Privacy Notice

1. Who is responsible for your information

One Poesis (legal name: To be confirmed, address: To be confirmed) operates One Poesis and is the personal information controller for the information described here. Our Data Protection Officer is To be confirmed and can be reached at [email protected].

This notice explains how we handle personal information under the Data Privacy Act of 2012 (Republic Act No. 10173) and its implementing rules. It applies to the websites www.poesis.space and poesis.one and the One Poesis app. Where other laws apply to you, for example if you are in the EEA or UK, those laws may give you additional rights; this draft does not decide which law applies to every user.

This page is a draft for review. Company identity and DPO details still show as To be confirmed until Master verifies them. Counsel has not approved this text.

2. What we collect

• Early access requests: your email, first and last name, date of birth (to confirm you are at least 18), whether you apply as an individual or business, company name, and what you are looking for.
• Account: your name and email. Your password is handled by our authentication provider and stored only in hashed form.
• Profile and onboarding: username, date of birth, the kinds of work you create and your role, and anything you choose to add, such as a profile picture, bio, website, job title, company and home country. Username and date of birth are set during setup and are not editable later in the current product.
• Your creations and records: files you upload, titles, descriptions, stories, tags, versions, contributors and other details you add to your projects.
• Authorship and integrity records: a digital fingerprint (SHA-256 hash) of a file, worked out in your browser where that path is used, related Authorship certificate claim status, Claim Records, verification pages and related metadata.
• Application details: for an application you prepare, the applicant's name, whether they are an individual or business, email, phone number, address and business size, plus the Authorize One Poesis record showing what you agreed to and when.
• Conversations and drafts: messages you send to Pyli and other AI features, drafts you write, and the results we produce for you.
• Payments and credits: payment status, amounts, and reference numbers from our payment provider, receipts you upload for manual payments, and your credit history. We do not receive or store your full card number.
• Technical information: your IP address and request details, used for security and rate limiting, error reports (for example through Sentry), and the cookies and browser storage described below.
• Visit analytics: aggregate page-visit information through Vercel Analytics.
• The free readiness check: if you use it without an account, the idea text you enter and a session cookie so you can come back to your result.

3. Why we use it

• To provide One Poesis under our agreement with you: running your account, storing and organising your work, creating Authorship certificates and other records, giving guidance, preparing applications and processing payments.
• To file applications you have authorised, which means sending the required details to the relevant IP office or partner filing channel.
• To keep One Poesis secure, prevent fraud and abuse, and fix problems (our legitimate interests).
• To meet legal, tax and record-keeping obligations.
• To send service messages about your account, approvals, applications and payments.
• To understand aggregate product use through Vercel Analytics.
• With your consent, where the law requires it. You can withdraw consent at any time, without affecting what was done before.

We do not sell your personal information, use it for advertising, or use your creations to train AI models.

4. How AI features use your information

Pyli and AIP are powered by third-party AI models. When you use them, we send the provider the text you write and the parts of your workspace the feature needs, such as project titles, descriptions, tags, file names and the status of your records and applications. Conversations are limited in length, and we send only what is needed for that reply.

For ordinary chat attachments, One Poesis currently includes the file name and file type in the prompt text. The binary contents of uploaded files and images are not attached to that path. Separate research or media features may use different providers or formats; if a feature needs to send media bytes, we will update this notice before treating that path as covered.

Depending on how One Poesis is configured, requests go to Google (Gemini) or to OpenRouter, which passes them to the model provider that answers. Current models may include providers such as xAI (Grok) and Anthropic (Claude), with other providers, such as OpenAI or DeepSeek, used only as fallbacks if a model is unavailable. Some research features use Google Search to find public information.

These providers process your content to produce a reply, under their own terms. Some may keep requests for a limited time, for example for abuse monitoring. Whether each provider retains prompts, for how long, and whether any training use is contractually barred is not yet verified in this draft and needs Master's confirmation with counsel against the live provider settings. Avoid putting information in a prompt that you would not want an AI provider to process.

Name and domain research may look up names you enter in public domain registries and on public websites.

5. Who receives your information

We share information only with those who need it to provide One Poesis, and we require our service providers to protect it:

• Vercel: hosts the One Poesis app and websites, and provides Analytics for aggregate visits.
• Supabase: stores our database and your files, runs sign-in, and sends account emails through its configured email channel.
• Google and OpenRouter, and the model providers OpenRouter uses: process AI requests as described above.
• Stripe: processes card payments.
• Sentry: receives error reports so we can fix problems, configured not to collect personal information by default.
• Government IP offices, such as IPOPHL: receive the application details for applications you authorise.
• Independent licensed professionals or filing partners: where one is engaged for your application.
• Authorities: when the law requires it, or to protect rights, safety and security.
• A successor: if One Poesis is reorganised or sold, under the same protections, with notice to you.

Authorised One Poesis staff can access account content when needed to provide support you ask for, prepare and review an application you authorised, check a manual payment, investigate misuse or security issues, or meet legal obligations. Access is limited to staff who need it for those purposes.

Resend and Ganap-related services were checked in the repository for this draft and are not active product processors in the current codebase. If they are added later, this notice must be updated before they process personal information.

6. Information processed outside the Philippines

Several of our providers process information outside the Philippines, including in the United States and other countries where they operate. When we use them, we take steps required by the Data Privacy Act to keep your information protected to a comparable standard.

The specific transfer mechanism for each provider (for example a data processing agreement or standard contractual clauses) is not verified in this draft and needs Master's confirmation and lawyer review.

7. What other people can see

Your workspace is private to your account by default. Some things are visible to others:

• Your profile picture is stored at a public web address so it can be displayed. Anyone with that address can view it.
• Share links you create let anyone with the link view what you shared for seven days.
• Applications filed with a government office may be published by that office in its official register, as the law provides.

8. Cookies and browser storage

We use cookies and similar storage needed to run One Poesis: to keep you signed in, remember your account role, support password resets, and remember a free readiness check. We use Vercel Analytics for aggregate visits. We do not use advertising cookies.

One Poesis also stores some information in your browser, such as your remembered email if you ask for it, drafts, and files you keep on your device before uploading. This stays on your device, is linked to your signed-in account, and is not used for advertising.

9. How long we keep information

We keep your information while your account is active. You can delete your workspace or your account in Settings (Danger zone).

• Deleting your workspace removes your conversations, drafts, research, alerts and creations that are not part of an application, along with their files, subject to what the deletion code keeps for active filings.
• Deleting your account removes eligible files and closes or anonymises the sign-in account. Deleting an account is not available while a filing is in progress.
• What we keep: applications and filings, their supporting documents (such as payment receipts and authorisation records) and your credit and payment history, because government office and tax rules may require them. Where these records must stay, we remove or replace your name, email, picture and profile details where the product supports that, and close the account.

Exact calendar retention periods for backups, logs, tax records and government filings are not yet set in this draft and need Master's confirmation with counsel. Backups and logs are deleted on their normal cycle. We keep retained records only as long as the law requires.

We do not promise immediate or complete deletion of every copy everywhere (including provider backups) unless and until the product and provider contracts actually support that claim.

10. How we protect it

Information travels over encrypted connections. Your files are kept in private storage, and access rules limit each account to its own records. Passwords are stored hashed. Proof fingerprints are calculated in your browser where that path is used. Staff access is limited as described above. No system is perfectly secure; if a breach affects you, we will notify you and the National Privacy Commission as the law requires.

11. Your rights

Under the Data Privacy Act you have the right to be informed, to access your information, to object to processing, to have inaccurate information corrected, to have information erased or blocked, to data portability, and to claim damages, subject to the limits the law allows.

You can update most of your information in the app and delete your workspace or account in Settings. The current product does not yet offer a one-click personal data export. For access, correction beyond the profile editor, erasure help, portability or other privacy requests, email [email protected]. We may need to confirm your identity first. We will respond within the time the law requires.

If you are not satisfied, you can complain to the National Privacy Commission (privacy.gov.ph).

A specific response-time promise (for example a number of days) is not stated here until Master and counsel approve one.

12. Age

One Poesis is for people aged 18 and over. We do not knowingly collect information from anyone younger. If you believe we have, contact us and we will delete it.

13. Changes to this notice

We will update this notice when our practices change. The version and date at the top show the current draft revision while this page remains under review. If a change materially affects you after this notice is approved and published, we will tell you in the app or by email.