Privacy Policy

How data is handled when using the Cryptic AI software

This Privacy Policy (the "Policy") describes what data Morpheous Dynamics (the "Operator") processes in connection with providing access to the "Cryptic AI" software (the "Software"), for what purposes, on what legal bases, and with which third parties. The Policy supplements the License Agreement governing use of the Software (the "License Agreement") and is to be read together with it; on definitions and the treatment of on-chain data, the Policy follows and does not contradict the License Agreement. For clients to whom the General Data Protection Regulation (GDPR) applies contractually, equivalent safeguards are provided through a separate Data Processing Agreement ("DPA") entered into in addition to this Policy.

1. Definitions

1.1."Operator" means Morpheous Dynamics, a legal entity incorporated under the laws of the Republic of Kazakhstan, which determines the purposes and means of processing personal data in connection with providing the Software.

1.2."Licensee" means the legal entity granted the right to use the Software under the License Agreement and the underlying Agreement.

1.3."User" means an employee of the Licensee or another individual authorized by the Licensee to use the Software under the Licensee's account.

1.4."Client Data" means any data uploaded, entered, or generated by the Licensee and its Users within the Software in the course of using it, including case materials, exchange reports, KYC documents, and investigation notes.

1.5."On-chain Data" means publicly available blockchain data (wallet addresses, transaction data, hashes, amounts, timing, counterparties, attribution and cluster data). Consistent with clause 11.4 of the License Agreement, on-chain data is not treated as personal data or confidential information.

1.6."Personal Data" means information relating to an identified or identifiable individual, as defined by the Law of the Republic of Kazakhstan "On Personal Data and Their Protection."

1.7."Sub-processor" means a third party engaged by the Operator to process data in connection with providing the Software, including cloud infrastructure providers, LLM providers, and blockchain analytics providers.

2. General provisions. Operator and applicable law

2.1.The operator (controller) of personal data processed in connection with use of the Software is Morpheous Dynamics (Republic of Kazakhstan).

2.2.Personal data is processed in accordance with the legislation of the Republic of Kazakhstan, primarily the Law of the Republic of Kazakhstan "On Personal Data and Their Protection," as well as other applicable legal acts.

2.3.Where GDPR or other applicable data protection legislation applies to the processing by virtue of contractual terms, the Operator provides an equivalent level of protection under a separate DPA entered into with the Licensee, which forms an integral part of the Parties' contractual relationship.

2.4.This Policy applies to data processing carried out by the Operator in providing the Software on a SaaS basis and does not govern processing carried out by the Licensee as an independent controller of data belonging to its own customers and counterparties that is uploaded into the Software (see Section 3.3).

3. What data we process

3.1.Registration data of Users, provided by the Licensee or its Users when creating and maintaining accounts:

  • first and last name;
  • email address;
  • phone number;
  • name of the organization (Licensee);
  • job title and role within the organization.

3.2.Technical and usage data:

IP address;

  • browser user-agent data;
  • access and activity logs within the Software;
  • session data (including data needed to maintain authorization).

3.3.Client Data uploaded by the Licensee and its Users in the course of using the Software (exchange reports, KYC documents, investigation notes, and other case materials). Such data may incidentally contain personal data of the Licensee's own customers and counterparties. With respect to such data, the Operator acts solely as a processor, acting on the instructions of the Licensee, which remains the independent controller of that data.

3.4.On-chain Data processed by the Software in the course of analysis and risk scoring. Consistent with clause 1.5 of this Policy and clause 11.4 of the License Agreement, on-chain data is not treated as personal data.

3.5.The Operator does not collect or process special categories of personal data (health data, religious or political views, and the like) as part of the Software's own functioning; such data may appear within Client Data only by decision of, and at the responsibility of, the Licensee, as provided in Section 3.3 of this Policy and clause 11.6 of the License Agreement.

4. Purposes of processing

4.1.The Operator processes the data described in Section 3 of this Policy for the following purposes:

  • providing access to the Software and to accounts, and authenticating Users;
  • performing the License Agreement and the Agreement with the Licensee;
  • providing the technical support described in Section 8 of the License Agreement;
  • ensuring information security and preventing fraud and unauthorized access;
  • operating the Software's functionality, including generating risk scores, reports, and analytical output on the Licensee's instructions;
  • improving the Software, including training, fine-tuning, and adjusting the models it uses, based on anonymized and/or aggregated data, as provided in clause 11.2 of the License Agreement;
  • complying with applicable law and lawful requests from authorized government bodies.

5. Legal bases for processing

5.1.Processing of Users' registration data and technical data is carried out on the basis of performance of the License Agreement and the Agreement with the Licensee, and on the basis of the Operator's legitimate interest in maintaining the functionality and security of the Software.

5.2.Processing of Client Data is carried out on the basis of the Licensee's instructions given to the Operator in connection with use of the Software; responsibility for the legal basis to upload such data into the Software rests with the Licensee, as provided in clause 11.6 of the License Agreement.

5.3.Processing of anonymized and/or aggregated interaction data for the purpose of improving models and the product is carried out on the basis of the Operator's legitimate interest and in accordance with clause 11.2 of the License Agreement.

5.4.Where required by applicable law, processing of certain categories of data may be carried out on the basis of the consent of the relevant data subject.

6. Use of AI in data processing

6.1.To generate analytical interpretations, explanations, and conclusions, the Software uses large language model (LLM) technologies provided by leading third-party AI providers, consistent with Section 5 of the License Agreement.

6.2.For the purpose of generating a response, relevant data related to the query, including relevant portions of Client Data and on-chain data, is sent to such LLM provider as a sub-processor, strictly to the extent necessary to generate the analytical response.

6.3.Consistent with clause 11.2 of the License Agreement, Users' queries and interactions with the Software, including the wording of prompts, actions taken in the interface, output produced by the Software, and User feedback, may be used by the Operator in anonymized and/or aggregated form for the internal training, fine-tuning, and improvement of the models and functionality of the Software. This use does not involve training models on non-anonymized personal data of Users or of the Licensee's customers.

6.4.The output of the AI is probabilistic and advisory in nature and does not replace the Licensee's own professional judgment, as further addressed in Sections 5 and 6 of the License Agreement.

7. Disclosure to third parties (sub-processors)

7.1.The Operator does not disclose the Licensee's personal data or confidential information to third parties, except as described in this Section or as required by applicable law or the License Agreement (clause 11.3 of the License Agreement).

7.2.To provide the Software, the Operator engages the following categories of sub-processors:

  • cloud infrastructure and hosting providers – currently OVH SAS data centers, with the production environment hosted in France and the test/staging environment hosted in Canada; hosting within the Republic of Kazakhstan is planned for the future;

AI/LLM provider – Anthropic (United States), used to generate analytical narrative and explanations from case data as described in Section 6 of this Policy;

  • blockchain analytics providers – Global Ledger, Chainalysis, and similar on-chain intelligence providers, which receive only on-chain addresses and transaction identifiers for risk-scoring purposes; such data does not constitute personal data.

7.3.The Operator may change its sub-processors in a manner analogous to the process for changing External Data Sources and LLMs described in Sections 4 and 5 of the License Agreement, while maintaining a level of data protection consistent with this Policy.

7.4.The Operator may disclose data to government authorities and other third parties in cases expressly provided for by applicable legislation of the Republic of Kazakhstan, including in response to lawful requests from authorized bodies.

8. Data retention

8.1.The data described in Section 3 of this Policy is retained for the duration of the License Period and the Agreement with the Licensee.

8.2.After the Agreement ends, data may be retained for a reasonable additional period as needed for legal, archival, or dispute-resolution purposes, unless the Agreement provides otherwise or the Licensee requests earlier deletion, where such deletion is permitted under applicable law.

8.3.Upon expiry of the applicable retention period, data is deleted or anonymized, except for data that, under clause 11.4 of the License Agreement and Section 6.3 of this Policy, the Operator already processes in anonymized and/or aggregated form.

9. Security measures

9.1.The Operator applies reasonable technical and organizational measures designed to protect data against unauthorized access, loss, alteration, or disclosure, and continues to develop these measures as the product grows.

9.2.As of the date of this Policy, these measures include the following:

  • all traffic between the User and the Software is encrypted in transit using TLS/HTTPS;

User passwords are stored only as one-way cryptographic hashes (bcrypt) and are never stored in plaintext;

  • access to administrative functions of the Software is restricted through role-based access control and is granted only to authorized personnel.

9.3.The Operator does not claim to hold certifications under international information security standards (including ISO 27001 or SOC 2), nor that all data is encrypted at rest, as of the current date; this Policy will be updated if such certifications are obtained or additional security measures are implemented.

9.4.The Licensee is independently responsible for protecting its Users' account credentials, as provided in clauses 3.2 and 10 of the License Agreement.

10. Data subject rights

10.1.A data subject may contact the Operator to exercise the following rights with respect to personal data that the Operator processes as an independent controller (the data described in Sections 3.1 and 3.2 of this Policy):

  • the right to access their personal data;
  • the right to correct inaccurate or incomplete personal data;
  • the right to have their personal data deleted;
  • the right to restrict processing of their personal data;
  • the right to withdraw consent, where processing is based on consent.

10.2.To exercise these rights, a request should be sent to the email address specified in Section 14 of this Policy.

10.3.With respect to Client Data uploaded by the Licensee (Section 3.3 of this Policy), the Operator acts as a processor on the Licensee's instructions; the exercise of data subject rights with respect to such data may be limited, and such requests should also be directed to the Licensee, which is the primary controller of that data.

11. Cookies and similar technologies

11.1.The Software uses cookies that are strictly necessary for the web application to function, in particular to maintain a User's authenticated session.

11.2.As of the date of this Policy, the Operator does not use third-party analytics, advertising, or behavioral-tracking cookies or similar technologies beyond the Software itself.

11.3.If analytics or other third-party cookie technologies are introduced, this Policy will be updated in advance to describe the relevant changes.

12. Age restrictions

12.1.The Software is a business-to-business (B2B) product intended for use by companies and their authorized personnel for professional purposes, and is not directed at individual consumers or minors.

12.2.The Operator does not knowingly collect personal data from minors.

13. Changes to this policy

13.1.The Operator may amend this Policy. The current version of the Policy is always available on the Operator's website.

13.2.The Operator will inform the Licensee of material changes affecting the scope or purposes of processing of the Licensee's data through the Software, the Operator's website, or by email, in a manner analogous to the notice mechanism provided in clauses 7.2 and 16.1 of the License Agreement.

14. Contact

14.1.For all questions relating to this Policy and to the processing of personal data, including the exercise of the rights described in Section 10, please contact: info@cryptic-ai.com.