How we handle
your data.

This Privacy Policy is effective as of March 1, 2026, and was last updated on September 27, 2026.

This Privacy Policy describes how Daniel AI LLC ("Company," "we," "us," or "our") collects, uses, discloses, and protects your personal information when you use the MUN website at gsgxai.com and related services (collectively, the "Service"). By using the Service, you agree to the collection and use of information in accordance with this policy.

We collect the following categories of personal information: a) Information You Provide Directly: • Account information: name, email address, password (hashed) • Birth information: date of birth, time of birth, gender (required for Saju analysis) • Profile information for others you add (with their consent) • Payment information (processed by our third-party payment processor; we do not store full payment card details) • Communications you send to us (contact form, support requests) b) Information Collected Automatically: • Device and browser information (type, version, operating system) • IP address and approximate geolocation • Usage data (pages visited, features used, consultation history, consultation-time usage) • Cookies and similar tracking technologies (see Section 8) c) Information from Third Parties: • Social login profile data (Google, Apple, Facebook, Kakao) — limited to name, email, and profile picture as authorized by you

Connected sources are optional and require separate, explicit consent for each source. If you connect them, MUN may collect: previously stored consultation conversations you authorize us to reanalyze; readable past and future Google Calendar or Apple Calendar event details; iOS or Android contact fields such as names, phone numbers, email addresses, birthdays, company, and job title; and the read-only health categories you approve in Apple HealthKit or Android Health Connect. The health allow-list is sleep duration, steps, active energy, exercise and workout duration, mindfulness duration, heart rate, resting heart rate, heart-rate variability, blood pressure, blood glucose, respiratory rate, oxygen saturation, body temperature, weight, body-mass index where supported, and body-fat percentage. MUN does not request health write access and does not collect diagnoses, medications, raw clinical or laboratory records, ECG or arrhythmia determinations, or reproductive-health records for this feature. Device processing and purpose: Contact direct identifiers are hashed or encrypted on the device. Health samples are reduced to encrypted daily aggregates on the device; raw samples and plaintext numeric values do not cross the native app boundary. We use connected data to infer possible life events, relationships, and non-medical wellness patterns, and to ask for confirmation naturally when the subject becomes relevant in a conversation. An inference is not treated as a confirmed fact for consultation until you confirm it. Health information is used only for lifestyle and wellness coaching, not diagnosis, treatment, medication advice, insurance, employment, credit, or other eligibility decisions. Traditional Saju body or organ correspondences are labeled separately from measured health observations. Missing, unavailable, partially authorized, or limited-history data is never treated as a zero measurement. Processing and disclosure: With the source-specific AI-processing consent shown when you connect a source, encrypted source data, derived features, inferred candidates, and confirmed memories may be processed by our contracted cloud and AI providers to provide the Service. We remove direct third-party identifiers such as phone numbers, email addresses, and attendee addresses before model processing, and require applicable providers not to train on this data and to follow contractual security and retention limits. We do not sell connected personal-graph data. We do not use HealthKit or Health Connect data for advertising, marketing, general data mining, or cross-context behavioral advertising. Control and retention: You may revoke an operating-system permission or disconnect a source at any time. Disconnecting stops future collection and removes the device key used for new syncs; source purge and account deletion use deletion or cryptographic erasure and retain only minimal audit receipts where required for security or law. Operating systems may provide only partial access or a limited history window. MUN rechecks available permissions before each read and does not ask you to perform repeated manual imports after a source is connected.

We use the information we collect for the following purposes: • Providing the Service: Generating Saju analyses, AI consultations, and compatibility readings • Account Management: Creating and maintaining your account, authenticating your identity • Payment Processing: Processing subscriptions, consultation-time purchases, and managing billing • Communications: Responding to inquiries, sending service-related notifications • Promotional Email (optional, only with your separate consent): Offers, discounts, and reminders such as picking up where your free consultation left off, sent to your account email. Consent is not required to use the Service, is off unless you turn it on, and can be withdrawn at any time in Settings or through the unsubscribe link in each email. We keep a record of when you gave or withdrew consent until your account is deleted. • Improvement: Analyzing usage patterns to improve the Service (in aggregate/anonymized form) • Security: Detecting and preventing fraud, abuse, and unauthorized access • Legal Compliance: Fulfilling legal obligations and enforcing our Terms of Service We do NOT use your personal information for: • Selling to third parties • Targeted advertising based on your Saju profile data • Automated decision-making that produces legal or similarly significant effects

We do not sell your personal information. We may share your information only in the following circumstances: • Service Providers: With third-party vendors who assist in operating the Service (hosting, payment processing, analytics) under strict contractual obligations • AI Processing: Your birth data and consultation queries are processed by AI language model providers to generate analyses. This data is sent without your name or email. Our current primary AI provider is Baseten in the United States. Alibaba Cloud Model Studio in the Singapore region and Fireworks AI are maintained as backup AI providers. • Legal Requirements: When required by law, subpoena, court order, or government request • Business Transfers: In connection with a merger, acquisition, or sale of assets (you will be notified) • With Your Consent: When you explicitly authorize sharing Our current third-party service providers include: • Supabase (database and authentication) • Baseten (primary AI language model processing, United States) • Alibaba Cloud Model Studio (backup AI language model processing, Singapore region) • Fireworks AI (backup AI language model processing) • Anthropic (optional AI language model processing) • Stripe (payment processing) • Cloudflare (CDN and security) • Microsoft Clarity (website analytics — see Section 8 for details) • Google Analytics 4 (website traffic and conversion tracking — see Section 8) • Meta Pixel (advertising conversion tracking — see Section 8) • OpenAI Ads Measurement Pixel (ChatGPT advertising conversion tracking — see Section 8) • Google AdSense (non-personalized display ads on free public content pages — see Section 8)

We retain your personal information for as long as your account is active or as needed to provide the Service. Specifically: • Account data: Retained until you delete your account • Consultation history: Retained during membership for your reference • Payment records: Retained as required by tax and financial regulations (typically 7 years) • Server logs: Automatically deleted after 90 days Upon account deletion, we will delete or anonymize your personal information within 30 days, except where retention is required by law.

Depending on your state of residence, you may have the following rights: a) All Users: • Access: Request a copy of your personal information • Correction: Request correction of inaccurate information • Deletion: Request deletion of your account and personal information • Portability: Request your data in a commonly used, machine-readable format b) California Residents (CCPA/CPRA): • Right to Know: What personal information we collect, use, disclose, and sell • Right to Delete: Request deletion of personal information • Right to Opt-Out of Sale: We do not sell personal information, but you may still submit an opt-out request • Right to Non-Discrimination: We will not discriminate against you for exercising your privacy rights • Right to Correct: Request correction of inaccurate personal information • Right to Limit Use of Sensitive Personal Information: Your birth data is used solely for providing the Service c) Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Utah (UCPA), and other state residents: • Right to access, correct, delete, and obtain a copy of your personal data • Right to opt out of targeted advertising (we do not use your Saju profile for targeted ads; free-page AdSense uses non-personalized display ads only with Marketing consent) • Right to opt out of sale of personal data (we do not sell personal data) • Right to appeal a denial of your privacy request To exercise these rights, contact us at [email protected] or use the Contact page on our website. We will respond within 45 days (or as required by applicable law). We may need to verify your identity before processing your request.

We implement reasonable administrative, technical, and physical safeguards to protect your personal information, including: • Encryption of data in transit (TLS/SSL) and at rest • Secure authentication with hashed passwords • Row-level security on database access • Regular security reviews and access controls • Limited employee access to personal information on a need-to-know basis No method of transmission over the Internet is 100% secure. While we strive to protect your information, we cannot guarantee absolute security.

We use the following types of cookies and browser storage: • Strictly Necessary: Required for login sessions, security, language preferences, and basic functionality. Cannot be disabled. • Analytics: GA4 traffic measurement and Microsoft Clarity behavioral analytics. Disabled until you explicitly consent. • Marketing: Meta and ChatGPT advertising conversion measurement, and non-personalized Google AdSense display ads on free public content pages. Disabled until you explicitly consent. Your choice: On your first visit, analytics, session replay, and marketing tags remain off until you make a selection. The only exception is the AdSense script on free public content pages, which loads with ad requests paused and requests no ads and sets no new cookies before you consent (see Google AdSense below). The notice does not reappear after your choice. You can withdraw or change it at any time through the footer “Privacy settings” control. Withdrawing consent clears or disables the applicable analytics storage for future activity. Essential Service functionality remains available when you choose “Use essential features only.” Google Analytics 4 (GA4): If you consent to Analytics, we use GA4 to understand pages visited, traffic sources, engagement, and conversion events. We manually measure page changes and remove payment, profile, session, OAuth, and token values from analytics URLs. Administrator, credential-link, internal verification, and non-production traffic are excluded. Google may process device, browser, and approximate location information under its privacy policy (https://policies.google.com/privacy). Microsoft Clarity: If you consent to Analytics, Clarity is limited to public informational and marketing pages for behavioral metrics, heatmaps, and session replay. We do not enable Clarity replay on consultation, profile, onboarding, account, authentication, administrator, or token-protected report pages. For Microsoft's practices, see https://www.microsoft.com/privacy/privacystatement. Meta Pixel: If you consent to Marketing, we use the Meta Pixel on eligible public pages to measure advertising conversions. Marketing consent also enables the Analytics category required for measurement. We do not enable Meta Pixel on consultation, account, administrator, or credential-link pages. For Meta's practices, see https://www.facebook.com/privacy/policy. OpenAI Ads Measurement Pixel: If you consent to Marketing, we use OpenAI's browser measurement SDK to attribute eligible page views, completed registrations, free-trial starts, checkout starts, purchases, and new subscriptions to ads shown in ChatGPT. It runs on public marketing pages and only the specific signup, onboarding, subscription, and consultation routes needed to record those events. We send standard event names, internal product or plan identifiers, currency, and purchase amounts; we do not send birth data, Saju profiles, consultation text, email addresses, or raw account identifiers. Automatic advanced matching is disabled. Administrator and token-protected report routes are excluded. For OpenAI's practices, see https://openai.com/policies/privacy-policy/. Google AdSense: On free public content pages only (/tools/saju-calculator, /tools/five-elements-calculator, /learn, and their public subpages, except the Japanese and Chinese /learn pages), the page includes Google's AdSense script with ad requests paused (Google's pauseAdRequests setting). Loading the script means your browser contacts Google's servers, which receive standard request information such as your IP address and browser type. While requests are paused, no ads are requested and no new cookies are set; Google may read cookies that already exist on its own domains. Ads are requested only after you consent to Marketing, and only in Google's non-personalized (NPA) mode. Non-personalized ads still use cookies or similar technologies for frequency capping, aggregated ad reporting, and fraud and abuse prevention. Third-party vendors, including Google, use cookies, web beacons, and IP addresses to serve and measure these ads. We do not place AdSense on consultation, account, administrator, or token-credential report pages, and we do not use your Saju profile, birth data, or consultation content to target ads. How Google uses information from sites that use its services: https://policies.google.com/technologies/partner-sites. You can manage Google ad settings at https://myadcenter.google.com and opt out of participating third-party vendors' cookies at https://www.aboutads.info/choices. Google's privacy policy: https://policies.google.com/privacy. We do not respond to Do Not Track (DNT) browser signals because there is no industry-standard interpretation; the in-site Privacy settings control applies regardless of DNT.

The Service is not directed to children under the age of 13. We do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe your child has provided us with personal information, please contact us at [email protected]. If we discover that we have collected personal information from a child under 13, we will delete it promptly.

Daniel AI LLC is based in the United States, while the Service and its providers may process or store information in the United States, the European Union, Singapore, and other jurisdictions where our service providers operate. In particular, our current primary AI language model processing uses Baseten in the United States. Alibaba Cloud Model Studio in the Singapore region remains available as a backup. Data protection laws in those jurisdictions may differ from those of your country. Where required, we use contractual and other lawful safeguards for international transfers.

The Service may contain links to third-party websites or services. We are not responsible for the privacy practices of these third parties. We encourage you to review the privacy policies of any third-party sites you visit.

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page with a new "Last Updated" date and, where required by law, by email notification. Your continued use of the Service after changes constitutes acceptance of the updated policy.

If you have questions about this Privacy Policy, wish to exercise your privacy rights, or have a complaint, please contact us: Daniel AI LLC Email: [email protected] Website: https://gsgxai.com/contact If you are a California resident and are not satisfied with our response, you may contact the California Attorney General at https://oag.ca.gov/contact.