Privacy Policy

1 Introduction & Scope

Agape Real Solutions LLC ("Agape," "Company," "we," "our," or "us") is a United States-based professional services company providing business-to-business (B2B) artificial intelligence training, model evaluation, and data quality services. This Privacy Policy explains how we collect, use, disclose, retain, and safeguard personal information when you:

• Visit our website at agaperealsolutions.com
• Create an account or log into our platform
• Request a consultation, submit a contact form, or communicate with us
• Subscribe to or purchase any of our services (Starter, Professional, or Enterprise)
• Provide data for AI training, model evaluation, or data quality projects

This policy applies to all users worldwide, including clients in the European Economic Area (EEA), United Kingdom, and California. By using our services, you acknowledge that you have read and understood this Privacy Policy.

2 Data Controller & Contact Information

Agape Real Solutions LLC is the data controller responsible for your personal information. If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, you may contact us at:

3 Information We Collect

3.1 Information You Provide Directly

3.2 Information Collected Automatically

3.3 Information from Third Parties

• Payment Processor (Stripe): Transaction confirmation, payment status, last 4 digits of card, billing country. Stripe is PCI DSS Level 1 certified. We never receive or store full credit card numbers.
• Authentication Providers: If you sign in via Google, we receive your name, email, and profile picture from your Google account.
• Business Referrals: Company name and contact details when referred by a partner or colleague.

3.4 Sensitive Data

We do not intentionally collect sensitive personal data (racial or ethnic origin, political opinions, religious beliefs, health data, biometric data, or sexual orientation). If project data provided by a client incidentally contains sensitive data, it is processed solely for the purpose of the contracted service under strict confidentiality and data processing agreements.

4 Legal Basis for Processing (GDPR)

For users in the EEA and UK, we process personal data under the following legal bases:

You may withdraw consent at any time without affecting the lawfulness of processing based on consent before withdrawal.

5 How We Use Your Information

We use the information we collect for the following specific purposes:

5.1 Service Delivery

• Creating and managing your account on our platform
• Providing AI model training, evaluation, and data quality services as contracted
• Processing project data strictly within the scope of the agreed Statement of Work (SOW)
• Generating reports, evaluations, benchmarks, and deliverables for your project
• Communicating project updates, milestones, and deliverable status

5.2 Billing & Payments

• Processing payments securely through Stripe (our PCI-compliant payment processor)
• Sending invoices, receipts, and billing notifications
• Managing subscriptions (Professional and Enterprise plans)
• Processing refunds in accordance with our Refund Policy
• Maintaining financial records as required by law

5.3 Communication

• Responding to your inquiries, consultation requests, and support tickets
• Sending transactional emails (account confirmations, payment receipts, service updates)
• Sending marketing communications about new services or features (with consent only, and with an unsubscribe option in every email)

5.4 Security & Fraud Prevention

• Monitoring for unauthorized access, suspicious activity, and security threats
• Preventing fraud, abuse, and violations of our Terms of Service
• Maintaining audit logs for SOC 2 compliance

5.5 Analytics & Improvement

• Understanding how users interact with our website (via anonymized analytics)
• Improving our website, platform, and service quality
• Conducting aggregate, de-identified analysis for business planning

6 Payment Processing & Stripe

All payments are processed through Stripe, Inc., a PCI DSS Level 1 certified payment processor. When you make a payment:

• Your payment card details are transmitted directly to Stripe via their secure, encrypted payment form — we never receive, process, or store your full credit card number
• Stripe provides us with a transaction ID, payment status, last 4 digits of your card, card type, and billing country for record-keeping
• Stripe may use your data in accordance with their own privacy policy: stripe.com/privacy
• Your billing statement will show charges from "AGAPE REAL SOLUTIONS" or "AGAPE REAL SOL"

7 Information Sharing & Disclosure

We do not sell, rent, or trade your personal information to any third party for marketing purposes. We may share information only in the following limited circumstances:

7.1 Service Providers (Sub-processors)

We engage trusted third-party companies to assist in operating our business. Each is bound by contractual data processing agreements:

7.2 Legal Requirements

We may disclose your information when required to do so by law, court order, subpoena, or government regulation, or when we believe in good faith that disclosure is necessary to protect our rights, your safety, or the safety of others, investigate fraud, or respond to a government request.

7.3 Business Transfers

In the event of a merger, acquisition, reorganization, bankruptcy, or sale of all or a portion of our assets, your personal information may be transferred as part of that transaction. We will provide notice before your personal information is transferred and becomes subject to a different privacy policy.

7.4 Client Project Data — Special Protections

8 Data Security

We implement comprehensive technical and organizational measures to protect your information:

8.1 Technical Measures

• Encryption in Transit: All data transmitted between your browser and our servers uses TLS 1.2+ / SSL encryption
• Encryption at Rest: All stored data is encrypted using AES-256 encryption
• Access Control: Role-based access controls (RBAC) with principle of least privilege
• Authentication: Multi-factor authentication (MFA) available for all accounts
• Infrastructure: Hosted on enterprise-grade cloud infrastructure (AWS/GCP/Azure) with SOC 2, ISO 27001, and SOC 1 certifications
• Network Security: Firewalls, intrusion detection systems (IDS), and DDoS protection

8.2 Organizational Measures

• SOC 2-aligned security policies and procedures
• Employee background checks and confidentiality agreements
• Regular security awareness training for all staff
• Incident response plan with defined escalation procedures
• Regular security assessments and penetration testing by independent third parties
• Comprehensive audit logging of all data access

8.3 Breach Notification

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify affected individuals within 72 hours of becoming aware of the breach (as required by GDPR) and will simultaneously notify relevant supervisory authorities. We will provide details of the breach, its likely consequences, and the measures taken to address it.

9 Data Retention

We retain personal data only as long as necessary for the purposes described in this policy, or as required by law:

Upon expiration of the retention period, data is securely deleted or anonymized. You may request early deletion of your data subject to legal retention requirements.

10 Your Rights

10.1 Rights Under GDPR (EEA/UK Residents)

If you are located in the European Economic Area or United Kingdom, you have the following rights under GDPR:

• Right of Access (Art. 15): Request a copy of the personal data we hold about you
• Right to Rectification (Art. 16): Request correction of inaccurate or incomplete data
• Right to Erasure (Art. 17): Request deletion of your personal data ("right to be forgotten")
• Right to Restriction (Art. 18): Request restriction of processing in certain circumstances
• Right to Data Portability (Art. 20): Receive your data in a structured, commonly used, machine-readable format
• Right to Object (Art. 21): Object to processing based on legitimate interests, including direct marketing
• Right to Withdraw Consent (Art. 7): Withdraw consent for any consent-based processing at any time
• Right to Lodge a Complaint: File a complaint with your local data protection supervisory authority

10.2 Rights Under CCPA (California Residents)

If you are a California resident, you have the following additional rights under the California Consumer Privacy Act:

• Right to Know: Request disclosure of the categories and specific pieces of personal information we have collected
• Right to Delete: Request deletion of personal information we have collected from you
• Right to Non-Discrimination: We will not discriminate against you for exercising your CCPA rights
• Right to Opt-Out of Sale: We do not sell personal information, so this right is automatically satisfied

In the preceding 12 months, we have not sold any personal information. We have disclosed personal information to service providers (Stripe, cloud hosting, analytics) solely for business purposes.

10.3 How to Exercise Your Rights

To exercise any of the above rights, please contact us at:

• Email: privacy@agaperealsolutions.com
• Contact Form: agaperealsolutions.com/contact

We will respond to your request within 30 days (GDPR) or 45 days (CCPA). We may need to verify your identity before processing your request. If we cannot fulfill your request due to a legal exception, we will explain the reason.

11 International Data Transfers

Your information may be transferred to and processed in the United States and other countries where our service providers operate. These countries may have data protection laws that differ from those in your jurisdiction.

For transfers from the EEA/UK to countries that do not have an adequacy decision from the European Commission, we implement appropriate safeguards including:

• Standard Contractual Clauses (SCCs): EU-approved contractual clauses that require the data importer to protect data to EU standards
• Data Processing Agreements (DPAs): Binding agreements with all sub-processors specifying data handling obligations
• Supplementary Measures: Technical measures (encryption) and organizational measures (access controls) to ensure the level of protection required by GDPR

12 Children's Privacy

Our services are designed for businesses and professionals and are not directed to individuals under 18 years of age. We do not knowingly collect personal information from children under 18. If we become aware that we have inadvertently collected data from a minor, we will promptly delete it. If you believe a child has provided us with personal information, please contact us at privacy@agaperealsolutions.com.

13 Do Not Track Signals

Our website does not currently respond to "Do Not Track" (DNT) browser signals. However, you can manage tracking through your cookie preferences and by opting out of Google Analytics using the Google Analytics Opt-out Browser Add-on.

14 Third-Party Links

Our website may contain links to third-party websites, services, or resources that are not operated by us. We have no control over and assume no responsibility for the content, privacy policies, or practices of any third-party sites. We encourage you to review the privacy policy of every site you visit.

15 Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or for other operational reasons. When we make material changes:

• We will update the "Last updated" date at the top of this page
• We will notify registered users via email at least 30 days before the changes take effect
• For material changes affecting how we process your data, we will seek renewed consent where required by law

Your continued use of our services after the effective date of the updated policy constitutes acceptance of the changes. We encourage you to review this page periodically.

16 Contact Us

If you have any questions, concerns, or complaints regarding this Privacy Policy or our data handling practices, please contact us:

If you are not satisfied with our response, you have the right to lodge a complaint with your local data protection supervisory authority.