Privacy Policy

1. Who we are

Iris Assistant, Inc. (“Meet Iris”, “Iris”, “we”, “us”) provides an AI personal assistant delivered as a mobile application with a cloud backend. We are the data controller for the personal data described in this policy.

2. The short version

• Iris acts on content you choose to connect (email, calendar, messages, contacts, files, and — if you use it — voice calls) to help you get things done.
• To answer your requests, Iris sends relevant content to third-party AI model providers (via OpenRouter). We disclose which ones below, and you consent to this when you use Iris’s AI features.
• We do not sell your personal information.
• You can access or delete your data — see Your rights.

3. Information we collect

a. Information you provide

• Account data: your name and email address (managed via Firebase Authentication) and authentication identifiers.
• Content you connect or create: when you connect an account or grant a permission, Iris accesses the data you authorize — e.g. email, calendar events, contacts, tasks, messages, and files you upload. Iris also stores your conversations with it and a memory derived from them to provide continuity.
• Voice / call data (optional): if you use Iris’s voice/calling features, we process call audio and transcripts to operate the feature.

b. Information collected automatically

• Usage and device data: app interactions, device and OS identifiers, language settings, IP address, and diagnostic logs used for security and reliability.
• Location (optional): if you enable location-based features, we process coarse visit/location signals to offer relevant suggestions. You can disable this in your device settings.

c. Information from integrations

When you connect a third-party account (e.g. Google / Gmail / Google Calendar or Microsoft / Outlook), we receive data from that service strictly within the scopes you grant.

4. How we use your information

We process your personal data for these purposes and legal bases:

We do not use your connected content (email, calendar, messages, files, voice) for advertising, and we do not sell it.

5. AI processing and third-party model providers

To fulfill your requests, Iris sends relevant content (your prompts and the connected context needed to answer) to third-party large-language-model providers through OpenRouter, which routes requests to providers such as Anthropic (Claude), Google (Gemini), and Moonshot (Kimi).

• These providers process your content to generate a response to your request.
• Iris does not use your content to train AI models. The providers’ handling of data is governed by their terms; we select providers and configure routing to limit use of your content to providing the service.
• This sharing is a core part of how Iris works; by using Iris’s AI features you consent to it. Apple’s App Store rules require explicit disclosure of sharing personal data with third-party AI — this section provides it.

6. Who we share data with (subprocessors)

We share data only with service providers that help us operate Iris, under contract and only as needed:

We may also disclose data to comply with law, enforce our terms, or protect rights and safety, and in connection with a corporate transaction (with notice where required). We do not sell your personal information and do not “share” it for cross-context behavioral advertising (as those terms are defined under California law).

7. Google & Microsoft user data (limited use)

If you connect a Google account, Iris’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We use Google user data only to provide and improve the user-facing features you request, do not transfer it except as necessary to provide those features or as required by law, do not use it for advertising, and do not allow humans to read it except with your consent, for security, or as required by law. The same limited-use commitments apply to data we receive from Microsoft Graph if you connect an Outlook / Microsoft account.

8. Data retention

We keep personal data only as long as needed for the purposes above, then delete or anonymize it, in line with our internal Data Retention Policy. In general, account data is kept for the life of your account, and operational logs are kept for a limited period for security and reliability. When you close your account or request deletion, we delete or anonymize your personal data within a reasonable period, except where we must retain it to meet a legal obligation. You can request deletion at any time (see §10).

9. Security

We protect your data with technical and organizational measures including encryption in transit (TLS 1.2+), encryption at rest for the production database and provider-managed encryption for cloud services, network firewalls, least-privilege access, monitoring, and regular backups. No system is perfectly secure, but we work to protect your information. Our security program is being assessed under SOC 2 (examination in progress).

10. Your rights

Depending on where you live, you may have the right to access, correct, delete, port, restrict, or object to the processing of your personal data, and to withdraw consent. California residents have the right to know, delete, correct, and opt out of sale / sharing (note: we do not sell or share for advertising). To exercise any right, email legal@meetiris.com. You may also lodge a complaint with your local data-protection authority. We will not discriminate against you for exercising your rights.

11. International transfers

We process and store data in the United States. If you access Iris from the EU, UK, or other regions, your data is transferred to the U.S. Where required, we rely on appropriate safeguards such as the EU Standard Contractual Clauses.

12. Children

Iris is not directed to children. You must be at least 18 years old to use Iris. We do not knowingly collect data from children below the applicable age; if we learn we have, we will delete it.

13. Changes to this policy

We may update this policy. We will post the updated version with a new “Last updated” date and, for material changes, provide additional notice as required.

14. SMS and text messages

If you provide and verify your mobile number in the Iris app, Iris may send you transactional and informational SMS text messages that relate to your own requests, for example confirmations of reservations, appointments or orders Iris arranges for you, information you ask Iris to find (such as an address, phone number, link or confirmation code), and status updates on tasks you assign. We send these messages only to the number you verified, and only as part of providing the assistant you asked for. We do not send marketing or promotional texts under this program.

• Consent: you opt in by entering and verifying your mobile number during onboarding and by asking Iris for assistance. Consent is not a condition of purchase.
• Message frequency varies based on your activity. Message and data rates may apply.
• Opt out at any time by replying STOP; reply HELP for help, or contact legal@meetiris.com.
• Your mobile opt-in and text-messaging consent information is never shared with third parties or affiliates for their own marketing purposes. The data categories described elsewhere in this policy exclude text-messaging opt-in and consent data from any such sharing.

15. Contact

Questions or requests: legal@meetiris.com · Iris Assistant, Inc., 801 S Miami Ave, Miami, FL 33131, USA.