1. Data Controller

The data controller responsible for your personal data is:

Topchiyska Enterprises LLC
Operating Unicornin60.ai
Contact: hello@unicornin60.ai

2. Your GDPR Rights

Under the GDPR and applicable EU/EEA data protection law, you have the following rights regarding your personal data:

• Right of access (Art. 15): Request a copy of all personal data we hold about you.
• Right to rectification (Art. 16): Correct inaccurate or incomplete personal data.
• Right to erasure / "right to be forgotten" (Art. 17): Request deletion of your personal data, subject to legal retention obligations.
• Right to restriction of processing (Art. 18): Request that we limit how we use your data.
• Right to data portability (Art. 20): Receive your data in a structured, machine-readable format.
• Right to object (Art. 21): Object to processing based on legitimate interests.
• Right to withdraw consent (Art. 7(3)): Where processing is based on consent, withdraw it at any time without affecting the lawfulness of prior processing.
• Right not to be subject to automated decision-making (Art. 22): Not be subject to decisions based solely on automated processing that produce legal or significant effects.

To exercise any of these rights, contact us at hello@unicornin60.ai. We will respond within 30 days. You also have the right to lodge a complaint with your national supervisory authority.

3. Legal Bases for Processing

We process your personal data under the following GDPR legal bases:

• Article 6(1)(b) — Contract: Processing necessary to provide the Platform services you subscribed to (account management, AI tools, billing).
• Article 6(1)(c) — Legal obligation: Retention of financial records, consent audit logs, and compliance with applicable law.
• Article 6(1)(f) — Legitimate interests: Fraud detection, security monitoring, service improvement, and abuse prevention.
• Article 6(1)(a) — Consent: Marketing communications (opt-in; you may withdraw at any time).

4. International Data Transfers

Unicornin60.ai is operated from the United States. Your personal data may be transferred to and processed in the United States and other countries outside the EU/EEA. Where such transfers occur, we ensure appropriate safeguards are in place, including:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• Adequacy decisions where applicable
• Data processing agreements with all sub-processors

Our key sub-processors and their data transfer mechanisms: Supabase (SCCs), Stripe (SCCs + Privacy Shield successor framework), Vercel (SCCs), Anthropic (SCCs), Resend (SCCs).

5. Retention Periods

We retain personal data for the minimum period necessary:

• Account data: Duration of account + 30-day deletion window after cancellation.
• Legal consent records: Indefinitely, as required by law.
• Financial records: 7 years (tax law requirement).
• AI session data: Duration of account + 30-day deletion window.
• Student ID documents: Duration of student subscription + 30 days.

6. Automated Decision-Making and Profiling

The Platform uses AI to generate business insights and recommendations. These AI outputs are tools to assist your decision-making — they do not constitute automated decisions that produce legal or significant effects on you within the meaning of Article 22 GDPR. You remain in full control of all decisions made using Platform outputs.

7. Your Right to Lodge a Complaint

If you believe we have processed your personal data in violation of the GDPR, you have the right to lodge a complaint with the supervisory authority in your EU/EEA member state. A list of EU supervisory authorities is available at edpb.europa.eu. UK residents may contact the Information Commissioner's Office (ICO) at ico.org.uk.

8. Consent Record

By agreeing to this statement, you acknowledge that you have read and understood this GDPR Compliance Statement and consent to the processing of your personal data as described herein. Your agreement, along with the timestamp, your IP address, and the document version, will be logged in our legal audit trail as required by Article 7(1) GDPR.

You may withdraw this consent at any time by contacting us at hello@unicornin60.ai. Note that withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal, and does not affect processing under other legal bases (contract, legal obligation, legitimate interests).