Privacy Policy

Privacy Policy

"We value your privacy. In short: we collect information about your symptoms solely so our AI can select nutrients for you. We use minimal analytics and affiliate links to support the project. We NEVER sell your health data to advertisers. Read the full version below."

Introduction

Last updated and effective date: July 21, 2026.

Brief description of the service: The PAWS ML service (available on the paws.ml website) is a non-medical AI assistant designed exclusively for the informational support of individuals going through Post-Acute Withdrawal Syndrome (PAWS). Our platform helps in the selection of legal over-the-counter nutrients and does not provide medical services, does not make diagnoses, and does not replace professional medical care.

The website owner and operator of your data is Aething Inc., registered at: 1111B S Governors Ave #6113 Dover, DE 19904.

Consent: By using the paws.ml website and interacting with our AI assistant, you confirm your understanding and express your full consent to the terms of this Privacy Policy. If you do not agree with how we collect and process your data, please discontinue using our service.

1. What Information We Collect

To ensure maximum transparency for our users and regulatory authorities, we divide the collected information into three clear categories to make it extremely clear where the data comes from and how it is classified:

Data voluntarily provided by you: When communicating with the AI assistant, you may transmit text information to us, which includes: a description of your current mood, the presence and nature of physical withdrawal symptoms, your age, gender, and current stage of quitting the habit. Important: We explicitly state that under the laws of some jurisdictions (in particular, according to the Washington State My Health My Data Act — MHMDA, as well as California CPRA laws and the European GDPR regulation), this information and any logical inferences made on its basis are strictly classified as "Consumer Health Data" or special categories of data.

Data collected automatically (Analytics): To maintain the operability, security, and improve the functionality of the site, we automatically collect technical data about your visit. This includes: your IP address, browser type, time zone, device type (smartphone/PC), and session logs. These data are collected in an anonymized (pseudonymized) form and tied to a unique session identifier (UUID).

Data for the operation of affiliate systems (Affiliate Networks): Our service may use affiliate links (affiliate marketing) to support the project. In this regard, we collect and process click identifiers (Click-IDs) and the history of your clicks on affiliate links to store websites (for example, iHerb or Amazon). These data are used exclusively so that partner stores can attribute the click from our website and accrue a commission for your purchases.

2. How and Why We Use Your Data

For service provision (Informational support and analysis) We use AI algorithms to analyze the PAWS symptoms you described, your mood, and your current stage of quitting the habit. This is necessary to generate a personalized list of legal nutraceuticals and provide you with relevant informational support.

• Legal basis: Your strict prior and explicit consent (Opt-in). Since the information you enter is classified as "Consumer Health Data" under US laws and "Special Categories of Data" under the European GDPR, we have no right and will not collect or analyze this information without your expressly stated permission.

For monetization (Affiliate Marketing) We track facts of clicking on our affiliate links to store websites (for example, iHerb or Amazon) so that affiliate networks can attribute the purchase and accrue us a commission for the recommendation. This data is transmitted exclusively in an anonymized form and is not tied to your name or identity on the store's side.

• Legal basis: Your separate consent. In accordance with legislation (in particular, the Washington MHMDA and the California CPRA), the transfer of click identifiers (Click-IDs) in the context of a health-related platform can be legally regarded as the "sale" or "transfer" of data. Therefore, we activate affiliate tracking pixels only after receiving your explicit consent; otherwise, we programmatically disable tracking parameters and use "clean" links.

For analytics and service improvement We collect technical and behavioral data (information about your device, session logs) to understand how users interact with the paws.ml platform, identify technical errors, and improve the site interface.

• Legal basis: Your explicit consent (Opt-in). Analytical tools are not strictly necessary for the basic functionality of the site. Under the rules of the ePrivacy Directive and the latest health data protection laws, the collection of any analytics capable of leading to logical inferences about your health is strictly prohibited until your active consent is received in the cookie management interface.

AI Training (Protection of your dialogues) We DO NOT use your dialogues and personal data to train the basic large language models (LLMs) of third-party providers (for example, OpenAI, Anthropic, etc.). The paws.ml platform uses specialized corporate API pricing plans that legally guarantee the refusal of AI providers to use your queries (prompts) to train their future neural networks. Any internal analysis of dialogues that we may conduct to improve the quality of the responses of our own algorithms is carried out exclusively after a strict procedure of de-identification (anonymization) and pseudonymization. Before any analysis, the texts of your queries on the side of our backend are cleared of possible random personal data (names, contacts) and are stored in a secure isolated database, which is completely separated from your direct identity identifiers.

4. Who We Share Your Data With

To ensure the uninterrupted operation of the paws.ml platform, we engage a limited circle of reliable third-party services. We transmit information only in the volume that is strictly necessary for the provision of the services requested by you, and legally oblige our partners (processors) to comply with the highest privacy standards. We divide data recipients into the following categories:

AI Infrastructure Providers Since our AI assistant operates based on advanced large language models (LLMs), we collaborate with corporate AI infrastructure providers (such as OpenAI API, Anthropic API). The transmission of your anonymized queries to providers is carried out exclusively via secure and encrypted communication channels (API). We mandatorily conclude Data Processing Agreements (DPAs) with AI providers, which strictly limit their rights: providers act exclusively as processors, they have no right to use your data for their own purposes, and they are legally prohibited from using your dialogues for additional training or improvement of their own neural networks.

Hosting and analytics To host databases, ensure site stability, and monitor technical errors, we use the services of secure cloud server providers and analytical services. These companies store and process information strictly on our terms, have no right to use it for their own needs, and are obliged to delete all copies of data upon receipt of a request from us.

Affiliate partners (Affiliate networks and marketplaces) For the purpose of monetization and support of the platform, we use affiliate programs of nutraceutical stores (for example, iHerb or Amazon). If you decide to follow an affiliate link to review a supplement, we transmit to the external system only a technical click identifier (Click-ID) or session parameter. Marketplaces and affiliate networks do not gain access to your name, communication history with the AI assistant, PAWS symptoms, or your health profile.

WE DO NOT SELL YOUR PERSONAL DIALOGUES, SYMPTOM DATA, OR HEALTH PROFILES TO INFORMATION BROKERS OR ADVERTISING NETWORKS.

We guarantee that confidential information about your well-being, emotional background, and the process of quitting the habit is safe. We will never sell your data to data brokers or pass them on to advertising networks for cross-targeted advertising. Our business model is built exclusively on anonymized link clicks, completely isolated from your sensitive information.

5. Data Retention & Security

Data Retention We strictly adhere to the principles of data minimization and storage limitation, collecting only the information necessary for the operation of the service and storing it no longer than is required.

• AI assistant chat logs: The texts of your dialogues (including any descriptions of symptoms and mood) are stored in an active database for no more than 30 days after your last activity on the site. After this period, the logs are automatically and irretrievably deleted or subjected to irreversible anonymization. Anonymized data that cannot be linked to your identity or device may be retained to calculate aggregated statistics and improve algorithms.
• Backups: In accordance with legislative requirements (in particular, the Washington MHMDA), any requests for data deletion also automatically extend to our archival and backup systems. The complete technical deletion of information from encrypted backup copies can take up to 6 months from the moment the process is initiated.

Security Given the sensitive nature of the information related to PAWS, we implement comprehensive administrative, technical, and physical security measures to protect your data from unauthorized access, disclosure, or alteration in accordance with advanced industry standards. Key protection methods include:

• Data encryption: All information transfer between your device and our servers (as well as via API channels to AI providers) is protected using modern encryption protocols (SSL/TLS). Data at rest (on our servers) is protected using the AES-256 encryption standard.
• Staff access restriction: The company has implemented a role-based access control (RBAC) model. Access to databases containing chat logs is strictly limited to a minimal number of authorized technical specialists who need it exclusively to support the operability of the platform. Staff does not have access to decrypted profile links, and all employees are bound by strict non-disclosure agreements (NDAs).
• Infrastructure isolation: We use a separate (pseudonymized) storage architecture, in which your technical session identifiers and dialogue texts are stored in isolation from each other, which further minimizes risks during any security incidents.

Here is the continuation of the Privacy Policy describing the rules for cross-border data transfer. This section is drawn up taking into account the strict requirements of the GDPR (Chapter V), and also touches upon the legislation of China (PIPL), as it imposes special requirements on the export of sensitive data:

6. International Transfers

Physical location of servers Aething Inc. is registered in the United States of America. Our main databases, servers, and cloud infrastructure providing the operation of the paws.ml platform and AI assistant algorithms are physically located in the US. This means that the information you provide when using our service is by default transmitted, processed, and stored in the United States.

For users from the European Union (EEA), the UK, and Switzerland We recognize that data protection laws in the US may differ from European standards and may not always provide an equivalent level of protection by default. Therefore, any cross-border transfer of your personal data (especially information relating to PAWS symptoms, which belongs to special categories of data) is carried out in strict accordance with the requirements of Chapter V of the GDPR.

To ensure maximum security of your information during transmission to the US, we apply the following approved legal mechanisms:

• Standard Contractual Clauses (SCCs): The transfer of data to our American sub-processors and AI infrastructure providers is carried out based on the latest standard contracts approved by the European Commission.
• Adequacy Decisions: We may also rely on the EU-US Data Privacy Framework (DPF) if our partners and hosting providers are officially certified under this program.
• Supplementary Measures: In accordance with the decisions of the EU Court of Justice (Schrems II) and the recommendations of the European Data Protection Board (EDPB), in addition to legal contracts, we apply strict supplementary measures. These include end-to-end data encryption (both in transit and at rest) and strict pseudonymization of your dialogues, which protects information from disproportionate access by public authorities of third countries.

For users from the People's Republic of China (PRC) In accordance with the Personal Information Protection Law (PIPL), the transfer of your health data outside mainland China to our servers in the US is regarded as the export of sensitive personal information. Such transfer is carried out exclusively after obtaining your separate informed consent for cross-border transfer. In addition, we provide a legal basis for such transfers by concluding a Standard Contract with our partners, the form of which is approved by the Cyberspace Administration of China (CAC), and conducting a preliminary personal information protection impact assessment.

7. Your Data Protection Rights (User Rights)

We are convinced that your privacy rights should be clear, transparent, and easy to exercise, regardless of the country in which you live. Since our service is available globally, we structure your rights depending on the legislation applicable to you.

For all users Regardless of your jurisdiction, you have the following basic rights regarding your information:

• Right to request a copy of your data (Right to access): You can request confirmation of whether we process your data and receive an export (copy) of your chats and communication history with the AI assistant.
• Right to demand complete deletion: You can request the complete deletion of your personal data and chat logs when they are no longer needed for processing purposes or if you withdraw your consent.
• Right to correct inaccuracies: You have the right to request the correction or completion of your information if you believe it to be inaccurate.

Users from the European Union, EEA, and the UK (GDPR) If you are located in Europe, your rights are additionally protected by the General Data Protection Regulation (GDPR):

• Special categories of data (Article 9 GDPR): Since you transmit information about PAWS symptoms to the AI assistant, these details are strictly classified as "health data", the processing of which is regulated by Article 9 GDPR. Our processing is based solely on your explicit consent.
• Right to withdraw consent: You have the right to withdraw your consent to the processing of health data at any time. The process of withdrawing consent is implemented to be as simple as the process of providing it.
• Right to lodge a complaint with a supervisory authority (DPA): In accordance with Article 77 GDPR, if you believe that the processing of your personal data violates the requirements of the regulation, you have the right to lodge a complaint with a data protection supervisory authority in the country of your habitual residence or at the place of the alleged infringement.

Users from the US (State Laws) Depending on your state of residence, we provide you with extended rights in accordance with the latest legislation:

• California Specifics (CPRA):
• Right to know: You have the right to know what categories of personal information we collect, as well as exactly who has access to them (including categories of third parties).
• Right to opt-out of data sharing ("Do Not Sell or Share"): You have the right at any time to forbid us from transferring or "selling" your data to third parties. A corresponding link or button "Do Not Sell or Share My Personal Information" is available on our website.
• You also have the right to limit the use of your Sensitive Personal Information.
• Washington & Nevada Specifics (My Health My Data Acts):
• The paws.ml platform strictly complies with consumer health data protection laws, in particular the Washington MHMDA and the Nevada SB 370.
• We provide a clear and accessible mechanism for withdrawing your consent to the collection and processing of data about your symptoms (Consumer Health Data).
• Upon receiving a data deletion request from you, we undertake not only to irretrievably delete your information from our systems (including archives and backups), but also to pass this request on to all our affiliates, processors, and AI providers for data deletion on their side.

Users from the People's Republic of China (PIPL) If you are a resident of the PRC, your data is processed taking into account the requirements of the Personal Information Protection Law (PIPL). In addition to the rights to access, correct, and delete data, the law grants you specific rights in the context of algorithmic processing:

• Right to algorithm explanation and profiling limitation: You have the right to request an explanation from us of the logic behind the algorithms of our AI assistant.
• You also have the right to limit automated profiling and can opt-out of decisions made solely on the basis of automated data processing if such decisions have a significant impact on your rights and interests.

8. Children's Privacy

The PAWS ML platform and our AI assistant are created exclusively for adult users. Our service is strictly not intended for use by persons under the age of 18.

We do not knowingly request, collect, or process personal information or symptom data from persons under the age of 18. If we become aware that we have inadvertently received personal data or health information from a minor, this data will be immediately and irretrievably deleted from all our systems, and the user's access to the service will be blocked.

This strict age restriction is implemented to ensure maximum safety and full compliance with global laws on the protection of children in the digital environment, including:

• GDPR (European Union, EEA, and UK): Under Article 8 GDPR, processing the data of children under 16 (or 13 in some EU countries) requires verified consent from parents or guardians. Given that we also process special categories of health data (Article 9 GDPR), we completely eliminate legal risks by making the platform accessible only from age 18.
• COPPA (US): We strictly comply with the Children's Online Privacy Protection Act and do not collect information from persons under 13.
• CPRA (California, US): California legislation imposes strict penalties (up to $7,500 per violation) for the unauthorized collection, sale, or sharing of data of consumers under 16. A zero-tolerance policy towards the collection of minors' data guarantees compliance with these standards.
• PIPL (China): Any personal information of persons under 14 is automatically classified as "sensitive personal information", requiring parental consent and the formation of specific processing rules.

Appeal to parents and guardians: If you are a parent or legal guardian and you have reason to believe that your child under the age of 18 has provided us with their personal information or data about their well-being, please immediately contact us via email at privacy@paws.ml. We will take all necessary measures to promptly find and completely delete this information from our databases.