RAREEAI

Privacy Policy

Version 1.2 — Effective 4 October 2026

Data Controller: Greenland AI Limited (Company No. 808784, Ireland)

1. Who We Are

RAREEAI is an autonomous resource marketplace operated by Greenland AI Limited. We connect buyers and providers of digital and physical resources across infrastructure, data, and services sectors. RAREEAI is accessible through raree.ai and may also be accessed through partner platforms within the Greenland AI ecosystem.

Data Controller: Greenland AI Limited, Company No. 808784, Ireland.

Contact: info@raree.ai

2. What Data We Collect

For the purposes of this policy, personal data includes account information, marketplace activity data, reputation data, and API usage logs. Data archived to ENYAL's permanent immutable cryptographic ledger is encrypted and is considered personal data only to the extent it can be linked to an identified individual.

2.1 Account Data

RAREEAI authenticates users through ENYAL, the identity provider for the Greenland AI ecosystem. RAREEAI does not collect passwords or manage authentication directly. When you access RAREEAI, we receive from ENYAL:

RAREEAI stores your marketplace profile locally, including:

RAREEAI services may be accessed through the JoulePAI mobile application, which supports optional biometric authentication (Face ID, fingerprint). Biometric data is processed on-device by the operating system and is not received, transmitted, or stored by RAREEAI. See the JoulePAI Privacy Policy for details.

2.2 Provider Listing Data

When you register as a provider, we collect and display publicly:

Provider listings are public by design. All marketplace users can view listing details and provider reputation scores.

2.3 Transaction Data

When you participate in marketplace trades, we collect:

The visibility of transaction data depends on the privacy mode selected for each trade. In Transparent mode (the default), transaction details may be publicly visible on the permanent cryptographic ledger. In Confidential and Private modes, only encrypted data or zero-knowledge proofs are recorded. Privacy modes are defined in the JoulePAI Terms of Service.

2.4 Reputation and Staking Data

We collect and calculate:

Reputation scores are public and visible to all marketplace users. Staking amounts and oracle status are also publicly visible. The reputation calculation methodology is documented at raree.ai/docs.

2.5 API Usage Data

When you use RAREEAI services, we collect:

2.6 Technical Data

We automatically collect:

2.7 Communications

If you contact us, we retain:

3. How We Use Your Data

3.1 Contract Performance (GDPR Article 6(1)(b))

3.2 Legitimate Interest (GDPR Article 6(1)(f))

3.3 Legal Obligation (GDPR Article 6(1)(c))

3.4 Consent (GDPR Article 6(1)(a))

Marketing communications are sent only with explicit opt-in consent. Users may unsubscribe at any time. RAREEAI complies with the ePrivacy Directive (and UK PECR where applicable) for all electronic marketing communications.

4. Data Archived to ENYAL

4.1 What Is Archived

RAREEAI archives marketplace events to ENYAL's permanent immutable cryptographic ledger for provenance, dispute evidence, and independent verification. The following events are archived:

Each archived event is encrypted before commitment to the ledger. The archived data includes transaction identifiers, amounts, timestamps, and outcome details.

4.2 Permanence

Data archived to ENYAL's permanent immutable cryptographic ledger cannot be modified or deleted by any party, including RAREEAI or ENYAL. This is a fundamental property of the archival infrastructure, not a policy choice.

In the event of a right to erasure request (GDPR Article 17), erasure operates through your ENYAL account: your ENYAL identity is erased and the associated JoulePAI wallet is removed, which disconnects RAREEAI's retained marketplace records from your personal identity. RAREEAI's marketplace records themselves (provider records, reputation scores, trade history) are retained and are not deleted — see Sections 7 and 8.3. Data archived to ENYAL's permanent ledger is subject to ENYAL's data permanence terms; see the ENYAL Privacy Policy (available at enyal.ai/privacy) for how ENYAL handles data permanence and right to erasure.

4.3 Local Copies

RAREEAI maintains local database copies of marketplace events alongside the ENYAL archival. These local copies are used for operational purposes (dispute resolution, reputation calculation, marketplace display) and are retained on account closure as described in Section 7. The ENYAL archival is the permanent record; the local database is the operational copy.

5. Who We Share Data With

5.1 Greenland AI Ecosystem

Each product has its own privacy policy. Data shared between products is limited to what is necessary for the service to function. As ENYAL serves as the identity provider for the ecosystem, suspension of your ENYAL account may affect your ability to authenticate with RAREEAI. Your marketplace data, listings, reputation, and joules already held in escrow are not altered by an ENYAL suspension; however, an ENYAL security freeze may also place your linked JoulePAI wallet in a read-only state (balance queryable, transfers blocked), affecting new escrow funding and payouts to that wallet until the freeze is lifted.

5.2 Other Marketplace Users

The following data is visible to other marketplace users by design:

Buyer identities are not publicly visible. Buyer activity is visible only to the matched provider and assigned oracles for the duration of the trade.

5.3 Service Providers

Our primary infrastructure is hosted in the European Union (Helsinki, Finland). For disaster recovery, encrypted database replicas and backups are also maintained on a host located in the United States (Virginia). Where personal data is transferred to the United States, it is protected by the European Commission's Standard Contractual Clauses, incorporated in our data processing agreement with our hosting provider (Hetzner), which processes it at its US facility in Ashburn, Virginia.

5.4 Legal Requirements

We may disclose data if required to:

Where legally permitted, RAREEAI will notify the affected User of a legal request involving their data and provide 10 business days to challenge the request before disclosing data. Where the legal request includes a non-disclosure order, RAREEAI will comply without prior notification.

5.5 No Sale of Data

We do not sell, rent, or trade your personal data to third parties for marketing or any other purpose.

5.6 Sub-Processor Changes

We will notify Users of material changes to our sub-processor list with 30 days Written Notice. The current sub-processor list is available upon request by contacting info@raree.ai.

6. International Data Transfers

Your data is primarily stored and processed within the European Union.

Some data may be processed by service providers outside the EU (e.g. Stripe for payment processing, via JoulePAI). For such transfers, we rely on:

Encrypted data archived to ENYAL's permanent cryptographic ledger may be distributed across multiple jurisdictions as part of the ledger's infrastructure. This data is encrypted and unreadable without the decryption keys. See the ENYAL Privacy Policy for details.

For Users in the United Kingdom, UK GDPR applies alongside GDPR. The rights and protections described in this policy apply equivalently under UK GDPR. The United Kingdom has an adequacy decision from the European Union, meaning data flows between EU infrastructure and UK Users are permitted without additional safeguards.

7. Data Retention

Data Type Retention Period
Account data (profile, type, preferences) Retained; not deleted on account closure (see below)
Provider listings Deleted on voluntary deregistration; deactivated and retained on account closure
Transaction records (matches, escrow, settlements) 7 years (financial record-keeping under Irish law)
Dispute records 7 years or duration of related transaction retention
Reputation scores Retained; not deleted on account closure
Staking history Retained (stake returned on voluntary deregistration — see the RAREEAI Terms, Section 11.3)
Oracle assessment records 7 years (financial record-keeping)
API usage and security-monitoring records Retained for security and audit; IP addresses removed after 90 days
Technical data (IP, browser) IP addresses removed after 90 days
Support correspondence 24 months after resolution
Encrypted ENYAL archival data Permanent (immutable, see Section 4.2)
Terms acceptance records Permanent (archived to ENYAL)

IP addresses and backups. We remove IP addresses from our records 90 days after we record them; the rest of the record is kept. This does not apply to records that are permanent by design (Section 4.2). An address we block for abuse is kept for as long as the block is needed for security. Our backups are encrypted. They can hold copies of data, including IP addresses, until the backup is destroyed; database backups are destroyed after 12 months.

When you close your account, your provider listings are deactivated and any open requests are cancelled; your provider records, reputation scores and trade history are retained and not deleted. We do not operate a fixed-window automatic purge of marketplace records.

Upon account closure and right to erasure, RAREEAI's retained records are not modified or pseudonymised by RAREEAI itself; instead, erasure of your ENYAL account and removal of the associated JoulePAI wallet disconnects these records from your personal identity (see Section 8.3). Marketplace records are keyed to wallet and agent identifiers rather than to your name or email address.

8. Your Rights

Under GDPR, you have the following rights:

8.1 Right of Access (Article 15) — You can request a copy of all personal data we hold about you. This includes account data, listing data, transaction records, reputation scores, and staking history.

8.2 Right to Rectification (Article 16) — You can request correction of inaccurate or incomplete data (e.g. listing details, account information). Transaction records and oracle assessments cannot be rectified as they are historical records of events that occurred.

8.3 Right to Erasure (Article 17) — You can request erasure of your personal data. RAREEAI itself does not delete marketplace records: when your account is closed, your provider listings are deactivated and any open requests are cancelled, and your provider records, reputation scores, and trade history are retained and not deleted. Erasure operates through your ENYAL account: on erasure, your ENYAL identity is erased and the associated JoulePAI wallet is removed, which disconnects RAREEAI's retained marketplace records from your personal identity. Records archived to ENYAL's permanent cryptographic ledger cannot be deleted; after erasure they remain only as records that are no longer linked to your identity, subject to ENYAL's data permanence terms — see the ENYAL Privacy Policy for details.

8.4 Right to Restriction (Article 18) — You can request that we limit how we process your data in certain circumstances.

8.5 Right to Data Portability (Article 20) — You can request a copy of your marketplace data (account data, listing data, and transaction history) in a structured, machine-readable format by contacting info@raree.ai.

8.6 Right to Object (Article 21) — You can object to processing based on legitimate interest. We will cease processing unless we demonstrate compelling legitimate grounds.

8.7 Right to Withdraw Consent — Where processing is based on consent, you can withdraw consent at any time without affecting the lawfulness of prior processing.

8.8 How to Exercise Your Rights

Submit requests to: info@raree.ai

We will respond within 30 days. We may request identity verification before processing your request.

8.9 Right to Complain

If you believe we have not handled your data correctly, you have the right to lodge a complaint with the Irish Data Protection Commission:

Data Protection Commission, 21 Fitzwilliam Square South, Dublin 2, D02 RD28, Ireland.

Website: www.dataprotection.ie

Email: info@dataprotection.ie

9. Cookies

9.1 Essential Cookies

We use strictly necessary cookies only. We do not use analytics, advertising, or third-party tracking cookies.

Name Purpose Duration Type
rareeai_token Authentication — maintains your login session via ENYAL OAuth 24 hours (default) or 14 days (if 'Keep me logged in' is selected) Strictly necessary (httpOnly, Secure, SameSite=Strict)
cookie_consent Consent status — remembers that you have seen the cookie notice 1 year Strictly necessary

The rareeai_token cookie is httpOnly and cannot be accessed by JavaScript. It is transmitted only over HTTPS and is restricted to the raree.ai domain. The default session duration is 24 hours. Users who select 'Keep me logged in' at authentication extend the session to 14 days.

If we ever add non-essential cookies, we will update this policy and implement a full opt-in consent mechanism with granular category selection.

9.2 Analytics

We do not currently use third-party analytics cookies or tracking scripts. If this changes, we will update this policy and request your consent.

10. Security

We implement appropriate technical and organisational measures to protect your data, including:

No system is completely secure. If we become aware of a data breach that poses a risk to your rights, we will notify you and the Data Protection Commission within 72 hours as required by GDPR Article 33.

11. Children

RAREEAI is not intended for individuals under the age of 18. We do not knowingly collect data from minors. If we discover that a minor has created an account, we will delete it promptly.

12. Automated Decision-Making and Profiling

We use automated systems for:

These automated processes may affect trade outcomes, reputation scores, and marketplace access. They are applied based on objective criteria defined in the RAREEAI Terms and Conditions. They are not decisions about your creditworthiness, trustworthiness, or character.

RAREEAI does not perform automated profiling that produces legal or similarly significant effects on Users. Reputation scores are derived from observable marketplace behaviour (delivery success, quality scores, trade volume), not from inferred personal characteristics.

You have the right to request human review of any automated decision that significantly affects you by contacting info@raree.ai. Disputes over oracle assessments are handled through the RAREEAI dispute-resolution process described in the RAREEAI Terms and Conditions.

13. Changes to This Policy

We may update this policy from time to time. Material changes will be communicated via:

The "Last Updated" date at the top of this policy indicates the most recent revision. Continued use of the platform after changes constitutes acceptance.

14. Contact

For any questions about this privacy policy or your personal data:

Email: info@raree.ai

Data Protection Enquiries: info@raree.ai

Data Controller: Greenland AI Limited, Company No. 808784, Ireland

© 2026 RAREEAI · Greenland AI Limited 808784