Privacy Policy

1. Introduction

Destro AI Inc. (“Destro AI,” “we,” “us,” or “our”) is a robotics-as-a-service (“RaaS”) and artificial intelligence company. We design, deploy, and operate autonomous and semi-autonomous robotic systems and the artificial intelligence and machine-learning models that power them, and we deliver these capabilities to our customers as a managed service.

This Privacy Policy (the “Policy”) describes how Destro AI collects, uses, discloses, retains, and protects personal information in connection with our websites, customer and operator dashboards, mobile and web applications, APIs, robotic hardware and sensors, and related products and services (collectively, the “Services”). It also explains the choices and rights available to you with respect to your personal information.

We are committed to handling personal information responsibly and in accordance with applicable privacy and data-protection laws, including the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act (collectively, the “CCPA”), and other applicable U.S. state privacy laws. Please read this Policy carefully. By accessing or using the Services, you acknowledge that you have read and understood this Policy.

2. Scope and Application

This Policy applies to personal information we collect or process through the following channels and activities:

Our public websites, marketing pages, and online forms;

Our customer, operator, and administrator dashboards, portals, and APIs;

Our robotic systems, devices, and the sensors they carry, including cameras, microphones, LiDAR, radar, and other environmental and telemetry sensors;

Our artificial intelligence and machine-learning systems, including model training, evaluation, and inference;

Communications with us, including support requests, sales inquiries, and event interactions; and

Our recruiting, hiring, and vendor-management activities.

This Policy does not apply to the practices of third parties that we do not own or control, including our customers acting as independent controllers of their own data, or third-party websites or services that may be linked from our Services.

3. Our Roles: Controller and Service Provider

Depending on the activity, Destro AI may act either as a “business” or “controller” (determining the purposes and means of processing) or as a “service provider” or “processor” (processing personal information on behalf of, and under the instructions of, a customer).

3.1 When We Act as a Controller

We act as a controller when we determine why and how personal information is processed — for example, when you visit our website, contact us, apply for a job, or when we operate our own systems and improve our Services and models.

3.2 When We Act as a Service Provider

We act as a service provider or processor when we operate robotic systems or process data on behalf of a customer under a written services agreement. In these cases, the customer is generally the controller and is responsible for determining the purposes of processing and for providing notices and honoring rights requests with respect to the individuals whose data is processed. If you have a privacy request relating to data we process on behalf of a customer, we will direct your request to the relevant customer or assist them in responding.

4. Information We Collect

We collect personal information from several sources and in several ways, as described below.

4.1 Information You Provide to Us

Contact and account information: name, email address, phone number, mailing address, company name, job title, username, and password.

Customer and billing information: billing contact, payment and transaction details, purchase and subscription history, and service preferences.

Communications: the contents of messages, support tickets, survey responses, and feedback you send to us.

Recruiting information: resume or CV, employment and education history, references, and any information you choose to provide as part of an application, along with voluntarily provided demographic information where permitted by law.

4.2 Information We Collect Automatically

Device and usage data: IP address, device and browser type, operating system, identifiers, pages viewed, features used, referring URLs, and timestamps.

Log and diagnostic data: system activity, error reports, performance metrics, and security events generated by our Services.

Cookies and similar technologies: as described in the “Cookies and Tracking Technologies” section below.

4.3 Information Collected by Our Robots, Devices, and Sensors

Our robotic systems collect data during operation in order to navigate safely, perform their tasks, and improve performance. Depending on the deployment and sensor configuration, this may include:

Audio, video, and image data: recordings and still images captured by on-board cameras and microphones, which may, in some circumstances, include identifiable individuals in or near the operating environment.

Spatial and mapping data: LiDAR, radar, depth, and other sensor outputs used for perception, localization, navigation, and mapping of the operating environment.

Geolocation data: precise and approximate location of robots and devices, route and trajectory data, and deployment-site information.

Telemetry and operational data: speed, orientation, battery and system status, fault and safety events, task and mission logs, and sensor health data.

Where robots operate in spaces that may include members of the public, we seek to limit collection to what is necessary for safety, security, navigation, operations, and the disclosed purposes below, and we apply technical and organizational safeguards such as access controls and, where feasible, redaction, blurring, or de-identification.

4.4 Information From Third Parties

Customers and their personnel, who may provide information about authorized users and deployment environments;

Service providers and partners, such as analytics, payment, hosting, and security providers;

Background-check and recruiting platforms, where permitted and relevant to hiring; and

Publicly available sources and licensed data, including data used to develop and improve our models.

4.5 Categories of Personal Information (CCPA)

In the preceding twelve (12) months, we have collected the following statutory categories of personal information, as defined under the CCPA:

Statutory Category (CCPA/CPRA)

Examples

Collected

Identifiers

Name, email address, phone number, postal address, account ID, IP address, device identifiers, unique online identifiers

Yes

Customer records (Cal. Civ. Code § 1798.80)

Name, contact details, payment/billing information, signature

Yes

Protected classifications

Age, gender, and similar demographic data (e.g., voluntarily provided by job applicants)

Yes (limited)

Commercial information

Records of products or services purchased or considered, subscription and usage history

Yes

Biometric information

Imagery or audio of identifiable individuals captured by robot sensors that may, in limited cases, contain biometric identifiers

Yes (limited)

Internet / network activity

Browsing history, interactions with our website, app, and dashboards, log and diagnostic data

Yes

Geolocation data

Precise and approximate location of robots, devices, and deployment sites

Yes

Sensory information

Audio, video, and image recordings and other sensor data collected by robots and devices during operation

Yes

Professional / employment information

Employment history, qualifications, and related data from job applicants and contractors

Yes (limited)

Inferences

Profiles, predictions, and operational insights derived from the data above

Yes

Sensitive personal information

Precise geolocation; account log-in credentials; contents of certain communications; data revealing limited protected characteristics

Yes (limited)

The specific pieces and categories collected depend on how you interact with the Services and the applicable deployment.

5. Sensitive Personal Information

Certain information we process may constitute “sensitive personal information” under the CCPA, such as precise geolocation, account log-in credentials, and the contents of certain communications. We use and disclose sensitive personal information only for the purposes permitted under applicable law — such as performing the Services, ensuring security and integrity, and other limited business purposes — and not for the purpose of inferring characteristics about an individual. Where required, we provide you with the right to limit the use and disclosure of your sensitive personal information.

6. How We Use Personal Information

We use personal information for the following business and commercial purposes:

To provide, operate, maintain, and secure the Services, including deploying and operating robotic systems;

To navigate, control, and monitor robots safely and to prevent collisions, theft, vandalism, and damage;

To authenticate users, administer accounts, and process transactions and billing;

To provide customer support and respond to inquiries and requests;

To develop, test, train, evaluate, and improve our products, services, algorithms, and AI/ML models (see Section 7);

To monitor and analyze usage, performance, reliability, and trends;

To detect, investigate, and prevent fraud, security incidents, and other harmful or unlawful activity;

To establish, exercise, or defend legal claims, and to maintain records for liability and incident purposes;

To communicate with you, including service, administrative, and (where permitted) marketing messages;

To carry out recruiting and hiring; and

To comply with legal obligations and enforce our agreements.

7. Artificial Intelligence and Machine Learning

Artificial intelligence and machine learning are central to our Services. This section describes how we handle personal information in connection with our AI/ML systems.

7.1 Training and Improving Models

We use data — including sensor data collected by our robots, operational and telemetry data, and, where applicable, licensed and publicly available datasets — to develop, train, evaluate, and improve our models for perception, navigation, autonomy, and related capabilities. Wherever feasible, we de-identify, aggregate, redact, or otherwise minimize personal information before it is used for model development, and we apply access controls and governance to training datasets.

7.2 Model Inputs and Outputs

When you interact with AI-enabled features, the inputs you provide and the outputs generated may be processed to deliver the feature, to maintain quality and safety, and, subject to your settings and applicable agreements, to improve our models. Where we act as a service provider, our use of customer inputs and outputs is governed by the applicable services agreement.

7.3 Automated Decision-Making and Profiling

Certain Services may involve automated processing, including profiling, to support functions such as routing, scheduling, anomaly and safety detection, and operational optimization. Where automated decision-making produces legal or similarly significant effects about an individual, and where required by applicable law, we will provide meaningful information about the logic involved, disclose the intended purposes, and offer the ability to request human review of, or to opt out of, such processing.

7.4 De-Identification and Aggregation

We may de-identify or aggregate personal information so that it no longer reasonably identifies an individual. We maintain such information in de-identified form and do not attempt to re-identify it except as permitted by law, and we use it for research, analytics, benchmarking, mapping, and product and model improvement.

7.5 Human Oversight and Responsible AI

We maintain governance practices intended to support the responsible development and deployment of AI, including human oversight of high-impact decisions, testing and evaluation for safety and performance, and measures to address foreseeable risks.

8. How We Disclose Personal Information

We disclose personal information to the following categories of recipients for the business purposes described in this Policy:

Service providers and processors: vendors that perform services on our behalf, such as cloud hosting and storage, data processing, analytics, payment processing, security, communications, and customer support, bound by contractual confidentiality and data-protection obligations.

Customers and authorized users: where we operate robots or process data on behalf of a customer, or as directed by the customer that controls the relevant data.

Affiliates: our corporate affiliates and subsidiaries, for purposes consistent with this Policy.

Professional advisors: auditors, lawyers, accountants, and insurers, where reasonably necessary.

Business transfers: in connection with a merger, acquisition, financing, reorganization, sale of assets, or bankruptcy, the relevant information may be transferred as part of that transaction.

Legal, safety, and compliance: government authorities, regulators, and other parties where necessary to comply with law or legal process, to enforce our terms, or to protect the rights, property, or safety of Destro AI, our users, or the public.

With your consent or at your direction: in other circumstances where you have consented to the disclosure.

8.1 No Sale of Personal Information

Destro AI does not sell personal information for monetary consideration. To the extent any sharing of identifiers or online activity for purposes such as analytics or cross-context behavioral advertising is deemed a “sale” or “sharing” under the CCPA, we provide the right to opt out as described in Section 13. We do not knowingly sell or share the personal information of individuals under 16 years of age.

9. Robot Operations and Public Spaces

Because our robots may operate in or near public and semi-public spaces, individuals other than our customers and users may be incidentally captured by robot sensors. We limit such collection to what is necessary for safety, security, navigation, and operations, and we apply safeguards such as access controls, retention limits, and, where feasible, redaction or blurring of faces and other identifying features.

Law enforcement and legal requests. Information collected by our robots, including video and audio recordings, location data, and sensor data, may be subject to subpoenas, court orders, or other lawful requests from law enforcement or government authorities. We will provide such information only in response to valid legal process, and will take reasonable steps to notify affected parties where legally permitted.

10. Cookies and Tracking Technologies

We and our service providers use cookies, web beacons, pixels, and similar technologies to operate and secure our websites and applications, remember your preferences, analyze usage and performance, and measure the effectiveness of our communications. The types of cookies we use include:

Strictly necessary cookies: required for core functionality and security.

Functional cookies: remember your preferences and settings.

Analytics cookies: help us understand how the Services are used (including third-party analytics).

Advertising cookies: support interest-based advertising, where applicable.

You can manage cookies through your browser settings and, where offered, through our cookie-preferences tool. Disabling certain cookies may affect the functionality of the Services.

11. Online Advertising and “Do Not Track”

Where we engage in interest-based advertising, you may opt out through industry programs such as the Network Advertising Initiative (optout.networkadvertising.org) and the Digital Advertising Alliance (optout.aboutads.info). Because there is no common industry standard for “Do Not Track” signals, we do not currently respond to such signals; however, we honor recognized opt-out preference signals (such as the Global Privacy Control) where required by applicable law.

12. Data Retention

We retain personal information for as long as necessary to fulfill the purposes described in this Policy, unless a longer retention period is required or permitted by law. The criteria we use to determine retention periods include:

The duration of our relationship with you and our provision of the Services;

Safety, security, liability, and incident-investigation needs (which may require retention of robot-collected data for defined periods);

Legal, regulatory, accounting, tax, and contractual obligations; and

Whether the information has been de-identified or aggregated.

When personal information is no longer needed, we delete, anonymize, or securely dispose of it in accordance with our retention schedules.

13. Your Privacy Rights

Subject to applicable law and certain exceptions, you may have the following rights with respect to your personal information:

Right to know / access: to request the categories and specific pieces of personal information we have collected, the sources, the purposes, and the categories of third parties to whom it was disclosed.

Right to delete: to request deletion of personal information we have collected, subject to legal exceptions.

Right to correct: to request correction of inaccurate personal information.

Right to opt out of sale/sharing: to opt out of any “sale” or “sharing” of personal information for cross-context behavioral advertising.

Right to limit use of sensitive personal information: to limit our use and disclosure of sensitive personal information to permitted purposes.

Rights regarding automated decision-making: to access information about, and where applicable opt out of, automated decision-making and profiling that produces legal or similarly significant effects.

Right to non-discrimination: you will not receive discriminatory treatment for exercising your privacy rights.

14. How to Exercise Your Rights

You may submit a privacy request by contacting us using the details in the “Contact Us” section below. To protect your information, we will take reasonable steps to verify your identity before responding, which may include confirming information we already hold about you. For sensitive or high-risk requests, including those involving robot-collected data, we may apply enhanced verification.

Authorized agents: you may use an authorized agent to submit requests on your behalf, provided the agent gives proof of signed permission or a valid power of attorney; we may also verify your identity directly.

Response timeline: we will acknowledge and respond to verifiable requests within the timeframes required by applicable law (generally within 45 days, extendable by an additional 45 days where reasonably necessary, with notice).

Appeals: where required by applicable state law, you may appeal a decision regarding your request by contacting us, and we will respond within the period required by law.

15. Notice of Financial Incentives

We do not currently offer financial incentives or price or service differences in exchange for the collection, retention, or sale of personal information. If we choose to offer such a program in the future, we will provide the disclosures required by applicable law and obtain your prior opt-in consent where required.

16. Additional U.S. State Privacy Disclosures

Residents of certain U.S. states may have additional rights under their state privacy laws (for example, Virginia, Colorado, Connecticut, Utah, Texas, and others). These rights may include the rights to access, correct, delete, and obtain a portable copy of personal data, and to opt out of targeted advertising, the sale of personal data, and certain profiling. To exercise these rights, please contact us as described below. California residents also have the right under the “Shine the Light” law to request information about disclosures of personal information to third parties for their direct marketing purposes; we do not disclose personal information to third parties for their own direct marketing.

17. Children’s Privacy

Our Services are intended for businesses and individuals who are at least 18 years old and are not directed to children. We do not knowingly collect personal information from children under 13 (or under the age specified by applicable law) in order to provide the Services. If we learn that we have collected such information without appropriate consent, we will take steps to delete it. We do not knowingly sell or share the personal information of minors under 16.

18. Data Security

We maintain administrative, technical, physical, and organizational safeguards designed to protect personal information against unauthorized access, use, disclosure, alteration, and destruction. These measures include encryption of data in transit and, where appropriate, at rest; access controls and authentication; network and endpoint security; logging and monitoring; vendor due diligence; and employee training. No method of transmission or storage is completely secure, however, and we cannot guarantee absolute security.

19. International Data Transfers

Destro AI is headquartered in the United States, and personal information we process may be stored and processed in the United States and in other countries where we or our service providers operate. These countries may have data-protection laws that differ from those of your jurisdiction. Where required, we implement appropriate safeguards — such as contractual protections — for international transfers of personal information.

20. Third-Party Links and Services

Our Services may contain links to, or integrations with, third-party websites, products, and services that we do not control. This Policy does not apply to those third parties, and we are not responsible for their privacy practices. We encourage you to review the privacy notices of any third party before providing your information.

21. Changes to This Policy

We may update this Policy from time to time to reflect changes in our practices, technologies, or legal requirements. When we make material changes, we will update the “Last Updated” date above and, where appropriate, provide additional notice (such as a notice on our website or by email). Your continued use of the Services after the effective date of any update constitutes your acknowledgment of the revised Policy.

22. Contact Us

If you have questions, concerns, or requests regarding this Policy or our privacy practices, or if you would like to exercise your privacy rights, please contact us:

Destro AI Inc.

Attn: Security Team

Email: security@destroai.com

Mailing Address: 35 Hudson Street, Apt W2308, Jersey City, NJ 07302, United States

Website: https://www.destroai.com

This Privacy Policy is effective as of April 1, 2026.