Privacy Policy

Welcome to Chaxi AI ("we", "our" or "us"), a service provided by ASell Empire Ltd., a UK company offering services to clients in France and the European Union. This privacy policy is established in accordance with: • The UK General Data Protection Regulation (UK GDPR) • The EU General Data Protection Regulation (GDPR) (EU) 2016/679 • The French Data Protection Act as amended • The UK Data Protection Act 2018 As we specifically target French customers, we comply with the requirements of the Commission Nationale de l'Informatique et des Libertés (CNIL) and have put in place measures to ensure that your data protection rights are fully respected. By using Chaxi AI, you accept the collection and use of your information in accordance with this policy. If you do not agree with the terms of this privacy policy, please do not access the site or use our services.

Company name: ASell Empire Ltd. Business name: Chaxi AI Registered office: 71-75 Shelton Street, Covent Garden, London, United Kingdom WC2H 9JQ UK registration number: 16341825 Directors: Thomas GIARDINA BIEMONT & Abdel GHADJGHEDJ Note: ICO registration pending. EU representative appointment in progress to ensure full GDPR compliance for French/EU clients. Contact for privacy questions: Email: privacy@chaxiai.com Support email: support@chaxiai.com EU/France support: france@chaxiai.com (Available 9am-5pm, 7/7)

We process your personal data on the basis of the following legal grounds, in accordance with Article 6 of the UK and EU GDPR: • Contract performance: Processing necessary for the performance of our service contract with you • Legitimate interests: To improve our services, ensure security and prevent fraud • Consent: For marketing communications and certain data processing activities • Legal obligations: To comply with UK, European and French laws applicable to our services

4.1 Information you provide directly • Account information: Name, email address and Google account identifier via Firebase authentication • Professional information: For French taxi companies - company name, SIRET/SIREN number, contact details, service areas and taxi/VTC license information • Chatbot configuration: Settings and preferences including departure/destination data, euro pricing and booking settings • Payment information: Billing address, VAT number (for French businesses), payment method details processed via Stripe 4.2 Information collected via third-party integrations When you connect your accounts, we access: • Google Calendar: Access to create, read and manage calendar events for taxi bookings • Gmail: Authorization to send notification emails on your behalf • WhatsApp Business: Connection details and message data necessary for your chatbot operation Chaxi AI attests to comply with Google's Limited Use policy requirements for Workspace APIs. No personal data from Gmail or Calendar is used to train an artificial intelligence model, nor shared with third parties. 4.3 Information collected automatically • Usage data: Information about how you interact with our service • Device information: Browser type, IP address, device type, operating system • Location data: We detect that you are accessing from France for compliance purposes • Cookies: Used in accordance with UK and French cookie regulations

6.1 Service providers (processors) • Google (USA): Firebase, Calendar, Gmail – with appropriate safeguards • WhatsApp/Meta (USA): Chatbot messaging – with appropriate safeguards • Stripe (Payment processing): Secure payment processing with EU operations • Hosting providers: EU-based servers for French client data 6.2 Other recipients • UK authorities (HMRC, ICO) when required by law • French authorities (for VAT compliance, CNIL requests) • Professional advisors subject to confidentiality • Potential acquirers (with notice)

We comply with both UK and French retention requirements, applying the longer period where they differ: • Account data: Contract duration + 5 years (French commercial law) • Booking data: 6 years (UK limitation period) or 5 years (French requirement) • Financial/VAT documents: 7 years (UK) or 10 years (French accounting obligations) • Marketing data: 3 years from last interaction • Technical logs: 1 year (CNIL recommendation)

You have full rights under the UK and EU GDPR: • Right of access: Request a copy of your personal data • Right of rectification: Correct inaccurate or incomplete data • Right to erasure: Request deletion ("right to be forgotten") • Right to restriction: Limit processing in certain circumstances • Right to portability: Receive your data in a portable format • Right to object: Object to processing, particularly for marketing purposes • Automated decision-making: Right not to be subject to purely automated decisions • Withdrawal of consent: Withdraw your consent at any time • Digital rights after death (France-specific): Give instructions on the fate of your data after death To exercise these rights, contact us at privacy@chaxiai.com with proof of identity. We will respond within one month.

We implement security measures compliant with UK and French standards: • TLS encryption for data in transit • AES-256 encryption for data at rest • Security practices aligned with ISO 27001 • Regular penetration testing • GDPR-compliant incident management procedures • UK and European data protection training for staff • Secure payment processing via Stripe (PCI-DSS compliant)

ASell Empire Ltd. (operating under the name Chaxi AI) 71-75 Shelton Street, Covent Garden London, United Kingdom WC2H 9JQ For any privacy-related questions: Email: privacy@chaxiai.com Support: support@chaxiai.com France support: france@chaxiai.com (9am-5pm, 7/7) EU/France Representative: Appointment in progress By using Chaxi AI, you acknowledge that you have read and understood this privacy policy and agree to its terms.