Privacy Policy

IrisOS, available at https://irisos.app, is operated by GRL Enterprises (we, us, or our). Our business address is 307, Grima Unnathi, Kyalasanahalli, Bengaluru – 560077, Karnataka, India.

For our own account administration, payments, support, service security and business communications, GRL Enterprises determines the purposes of processing and generally acts as controller or data fiduciary. For personal data in a customer’s workspace, we generally act as processor on that customer’s instructions. A customer may itself be a processor for its clients. The applicable role depends on the activity and law, rather than applying one role to all data. Requests about customer-controlled records should normally go to that customer; we assist as required.

• Account and access information supplied by users and administrators: name, email, phone, profile image, authentication identifiers, workspace membership, roles, permissions and preferences.
• Customer Data supplied, imported or generated in a Workspace: client and lead contacts, addresses, projects, tasks, financial records, invoices, contracts, proposals, reports, design references, messages, calendar events and automation records. Customer Data means content submitted to or generated for the customer through IrisOS.
• Document-signing information: signer names, consent and signing events, timestamps, document content and hashes, and request audit information used by the signing workflow.
• Connected-service information: OAuth grants, credentials, account identifiers, calendar and advertising data, leads, synchronization status and other records requested by the authorized integration.
• Miles AI information: prompts, submitted content, conversation or workflow context, permitted workspace records, model responses, generated documents, audio and transcripts for voice features, and usage measurements.
• Payment and support information: transaction/order identifiers, amounts, currency, tax and coupon details, help requests, correspondence and associated delivery records. Razorpay handles payment credentials through its checkout; IrisOS records payment metadata.
• Technical information generated through use: browser and device signals, IP/request information, session cookies and browser storage, activity and error records, and security or performance diagnostics. Authentication, anti-abuse and hosting providers may also process these signals.

We use information to deliver and administer accounts and Workspaces; provide customer-requested operations, documents, communications and integrations; process payments; respond to support and rights requests; protect the service; and meet applicable legal duties.

Where EU or UK law applies to our controller activities, relevant grounds may include contract performance for account/service delivery, legitimate interests in security and support subject to individual rights, legal obligations for required records, and consent for optional processing where required. Other jurisdictions have their own consent and permitted-use rules; we do not treat legitimate interests as a universal legal basis. Customers are responsible for the lawful grounds and notices for their workspace instructions.

Miles AI supports integrations with OpenAI, Google Gemini and Anthropic Claude. The provider used depends on the enabled feature and service configuration. OpenAI paths support financial analysis, forecasting, voice and transcription; Gemini paths support classification, summaries, meetings and automation planning; Claude paths support strategy, reasoning and document generation. Availability of a supported integration does not mean every provider processes every request.

Routing is automatic in the implemented chat workflow. A classification request may send your query to Gemini before a separate provider answers it. Other workflows may use several model calls. Routing and supported models can change with functionality, availability, performance, cost and internal rules; users should not assume a fixed provider or manual provider selection.

Requests may contain your prompt, submitted attachments or their extracted content when supported, conversation or workflow history, internal instructions, and workspace context permitted by your settings and role. This can include personal information and confidential business records. Disabling optional workspace access does not remove information you directly submit to Miles.

IrisOS stores chat sessions, prompts and responses, generated records and usage information. You can delete your own chat sessions where the chat controls are available, or request deletion through the contact below. Deleting a conversation does not automatically remove a document or business record created from it, usage records, provider logs or copies outside IrisOS.

• OpenAI: its published API policy states that API content is not used for model training by default unless opted in; retention and abuse-monitoring practices depend on the endpoint and approved account controls. This is not a promise of zero retention for IrisOS requests.
• Google Gemini: published terms distinguish paid and unpaid services. Unpaid-service terms can permit product improvement and human review; paid-service terms provide different restrictions on use of prompts and responses. Safety and abuse processing may still occur. The applicable IrisOS account terms must be verified; do not assume that every API request has a no-training guarantee.
• Anthropic: published API documentation describes restrictions on training without express permission and retention that varies by feature, model and contractual arrangement. Some models or features require storage. A zero-retention arrangement is not implied by using the API.
• Provider processing can include safety checks, abuse logs, legally required retention and international transfers. The provider’s applicable API contract and settings govern these activities. We do not promise deletion from a provider merely because a chat is deleted in IrisOS.
• The reviewed IrisOS workflows perform inference and do not implement training a general IrisOS model on customer content. Any future additional use needs its own lawful basis and notice; this statement does not replace the provider-specific disclosures above.

Starting a Miles voice or transcription session sends audio to the configured speech/AI service. Transcripts and responses may be retained in chat history. The reviewed realtime workflow does not save microphone audio as an IrisOS recording; provider processing and retained transcripts are separate.

Messaging stores encrypted content and attachment data together with delivery, participant and key-management information. Authorized recipients can read, download and retain copies. This is not a claim that all IrisOS content is end-to-end encrypted or that every key remains exclusively on a device.

Documents and financial reports may be stored as source records and rendered PDF or Word artifacts. Signed-document evidence and downloaded or emailed copies have a different lifecycle from an AI chat.

Depending on the enabled feature, recipients include authentication and database infrastructure, hosting, AI providers, Razorpay, configured email delivery, Google Sheets for support/access administration, and Google, Meta or Canva services connected by the customer. The Provider Register distinguishes service providers from independent payment providers and customer-authorized integrations.

Workspace administrators and authorized collaborators can access records within their permissions. We may also disclose information where legally required, to resolve disputes, protect rights or address security incidents, and in a lawful business transfer subject to applicable safeguards. The reviewed workflows do not implement the sale of personal data or cross-context advertising; connecting an advertising account for a customer’s work is a separate activity.

Providers and authorized recipients may process information outside your country, including outside India. We do not offer a verified country-specific residency or localization guarantee in this policy. For a transfer requiring safeguards, the applicable parties must establish the required legal mechanism and assessments, which may include EU standard contractual clauses or an appropriate UK instrument. A general DPA does not by itself satisfy those requirements. Contact us before submitting data subject to a specific residency or transfer restriction.

Workspace records and AI history generally remain until removed through available controls or a supported deletion request. Account settings and usage records may remain after a workspace-data wipe. A calendar-month reset of the AI counter does not erase historical usage records.

Billing/payment records, support correspondence, security/activity records, derived document artifacts, provider copies and backups can have separate retention. We have not established a uniform automatic deletion period across these categories. Records required for an applicable legal obligation or dispute may be retained for that purpose; a deletion request should identify the categories so we can explain any continuing retention and its basis.

Deletion from the active application is not a guarantee of immediate irreversible removal from backups, external providers, recipient devices or downloaded files. Backup retention and restoration safeguards must be confirmed for the relevant deployment. No fixed backup-erasure deadline is promised here.

• Wipe Account Data: an organization administrator can remove the main workspace records, including clients, projects, tasks through related records, financial records, generated documents, messages, AI chats and local integration records. The organization, user logins, preferences and completed onboarding remain. Payment/support records, usage history, some cached document artifacts and external copies are not all covered by this operation.
• Delete Entire Account: this is an administrator-controlled organization-wide operation, not a personal member-account deletion. It removes the organization’s application records and then attempts to remove the associated authentication identities. It affects other workspace users. Database and authentication deletion are separate steps, so a failure may require support to finish.
• An individual member seeking removal or correction should contact their workspace administrator or our privacy contact. Do not use the entire-account operation to remove just one person. Coordinate authority, other users’ access and any ownership changes before an organization deletion.
• Deleting local connection records does not guarantee provider-side credential revocation, deletion of remote content or cancellation of external subscriptions. Revoke grants in the external provider’s settings where appropriate. Export required records beforehand using available downloads or request assistance; there is no promise of a complete one-click export.

The application implements authentication, role and organization checks, credential-protection helpers, encrypted messaging workflows, request rate limiting and payment-verification controls. These descriptions do not certify all deployments or establish ISO, SOC 2 or other independent certification, universal encryption, a guaranteed backup service or an uptime target.

Miles recommendations and scores are decision-support outputs. Customers must maintain human oversight of consequential decisions and verify generated instructions before use. Applicable rights to object, contest qualifying automated decisions or seek human review remain available. Security incidents are assessed and notified according to the law and contract applicable to the incident.

For privacy, legal, billing or service requests, email contact@irisos.app, use Get Help in IrisOS, or write to GRL Enterprises at the business address above. Include the relevant workspace and request details; do not send passwords or payment-card credentials.

Depending on the applicable law and our role, you may request information and access, correction, erasure, restriction, portability, withdrawal of consent, objection to certain processing, and review of qualifying automated decisions. Withdrawal does not undo earlier lawful processing. Some records may remain under a lawful exception; we will explain a denial and any applicable review or appeal route.

We may request proportionate identity verification and evidence of authority for a representative. If we act for a customer, we may refer the request to that customer and assist it. Requests and complaints do not require a paid account. You may complain to the competent privacy authority without losing any mandatory remedy.

• EEA and UK: rights depend on the processing and lawful basis; responses are generally due within one month, with extensions and verification rules only where legally permitted. Where an extension applies, the required notice and reasons must be supplied. You may contact your competent supervisory authority or the UK ICO.
• India: access information, correction, erasure, grievance and nomination rights apply to the extent the relevant DPDP provisions have commenced and govern the processing. The Act and 2025 Rules have phased commencement; this policy does not represent all provisions as already in force. Other applicable privacy and grievance rights remain available.
• Singapore: applicable access, correction and consent-withdrawal rights are subject to PDPA conditions and exceptions. Access requests are handled as soon as reasonably possible; if a response cannot be provided within 30 days, the required written timing notice must be given. This does not promise GDPR-style portability or erasure rights under every law.

IrisOS uses cookies and browser storage for authentication, preferences and service continuity. Configured anti-abuse and performance tools may process technical signals. Optional uses that require consent must be disclosed and consented to before activation; disabling essential storage may prevent sign-in or normal operation.

IrisOS is intended for adult business users. Do not submit children’s data or highly sensitive information such as health records, biometrics, payment-card credentials or government identifiers unless the relevant feature and agreed safeguards specifically support that use. Contact us if such information has been submitted improperly.

Material changes will be communicated as required by the applicable agreement and law, with a prospective effective date. Where renewed consent or acceptance is required, it must be obtained before the change applies. A revised policy does not retroactively authorize a new use of personal data or impose new charges.

Nothing in these documents excludes or restricts mandatory privacy, consumer, payment-dispute or other statutory rights. If a mandatory legal protection conflicts with a provision, that protection prevails.

• Terms of Service
• Cancellation & Refunds
• Data Processing Agreement
• AI Usage & Credits
• Provider Register