GREENLANDAI

Privacy Policy

Version 1.2 — Effective 10 October 2026

Data Controller: Greenland AI Limited (Company No. 808784, Ireland)

1. Who We Are

GREENLANDAI is a frontier infrastructure intelligence platform operated by Greenland AI Limited. GREENLANDAI tracks and analyses physical-layer infrastructure assets across ten sectors: rare earth elements, compute, ocean resources, space infrastructure, Arctic resources, energy, robotics, manufacturing, biotech, and defence. The platform provides intelligence through an API for autonomous agents and a web dashboard for human operators.

Data Controller: Greenland AI Limited, Company No. 808784, Ireland. Contact: info@greenlandai.ai

2. What Data We Collect

2.1 Account Data. GREENLANDAI authenticates users through ENYAL, the identity provider for the Greenland AI ecosystem. GREENLANDAI does not collect passwords or manage authentication directly. When you access GREENLANDAI, we receive from ENYAL: your ENYAL account identifier, email address, and authentication status and OAuth scopes. GREENLANDAI stores your intelligence profile locally, including: your GREENLANDAI user identifier, account creation date, account subscription status, and your terms-acceptance record (archived to ENYAL).

2.2 Query Data. When you or your agents query GREENLANDAI, we collect: query text, parameters and filters; query timestamp and response time; entity identifiers accessed; frontier and resource type requested; relationship-intelligence depth (hop count); L4 basket contents and analysis requests; and a session identifier (for follow-up query context). Query data is the core of GREENLANDAI's service. It records what intelligence you requested, when, and at what depth. Query data is retained in GREENLANDAI's database and is subject to the retention periods in Section 7.

2.3 Agent Data. When agents query GREENLANDAI via the API, we collect: agent identifier; API key prefix (for identification — full keys are never stored); OAuth token scopes (if using ENYAL OAuth); query volume and patterns per agent; and rate-limit status.

2.4 ENYAL Archival Data. You may opt in to archival of query history to ENYAL's permanent immutable cryptographic ledger. When enabled: each query and its response are archived as an encrypted chunk in ENYAL; archived data is subject to ENYAL's data-permanence terms — it cannot be deleted from the permanent ledger (erasure is handled cryptographically — see Section 4.2); archival is billed in joules at ENYAL's published archive rate, through JoulePAI; and users must review ENYAL's data-permanence terms before enabling archival. Archival is disabled by default and must be explicitly enabled in the Dashboard settings. You may disable archival at any time; this stops future queries from being archived but does not affect previously-archived records.

2.5 Billing Data. GREENLANDAI query costs are billed in joules through JoulePAI. GREENLANDAI records: joule cost per query; billing transaction reference; and JoulePAI wallet identifier. GREENLANDAI does not process fiat payments directly. All payment processing, including credit-card and USDC deposits, is handled by JoulePAI. See the JoulePAI Privacy Policy for payment-data handling.

2.6 API Usage Data. When you use GREENLANDAI services, we collect: endpoint called and HTTP method; timestamp and response time; caller identifier (account, agent, or OAuth token); rate-limit status and burst-rate usage; x402 payment-negotiation metadata (if applicable); and a correlation identifier for cross-service request tracing.

2.7 Technical Data. We automatically collect: IP address; browser type and version (for Dashboard access); and access timestamps.

To protect the starter allocation from abuse, when you verify your email we check the address against public lists of disposable email services and the domain's mail server, and we keep a scrambled (hashed) record of the network range and device used, for up to 90 days, to stop the same person claiming it many times. Signing up is not affected. An allocation held for review is released after a manual check.

2.8 Communications. If you contact us, we retain: email correspondence and support requests. GREENLANDAI services may be accessed through the JoulePAI mobile application, which supports optional biometric authentication (Face ID, fingerprint). Biometric data is processed on-device by the operating system and is not received, transmitted, or stored by GREENLANDAI. See the JoulePAI Privacy Policy for details.

3. How We Use Your Data

We process your personal data for the following purposes:

3.1 Contract Performance (GDPR Article 6(1)(b)): providing and maintaining the intelligence platform; processing intelligence queries and returning results; managing account limits, rate limits and query allocations; billing queries through JoulePAI; maintaining session context for follow-up queries; archiving query history to ENYAL (when opted in); and authenticating you via ENYAL across the Greenland AI ecosystem.

3.2 Legitimate Interest (GDPR Article 6(1)(f)): detecting and preventing systematic data extraction and scraping; monitoring for prohibited use (redistribution, AI training, competing products); enforcing rate limits, burst rates and query allocations; monitoring platform security; generating anonymised, aggregated analytics to improve intelligence quality; and improving the knowledge graph using anonymised query patterns.

3.3 Legal Obligation (GDPR Article 6(1)(c)): financial record-keeping (7-year retention under Irish law); responding to lawful requests from regulatory authorities; and maintaining records required under Irish and EU law.

3.4 Consent (GDPR Article 6(1)(a)): sending marketing communications (only with explicit opt-in); processing cookies beyond those strictly necessary; and archiving query history to ENYAL (explicit opt-in per Section 2.4).

Marketing communications are sent only with explicit opt-in consent. You may unsubscribe at any time. GREENLANDAI complies with the ePrivacy Directive (and UK PECR where applicable) for all electronic marketing communications.

4. Intelligence Data and Privacy

4.1 Query Data Handling. Your query text is processed by our own query engine, including self-hosted, locally-operated language models running on our own infrastructure, alongside our proprietary database. Your query content is not shared with any third-party AI provider. Query data is stored in GREENLANDAI's database for the retention periods described in Section 7. We use anonymised and aggregated query patterns to improve the knowledge graph and intelligence quality. Individual queries are not disclosed to third parties.

4.2 ENYAL Archival. When ENYAL archival is enabled, query data is encrypted and archived to ENYAL's permanent immutable cryptographic ledger; the archived data consists of the query, the response, a timestamp, and metadata — all encrypted using ENYAL's ECDH encryption. Once archived, the data is permanent and cannot be deleted from the ledger. The right to erasure (GDPR Article 17) is addressed cryptographically by ENYAL: upon an erasure request, ENYAL destroys the key share it holds for your archive (for zero-knowledge archives, ENYAL never holds the means to read them in the first place), so the archived records remain on the permanent ledger but can no longer be read or linked back to you. (This crypto-erasure applies specifically to ENYAL archival; GREENLANDAI's erasure of your own account data is described in Section 8.3.)

4.3 Knowledge Graph Data. GREENLANDAI's knowledge graph contains information about infrastructure entities, companies, resources, and their relationships. This data is sourced from public and proprietary sources and does not contain personal data about GREENLANDAI users. The knowledge graph is the exclusive property of Greenland AI Limited.

5. Who We Share Data With

5.1 Greenland AI Ecosystem. ENYAL (trust infrastructure) — provides authentication via OAuth; receives query archives when opted in; ENYAL's own privacy policy applies to archived data. JoulePAI (payment infrastructure) — processes query billing in joules; receives billing transaction data; JoulePAI's own privacy policy applies. RAREEAI (resource marketplace) — GREENLANDAI intelligence may inform marketplace decisions; no query data is shared with RAREEAI directly. Each product has its own privacy policy. As ENYAL is the identity provider, suspension of your ENYAL account may affect your ability to authenticate with GREENLANDAI; your query history and intelligence data stored locally by GREENLANDAI are not altered by an ENYAL suspension; however, an ENYAL security freeze may also place your linked JoulePAI billing wallet in a read-only state, which can affect query billing until the freeze is lifted.

5.2 Service Providers. GREENLANDAI shares personal data only with the service providers needed to run the platform: Hetzner Online GmbH (infrastructure hosting) and Stripe (payment processing, via JoulePAI). Our primary infrastructure is hosted in the European Union (Helsinki, Finland). For disaster recovery, encrypted database replicas and backups are also maintained on a host located in the United States (Hetzner, Ashburn, Virginia); this replication is covered by the safeguards in Section 6. Operational and security alerts to our team are delivered via Telegram (Telegram FZ-LLC). These alerts may include technical data such as source IP addresses, requested endpoints, wallet identifiers, and the reason for an account action. Telegram acts as a processor for these operational notifications.

5.3 Legal Requirements. We may disclose data where required to comply with a legal obligation or court order, to protect the rights, property or safety of GREENLANDAI, our users or the public, or to detect and prevent fraud or illegal activity. Where a legal request includes a non-disclosure order, we cannot notify you.

5.4 No Sale of Data. We do not sell, rent, or trade your personal data to third parties for marketing or any other purpose.

5.5 Sub-Processor Changes. We may update our sub-processors from time to time. The current list of sub-processors is available on request by contacting info@greenlandai.ai.

6. International Data Transfers

Your data is primarily stored and processed in the European Union (Helsinki, Finland). For disaster recovery, encrypted database replicas and backups are also maintained on a host located in the United States (Hetzner, Ashburn, Virginia). Some data is also processed by a service provider in the United States (Stripe, for payment processing via JoulePAI).

Where personal data is transferred to the United States, it is protected by the European Commission's Standard Contractual Clauses, incorporated in our data processing agreement with our hosting provider (Hetzner); we also rely on the EU-US Data Privacy Framework where applicable, and on each service provider's own GDPR compliance measures.

For users in the United Kingdom, UK GDPR applies alongside GDPR. The rights and protections described in this policy apply equivalently under UK GDPR.

7. Data Retention

Data Type	Retention Period
Account data (profile, subscription status)	Anonymised on account closure or erasure (see Section 8.3)
Query history / query and API logs	Retained while your account is active (IP addresses removed after 90 days); deleted when you close your account
Security-monitoring records	Retained for security and audit purposes; IP addresses removed after 90 days
Billing records (joule costs, transaction references)	7 years (financial record-keeping under Irish law); pseudonymised on erasure
ENYAL archived queries (if opted in)	Permanent (encrypted, immutable ledger — see Section 4.2)
Session data (conversation context)	48 hours after last activity (auto-expiry)

While your account is active, your query and API logs and our security-monitoring records are retained.

IP addresses and backups. We remove IP addresses from our records 90 days after we record them; the rest of the record is kept. This does not apply to records that are permanent by design (Section 4.2). An address we block for abuse is kept for as long as the block is needed for security. Our backups are encrypted. They can hold copies of data, including IP addresses, until the backup is destroyed; database backups are destroyed after 12 months.

When you close your account, your sessions, query history and API request logs are deleted. Records written to the permanent archival ledger (if you opted in) are immutable and are retained; erasure of those is cryptographic (Section 4.2). Billing records required by law are retained for 7 years and are pseudonymised on erasure.

8. Your Rights

Under GDPR, you have the following rights:

8.1 Right of Access (Article 15). You can request a copy of all personal data we hold about you. This includes account data, query history, agent data, billing records, and API usage logs.

8.2 Right to Rectification (Article 16). You can request correction of inaccurate or incomplete account data. Query records cannot be rectified as they are historical records of queries that were executed.

8.3 Right to Erasure (Article 17). You can request deletion of your personal data. On account closure or an erasure request, GREENLANDAI anonymises your account record — your email address, password hash, API keys, payment-processor identifiers and the salt used for your consent record are nulled or replaced with a non-identifying value — and unlinks your platform wallet identifier and your archival index entries, so your account data can no longer be linked to you. Your sessions, query history and API request logs are deleted. Billing records required by Irish law are retained for 7 years in pseudonymised form. If you opted in to ENYAL archival, those records live on ENYAL's permanent immutable ledger; on erasure ENYAL destroys the key share that makes them readable (for zero-knowledge archives, ENYAL never holds the means to read them), so the archived data remains only as records that cannot be read or linked back to you (Section 4.2).

8.4 Right to Restriction (Article 18). You can request that we limit how we process your data in certain circumstances.

8.5 Right to Data Portability (Article 20). You can request a copy of your account data and query history in a structured, commonly-used, machine-readable format by contacting info@greenlandai.ai.

8.6 Right to Object (Article 21). You can object to processing based on legitimate interest. We will cease processing unless we demonstrate compelling legitimate grounds.

8.7 Right to Withdraw Consent. Where processing is based on consent, you can withdraw consent at any time without affecting the lawfulness of prior processing.

8.8 How to Exercise Your Rights. Submit requests to: info@greenlandai.ai. We will respond within 30 days. We may request identity verification before processing your request.

8.9 Right to Complain. If you believe we have not handled your data correctly, you have the right to lodge a complaint with the Irish Data Protection Commission: Data Protection Commission, 21 Fitzwilliam Square South, Dublin 2, D02 RD28, Ireland. Website: www.dataprotection.ie. Email: info@dataprotection.ie.

9. Cookies

9.1 Essential Cookies. We use strictly necessary cookies only. We do not use analytics, advertising, or third-party tracking cookies.

Name	Purpose	Duration	Type
greenlandai_session	Authentication — maintains your login session via ENYAL OAuth	24 hours	Strictly necessary (httpOnly, Secure, SameSite=Strict)
cookie_consent	Consent status — remembers that you have seen the cookie notice	1 year	Strictly necessary

The greenlandai_session cookie is httpOnly and cannot be accessed by JavaScript. It is transmitted only over HTTPS, is restricted to the greenlandai.ai domain, and lasts 24 hours. If we ever add non-essential cookies, we will update this policy and implement a full opt-in consent mechanism with granular category selection.

9.2 Analytics. We do not currently use third-party analytics cookies or tracking scripts. If this changes, we will update this policy and request your consent.

10. Security

We implement appropriate technical and organisational measures to protect your data, including: encrypted data transmission (TLS); authentication delegated to ENYAL with secure OAuth token handling; httpOnly secure session cookies (not accessible to JavaScript); rate limiting on all API endpoints with tiered burst-rate controls; SQL-injection prevention middleware on all endpoints; continuous automated security monitoring; correlation-identifier tracing across all services for security-event investigation; and query data encrypted at rest. ENYAL archival data is encrypted; depending on the archive trust model you choose, it is readable only by you (zero-knowledge) or recoverable with ENYAL's assistance using your key share (see Section 4.2).

No system is completely secure. If we become aware of a data breach that poses a risk to your rights, we will notify you and the Data Protection Commission within 72 hours as required by GDPR Article 33.

11. Children

GREENLANDAI is not intended for individuals under the age of 18. We do not knowingly collect data from minors. If we discover that a minor has created an account, we will delete it promptly.

12. Automated Decision-Making and Profiling

We use automated systems for: rate limiting (enforcing query limits and burst-rate controls); anti-scraping detection (monitoring for systematic data-extraction patterns); query/conversation session management (48-hour inactivity expiry — distinct from the 24-hour login cookie in Section 9.1); query billing (automatic joule deduction per query); and x402 payment negotiation (automated billing via HTTP 402 responses).

These automated processes may restrict platform access, throttle queries, or suspend accounts. They are technical controls applied based on objective criteria (request counts, query patterns, subscription limits). They are not decisions about your creditworthiness, trustworthiness, or character. GREENLANDAI does not perform automated profiling that produces legal or similarly significant effects on users. Anti-scraping detection is based on objective patterns (query velocity, parameter variation, extraction volume), not on inferred personal characteristics. You have the right to request human review of any automated decision that significantly affects you by contacting info@greenlandai.ai.

We also operate automated security systems that may block source IP addresses exhibiting attack or abuse patterns. A block may be permanent (for clear attack signatures) or temporary. IP-address blocks are network-level and are not account-level decisions about you; they are not individually notified. If you believe your IP address was blocked in error, contact us at info@greenlandai.ai.

13. Changes to This Policy

We may update this policy from time to time. Material changes will be communicated via a notice on the platform and email notification to registered users. The Version and Effective date shown at the top of this policy indicate the current revision. Continued use of the platform after changes constitutes acceptance.

14. Contact

For any questions about this privacy policy or your personal data: Email: info@greenlandai.ai. Company: Greenland AI Limited (Company No. 808784), Ireland.

This privacy policy is governed by Irish law and the General Data Protection Regulation (EU) 2016/679.