Cookies — These are essential for the website to function. They enable core features like security, network management, and account access. You cannot opt out of these cookies without impairing site functionality.

• luxyra_session — Session management (expires: session)
• luxyra_csrf — Cross-site request forgery protection (expires: session)
• luxyra_auth — Authentication state for client portal (expires: 30 days)

Performance & Analytics Cookies — These help us understand how visitors use our website by collecting anonymized usage data.

• _ga, _gid — Google Analytics (expires: 2 years / 24 hours)
• _hotjar_* — Hotjar session recordings and heatmaps (expires: 365 days)
• luxyra_perf — Internal performance metrics (expires: 90 days)

Functional Cookies — These enable personalization and enhanced functionality.

• luxyra_prefs — User interface preferences (expires: 1 year)
• luxyra_lang — Language preference (expires: 1 year)

Marketing & Targeting Cookies — Used to deliver relevant advertisements and track campaign effectiveness.

• _fbp — Facebook Pixel for ad retargeting (expires: 90 days)
• li_fat_id — LinkedIn Insight Tag (expires: 30 days)
• _gcl_au — Google Ads conversion tracking (expires: 90 days)

3. Managing Your Cookie Preferences

You can manage cookie preferences at any time by: clicking "Cookie Settings" in the footer of our website; adjusting your browser settings to block or delete cookies; or using browser extensions like Privacy Badger or uBlock Origin. Note that blocking certain cookies may impair website functionality.

4. Third-Party Cookies

Some cookies on our site are set by third parties. We do not control these third parties' cookie practices. We recommend reviewing their privacy policies: Google Analytics (policies.google.com), HubSpot CRM, Stripe (payments), LinkedIn, and Meta.

5. Do Not Track

Our website currently does not respond to browser "Do Not Track" signals. We are monitoring regulatory developments in this area and will update our practices accordingly.

6. Cookie Retention

Session cookies are deleted when you close your browser. Persistent cookies remain on your device for the duration specified in their settings. You can delete all cookies at any time through your browser settings.

7. Contact

For cookie-related questions, contact us at privacy@luxyra.ai.

Acceptable Use Policy

Last Updated: January 1, 2025 · Effective Date: January 1, 2025

This Acceptable Use Policy ("AUP") defines the rules and restrictions for using Luxyra AI's services, platform, and AI systems. Violations may result in immediate service suspension or termination without refund.

1. Core Principles

All use of Luxyra AI's services must be lawful, ethical, and consistent with the purpose for which the services are designed. We are committed to responsible AI development and expect our clients to uphold the same standards. Our services are designed to create value — not to cause harm.

2. Prohibited Activities

You may not use Luxyra AI's services to:

• Generate Illegal Content: Create, distribute, or facilitate any content that violates local, national, or international laws.
• Deceptive AI Deployment: Deploy AI systems that impersonate humans without disclosure, engage in deceptive practices, or manipulate users psychologically without consent.
• Weapons & Harmful Systems: Develop AI for autonomous weapons, mass surveillance, or systems designed to cause physical harm to individuals or groups.
• Discriminatory AI: Build systems that discriminate based on protected characteristics including race, gender, religion, national origin, disability, or sexual orientation.
• Privacy Violations: Use AI to unlawfully collect, process, or exploit personal data; conduct surveillance without legal authority; or build systems that violate GDPR, CCPA, or equivalent laws.
• Intellectual Property Infringement: Use our services to create systems that systematically reproduce copyrighted material without authorization.
• Security Attacks: Develop or deploy AI to conduct cyberattacks, generate malware, compromise systems, or facilitate unauthorized access.
• Disinformation: Create AI systems designed to generate or amplify false information at scale for political manipulation or public harm.
• Child Exploitation: Generate, distribute, or facilitate any content that exploits or endangers minors in any way.
• Platform Abuse: Attempt to reverse engineer Luxyra AI's proprietary systems, resell our services without authorization, or circumvent usage limits or billing systems.

3. Responsible AI Commitments

By using our services, you commit to: documenting intended use cases for AI systems we build; implementing appropriate human oversight for high-stakes AI applications; notifying end users when they are interacting with AI; and conducting impact assessments for AI systems affecting sensitive populations.

4. High-Risk Applications

Certain AI applications require additional review and approval from Luxyra AI, including systems used in: medical diagnosis or treatment decisions; criminal justice or parole decisions; financial credit scoring affecting individuals; large-scale hiring or employment decisions; and systems interacting with vulnerable populations. Contact us before initiating such projects.

5. Reporting Violations

If you suspect a violation of this AUP, please report it to trust@luxyra.ai. We take all reports seriously and investigate promptly.

6. Enforcement

Violations of this AUP may result in immediate account suspension, service termination without refund, legal action, and reporting to relevant authorities. We reserve the right to monitor service usage for compliance purposes.

GDPR Compliance Statement

Last Updated: January 1, 2025 · Effective Date: January 1, 2025

Luxyra AI, Inc. is committed to compliance with the General Data Protection Regulation (EU) 2016/679 ("GDPR") and the UK GDPR. This statement describes our approach to GDPR compliance and your rights as a data subject.

1. Data Controller & Processor Roles

Luxyra AI acts as a Data Controller when we collect and process your personal data for our own business purposes (e.g., marketing, billing, website analytics). We act as a Data Processor when we process personal data on your behalf as part of delivering AI services. In each case, we fulfill the obligations appropriate to our role under the GDPR.

2. Data Protection Officer

We have appointed a Data Protection Officer (DPO) responsible for overseeing our GDPR compliance. You can contact our DPO at dpo@luxyra.ai or by post at: DPO, Luxyra AI, Inc., One World Trade Center, Suite 8500, New York, NY 10007, USA.

3. Your GDPR Rights

As a data subject under the GDPR, you have the following rights:

• Right of Access (Art. 15): Request a copy of the personal data we hold about you.
• Right to Rectification (Art. 16): Request correction of inaccurate or incomplete data.
• Right to Erasure (Art. 17): Request deletion of your personal data under certain circumstances.
• Right to Restrict Processing (Art. 18): Request that we limit how we use your data.
• Right to Data Portability (Art. 20): Receive your data in a structured, machine-readable format.
• Right to Object (Art. 21): Object to processing based on legitimate interests or for direct marketing.
• Rights Related to Automated Decision-Making (Art. 22): Not be subject to solely automated decisions that significantly affect you without human review.

To exercise any of these rights, submit a request to privacy@luxyra.ai. We will respond within 30 days.

4. Data Processing Agreements

We execute Data Processing Agreements (DPAs) with all clients who engage us to process personal data on their behalf. Standard DPAs incorporating EU Standard Contractual Clauses are available upon request. Contact legal@luxyra.ai for DPA execution.

5. International Data Transfers

When we transfer personal data outside the EEA or UK, we rely on: EU Standard Contractual Clauses (SCCs); adequacy decisions by the European Commission; or other appropriate safeguards as permitted under the GDPR. We maintain a transfer impact assessment for all cross-border data flows.

6. Data Breach Notification

We maintain a documented data breach response procedure. In the event of a breach likely to result in a high risk to individuals' rights and freedoms, we will notify the relevant supervisory authority within 72 hours and affected data subjects without undue delay, as required by GDPR Article 33.

7. Supervisory Authority

If you believe our processing of your personal data infringes the GDPR, you have the right to lodge a complaint with a supervisory authority — in particular in the EU member state of your habitual residence, place of work, or place of the alleged infringement. Our lead supervisory authority for EU matters is the Irish Data Protection Commission (DPC).

8. Sub-processors

We maintain a current list of sub-processors. Major sub-processors include: Amazon Web Services (cloud infrastructure, US), Google LLC (analytics, US), Stripe (payments, US), HubSpot (CRM, US), and Anthropic/OpenAI (AI inference, US). All sub-processors are bound by appropriate data protection agreements.

Security Policy

Last Updated: January 1, 2025 · Effective Date: January 1, 2025

At Luxyra AI, security is foundational — not an afterthought. This Security Policy describes the technical and organizational measures we implement to protect your data and our infrastructure. We hold ourselves to the highest standards of enterprise security.

1. Certifications & Compliance

• SOC 2 Type II: Annual audit covering Security, Availability, and Confidentiality trust service criteria.
• ISO 27001: Information security management system certification.
• PCI DSS Level 1: Highest level of payment card industry compliance.
• HIPAA: Business Associate Agreements available for healthcare clients.
• GDPR & CCPA: Full compliance with applicable data protection regulations.

2. Infrastructure Security

Our infrastructure is built on AWS GovCloud with multi-region redundancy. We implement: zero-trust network architecture; VPC isolation for all client environments; Web Application Firewall (WAF) with DDoS protection; automated vulnerability scanning; and Infrastructure-as-Code with security reviews on all changes.

3. Data Encryption

• At Rest: AES-256 encryption for all stored data, with customer-managed encryption keys (CMK) available for Enterprise clients.
• In Transit: TLS 1.3 minimum for all data transmission; HSTS enforced; certificate pinning for mobile clients.
• Database: Column-level encryption for sensitive fields; encrypted backups with separate key management.
• Key Management: AWS KMS with Hardware Security Module (HSM) backing; regular key rotation.

4. Access Controls

We enforce strict access controls including: role-based access control (RBAC) with least-privilege principles; mandatory multi-factor authentication for all internal systems; privileged access management (PAM) for infrastructure access; quarterly access reviews and immediate revocation on offboarding; and comprehensive audit logging of all access events.

5. Application Security

Our development practices include: mandatory security code reviews; static application security testing (SAST) in CI/CD pipeline; dynamic application security testing (DAST); Software Composition Analysis (SCA) for dependency vulnerabilities; OWASP Top 10 testing; and annual third-party penetration testing.

6. AI Model Security

AI-specific security measures include: model weight encryption; adversarial input detection and filtering; prompt injection prevention for LLM systems; model output monitoring for anomalies; data poisoning prevention in training pipelines; and model provenance tracking.

7. Incident Response

We maintain a documented incident response plan with defined severity levels and response SLAs. Our Security Operations Center (SOC) monitors systems 24/7. We conduct quarterly tabletop exercises and annual incident response drills. All security incidents are logged, investigated, and subject to post-incident review.

8. Vulnerability Disclosure

We operate a responsible disclosure program. If you discover a security vulnerability in our systems, please report it to security@luxyra.ai with full details. We commit to acknowledging reports within 24 hours and providing a resolution timeline within 5 business days. We do not pursue legal action against good-faith security researchers.

9. Business Continuity

We maintain Recovery Time Objectives (RTO) of 4 hours and Recovery Point Objectives (RPO) of 1 hour for critical systems. Data is replicated across at least 3 geographically separated availability zones. We conduct quarterly disaster recovery tests and maintain a comprehensive Business Continuity Plan (BCP).

10. Security Contact

Security inquiries: security@luxyra.ai
For PGP-encrypted communications, our public key is available at: luxyra.ai/security/pgp-key.txt
For urgent security matters: +1 (212) 555-0199 (24/7 Security Hotline)