Privacy Policy

This Privacy Policy describes how CentroidAI, Inc. (“CentroidAI”, “we”, “us”, “our”) collects, uses, discloses and protects information. It applies to visitors to our website, job applicants, and customers who use our services.

CentroidAI is an AI-powered behavioral intelligence platform serving organizations across life sciences, healthcare, medical technology, higher education and non-profit sectors. Our products help organizations predict and act on behavioral change, in donor populations, patient cohorts, hospital accounts, alumni networks and commercial relationships, while maintaining the highest standards of data privacy and security.

We are committed to protecting the privacy of all individuals whose data we may encounter, including your customers, patients, donors, students and alumni. CentroidAI, Inc. is a Delaware corporation headquartered in Knightdale, North Carolina, USA.

1.Information we collect

1.1 Information you provide directly

Job applicants. When you apply for a position, we collect what you submit: your name, contact information, resume, work history, and anything else you choose to provide. It is used solely for recruitment and hiring decisions.

Business contacts. When you inquire about our services or become a customer, we collect business contact information such as your name, company, job title, email address and phone number.

1.2 Information we process on behalf of customers

As a data processor, we process data our customers provide for analytics purposes. That data belongs to our customers, not to CentroidAI. We process it only according to our customers’ instructions and the applicable data processing agreement.

Depending on the product, it may include aggregated marketing and campaign performance data; donor behavioral and engagement patterns; de-identified or pseudonymized patient clinical data including laboratory values, medication history and diagnostic codes; commercial order and account activity from enterprise resource planning systems; healthcare professional behavioral and network data; alumni engagement, giving history and phonathon response data; and non-profit supporter and beneficiary engagement patterns.

We strongly encourage customers to anonymize or de-identify data before providing it. We do not combine data across customers.

1.3 Information we do not collect from website visitors

When you visit centroid-ai.com we do not collect personal information unless you volunteer it. Specifically we do not collect social media account information, personal browsing history, search queries, information about your customers or vendors, or financial information.

1.4 Cookies and tracking technologies

One thing is stored in your own browser, and only if you ask for it. If you unlock a white paper by giving an email address, we store the domain of that address and the time, so you are not asked again on your next visit. It stays in your browser, it is never sent anywhere as a tracking signal, and the white paper cannot remember you without it. Clearing your browser storage removes it.

If we ever add an analytics tool, we will name it in this section and say what it collects before we switch it on.

1.5 Information we collect from public and third-party sources

Some of our products, in particular FyndEm Shield, work by observing information that is already public. We collect it on behalf of a customer, for their own brands and products, and on their instruction.

What we collect. Notices, alerts and enforcement records published by regulators and health authorities; domain registration and DNS records; publicly listed product information; listings offered for sale on online marketplaces, accessed through those marketplaces’ own programming interfaces where they provide one; the content of public web pages; and photographs appearing on those pages and listings, together with our own screen captures recording what a page showed at a given time.

Personal information within it. This material is about products, listings and sellers rather than about consumers, but it can contain personal information. A listing may carry a seller’s name or handle. A regulator notice may name an individual. A web page or a photograph may show a person, a business address or contact details. We treat that as personal data and apply this policy to it.

Why we collect it. To identify and evidence the sale of falsified, diverted, stolen or unauthorized medicines and other products, and to help the rights holder and the authorities act on it. We do not use it for advertising, we do not build profiles of consumers, and we do not sell it.

How we limit it. We collect only material connected to the brands and products a customer has asked us to watch. Our collectors identify themselves rather than presenting as an ordinary browser, they read pages only, and they honor a request to stop; see our crawler page. We keep photographs and screen captures privately, for a limited period, and we delete them when that period ends unless a named person has recorded a reason to keep a specific item for a specific case. We do not publish this material, and we do not use it to train artificial intelligence models.

What we do not do. We do not attempt to sign in to any account, complete any purchase, submit any form, or gain access to anything not publicly available. We do not combine this material across customers.

If you believe we hold information about you that we collected this way, section 6.1 explains how to ask.

1.6 Children’s information

Our services are not directed to children under 18. We do not collect personal information from children. If you believe we have inadvertently collected information about a child, contact us at privacy@centroid-ai.com and we will promptly delete it.

2.How we use information

2.1 Our direct uses

Processing job applications and making hiring decisions; communicating with prospective and current customers about our services; providing customer support; complying with legal obligations; and protecting our rights and preventing fraud.

2.2 Processing customer data

We process customer data solely as instructed by our customers and as specified in our data processing agreements, and only to provide the analytics services they have contracted for. We do not use one customer’s data to benefit another.

2.3 AI and machine learning

Our platform uses proprietary artificial intelligence and machine learning methods. Our commitments:

• Training data. Our models are trained on aggregated, anonymized datasets. We do not use individual customer data to train our general-purpose models without explicit written consent.
• Human oversight. AI-generated insights are subject to quality review. Our AI assists human decision-making but does not make autonomous decisions affecting individuals.
• Algorithmic transparency. On request we provide customers with documentation explaining how the platform processes their data, what factors influence outputs, and the general methodology, under applicable confidentiality agreements.
• Bias prevention. We audit our algorithms for potential bias and take corrective action when issues are identified.

We do not use imagery or web content collected from public and third-party sources, as described in section 1.5, to train any model.

3.Information sharing and disclosure

CentroidAI will never sell your personal information. We will never share it with third-party marketing companies or mailing lists. We share only in these limited circumstances:

• Service providers. A limited number of sub-processors help us operate. They are contractually bound to protect your information and may use it only to provide services to us. We provide a list of sub-processors on demand.
• Legal requirements. Where required by law, court order or regulation, or where we believe disclosure is necessary to protect our rights, your safety or the safety of others.
• Business transfers. In a merger, acquisition or sale of assets, your information may transfer as part of the transaction. We will notify affected parties of any change in control.

4.Data security

• Encryption. Data is encrypted in transit using TLS 1.2 or higher, and at rest using AES-256.
• Access controls. Role-based access and least privilege. All team members use multi-factor authentication.
• Infrastructure. SOC 2 Type II certified cloud infrastructure, data centers in the United States.
• Monitoring. Logging and monitoring to detect and respond to potential incidents.
• Security reviews. Regular assessments and vulnerability testing.

For more detail, contact security@centroid-ai.com.

5.Data retention

• Job application data. Up to two years after the position is filled, unless you request earlier deletion.
• Customer data. For the duration of the service agreement plus thirty days, after which it is securely deleted unless a longer period is required by law or requested by the customer.
• Business contact information. While we have an ongoing business relationship, plus three years for legal and compliance purposes.
• Public and third-party source material. Records of what we observed, including the source address, the date and a cryptographic fingerprint, are retained for the duration of the customer’s service agreement. Copies of photographs and screen captures are retained for 30 days by default and then deleted, unless a named person records a reason to keep a specific item as evidence for a specific case, which is logged. Where the source’s own terms require earlier deletion, those terms govern; material obtained from an online marketplace is deleted as soon as the underlying listing is no longer publicly available.

6.Your rights

Depending on your location you may have the right to access a copy of information we hold about you, to request correction of inaccurate information, to request deletion subject to legal exceptions, to data portability, and to object to certain processing.

To exercise any of these, contact privacy@centroid-ai.com. We will respond within thirty days. We may need to verify your identity first.

California residents. We do not sell personal information as defined under the California Consumer Privacy Act.

6.1 If we are not in a relationship with you

You may be a seller, a site operator or another individual whose information we encountered while observing public sources on a customer’s behalf, rather than a customer, a website visitor or a job applicant. The rights above still apply to you.

Write to privacy@centroid-ai.com, telling us where you saw the material or what identifies it, for example the web address or the listing. We will respond within thirty days. We may need to verify your identity, or your authority to act for a business, before we act.

If your concern is that material we hold infringes your copyright, the faster route is the takedown procedure in our Terms of Use, which names a designated agent and a five-business-day acknowledgment.

7.Regulated industries and compliance

• Healthcare (HIPAA). Our infrastructure and processes are designed with HIPAA requirements in mind. We are prepared to enter into Business Associate Agreements with covered entities where appropriate. Contact legal@centroid-ai.com.
• Higher education (FERPA). When processing data for educational institutions we operate as a school official with a legitimate educational interest, or under the direction of the institution as a data processor. We do not disclose student educational records except as directed by the institution or required by law.
• Non-profit organizations. Donor, beneficiary and supporter data is treated as confidential and processed only for the contracted analytics services. We do not share, sell or use it for any other purpose.
• Life sciences and medical technology. We offer Data Processing Agreements that comply with applicable privacy regulations. Contact legal@centroid-ai.com.

8.International data transfers

CentroidAI is based in the United States and our data is processed and stored there. For customers subject to the GDPR or other international privacy regulations we implement appropriate safeguards, including Standard Contractual Clauses where applicable. For EU-based customers we offer data processing in EU-region infrastructure on request.

9.Security incident response

In the event of a security incident affecting personal information we will:

• Investigate and contain the incident promptly.
• Notify affected individuals within seventy-two hours of confirming a breach, unless law enforcement requests a delay.
• Notify relevant regulatory authorities as required by applicable law.
• Provide information about the nature of the incident, the data affected, and steps individuals can take to protect themselves.

To report a security concern, contact security@centroid-ai.com.

10.Changes to this policy

We may update this policy from time to time. When we make material changes we will update the effective date at the top, add a note to the version history below, and post a notice on our website. For material changes affecting existing customers we will provide direct notification by email.

11.Contact us

• General privacy inquiries: privacy@centroid-ai.com
• Security concerns: security@centroid-ai.com
• Legal, DPA and BAA requests: legal@centroid-ai.com
• Copyright and takedown: copyright@centroid-ai.com
• Crawler and collection questions: crawler@centroid-ai.com
• General contact: info@centroid-ai.com

Mailing address: CentroidAI, Inc., Attn: Privacy, 1236 Hardin Hill Ln, Knightdale, North Carolina, USA.

12.Version history

Version 5.0, October 2026. Added section 1.5 covering information collected from public and third-party sources, which is how FyndEm Shield operates. Added a retention category for that material and a rights route for people we are not in a direct relationship with. Rewrote section 1.4 to state that the site sets no cookies and uses no third-party analytics. Added copyright and crawler contact addresses.

Version 4.0, February 2026. Expanded company description and data type categories to reflect the six-industry product line. Added FERPA and non-profit data handling sections. Updated AI language. Added the EU infrastructure option for international customers.