Privacy Policy

1. Introduction

Power Pals Ltd ("Power Pals", "we", "us" or "our") is an Irish incorporated provider of an AI assistance application used by both individual users (B2C) and business users (B2B).

This Privacy Policy explains, in plain English and with legal precision, how we collect, use, share, and protect personal data when you use Power Pals, including where you choose to connect third‑party services such as Google/Gmail or Microsoft/Outlook.

We are committed to handling personal data in line with:

• the General Data Protection Regulation (GDPR) and applicable Irish/EU data protection law; and
• applicable EU AI legislation relevant to how our AI assistance features are provided (including transparency expectations as they apply to AI systems in the EU as of 2026).

This Privacy Policy is intended to support both:

• website publication (so users can clearly understand how we handle personal data); and
• Google verification requirements where Power Pals integrates with Google services (including Gmail permissions); and
• Microsoft Verified Publisher requirements where Power Pals uses the Microsoft identity platform (including Microsoft Entra ID authentication and Microsoft 365 Outlook integration).

2. Who We Are (Controller Information)

Data Controller
Power Pals Ltd is the data controller for personal data processed through the Power Pals website and the Power Pals application (including where you connect Google/Gmail to use relevant features).

Company Location / Incorporation
Power Pals Ltd is incorporated in Ireland.

How to Contact Us (Privacy Queries)
If you have any questions about this Privacy Policy or how we handle your personal data, contact us at:

• Email: privacy@powerpals.ai

Supervisory Authority (Ireland)
If you are located in the EEA, you also have the right to raise concerns with the relevant supervisory authority. In Ireland, the supervisory authority is the Irish Data Protection Commission (DPC).

3. Scope of This Policy

This Privacy Policy explains how we handle personal data when you interact with Power Pals.

It applies to personal data processed in connection with:

• Website visitors who browse our site (whether or not you create an account).
• Individual customers (B2C) who create or use a Power Pals account.
• Business customers (B2B) (and their authorised users) who access Power Pals through an organisation, including:
  • administrators and account owners; and
  • employees, contractors, or other end users using Power Pals under that business arrangement.
• Users who connect a Google account or Gmail account to Power Pals, including where we access Google/Gmail data through Google permissions (scopes) you enable.
• Users who sign in using a Microsoft work or school account or personal Microsoft account via Microsoft Entra ID, and users who connect Microsoft 365 Outlook to Power Pals, including where we access Outlook email, calendar, contacts, and tasks through Microsoft Graph permissions you grant.
• Users of AI-powered features and integrations within Power Pals, including features that rely on AI model providers and features that connect to external services (such as Google/Gmail).

This Privacy Policy covers personal data processed:

• within the Power Pals app and services, including AI-assisted functionality; and
• through supported integrations (including Google/Gmail connections) when you choose to enable them.

Where your use of Power Pals is arranged through a business customer (for example, your employer or another organisation), this Privacy Policy still applies to our processing of your personal data in connection with providing Power Pals. Your organisation may also have its own internal policies that govern how you should use Power Pals.

This Privacy Policy does not cover third-party services, products, applications, or websites that may be linked to, integrated with, or used alongside Power Pals (including third-party AI model providers, Google services, and Microsoft services). Those third parties’ own terms and privacy policies will apply to their processing.

4. The Personal Data We Collect

We collect personal data from you directly (for example, when you create an account, connect integrations, enter prompts, or contact support) and automatically (for example, when you use our website/app).

The types of personal data we may collect depend on how you use Power Pals (including which features and integrations you enable) and whether you use Power Pals for personal use (B2C) or through a business account (B2B).

4.1 Account and identity data

This is data used to create, secure, and administer your Power Pals account, such as:

• Name
• Email address
• Password (or equivalent authentication credentials)

4.2 Profile data

This is data you choose to provide to build your profile and preferences in Power Pals, such as:

• Profile information you add in the app
• Preferences and settings associated with your account

4.3 AI interaction data (prompts and outputs)

When you use Power Pals’ AI assistant features, we process data related to your interactions, including:

• The prompts, instructions, messages, and other inputs you provide to Power Pals (including any personal data included in those inputs)
• AI-generated outputs returned to you
• Any content you upload or submit for the AI assistant to work with (including any personal data contained in that content)

4.4 Usage and technical data

When you access and use our website/app, we collect usage and technical data to operate, secure, and improve the service, such as:

• Usage/activity logs relating to your use of features and interactions with the service
• Device and connection information (including IP address)
• Other technical data generated as part of operating and securing the service

4.5 Payment data

If you purchase a paid plan or otherwise make payments, we process payment-related data, such as:

• Payment and transaction information needed to process your payment (note: payment processing is handled via a payment processing service)

4.6 Support communications

If you contact us for support or communicate with us (for example, to request help, raise an issue, or make an enquiry), we process:

• The content of your communications with us
• Contact details you provide as part of the support request
• Any other information you choose to include in your message (which may include personal data)

4.7 Google account data (including Gmail) - when you connect Google

If you choose to connect your Google account to Power Pals, we process Google user data to provide the Gmail-related functionality you enable.

(a) Google account identifier data

• Google account email address (via userinfo.email)

(b) Gmail data (restricted scope access)

Depending on the features you enable, we may process Gmail data via the following Google scopes:

• gmail.readonly - read email messages so the Service can find, summarise, and answer questions about your email at your request
• gmail.compose - create draft emails in your Gmail account for you to review and send yourself (Power Pals never sends email on your behalf)

Important: transient processing only. Gmail content accessed through these scopes is processed transiently (in-session) to provide the requested functionality and is not stored by Power Pals after retrieval.

4.8 Microsoft account data (including Outlook, Calendar, Contacts, and Tasks) - when you connect Microsoft

Power Pals uses Microsoft Entra ID (via MSAL.js / OAuth 2.0 / OpenID Connect) to authenticate users and, where you choose to connect Microsoft 365 Outlook, we access Microsoft 365 data via the Microsoft Graph API.

(a) Microsoft identity and account data (all authenticated users)

When you sign in using a Microsoft work or school account or personal Microsoft account, we receive basic identity data from Microsoft Entra ID, including:

• Display name and email address
• Account identifier (Microsoft user object ID)
• Tenant identifier (for work or school accounts)

(b) Microsoft 365 Outlook and Graph data (when you connect Outlook)

If you choose to connect Microsoft 365 Outlook, we may access Microsoft 365 data via the following Microsoft Graph API permissions:

• Mail.ReadWrite - read, compose, send, and manage email messages
• Calendars.ReadWrite - read and manage calendar events
• Contacts.ReadWrite - read and manage contacts
• Tasks.ReadWrite - read and manage tasks
• User.Read - read your basic profile information

Important: transient processing only. Outlook email, calendar, contact, and task data accessed via Microsoft Graph is processed transiently (in-session) to perform the action you request and is not stored by Power Pals after retrieval, except where you explicitly instruct the Service to retain content as part of a workflow you configure.

5. How and Why We Use Personal Data

We use personal data only where we have a lawful basis under the GDPR. The table below explains why we process personal data and the legal basis we rely on.

5.1 Purposes and lawful bases (GDPR Article 6)

5.2 Legitimate interests (when we rely on Article 6(1)(f))

Where we rely on legitimate interests, those interests typically include:

• keeping the Service secure and preventing fraud or misuse;
• maintaining and improving reliability, performance, and functionality;
• providing an effective customer support experience.

When we rely on legitimate interests, we consider and balance our interests against your rights and freedoms.

5.3 Consent (especially for Google and Microsoft integrations)

Where we rely on consent, you can withdraw your consent at any time by disconnecting the relevant integration or otherwise stopping the relevant permission/authorisation. For Microsoft integrations, you can revoke access via your Microsoft account settings or Azure/Entra account permissions. Withdrawing consent does not affect the lawfulness of processing carried out before you withdrew it.

5.4 No model training on your data

We do not use your personal data to train models.

6. AI Functionality and Transparency

6.1 AI-generated outputs (and what that means)

Power Pals includes AI-powered features. When you use these features, you may receive AI-generated outputs (for example, summaries, suggested text, drafts, recommendations, or other assistance). These outputs are generated by AI and are provided to help you work more efficiently and make informed choices.

6.2 Outputs are probabilistic and may be incorrect

AI outputs are probabilistic. This means they are generated based on patterns and probabilities, and they may:

• be incomplete, inaccurate, or outdated,
• contain mistakes or misleading statements,
• not apply to your specific situation,
• reflect limitations in the information available to the AI at the time.

You should review and validate AI outputs before relying on them, especially for important decisions.

6.3 Assistive by design; human-in-the-loop by default

Power Pals is designed to assist and advise. By default, it is human-in-the-loop, meaning:

• you (or your organisation’s authorised users) remain responsible for decisions and actions, and
• AI outputs are intended to support human judgement rather than replace it.

6.4 No automated decision-making with legal or similarly significant effects (by default)

By default, Power Pals does not make decisions about you that produce legal effects or other similarly significant effects without meaningful human involvement. The service is intended to provide support, suggestions, and drafting assistance rather than autonomous decision-making.

6.5 Model training: no training of foundation models using your data

Power Pals does not use your personal data to train foundation models (i.e., the large general-purpose AI models used to generate outputs). In other words, your data is not used to improve or train those underlying models.

6.6 Responsible use expectations and limitations

You are expected to use Power Pals responsibly and in a way that reflects its assistive nature. In particular:

• Do not treat AI outputs as professional advice without independent review.
• Do not rely on AI outputs as the sole basis for decisions that require human judgement or oversight.
• Where you can configure or connect Power Pals to other tools or workflows, you are responsible for ensuring your configuration is appropriate and complies with applicable law and your own internal policies.

If you have questions about how Power Pals’ AI features work in practice for your specific use case, you can contact us using the details provided in this Privacy Policy.

7. Google API and Gmail Data Disclosure

If you choose to connect your Google account (including Gmail) to Power Pals, we will access and use certain Google user data only to provide the features you request. We handle this data in line with the Google API Services User Data Policy requirements, including Limited Use requirements.

7.1 Google API scopes we request

Power Pals requests only the scopes needed to enable the Google/Gmail features you turn on. The scopes we use may include:

• gmail.readonly (a restricted scope) - to read email messages so the Service can find, summarise, and answer questions about your email when you ask
• gmail.compose (a restricted scope) - to create draft emails for your review; Power Pals does not send email on your behalf
• userinfo.email - to identify the Google account you connected

7.2 How access works (OAuth 2.0)

We access Google data only after you authorise access using OAuth 2.0. This means:

• You authenticate directly with Google.
• You can revoke Power Pals’ access at any time via your Google account settings.
• Access is designed around minimum privilege (requesting and using only what is required for the features you enable).

7.3 What we do with Gmail and Google user data (Limited Use)

When you connect Gmail, Power Pals uses Gmail and related Google user data only to provide the connected functionality you request.

In particular:

• No sale of Google user data: We do not sell Google user data.
• No secondary use beyond our service: We do not commercialise Google user data beyond using it to provide Power Pals’ functionality for you.
• No AI training: We do not use Google user data (including Gmail data) to train AI models.
• Secure, restricted access: Access is limited and controlled using minimum privilege and security controls aligned with ISO 27001 practices.

Use with AI model providers: Where Gmail data is processed to generate AI-assisted drafts or responses at your direction, it is transmitted only as strictly necessary to perform the user-requested action and remains subject to the same Limited Use, no-sale, and no-training restrictions described above.

7.4 Transient processing (no storage of Gmail content)

Power Pals processes Gmail data transiently. This means:

• Gmail content is used in-session to perform the task you requested.
• We do not store Gmail content after retrieval as part of providing this integration.

7.5 User controls and deletion rights

You control whether Power Pals can access your Google account data:

• Disconnect/revoke access: You can revoke Power Pals’ access to Google data at any time through your Google account permissions.
• Deletion rights: You may request deletion of personal data associated with your Power Pals account in accordance with the rights described elsewhere in this Privacy Policy.

7A. Microsoft Identity Platform and Outlook Data Disclosure

Power Pals uses the Microsoft identity platform (Microsoft Entra ID) to authenticate users and, where you choose to enable it, the Microsoft Graph API to provide Microsoft 365 Outlook functionality. We handle Microsoft user data in line with the Microsoft identity platform for developers Terms of Use and applicable Microsoft API requirements.

7A.1 How authentication works (Microsoft Entra ID / MSAL)

Power Pals uses Microsoft Authentication Library (MSAL) and OAuth 2.0 / OpenID Connect via Microsoft Entra ID to authenticate users. This means:

• You authenticate directly with Microsoft - Power Pals does not handle your Microsoft password.
• Authentication covers both Microsoft work or school accounts (via Microsoft Entra ID / Azure AD) and personal Microsoft accounts.
• We receive only the identity claims (name, email, user ID, tenant ID) needed to create and manage your Power Pals session.

7A.2 Microsoft Graph API scopes we request (Outlook integration)

When you choose to connect Microsoft 365 Outlook, Power Pals requests only the Graph API permissions needed to provide the features you enable. These may include:

• User.Read
• Mail.ReadWrite
• Calendars.ReadWrite
• Contacts.ReadWrite
• Tasks.ReadWrite

7A.3 What we do with Microsoft 365 data (Limited Use)

When you connect Microsoft 365 Outlook, Power Pals uses Outlook and related Microsoft 365 data only to provide the connected functionality you request.

In particular:

• No sale of Microsoft user data: We do not sell Microsoft user data.
• No secondary use: We do not use Microsoft user data for advertising or for purposes beyond providing the Power Pals service to you.
• No AI training: We do not use Microsoft user data (including Outlook, calendar, contacts, or task data) to train AI models.
• Minimum privilege: We request and use only the Microsoft Graph permissions required for the specific features you enable.

7A.4 Transient processing (no storage of Outlook/Graph content)

Power Pals processes Microsoft 365 data transiently. This means:

• Outlook email, calendar, contact, and task data is accessed in-session to perform the action you requested.
• We do not store that content after retrieval as part of providing this integration, except where you explicitly instruct the Service to retain content as part of a workflow you configure.

7A.5 On-Behalf-Of (OBO) flow for work accounts

For users accessing Power Pals through a business or organisation (B2B), we use the OAuth 2.0 On-Behalf-Of (OBO) flow to access Microsoft 365 data on your behalf. This means:

• Power Pals acts on your behalf using tokens that are scoped to your account and the permissions you have granted.
• Your organisation’s Microsoft 365 administrator may also control what permissions can be granted.

7A.6 User controls and revocation

You control whether Power Pals can access your Microsoft account data:

• Disconnect/revoke access: You can revoke Power Pals’ access to your Microsoft account at any time through your Microsoft account permissions or your organisation’s Azure/Entra admin settings.
• Deletion rights: You may request deletion of personal data associated with your Power Pals account in accordance with the rights described in Section 12 of this Privacy Policy.

8. How We Share Personal Data

We share personal data only where it is necessary to provide and operate the Power Pals service, comply with law, protect the security and integrity of our systems, or support our business operations. We do not sell personal data.

When we share personal data with third parties, we do so under appropriate contractual safeguards and require those parties to protect personal data and use it only for the purposes we specify.

8.1 Service providers (processors and sub-processors)

We use trusted service providers to help us run Power Pals. Depending on how you use the service, this may involve sharing limited personal data with the following types of providers:

(a) Cloud hosting and infrastructure (Microsoft Azure - EU hosted)

We use Microsoft Azure infrastructure to host and operate Power Pals. As part of providing the service, personal data may be processed within our Azure environment and stored on Microsoft resources.

(b) AI model providers (GPAI / LLM providers we orchestrate)

Power Pals orchestrates multiple AI model providers to deliver AI-assisted functionality. Where required to provide the service, we may share relevant inputs with these providers so that they can return outputs to Power Pals. These providers may include:

• OpenAI
• Anthropic
• Google (Gemini)
• Perplexity

We share personal data with AI model providers only as needed to generate responses and operate the features you use, and under contractual safeguards.

(c) Payment processing

If you purchase paid services, we use a payment processing service. Payment providers process payment-related information to complete transactions and manage billing.

(d) Professional advisers

We may share personal data with our professional advisers (for example, legal, compliance, audit, or similar advisers) where necessary to:

• obtain professional advice,
• support our compliance obligations, or
• protect and enforce our legal rights.

8.2 Legal and regulatory disclosures

We may share personal data if we believe it is reasonably necessary to:

• comply with applicable laws, regulations, lawful requests, or legal process, or
• protect the rights, property, or safety of Power Pals Ltd, our users, customers, or others.

8.3 Business operations and protection

We may share personal data where necessary to support the secure and reliable operation of Power Pals, including to:

• investigate, prevent, or take action regarding security incidents or suspected misuse, and
• enforce our contractual terms.

8.4 Data minimisation and access controls

We apply the principle of minimum necessary sharing. This means:

• we only share the data required for the specific service function being performed, and
• we restrict access through role-based controls and minimum privilege practices.

8.5 Contractual safeguards

When we engage processors and sub-processors, we require them to implement appropriate safeguards and to process personal data only in line with our instructions and contractual commitments, including appropriate confidentiality and security obligations.

9. International Data Transfers

Power Pals Ltd uses Microsoft Azure infrastructure hosted in the EU. This means our core hosting and storage environment is EU-based.

However, some of the third-party AI model providers we use as part of our service may process data outside the European Economic Area (EEA). We do not control where those providers operate their infrastructure at all times, and as a result, certain processing may involve international data transfers.

9.1 When international transfers may occur

International transfers may occur where personal data is processed by our AI model providers in connection with providing AI functionality within the Power Pals service.

9.2 Safeguards we rely on

Where personal data is transferred outside the EEA, we put appropriate safeguards in place as required under GDPR. These safeguards may include:

• Standard Contractual Clauses (SCCs): contractual protections approved for international transfers; and/or
• EU–US Data Privacy Framework (EU–US DPF): where applicable, where a recipient is certified and the transfer can rely on that mechanism.

The safeguards used may depend on the relevant provider, the nature of the processing, and the transfer route.

9.3 Additional measures

In addition to the transfer safeguards above, we take steps designed to reduce transfer risk in practice, including limiting what is shared with third parties to what is necessary to provide the service.

If you would like more information about the safeguards used for a specific transfer, you can contact us using the details in Section 2.

10. Data Retention

We keep personal data only for as long as it is needed for the purposes described in this Privacy Policy, unless a longer period is required or permitted by law. Retention periods vary depending on the type of data and how it is used.

10.1 Account and profile data

We retain account and profile data while your account remains active. If you close your account, we will delete or anonymise this data within a reasonable period, unless we need to keep some of it for legal, security, dispute-resolution, or compliance reasons.

10.2 AI interaction data (including prompts and outputs)

We retain AI interaction data (such as prompts you provide and outputs generated for you) only for as long as needed to provide, maintain, secure, and improve the service, and to address support requests and troubleshooting.

Where we can, we minimise what we keep and how long we keep it, and we apply access controls consistent with minimum-privilege principles.

10.3 Gmail and Google user data (transient processing; not stored)

When you connect your Google account and use Gmail-related features, Gmail data is processed transiently. This means:

• we access and process Gmail data only to perform the action you request; and
• we do not store Gmail content after retrieval.

10.4 Microsoft 365 Outlook, Calendar, Contacts, and Tasks data (transient processing; not stored)

When you connect Microsoft 365 Outlook and use related features, Outlook, calendar, contact, and task data accessed via Microsoft Graph is processed transiently. This means:

• we access and process that data only to perform the action you request; and
• we do not store Outlook or Microsoft 365 content after retrieval, except where you explicitly instruct the Service to retain content as part of a workflow you configure.

Basic identity data received from Microsoft Entra ID at sign-in (name, email, account identifier) is retained for as long as your account remains active, as it is necessary to maintain your session and account.

10.5 Payment and transaction records

Where payment processing is used, payment and transaction-related records are retained for as long as necessary to administer billing, maintain accurate records, and meet applicable compliance obligations. We do not retain more than is necessary for these purposes.

10.6 Support communications

If you contact us for support, we retain support communications (and related diagnostic information you choose to provide) for as long as needed to:

• respond to and resolve your request;
• maintain service quality and continuity; and
• address follow-up queries, if needed.

10.7 Backups and residual copies

Personal data may remain in encrypted backups for a limited period after deletion from live systems. Where this happens, we restrict access and use the data only as needed for backup integrity, security, and system recovery.

10.8 Retention review

We periodically review the data we hold and how long we keep it, to ensure it remains limited to what is necessary for the purposes for which it was collected and used.

11. Security Measures

We use a combination of technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data.

Because security is an ongoing process, our controls are reviewed and improved over time in line with the nature of our services and the risks presented by the processing.

11.1 EU-based hosting and infrastructure controls

• EU hosting for our core infrastructure: Our application and core data storage are hosted on Microsoft Azure resources located in the EU.
• Provider-managed infrastructure safeguards: Where we rely on cloud infrastructure services, we also rely on the underlying security capabilities of those services (for example, physical security and certain platform security controls) as part of our overall security posture.

11.2 Encryption and secure transmission

• Encryption in transit: We use encryption for data transmitted between your device and our services, and between our services and integrated systems, to reduce the risk of interception.
• Encryption at rest: We use encryption for data stored within our systems to reduce the risk of unauthorised access to stored information.

11.3 Access controls, minimum privilege, and segregation

We restrict access to personal data and systems to help ensure that only authorised personnel and services can access them.

• Minimum privilege: Access is granted on a “least privilege” basis - meaning access is limited to what is necessary for a specific role or function.
• Role-based controls: Access is managed through role-based permissions and controlled administrative access.
• Restricted internal access: We apply strict access restrictions to sensitive integrations and data, including Google-related data.

11.4 Security management aligned to ISO 27001

We operate security controls aligned with ISO 27001 principles, including (at a high level):

• documented security policies and procedures;
• security risk management and control selection;
• access management and change controls;
• security incident management practices.

11.5 Third-party integration security (OAuth 2.0 and scope control)

For integrations that use Google services:

• OAuth 2.0 authentication: We use OAuth 2.0 to connect to Google services. This is intended to ensure that access is authorised by the user and can be revoked.
• Scoped access: We request and use Google permissions (scopes) on a minimum necessary basis and apply technical controls intended to prevent broader access than required.
• Controlled handling of Google data: We apply access restrictions and security controls designed to protect Google user data accessed via these integrations.

For integrations that use Microsoft services:

• MSAL and OAuth 2.0 / OpenID Connect: We use Microsoft Authentication Library (MSAL) and the Microsoft identity platform (Microsoft Entra ID) for authentication and Graph API access. This is intended to ensure that access is authorised by the user (and, where applicable, the organisation’s administrator) and can be revoked.
• Scoped Graph API access: We request and use Microsoft Graph permissions on a minimum necessary basis and apply technical controls intended to prevent broader access than required.
• Controlled handling of Microsoft 365 data: We apply access restrictions and security controls designed to protect Microsoft user data (including Outlook, calendar, contacts, and task data) accessed via the Microsoft Graph API.

11.6 Organisational safeguards

In addition to technical controls, we maintain organisational measures designed to support secure processing, including:

• limiting access to systems and data to authorised personnel;
• maintaining appropriate internal procedures to support secure operations;
• taking reasonable steps to ensure that people with access to personal data understand their security responsibilities.

11.7 Important security note

No method of transmission over the internet or method of electronic storage is completely secure. While we take reasonable and appropriate measures to protect personal data, we cannot guarantee absolute security.

12. Your Data Protection Rights

If you are located in the EU/EEA (including Ireland), you have rights in relation to your personal data under the GDPR. These rights are not absolute and may apply differently depending on the circumstances.

To exercise any of the rights below, contact us using the privacy contact details set out in Section 2 (Who We Are). We may need to verify your identity before we action your request.

12.1 Right of access

You have the right to ask us for confirmation of whether we process your personal data and, where we do, to request access to that personal data and certain related information.

12.2 Right to rectification

You have the right to ask us to correct inaccurate personal data about you, and (taking into account the purposes of processing) to complete incomplete personal data.

12.3 Right to erasure (“right to be forgotten”)

You have the right to ask us to delete your personal data in certain situations, for example where:

• the personal data is no longer necessary for the purposes for which it was collected or otherwise processed; or
• you withdraw your consent (where our processing is based on consent) and there is no other legal basis to continue processing; or
• you object to processing and there are no overriding legitimate grounds to continue; or
• the personal data has been unlawfully processed.

12.4 Right to restriction of processing

You have the right to ask us to restrict (limit) our processing of your personal data in certain situations, for example where:

• you contest the accuracy of the data (for a period enabling us to verify it);
• the processing is unlawful but you do not want the data erased;
• we no longer need the personal data for the relevant purposes, but you require it for the establishment, exercise, or defence of legal claims; or
• you have objected to processing and we are considering whether our legitimate grounds override your interests, rights, and freedoms.

12.5 Right to data portability

Where our processing is based on your consent or a contract with you, and the processing is carried out by automated means, you have the right to receive the personal data you have provided to us in a structured, commonly used, and machine-readable format, and to request that we transmit it to another controller where technically feasible.

12.6 Right to object

You have the right to object to our processing of your personal data in certain situations, including where we process your personal data on the basis of legitimate interests. If you object, we will stop processing unless we can demonstrate compelling legitimate grounds to continue that override your interests, rights, and freedoms, or where the processing is needed for the establishment, exercise, or defence of legal claims.

12.7 Right to withdraw consent

Where we rely on your consent to process personal data, you have the right to withdraw that consent at any time. Withdrawing consent will not affect the lawfulness of processing carried out before you withdrew it.

12.8 Right to lodge a complaint with the Irish Data Protection Commission

You have the right to lodge a complaint with the Irish Data Protection Commission (DPC) if you believe our processing of your personal data infringes data protection law. You can contact the DPC through its official channels.

We would appreciate the opportunity to address your concerns first - please contact us using the details in Section 2 (Who We Are).

13. EU AI Act Transparency Statement

Power Pals Ltd provides an AI assistant application and, for the purposes of applicable EU AI legislation (including the EU AI Act as it applies on 28 February 2026), we consider Power Pals Ltd to act as an AI system provider for the AI system made available to users under the “Power Pals” name.

13.1 Our AI system risk position (as designed and made available by us)

Power Pals is designed and made available as an assistive AI system. It is intended to support users with tasks and content generation, and is not designed to make autonomous decisions that produce legal effects or similarly significant effects on individuals.

Based on the intended purpose and how Power Pals is designed to operate, we consider Power Pals to be a limited-risk AI system for EU AI Act purposes.

13.2 Transparency commitments

We are committed to transparency about how our AI assistant operates. In practice, this means we aim to ensure that:

• Users can understand they are interacting with AI-supported functionality within the Power Pals service.
• The service is presented as an assistive tool, and users are expected to apply human judgment before acting on outputs.
• We communicate meaningful information about the system’s intended use and limitations in user-facing materials and product experiences, where appropriate.

13.3 Human oversight by default

Power Pals is designed with human-in-the-loop oversight by default. The system is intended to assist and advise rather than operate as an autonomous decision-maker.

13.4 Risk monitoring and responsible operation

We maintain processes intended to support responsible operation of Power Pals, including:

• Monitoring for foreseeable risks associated with the AI assistant’s use in real-world contexts.
• Reviewing, prioritising, and addressing issues that may arise from how the service is used or how outputs are generated.
• Maintaining internal documentation and governance practices appropriate to an AI system provider posture.

13.5 Prohibited and not-intended uses (high-risk use restrictions)

Power Pals is not intended to be used as a high-risk AI system or for use cases that would materially change its risk profile. In particular:

• Power Pals is not intended to be configured or used to make fully automated decisions with legal or similarly significant effects on individuals.
• Where customers or users have the ability to build or edit connections and workflows, they must not use Power Pals in ways that would create a high-risk or otherwise non-compliant deployment, including uses that contradict the system’s intended assistive, human-oversight design.

We may take steps to restrict, suspend, or terminate access where we become aware of use that is inconsistent with these restrictions or our applicable terms, policies, or legal obligations.

13.6 Evolution of obligations and updates

EU AI legislation is evolving and obligations may phase in or be clarified over time. We will update our transparency statements and supporting measures as needed to reflect changes in our service and applicable legal requirements.

14. Children’s Data

Our Services are not intended for children under 16 years of age.

• No accounts for children under 16: If you are under 16, you must not create an account or use the Services.
• No knowing collection: We do not knowingly collect personal data from children under 16.
• If we learn a child has provided personal data: If we become aware that a child under 16 has created an account or provided personal data, we will take steps to delete that data and close the account (unless we have a valid legal basis and are legally permitted to retain certain information).
• Parents/guardians: If you are a parent or guardian and believe a child under 16 has provided personal data to us, please contact us using the contact details set out in this Privacy Policy so we can address the issue.

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our services, how we operate, legal or regulatory requirements, or our privacy practices.

How we will notify you

When we make changes, we will:

• post the updated Privacy Policy on our website (and/or within the Power Pals service, where applicable); and
• update the “Last updated” date at the top of the Privacy Policy.

If a change is material, we may also take additional steps to bring it to your attention (for example, by providing an in-product notice or sending an email notification where we have your email address and it is appropriate to do so).

When changes take effect

Unless we state otherwise, updates take effect from the date they are published.

Your acceptance of updates

By continuing to use Power Pals after an updated Privacy Policy is published, you acknowledge that you have had the opportunity to review the changes and agree to the updated Privacy Policy.

If you do not agree with an updated Privacy Policy, you should stop using Power Pals and, where applicable, close your account.