This Privacy Policy explains how AICY, Inc. ("AICY", "Numen", "we", "us") collects, uses, discloses, and safeguards personal information when you use Numen — our AI operating system for finance, including the Numen Plan (FP&A) and Numen Books (cost accounting) modules, our websites, and related services (collectively, the "Services").
Numen is a business-to-business product built for finance teams. We act as a data processor (or "service provider") for the customer content you upload, and as a data controller for account, billing, and website data. This policy is effective as of the date shown above.
1. Information we collect
Account & contact data
Name, business email, password, company name, job title, and phone number.
Marketing preferences (optional).
Billing data
Plan, workspace count, billing contact, and payment records. Card details are handled by our payment providers; we do not store full card numbers.
Customer content
Financial data you upload or connect — general ledger and sub-ledger exports, trial balances, budgets, and related spreadsheets — together with the analyses, forecasts, and reports generated on your canvas.
Usage & device data
Log data, IP address, browser and device information, and product-usage events, collected automatically and through cookies. See our Cookie Policy.
2. How we use information
Provide, operate, secure, and improve the Services.
Authenticate users, manage subscriptions, and process payments.
Generate forecasts, scenarios, variance analyses, and reports from your content.
Respond to support requests and send service and, where permitted, marketing communications.
Detect, prevent, and address fraud, abuse, and security incidents.
Comply with legal obligations.
3. Legal bases (EEA / UK)
Where the GDPR or UK GDPR applies, we process personal data on the basis of contract performance, our legitimate interests (e.g., securing and improving the Services), your consent (e.g., marketing), and compliance with legal obligations.
4. AI processing
Numen is model-agnostic. To generate outputs, relevant content may be sent to large-language-model providers that act as our subprocessors. These providers process inputs solely to return a result and do not use your content to train their models. We do not sell your content, and we do not use customer content to train models for other customers.
5. Subprocessors
We engage vetted service providers under written data-processing terms:
Subprocessor | Purpose | Region |
|---|---|---|
Amazon Web Services | Cloud hosting & storage | Global |
Naver Cloud Platform | Cloud hosting & storage | KR |
Anthropic, OpenAI, Google | LLM inference (no training on inputs) | US |
Payment provider | Subscription & payment processing | Global |
Email provider | Transactional & newsletter email | Global |
A current list is available on request. We give notice before adding a subprocessor that materially affects the processing of customer content.
6. How we share information
We share personal data only with: (a) the subprocessors listed above; (b) authorities where required by law or valid legal process; and (c) an acquirer in the event of a merger, acquisition, or asset sale, subject to this policy. We do not sell personal information.
7. International transfers
We may process data in the Republic of Korea, the United States, and other jurisdictions where we or our subprocessors operate. Where required, transfers rely on appropriate safeguards such as the EU Standard Contractual Clauses.
8. Data retention
We retain account data and customer content for the life of your subscription and delete or anonymize it within a commercially reasonable period after termination, except where longer retention is required by law. You may request earlier deletion as described below.
9. Security
We apply administrative, technical, and physical safeguards, including encryption in transit and at rest, least-privilege access controls, audit logging, and regular reviews. No method of transmission or storage is completely secure.
10. Your rights
Subject to your jurisdiction, you may have the right to access, correct, delete, port, or restrict processing of your personal data, and to object to certain processing or withdraw consent. California residents may exercise rights under the CCPA/CPRA, including the right to know, delete, correct, and opt out of the "sale" or "sharing" of personal information (we do neither). To exercise these rights, contact us using the details below. We will not discriminate against you for exercising them.
11. Children
The Services are not directed to children and are intended solely for business use by individuals aged 18 or older.
12. Changes to this policy
We may update this policy from time to time. We will post the updated version with a new effective date and, for material changes, provide additional notice.
13. Contact
AICY, Inc. — 180 Bangbae-ro, Seocho-gu, Seoul, Republic of Korea.
Privacy inquiries: numen-support@aicy.ai