Privacy Policy

This Privacy Policy describes how Qpher LLC ("Qpher", "we", "us") collects, uses, stores, and shares personal data when you use the Qpher PQC Security Cloud platform, including the API (api.qpher.ai), User Portal (portal.qpher.ai), marketing site (qpher.ai), documentation (docs.qpher.ai), and the **Qpher Vault** mobile application available on the Apple App Store. We are committed to protecting your privacy and handling your data transparently. This policy applies to all users of the Service, including account holders, administrators, mobile-app subscribers, and visitors to our websites. **Two-Account Model**: Qpher operates two independent product lines with separate billing and separate user databases — (a) **SaaS API & User Portal** (web-based, Stripe billing, intended for developers and enterprises integrating PQC into their own products) and (b) **Qpher Vault** (iOS app, Apple In-App Purchase billing, intended for individuals encrypting personal documents). The same email address may be used for both products, but the two accounts remain isolated by design and are governed by the data handling rules described below.

Qpher acts in two distinct data roles depending on the category of data: **Controller**: Qpher is the data controller for customer account data (email, name, company), billing and payment data (invoices, payment history, Stripe customer ID), and API usage and audit logs (request counts, error logs, tenant activity). The legal bases are legitimate interest (GDPR Art. 6(1)(f)), contract performance (Art. 6(1)(b)), and legal obligation (Art. 6(1)(c)). **Processor**: Qpher is a data processor for customer-encrypted data (ciphertext processed via the KEM encrypt API), PQC cryptographic keys (Kyber768/Dilithium3 key pairs managed by the KMS), and customer plaintext submitted for encryption (transient, never stored or logged). The legal basis is contract performance (Art. 6(1)(b)). A Data Processing Agreement (DPA) is available at /legal/dpa.

**Account Information (SaaS)**: Email address, full name, company name, and password (stored as bcrypt hash with cost factor >= 12). **Billing Information (SaaS)**: Plan selection, billing interval, payment method metadata (card last four digits, expiry). Full payment card details are handled exclusively by Stripe and never reach Qpher servers. **Usage Data**: API request counts, endpoint usage, response times, error rates, and tenant-level activity logs. **Cryptographic Data (as Processor)**: Ciphertext produced by KEM encryption, digital signatures produced by Dilithium signing, and PQC key pairs (public keys stored in the database, private keys stored encrypted in the KMS secure enclave). Customer plaintext submitted to the /kem/encrypt endpoint is transient and is never stored, logged, or persisted. **iOS Vault App Data**: When you use the Qpher Vault iOS app, we additionally collect: - **Vault account credentials** (email address, display name, password hashed with bcrypt cost factor >= 12) — stored in a database table physically separated from SaaS API user accounts. - **Apple StoreKit transaction identifiers** (`apple_original_transaction_id`, `transaction_id`, and the subscribed `product_id`) for verifying active Personal or Personal Pro subscription status. - **Apple Sign In relay email addresses** (in the form `*@privaterelay.appleid.com`) when the user authenticates via Sign in with Apple. We never attempt to resolve relay addresses to a user's underlying real email. - **Encrypted document ciphertext** stored on Cloudflare R2 (see Section 6.5 for the encryption design and the operator-trust boundary — Qpher does not read document contents during normal service operation). - **Document metadata stored unencrypted in our PostgreSQL database** so the application can render your file list: document name (original filename), MIME type, original byte size, file hash, encryption algorithm identifier, key version, and timestamps. **Filenames are NOT encrypted for standard Qpher Vault documents** in this release — please avoid putting sensitive information directly in filenames if this matters to you. (Platform-wide encrypted filenames are a v2.0 roadmap item.) **Legacy Vault documents are the exception: their file names and folder names are encrypted on your device before upload, so Qpher stores only ciphertext for those metadata fields (see the Consumer Health Data Privacy Policy).** - **Document-relationship records** including organization-membership rows (which Vault Team you belong to and your role), document-share records (recipients, permission level, expiration), pending-invitation records, and access audit logs (operations performed on your documents, with timestamps and the actor's user ID). - **Multi-Factor Authentication state**: an encrypted TOTP shared secret (server-side AES-256-GCM at rest), a count of unused recovery code hashes, and (where applicable) an email OTP delivery audit row. - **Refresh-token records** for keeping you signed in (a per-token UUID + revocation flag — the token itself is bcrypt-hashed before storage). - **Apple Push Notification Service (APNs) device tokens**, collected from both of our iOS apps and used only to deliver the notifications described here — nothing else. From **Qpher Vault** (`ai.qpher.vault`): MFA prompts and shared-document notifications. From **Qpher Legacy** (`ai.qpher.legacy`): alerts to the vault owner when a claim is opened on their Legacy Vault, when that claim enters its waiting period, and when documents are released. These Legacy alerts exist so that an owner can exercise their right to stop a claim; we do not send push notifications to heirs or confirmers. A device token is a routing address only — it is not linked to the contents of any document, and it is never shared with anyone but Apple for the purpose of delivering the notification. Tokens rotate when iOS revokes them, are removed when you sign out or turn notifications off, and are deleted with your account when deletion is finalised. If you delete your account, your tokens are **retained during the 30-day recovery window** rather than removed immediately: an owner whose account is pending deletion is precisely the person who most needs to hear that someone has claimed their vault. We do NOT collect, anywhere in the iOS Vault app: photo library content (we read pixel data into the encryption pipeline but never transmit raw photos), location data (no GPS, no Core Location), contacts, calendar, microphone, advertising identifiers (no IDFA), device identifier-for-vendor (no IDFV), analytics events (no Firebase, Mixpanel, Amplitude, or comparable SDK), crash telemetry beyond what Apple captures via TestFlight, or any third-party tracking data. **Website Analytics**: Page views, referrer information, and approximate country for the marketing site `qpher.ai` only (via Plausible Analytics, which is cookie-free and collects no personally identifiable information). The iOS Vault app does NOT use Plausible or any other analytics tool.

If you use Qpher Legacy (our digital legacy vault iOS app) — or if a Qpher Legacy vault owner designates you as an heir or confirmer — we additionally process the following data. Qpher acts as the data controller for these categories. **User-designated contacts (heirs and confirmers)**: the name and email address of each person a vault owner designates, provided to us at the owner's direction. We use this data only to operate the owner's legacy policy: sending the designation notice, claim and status notifications, confirmation requests, and — if the owner's release policy completes — delivering the owner's documents to the designated recipients. When we first contact a designated person, the message identifies who designated them, explains why we hold their name and email, and explains how to object. A designated person may object to our processing of their contact data at any time by emailing privacy@qpher.ai — Qpher itself receives and carries out the objection by suppressing the contact record and notifying the vault owner that their policy needs review. You do not need to ask the owner to remove you. **Death certificates**: if a claimant does not have a claim code, their claim is routed to a manual review lane and they submit a copy of a death certificate. We use it solely to review that claim in good faith. It is retained as part of the claim record and deleted on the schedule in Section 7.1. **Sworn claim attestations**: every claim on a Legacy Vault requires the claimant's sworn statement, made under penalty of perjury, that the vault owner has died, together with the claimant's typed legal name and the date. The attestation text, its version, and the acceptance timestamp are retained in the append-only legacy policy ledger as evidence of the basis for the claim. **Consumer health data**: for Washington and Nevada consumers, our separate Consumer Health Data Privacy Policy at qpher.ai/legal/consumer-health-data also governs any consumer health data we hold.

**Contract Performance (Art. 6(1)(b))**: Processing account data and cryptographic data is necessary to provide the Service as agreed in the Terms of Service. **Legitimate Interest (Art. 6(1)(f))**: Processing usage data and audit logs is necessary for platform security, abuse prevention, and service improvement. We have conducted a legitimate interest assessment and determined that these interests do not override data subject rights. **Legal Obligation (Art. 6(1)(c))**: Retaining billing records and invoices for 7 years is required for tax compliance. **Consent**: We rely on consent only where required by law (e.g., for optional marketing communications). Consent may be withdrawn at any time.

We use your data to: (a) provide and maintain the Service, including account management, authentication, and API access, (b) process billing and payments through Stripe, (c) enforce plan limits and rate limiting, (d) generate audit logs for security and compliance, (e) monitor platform performance and availability, (f) send transactional emails (account verification, password reset, security alerts, billing notifications), (g) improve the Service based on aggregated, anonymized usage patterns, and (h) comply with legal obligations. We do not sell personal information to third parties. We do not use customer cryptographic data (ciphertext, keys) for any purpose other than providing the requested cryptographic operations.

Qpher shares data with the following sub-processors: - **Stripe, Inc.** (USA, EU-US Data Privacy Framework): Payment processing for the SaaS API and User Portal. Receives customer name, email, billing address, and tokenized payment card data. - **Apple Inc.** (USA): App Store Connect billing and StoreKit subscription management for the Qpher Vault iOS application. Receives Apple ID, IAP transaction identifiers, and subscription metadata. Apple's handling of payment data is governed by the Apple Privacy Policy. - **Cloudflare, Inc.** (USA): R2 object storage for Qpher Vault encrypted documents. Receives the encrypted ciphertext bytes (which Cloudflare cannot read), and a small JSON metadata sidecar per document containing the byte size and PQC algorithm identifier, and — for standard Qpher Vault documents — the original filename in plaintext (these standard-Vault metadata fields are stored unencrypted both on Cloudflare and in our PostgreSQL database — see Section 3 and Section 6.5; for Legacy Vault documents the file name and folder name are encrypted on-device and stored only as ciphertext). Cloudflare does not have access to the document contents themselves. - **Twilio SendGrid** (USA): Transactional email delivery (account verification, password reset, MFA email OTP, lifecycle notifications). Receives recipient email address and email content. - **Google Cloud Platform (Google LLC, USA — us-east1)**: Compute (Cloud Run), database (Cloud SQL), key management (Cloud KMS), object storage, and in-memory cache / rate limiting (Memorystore Redis). All platform data is encrypted at rest and in transit. - **Cloudflare, Inc. (R2 Object Storage)** (USA, Cloudflare Data Processing Addendum 2024): Customer vault document storage. Receives encrypted document ciphertext, metadata (document IDs, filenames, content hashes), and organization/tenant identifiers. Documents are encrypted with AES-256-GCM using Qpher-managed keys before upload; Cloudflare cannot read document contents. - **Google LLC (Google Cloud KMS)** (USA, us-east1 Iowa, Google Cloud Data Processing and Security Terms): Envelope encryption of PQC private key material (Level 2 protection per ADR-0028). Receives encrypted key blobs only; never receives plaintext customer data or unencrypted private keys. - **Anthropic, PBC** (USA): Powers the in-product AI support assistant (Claude). Receives the chat messages you send and, for the authenticated portal chat, your account email, display name, plan, and tenant identifier. Does not receive your documents, plaintext, ciphertext, or cryptographic keys. Per Anthropic's commercial terms, data submitted via the API is not used to train models (see Anthropic's privacy policy). - **Plausible Analytics** (EU, Germany): Privacy-focused website analytics for the marketing site only (NOT used in the iOS app). Receives page views, referrer, and approximate country. No personally identifiable information or cookies. - **BetterStack** (EU): Uptime monitoring and status page. Receives API endpoint URLs and response times only. We provide 30 days advance notice via email and in-portal notification before adding new sub-processors. Enterprise customers with custom DPA terms may object per their contractual agreement.

The Qpher Vault iOS application encrypts your document content on-device before it leaves your phone. The encryption design — described in detail in our public Architecture Decision Records ADR-0023 (KEM-DEM scheme), ADR-0031 (hybrid PQC+classical algorithms), and ADR-0010 (private key boundary) — works as follows: 1. **On-device encryption**: When you upload a document, the Vault app generates a random AES-256-GCM data encryption key (DEK) on your device and encrypts the file locally. The plaintext content never leaves your device. 2. **Hybrid post-quantum key wrapping**: The DEK is wrapped using **X-Wing**, a hybrid scheme combining NIST-standardized post-quantum cryptography (ML-KEM-768, formerly Kyber768, FIPS 203) with classical X25519 elliptic-curve key agreement. This dual-layer design provides defense-in-depth against future cryptanalytic advances on either algorithm. Wrapping uses your tenant's public encapsulation key. 3. **Storage**: The encrypted ciphertext bytes and the wrapped DEK are uploaded to Cloudflare R2. The unwrapped DEK is never persisted server-side. A small JSON metadata sidecar containing the document's byte size and algorithm identifier — and, for standard Qpher Vault documents, the plaintext filename — accompanies the ciphertext on R2 and in our PostgreSQL database (see Section 3). For standard Qpher Vault documents these filename fields are NOT encrypted in this release; for documents selected into a Qpher Legacy Vault, the file names and folder names are encrypted on-device before upload and stored only as ciphertext (see the Consumer Health Data Privacy Policy). 4. **Decryption**: When you open a document, the Vault app authenticates and requests the wrapped DEK be unwrapped. The Qpher Key Management Service (KMS-Orchestrator) holds the tenant decapsulation private key inside an access-controlled secure enclave per ADR-0010, performs the KEM decapsulation, and returns the unwrapped DEK to your device, which then decrypts the file locally. The DEK exists in server memory only for the duration of the API call and is zeroed immediately afterward via explicit `ctypes.memset` calls (see ADR-0023 §C1). **Trust model — please read this carefully.** Qpher operates this release of the iOS Vault under an **operator-trusted** model: Qpher's Key Management Service holds the tenant decapsulation private key. This means that, under normal service operation, our automated infrastructure does NOT read the plaintext content of your documents — every decapsulation requires an authenticated request from your device, and the unwrapped DEK is returned to you and zeroed from server memory. However, a privileged Qpher operator with production KMS access could in principle perform a decapsulation outside the normal request flow. This model is the same one used by, for example, Dropbox, Box, and Apple iCloud's standard data protection — and is materially different from a true zero-knowledge model used by Apple's Advanced Data Protection, Bitwarden, or 1Password (where the encryption keys live only on the user's devices and the service operator cannot decrypt content even if compelled to). **What this means for you in practice.** - Forgetting your password and resetting it via email **does not lose your document access** — the encryption keys are managed by Qpher's KMS, not derived from your password. - Qpher is technically capable of complying with a valid legal order (subpoena, search warrant, court order) to decrypt the documents of a specific account. We have not been required to do so to date. We will publish a transparency report if and when we receive such legal demands, including aggregate counts and categories permitted to be disclosed under applicable law. We will notify the affected user unless prohibited by law. - **A true zero-knowledge mode ("Personal Pro Privacy Mode") is on the v2.0 product roadmap** as an opt-in for paid tiers. Once shipped, that mode will move the decapsulation key to your device and remove Qpher's ability to access content even with operator access. We will publish a separate ADR and updated Privacy Policy section before that capability ships. - App Store Privacy Nutrition Label: per Apple's guidance for apps using end-to-end-style encryption-at-rest where the service operator does not normally access content, we exclude document content from the "User Content" category in the App Store metadata. The metadata sidecar described above (filename, size, algorithm) is collected and disclosed in Section 3.

Retention varies by data category and user action. We publish this schedule to satisfy GDPR Article 13(2)(a), UK-GDPR, CCPA, and comparable transparency requirements. See Section 7.1 for the retention schedule by category, Section 7.2 for the criteria used to determine each period, and Section 7.3 for your right to accelerated deletion.

**Individual account data** (iOS Qpher Vault): - While the account is active: retained indefinitely. - After user-initiated deletion: 30-day grace window during which the account is non-functional but recoverable via 'Restore Account'. After grace, account data (email, password hash, MFA secrets, vault document contents, vault metadata) is removed from active systems; full purge from encrypted backup storage within a further 14 calendar days. - After administrative removal by an organization administrator: 10-minute operational-safety buffer, then the member's organization-level row is removed; the individual's personal vault data (if the user has a personal account outside the organization) is preserved. **Organization data**: - While active: retained indefinitely. - After owner-initiated deletion: 30-day grace, then same removal + backup-purge schedule as individual accounts. Shared documents in Cloudflare R2 and organization-scoped API keys are removed at the end of grace. The Stripe subscription is set to cancel at the end of the current billing period upon grace initiation — see Terms of Service Section 7.3. **Cryptographic key material**: - PQC private keys (Kyber768, Dilithium3) are rendered inaccessible for normal operations within 30 days via Google Cloud KMS key destruction; complete cryptographic unrecoverability follows the 14-day backup-purge cycle for any backup copies. - PQC public keys: same retention schedule as the associated account. **Operational data**: - Audit logs (append-only lifecycle events): retained indefinitely. These records are append-only by design — they are the tamper-evident proof that a deletion, restoration, or release actually followed the process we describe, and our deletion automation refuses to act on an account that has no matching audit entry. Each entry holds identifiers and process facts only (which action, when, by which role, against which internal record ID) and never contains your name, email address, document names, or document contents. Once the associated account or organization is permanently deleted, the records those identifiers point to no longer exist, so the surviving entries can no longer be linked to you by us or by anyone else. Data subjects may request a copy of their audit log entries via Section 7.3 while the account exists. - Invoices and billing records: retained 7 years per U.S. IRS 26 CFR §1.6001-1 and applicable EU Member State tax law. - Prometheus operational metrics: 15 days hot storage, 90 days cold storage, then anonymized by removing tenant identifiers. **Qpher Legacy data** (see Section 3.1): - While a legacy policy is armed, the account is exempt from automatic deletion processes (a "Legacy Hold") — an armed vault is preserved for its designated recipients even if the subscription lapses, until it is claimed, vetoed, or the owner disarms or deletes it. - Legacy Vault documents after a completed release: retained for at least 24 months after release so that recipients can claim and download them, regardless of subscription status. In plain terms, this 24-month clock pauses while any claim is open or while a court-ordered or estate-dispute freeze is in place, and resumes counting when the claim or freeze is resolved — an open dispute never runs the clock out. Before any purge, we notify all known contacts 90, 30, and 7 days in advance. - Death certificates (manual claim-review lane): retained with the claim record for as long as the related claim record is retained, then deleted on the same schedule as the policy's audit records. - Designated-contact records (heir/confirmer name and email): retained while the owner's policy references them; removed when the owner deletes the policy or account (subject to the append-only ledger entries above), or suppressed immediately when the contact objects per Section 3.1. - Legacy policy ledger entries (append-only lifecycle events for designations, claims, confirmations, vetoes, freezes, and releases): retained per the audit-log schedule above.

The retention periods in Section 7.1 are determined by the following considerations, as required by GDPR Article 13(2)(a) and comparable applicable law: **30-day grace period** for account and organization deletion: balances industry-standard user-recovery window (Apple App Store Guideline 5.1.1(v) recommendation; parity with Anthropic, OpenAI, Notion, and GitHub account-deletion practices) against the data subject's right to prompt erasure. Legal basis: Article 6(1)(b) (contract performance: the grace period enables the user to restore their ongoing service relationship). **14-day backup-purge window** after active-system deletion: determined by our disaster-recovery backup retention policy (Google Cloud SQL automated backups with 7-day point-in-time-recovery window, plus operational-recovery buffer). Backup-retained data is inaccessible to Qpher personnel except in bona-fide disaster-recovery scenarios. Legal basis: Article 6(1)(f) (legitimate interest: business continuity; see Section 4 for our legitimate interest assessment). **10-minute buffer** for administrative removal: minimizes the risk of accidental administrator actions while honoring the prompt-removal expectation of the affected user. Legal basis: Article 6(1)(b) contract performance. **Indefinite audit log retention**: required for forensic review, security incident investigation, dispute evidence (including inheritance disputes under Qpher Legacy, which can arise years after a release), and regulatory compliance. These records are append-only and hold identifiers and process facts only — no names, email addresses, or document contents — and once the account they reference is deleted they can no longer be linked to an individual. Legal basis: Article 6(1)(f) legitimate interest (platform security and evidentiary integrity). **7-year invoice retention**: required by U.S. IRS 26 CFR §1.6001-1 and applicable EU Member State tax law. Legal basis: Article 6(1)(c) legal obligation.

You may request accelerated deletion (faster than the 30-day grace) at any time under GDPR Article 17, UK-GDPR Article 17, CCPA §1798.105 (for California residents), and comparable applicable law in your jurisdiction. To request accelerated deletion: 1. Email privacy@qpher.ai with your account email and a clear request for accelerated deletion. 2. We verify your request and respond within 1 calendar month of receipt. For complex requests we may extend by up to an additional 2 months, notifying you of the extension and the reason per GDPR Article 12(3). 3. Upon verification, deletion proceeds: active-system removal within 30 calendar days of the verification date; full backup purge within a further 14 calendar days. 4. We may retain data longer where legal obligations require (e.g., 7-year invoice retention for tax compliance); we identify any such retained data in our response. **Automated deletion enforcement (as of 2026-06-30)**: Qpher's automated deletion-enforcement process is in a supervised rollout phase (staged production enablement). Soft-deleted data remains logically inaccessible and non-restorable; automated permanent-delete enforcement is targeted for full production by 2026 Q2. During the rollout, data subjects who require guaranteed immediate permanent deletion should use the email path above to receive manual expedited processing — this path is available today and effective within the 30 calendar days above. You retain all rights under GDPR, UK-GDPR, and CCPA throughout the rollout. If you believe your erasure request has not been honored within the stated timeframe, you may lodge a complaint with your local supervisory authority (EEA: your national Data Protection Authority; UK: Information Commissioner's Office; California: Attorney General's Office; other jurisdictions: your applicable authority).

If you are located in the European Economic Area (EEA) or the United Kingdom, you have the following rights: - **Right to Access (Art. 15)**: Request a copy of your personal data by emailing privacy@qpher.ai; we respond within 30 days. - **Right to Rectification (Art. 16)**: Update your profile information in the portal settings. - **Right to Erasure (Art. 17)**: Request account deletion; processing completes within 30 days. - **Right to Restrict Processing (Art. 18)**: Request account suspension (API access disabled, data preserved). - **Right to Data Portability (Art. 20)**: Request a machine-readable copy of your public keys and data by emailing privacy@qpher.ai. - **Right to Object (Art. 21)**: Object to processing based on legitimate interest by contacting privacy@qpher.ai. To exercise these rights, use the portal settings or contact privacy@qpher.ai. We respond to requests within 30 days. You also have the right to lodge a complaint with your local supervisory authority.

If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA): - **Right to Know (Section 1798.100)**: Request information about the categories and specific pieces of personal information we collect. Submit your request by emailing privacy@qpher.ai (same mechanism as GDPR Art. 15 above). - **Right to Delete (Section 1798.105)**: Request deletion of your personal information. We process requests within 30 days. See Section 7.3 for the accelerated deletion mechanism, response timeframes, and rollout status. - **Right to Opt-Out of Sale (Section 1798.120)**: Qpher does not sell personal information to third parties. - **Right to Non-Discrimination (Section 1798.125)**: We do not discriminate in pricing or service quality based on the exercise of privacy rights. Categories of personal information collected: identifiers (email, name), commercial information (billing records), and internet activity (API usage logs). To exercise your rights, use the portal settings or contact privacy@qpher.ai.

We implement the following security measures to protect your data: (a) all data in transit is encrypted via TLS 1.2+ (TLS 1.3 preferred), (b) all data at rest is encrypted, including PQC private keys encrypted with AES-256-GCM, (c) passwords are hashed with bcrypt (cost factor >= 12), (d) API keys are stored as HMAC-SHA256 hashes, never in plaintext, (e) application-level tenant isolation ensures no cross-tenant data access, (f) a zero trust policy engine evaluates every API request, (g) audit logs track all security-relevant operations and are append-only and retained indefinitely (see Section 7.1), and (h) all changes to security-critical components require peer code review before deployment. Independent third-party penetration testing and SOC 2 Type II certification are planned as part of our enterprise-readiness roadmap and have not yet been performed.

Qpher is based in the United States. If you are accessing the Service from outside the United States, your data may be transferred to and processed in the United States. For transfers from the EEA/UK to the US, we rely on: (a) the EU-US Data Privacy Framework (DPF) where our sub-processors are certified, (b) Standard Contractual Clauses (SCCs) as approved by the European Commission, and (c) supplementary technical measures including encryption in transit and at rest. Enterprise customers may negotiate additional data transfer safeguards in their DPA.

For privacy-related inquiries, data subject requests, or complaints: - **Privacy Team**: privacy@qpher.ai - **Security Team**: security@qpher.ai - **General Inquiries**: sales@qpher.ai - **Postal Address**: Qpher LLC, 8401 Mayland Dr Ste A, Richmond, VA 23294, USA We aim to respond to all privacy inquiries within 30 days. If you are not satisfied with our response, you have the right to lodge a complaint with your local data protection supervisory authority.

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or the Service. Material changes will be communicated via email to the account holder and through an in-portal notification at least 30 days before taking effect. The current version of the Privacy Policy is always available at qpher.ai/legal/privacy. We encourage you to review this policy periodically. Your continued use of the Service after changes take effect constitutes your acceptance of the updated policy.