Privacy Policy
IRIS is an investor-relations service operated by Nu Haus Digital Marketing LLC ("IRIS", "we"). Public companies ("Clients") install IRIS on their investor websites. This policy explains what IRIS collects when you visit a Client's site or useiris.ai, what we do with it, and the choices you have.
1. Who is responsible
The Client whose website you are visiting decides why and how your information is used. For that data the Client is the controller (or "business") and IRIS is its processor (or "service provider"), acting on the Client's instructions under a data processing agreement. For useiris.ai itself, and for the accounts of Client staff who log in to IRIS, we are the controller.
2. What IRIS collects
| Information | When | Notes |
|---|---|---|
| Pages viewed, time of visit, referring site or campaign tag, device type | Each page view on a site that runs IRIS | |
| Approximate location (city, region, country) and the name of your network or internet provider | Each request | Derived from your IP address by our hosting provider. IRIS does not store your IP address. To limit abuse it keeps only a one-way fingerprint of it that changes every day and cannot be turned back into an address. |
| A random visitor identifier kept in your browser's local storage | First visit | Used to recognise a returning browser. Not set, or reset on every visit, if you refuse tracking (section 6). |
| Questions you type or speak to the concierge, and the answers | When you use the concierge | Voice is processed live to produce a reply and is not stored as a recording. |
| Name, email address and phone number | When you submit a sign-up form, the presentation gate, or the concierge contact prompt | Only what you choose to provide. |
| Presentation reading activity (which pages, how long) | When you open a presentation in the IRIS viewer | |
| Email engagement (delivered, opened, clicked, bounced, unsubscribed) | When the Client emails you through IRIS or a connected email tool | |
| Notes and contact details added by the Client's team | When the Client records them | For example a phone number or the context of a conversation. |
IRIS does not collect government identifiers, payment card or bank account numbers, health information, or other special categories of personal data, and asks you not to type them into the concierge. IRIS does not buy personal data from brokers. IRIS is intended for adults and is not directed to children under 16.
3. How your activity becomes linked to you
A visit is anonymous until one of these happens: you submit your email address on the site, in the presentation viewer or in the concierge; or you click a link in an email from the Client that was personalised to your address. From then on IRIS associates that browser's past and future activity on that Client's site with your email address. Where a click cannot be tied to an address with certainty, the Client may see a match marked as inferred rather than confirmed.
4. How the information is used
- To answer your questions from the Client's public disclosure.
- To show the Client's investor-relations team who is engaging with their site and presentation, so that they can follow up with relevant information. This includes an engagement score, which is a simple count-based formula over visits, presentation pages and questions. It is not a prediction, and IRIS makes no automated decision about you that has a legal or similarly significant effect.
- To alert the Client when a person they already know returns to the site.
- To send you email you asked for, and to honour unsubscribe requests.
- To produce aggregate statistics (regions, channels, retail and institutional mix).
- To keep the service secure, prevent abuse, and fix faults.
Where a legal basis is required, the Client relies on its legitimate interest in communicating with current and prospective investors, and on your consent for email and for non-essential tracking where the law requires consent. IRIS does not sell personal data and does not share it for cross-context behavioural advertising.
5. Who receives it
The Client whose site you visited, and the providers that run the service for us:
| Provider | Purpose | Location |
|---|---|---|
| Cloudflare, Inc. | Hosting, database, security, location lookup | USA and global edge |
| OpenAI, L.L.C. | Generating concierge and voice answers. API inputs are not used to train its models. | USA |
| Anthropic, PBC | Drafting text for the Client's team. API inputs are not used to train its models. | USA |
| Resend (Plus Five Five, Inc.) | Sending email | USA |
| Intuit Mailchimp | The Client's own mailing list, where the Client connects it | USA |
| TradingView, Inc. | Share price chart shown in the concierge on some Client sites. Loaded from TradingView only when the chart is displayed. | USA |
Information may be transferred to and processed in the United States. Where required, transfers rely on standard contractual clauses or an equivalent mechanism. We may disclose information if required by law.
6. Your choices
- Refuse tracking. If your browser sends the Global Privacy Control signal, IRIS treats every visit as anonymous: no visitor identifier is kept and your activity is not linked to you. Visitors in the European Economic Area, the United Kingdom and Switzerland are asked before any identifier is stored, and can decline.
- Unsubscribe. Every email sent through IRIS has an unsubscribe link that takes effect immediately.
- Clear the identifier. Clearing your browser's site data for the Client's site removes the identifier.
7. Your rights
Depending on where you live (for example under GDPR, UK GDPR, PIPEDA, or California law) you may have the right to access, correct, export or delete your personal information, to object to or restrict its use, and to withdraw consent. To make a request, write to hello@useiris.ai from the email address concerned and name the company whose site you visited. We will confirm receipt, pass the request to that Client where they are the controller, and complete it within 30 days. You will not be treated differently for making a request. You may also complain to your data protection authority.
8. How long it is kept
- Visit, presentation and concierge records: 24 months, then deleted automatically.
- Operational logs: sign-in attempts 90 days; email delivery and console activity logs 24 months.
- Contact records (name, email, notes) and email engagement: for as long as the Client uses IRIS, then deleted or returned within 90 days of the end of the engagement.
- Unsubscribe and deletion requests: kept as long as needed to keep honouring them.
9. Security
Data is encrypted in transit and at rest. Phone numbers and free-text notes about a contact carry a second layer of encryption inside the database. Payment card, government ID and bank account numbers typed into the concierge are removed before the message is processed or stored; please do not send them. Each Client's data is separated and access is enforced on the server. Staff access is by named login with lockout and optional two-step verification. No system is perfectly secure; if a breach affects your information we will notify the Client and, where required, you and the regulator.
10. useiris.ai
On our own website we record page views and approximate location in the same way, without advertising trackers. If you request a demo or early access we keep your email address to reply to you.
11. Changes and contact
We will post changes here and update the date above. Questions: hello@useiris.ai, or Nu Haus Digital Marketing LLC, 165 Eucalyptus Avenue, Hillsborough, CA 94010, USA.