HORDUS AI LTD.

PRIVACY POLICY

Last Updated: June 1, 2026

This Privacy Policy explains how Hordus AI Ltd. (“Hordus,” “we,” “us,” or “our”) collects, uses, stores, discloses, transfers, and protects personal data in connection with our website, platform, dashboards, AI visibility tools, GEO audits, content workflows, APIs, integrations, communications, and related services.

Hordus AI Ltd. is located at Harakevet 58, Tel Aviv, Israel.

For privacy questions or requests, contact: privacy@hordus.ai.
For security issues, contact: security@hordus.ai.

The Services are intended for business customers only and are not intended for consumers, children, or personal use.

1. Important Notice: No Personal Data in Customer Workspaces

Hordus is a B2B platform. Customer workspaces are designed to process business, company, website, content, and GEO-related data, not personal data.

Customers must not upload, submit, connect, or provide personal data to the platform, whether sensitive or non-sensitive, unless Hordus has expressly agreed in writing.

This means Customers should not upload:

1. Personal contact lists.
2. Consumer data.
3. Employee records.
4. Candidate or HR data.
5. Health data.
6. Financial account data.
7. Government IDs.
8. Children’s data.
9. Sensitive personal data.
10. Private communications.
11. Any other information that identifies or can reasonably identify a natural person.

Hordus may still collect limited personal data from business representatives who interact with Hordus, such as business contact details, account login data, support communications, cookie data, and website usage data. This is explained below.

2. When This Privacy Policy Applies

This Privacy Policy applies to:

1. Visitors to the Hordus website.
2. People who request a demo, report, audit, or consultation.
3. Business representatives who communicate with Hordus.
4. Authorized users of Hordus customer workspaces.
5. Prospects, partners, suppliers, and service providers.
6. Users who interact with Hordus marketing, emails, forms, or events.
7. Users whose browser or device interacts with Hordus cookies, analytics tools, or advertising pixels.

This Privacy Policy does not apply to third-party websites, AI providers, search engines, social platforms, publishers, or integrations that are not controlled by Hordus.

3. Our Role

Depending on the context, Hordus may act as:

1. A controller or business when we operate our website, manage accounts, respond to inquiries, run marketing, secure the Services, analyze usage, and manage customer relationships.
2. A processor or service provider when we process Customer Data on behalf of a business customer under that customer’s instructions.

Where required, Hordus’s Data Processing Addendum and Subprocessor information are available upon request.

4. Personal Data We Collect

Although Customer workspaces should not contain personal data, we may collect the following limited categories of personal data in connection with operating our business and Services.

A. Business Contact Data

This may include:

1. Name.
2. Business email.
3. Business phone number.
4. Job title.
5. Company name.
6. Department.
7. Country or region.
8. LinkedIn or business profile information.
9. Communication preferences.

B. Account and Authentication Data

This may include:

1. User name.
2. Business email.
3. Account ID.
4. Workspace ID.
5. User role.
6. Login records.
7. Authentication tokens.
8. API key metadata.
9. Permissions.
10. Session information.
11. Security logs.

C. Website and Device Data

This may include:

1. IP address.
2. Browser type.
3. Device type.
4. Operating system.
5. Referring URL.
6. Pages viewed.
7. Time spent on pages.
8. UTM parameters.
9. Approximate location derived from IP address.
10. Cookie identifiers.
11. Pixel identifiers.
12. Interaction events.
13. Log data.

D. Communications and Support Data

This may include:

1. Emails.
2. Messages.
3. Demo requests.
4. Support tickets.
5. Meeting notes.
6. Feedback.
7. Survey responses.
8. Call summaries.
9. Contract-related correspondence.

E. Billing and Commercial Data

This may include:

1. Billing contact details.
2. Subscription plan.
3. Invoice details.
4. Payment status.
5. Tax information.
6. Purchase history.
7. Order Form details.

Payment card information, if used, is processed by payment providers and is not intended to be stored directly by Hordus.

F. Platform Usage Data

This may include:

1. Login activity.
2. Feature usage.
3. Workspace activity.
4. Tool calls.
5. Audit activity.
6. Draft generation activity.
7. Export activity.
8. API activity.
9. Error logs.
10. Performance logs.
11. Security and abuse-prevention logs.

G. Customer Workspace Data

Customer workspace data may include business and website-related data such as:

1. Company URLs.
2. Website pages.
3. Product descriptions.
4. Brand guidelines.
5. Public website content.
6. Prompts.
7. Topics.
8. AI answer records.
9. Citation sources.
10. Competitor lists.
11. Audit findings.
12. Content opportunities.
13. Drafts.
14. Reports.
15. Recommendations.
16. Comments and instructions.

Customer workspace data must not include personal data.

5. Sources of Personal Data

We collect personal data from:

1. You, when you submit forms, communicate with us, create an account, or use the Services.
2. Your organization, when it creates or manages a Hordus workspace.
3. Your browser or device, through cookies, pixels, logs, and analytics tools.
4. Service providers, such as CRM, analytics, advertising, email, security, hosting, and support tools.
5. Third-party integrations authorized by your organization.
6. Public business sources, where relevant to business development, market research, or GEO analysis.

6. How We Use Personal Data

We use personal data for the following purposes:

1. To provide, operate, maintain, and secure the Services.
2. To create and manage accounts and workspaces.
3. To authenticate users and manage permissions.
4. To respond to demo requests, questions, and support inquiries.
5. To perform GEO analysis, AI visibility analysis, content workflows, site audits, and reporting.
6. To generate business reports, recommendations, briefs, and draft content.
7. To monitor usage, performance, reliability, and security.
8. To prevent fraud, abuse, unauthorized access, and misuse.
9. To send service notices, administrative messages, security alerts, and billing communications.
10. To send marketing communications, newsletters, event invitations, and product updates, subject to opt-out rights.
11. To measure advertising and marketing effectiveness.
12. To improve our website, Services, workflows, user experience, and product features.
13. To comply with legal obligations.
14. To enforce agreements and protect rights.
15. To create aggregated or de-identified insights that do not identify individuals.

7. Legal Bases for Processing

Where GDPR, UK GDPR, or similar laws apply, we rely on the following legal bases:

8. Cookies, Pixels, Analytics, and Tracking Technologies

We use cookies, pixels, tags, scripts, local storage, SDKs, and similar technologies.

These may include:

1. Google Analytics.
2. Google Tag Manager.
3. Google Ads.
4. LinkedIn Insight Tag.
5. Meta Pixel.
6. HubSpot.
7. Hotjar.
8. Microsoft Clarity.
9. Other analytics, advertising, CRM, security, and performance tools.

We use these technologies to:

1. Operate the website and Services.
2. Authenticate users.
3. Remember preferences.
4. Analyze traffic and product usage.
5. Understand user journeys.
6. Improve performance.
7. Support marketing attribution.
8. Run advertising and retargeting.
9. Measure campaign performance.
10. Detect security issues and abuse.

Some cookies are strictly necessary. Others, including analytics, advertising, retargeting, and behavioral tracking technologies, may require consent depending on your location.

Where required, we use a cookie banner or consent-management tool that allows users to accept, reject, or manage non-essential cookies.

You can also manage cookies through your browser settings and through the cookie settings tool available on our website.

9. Advertising, Retargeting, and “Sale” or “Sharing”

Hordus uses advertising and retargeting technologies, including tools such as Google Ads, LinkedIn Insight Tag, Meta Pixel, and similar technologies.

We do not sell personal data for money.

However, under some U.S. privacy laws, including California law, certain advertising, retargeting, analytics, or cross-context behavioral advertising activities may be considered a “sale,” “sharing,” or “targeted advertising.”

Where applicable, you may opt out of such activities by:

1. Using the cookie settings tool on our website.
2. Using a “Do Not Sell or Share My Personal Information” link where displayed.
3. Sending a request to privacy@hordus.ai.
4. Using browser-based opt-out signals where legally required, such as Global Privacy Control.

10. AI Providers and Model Processing

Hordus may use AI providers and large language model providers to provide parts of the Services.

These may include:

1. OpenAI.
2. Anthropic.
3. Google/Gemini.
4. Perplexity.
5. Other AI, language model, classification, summarization, embedding, or analysis providers.

AI providers may be used to:

1. Analyze AI answers.
2. Summarize sources.
3. Classify prompts, topics, citations, and sentiment.
4. Generate recommendations.
5. Generate content briefs.
6. Generate draft content.
7. Rewrite or improve draft sections.
8. Create metadata, FAQ suggestions, schema suggestions, or reports.

Hordus does not use Customer Data to train public foundation models.

Customer should not submit personal data, confidential personal information, or sensitive data into the Services.

11. How We Share Personal Data

We may share personal data with:

1. Cloud hosting and infrastructure providers.
2. AI providers and model service providers.
3. Analytics providers.
4. Advertising and retargeting providers.
5. CRM and marketing automation providers.
6. Email and communication providers.
7. Security and fraud-prevention providers.
8. Customer support providers.
9. Payment and billing providers.
10. Professional advisors, including lawyers, accountants, auditors, and insurers.
11. Authorized customer administrators.
12. Third-party integrations authorized by the Customer.
13. Public authorities, courts, regulators, or law enforcement where required by law.
14. Parties involved in a merger, acquisition, financing, restructuring, or sale of assets.
15. Other parties where you or your organization direct us to share information.

Hordus’s Data Processing Addendum and Subprocessor information are available upon request.

12. International Transfers

Hordus is based in Israel and may process personal data in Israel, the European Economic Area, the United Kingdom, the United States, and other countries where Hordus or its service providers operate.

Where required by applicable law, we use appropriate safeguards for international transfers, such as:

1. Adequacy decisions.
2. Standard Contractual Clauses.
3. Data Processing Addenda.
4. Transfer impact assessments.
5. Contractual and technical safeguards.
6. Other lawful transfer mechanisms.

13. Data Retention

We retain personal data only for as long as reasonably necessary for the purposes described in this Privacy Policy, unless a longer period is required or permitted by law.

Unless otherwise agreed in an Order Form or required by law:

1. Customer workspace data is retained for up to 90 days after termination or account closure.
2. Drafts, reports, audit records, and generated outputs are retained for up to 90 days after termination or account closure.
3. Account, billing, tax, security, and legal records may be retained for longer where required for compliance, accounting, security, dispute resolution, or legitimate business purposes.
4. Backup copies may persist for a limited period according to backup cycles.
5. Marketing contact data is retained until opt-out, deletion request, or inactivity-based deletion.
6. Security logs may be retained as needed to protect the Services and investigate abuse.

14. Security

We use reasonable technical, organizational, and administrative safeguards designed to protect personal data.

These may include:

1. Access controls.
2. Authentication.
3. Permission management.
4. Encryption where appropriate.
5. Monitoring and logging.
6. Security reviews.
7. Vendor review.
8. Abuse-prevention controls.
9. Incident response procedures.
10. Least-privilege access practices.

No method of transmission or storage is completely secure.

If you believe there has been a security issue, contact security@hordus.ai.

15. Your Privacy Rights

Depending on your location and applicable law, you may have the right to:

1. Access personal data.
2. Correct inaccurate personal data.
3. Delete personal data.
4. Restrict processing.
5. Object to processing.
6. Withdraw consent.
7. Receive a portable copy of personal data.
8. Opt out of marketing communications.
9. Opt out of sale, sharing, targeted advertising, or certain profiling, where applicable.
10. Appeal a denied privacy request, where required by law.
11. Lodge a complaint with a data protection authority.

To exercise rights, contact privacy@hordus.ai.

We may need to verify your identity and authority before fulfilling a request.

If your request relates to personal data processed by Hordus on behalf of a Customer, we may refer the request to that Customer or act according to that Customer’s instructions.

16. Israel Privacy Notice

Where Israeli privacy law applies, you may have rights to inspect information about you, request correction or deletion of inaccurate, incomplete, unclear, or outdated information, and exercise other rights under applicable law.

Hordus’s contact for privacy requests is:

Hordus AI Ltd.
Harakevet 58
Tel Aviv, Israel
Email: privacy@hordus.ai

17. EEA, EU, and UK Privacy Notice

If you are located in the European Economic Area, European Union, or United Kingdom, you may have rights under applicable data protection law, including the right to access, rectify, erase, restrict, object, port data, and withdraw consent.

You also have the right to lodge a complaint with your local data protection authority.

Hordus does not intentionally collect personal data in Customer workspaces. Business contact, account, website, cookie, marketing, support, and usage data may still be processed as described in this Privacy Policy.

18. California and U.S. State Privacy Notice

This section applies where Hordus is subject to the California Consumer Privacy Act, as amended by the California Privacy Rights Act, or similar U.S. state privacy laws.

Categories of Personal Information Collected

In the last 12 months, Hordus may have collected the following categories of personal information:

1. Identifiers, such as name, business email, IP address, cookie ID, account ID, and online identifiers.
2. Commercial information, such as subscription details, billing records, and service history.
3. Internet or electronic network activity, such as website visits, product usage, logs, referring pages, and interaction data.
4. Professional or employment-related information, such as job title, company, department, and business contact information.
5. Approximate geolocation, such as location inferred from IP address.
6. Inferences, such as product interest, marketing segment, or usage patterns.
7. Communications, such as support requests, demo requests, and business correspondence.

Hordus does not intentionally collect sensitive personal information and does not permit Customers to upload sensitive personal information to the Services.

Sources

We collect personal information from:

1. You.
2. Your organization.
3. Your browser or device.
4. Service providers.
5. Advertising and analytics tools.
6. Public business sources.
7. Authorized integrations.

Purposes

We use personal information for the business and commercial purposes described in this Privacy Policy, including providing the Services, managing accounts, improving the Services, security, support, marketing, analytics, advertising, and legal compliance.

Disclosure

We may disclose personal information to service providers, contractors, subprocessors, authorized customer administrators, advisors, legal authorities, and business transaction parties.

Sale, Sharing, and Targeted Advertising

Hordus does not sell personal information for money.

Because we use advertising and retargeting tools, we may engage in activities that may be considered “sharing,” “sale,” or “targeted advertising” under some U.S. privacy laws.

You may opt out by using the cookie settings tool on our website, using the “Do Not Sell or Share My Personal Information” link where displayed, enabling legally recognized browser opt-out signals where required, or contacting privacy@hordus.ai.

California Privacy Rights

California residents may have the right to:

1. Know what personal information we collect, use, disclose, sell, or share.
2. Access personal information.
3. Delete personal information.
4. Correct inaccurate personal information.
5. Opt out of sale or sharing.
6. Limit use of sensitive personal information, if applicable.
7. Not be discriminated against for exercising privacy rights.

To exercise rights, contact privacy@hordus.ai.

19. Marketing Communications

You may opt out of marketing emails at any time by using the unsubscribe link in the email or contacting privacy@hordus.ai.

Even if you opt out of marketing emails, we may still send service, security, billing, legal, and administrative communications.

20. Children

The Services are intended for business users and are not directed to children.

We do not knowingly collect personal data from children under 16.

If you believe that a child has provided personal data to Hordus, contact privacy@hordus.ai.

21. Automated Analysis

Hordus may use automated tools, including AI systems, to analyze business websites, prompts, AI answers, citations, sources, competitors, audit findings, and content opportunities.

These tools support business recommendations and content workflows.

Hordus does not use automated decision-making to make legal or similarly significant decisions about individuals.

22. Aggregated and De-Identified Data

We may create aggregated, statistical, or de-identified data from use of the Services.

We may use such data to:

1. Improve the Services.
2. Develop benchmarks.
3. Analyze market trends.
4. Improve security and performance.
5. Create product insights.
6. Publish aggregated insights that do not identify Customers or individuals.

We will not attempt to re-identify de-identified data except as permitted by law.

23. Third-Party Websites and Services

The Services may link to or analyze third-party websites, AI platforms, search engines, social networks, forums, publishers, analytics tools, content platforms, or integrations.

Hordus is not responsible for the privacy practices, security practices, content, or policies of third parties.

24. Data Processing Addendum and Subprocessors

Where required, Hordus’s Data Processing Addendum and Subprocessor information are available upon request.

Requests may be sent to privacy@hordus.ai.

25. Changes to This Privacy Policy

We may update this Privacy Policy from time to time.

Updated versions will be posted on the Hordus website with a new “Last Updated” date.

If changes are material, we may provide additional notice by email, dashboard notice, or other reasonable means.

26. Contact

For privacy questions or rights requests:

Hordus AI Ltd.
Harakevet 58
Tel Aviv, Israel
Email: privacy@hordus.ai

For security issues:

Email: nir@hordus.ai