Privacy Policy
IRIS is an investor-relations service operated by Nu Haus Digital Marketing LLC ("IRIS", "we"). Public companies ("Clients") install IRIS on their investor websites. This policy explains what IRIS collects when you visit a Client's site or useiris.ai, what we do with it, and the choices you have.
1. Who is responsible
The Client whose website you are visiting decides why and how your information is used. For that data the Client is the controller (or "business") and IRIS is its processor (or "service provider"), acting on the Client's instructions under a data processing agreement. For useiris.ai itself, and for the accounts of Client staff who log in to IRIS, we are the controller.
2. What IRIS collects
| Information | When | Notes |
|---|---|---|
| Pages viewed, time of visit, referring site or campaign tag, device type | Each page view on a site that runs IRIS | |
| The click identifier Google or LinkedIn adds to the link when you arrive by clicking one of the Client's paid ads | The visit you arrive on and a sign-up during that visit | Used only to confirm that a sign-up came from a real ad click. Not kept if you refuse tracking (section 6). |
| Approximate location (city, region, country) and the name of your network or internet provider | Each request | Derived from your IP address by our hosting provider. IRIS does not store your IP address. To limit abuse it keeps only a one-way fingerprint of it that changes every day and cannot be turned back into an address. |
| A random visitor identifier kept in your browser's local storage | First visit | Used to recognise a returning browser. Not set, or reset on every visit, if you refuse tracking (section 6). |
| Questions you type or speak to the concierge, and the answers | When you use the concierge | Voice is processed live to produce a reply and is not stored as a recording. |
| Name, email address and phone number | When you submit a sign-up form or a call request, the presentation gate, or the concierge contact prompt | Only what you choose to provide. A phone number left with a call request goes to the Client's team so they can call you. |
| Signals used to screen out automated submissions (how quickly a form was filled, a hidden form field, browser type, network type, email domain) | When you submit a sign-up form or a call request | Used only to filter out bots and spam. Clearly automated submissions are not passed on and are kept only as a short audit record; borderline ones are marked for the Client's team. |
| Webinar registration: your email address, your browser's time zone, whether you asked for company updates, and when you opened your personal link and joined | When you register for a Client's webinar | Used to send your personal link and reminders, and to show the Client who registered and attended. |
| Presentation reading activity (which pages, how long) | When you open a presentation in the IRIS viewer | |
| Email engagement (delivered, opened, clicked, bounced, unsubscribed) | When the Client emails you through IRIS or a connected email tool | |
| Notes and contact details added by the Client's team | When the Client records them | For example a phone number or the context of a conversation. |
IRIS does not collect government identifiers, payment card or bank account numbers, health information, or other special categories of personal data, and asks you not to type them into the concierge. IRIS does not buy personal data from brokers. IRIS is intended for adults and is not directed to children under 16.
3. How your activity becomes linked to you
A visit is anonymous until one of these happens: you submit your email address on the site, in the presentation viewer or in the concierge; or you click a link in an email from the Client that was personalised to your address. From then on IRIS associates that browser's past and future activity on that Client's site with your email address. Where a click cannot be tied to an address with certainty, the Client may see a match marked as inferred rather than confirmed.
4. How the information is used
- To answer your questions from the Client's public disclosure.
- To show the Client's investor-relations team who is engaging with their site and presentation, so that they can follow up with relevant information. This includes an engagement score, which is a simple count-based formula over visits, presentation pages and questions. It is not a prediction, and IRIS makes no automated decision about you that has a legal or similarly significant effect.
- To alert the Client when a person they already know returns to the site.
- To send you email you asked for, and to honour unsubscribe requests.
- To produce aggregate statistics (regions, channels, retail and institutional mix).
- To keep the service secure, prevent abuse, and fix faults.
Where a legal basis is required, the Client relies on its legitimate interest in communicating with current and prospective investors, and on your consent for email and for non-essential tracking where the law requires consent. IRIS does not sell personal data and does not share it for cross-context behavioural advertising.
5. Who receives it
The Client whose site you visited, and the providers that run the service for us:
| Provider | Purpose | Location |
|---|---|---|
| Cloudflare, Inc. | Hosting, database, security, location lookup | USA and global edge |
| OpenAI, L.L.C. | Generating concierge and voice answers. API inputs are not used to train its models. | USA |
| Anthropic, PBC | Drafting text for the Client's team. API inputs are not used to train its models. | USA |
| Resend (Plus Five Five, Inc.) | Sending email | USA |
| Intuit Mailchimp | The Client's own mailing list, where the Client connects it | USA |
| TradingView, Inc. | Share price chart shown in the concierge on some Client sites. Loaded from TradingView only when the chart is displayed. | USA |
Posts a Client approves are sent to the social networks the Client connected, under each network's own terms.
Information may be transferred to and processed in the United States. Where required, transfers rely on standard contractual clauses or an equivalent mechanism. We may disclose information if required by law.
6. Your choices
- Refuse tracking. If your browser sends the Global Privacy Control signal, IRIS treats every visit as anonymous: no visitor identifier is kept and your activity is not linked to you. Visitors in the European Economic Area, the United Kingdom and Switzerland are asked before any identifier is stored, and can decline.
- Unsubscribe. Every email sent through IRIS has an unsubscribe link that takes effect immediately.
- Clear the identifier. Clearing your browser's site data for the Client's site removes the identifier.
7. Your rights
Depending on where you live (for example under GDPR, UK GDPR, PIPEDA, or California law) you may have the right to access, correct, export or delete your personal information, to object to or restrict its use, and to withdraw consent. To make a request, write to [email protected] from the email address concerned and name the company whose site you visited. We will confirm receipt, pass the request to that Client where they are the controller, and complete it within 30 days. You will not be treated differently for making a request. You may also complain to your data protection authority.
8. How long it is kept
- Visit, presentation and concierge records: kept while the person stays active, and deleted automatically 24 months after their last activity. At that point a short summary (dates, counts, sources and pages viewed; no message text) is kept with the contact record. Activity with no identifiable visitor is deleted 24 months after it occurred.
- Operational logs: sign-in attempts 90 days; email delivery and console activity logs 24 months. The names and email addresses of Client staff recorded on planned social media posts (who wrote, commented on or approved a post) are kept with those posts for as long as the Client uses IRIS.
- Contact records (name, email, notes) and email engagement: for as long as the Client uses IRIS, then deleted or returned within 90 days of the end of the engagement.
- Unsubscribe and deletion requests: kept as long as needed to keep honouring them.
9. Social media accounts a Client connects
When a Client connects its company LinkedIn Page, X account, Facebook Page or Instagram professional account to IRIS, IRIS receives an access token from that network and stores it encrypted. IRIS uses it only to publish posts the Client has approved in IRIS and to read that account's own posts and their performance figures (for example impressions, views, clicks, reactions, comments and reposts counts), which are shown only to the Client's own team. IRIS does not read private messages and does not collect who commented, reacted or shared. Nothing from a connected account is used to identify, profile or contact individuals, for advertising, or for any other client.
Post text and images copied from LinkedIn are deleted after 6 months and LinkedIn performance figures after 12 months. Posts deleted on X are deleted from IRIS within 24 hours. Other copied posts and figures are kept while the account stays connected. When a Client disconnects an account, or stops using IRIS, the token is deleted at once and the copied posts and figures within 10 days. A person who connected a Facebook or Instagram account can also ask for deletion through Facebook's app settings, or by writing to [email protected].
10. Security
Data is encrypted in transit and at rest. Phone numbers and free-text notes about a contact carry a second layer of encryption inside the database. Payment card, government ID and bank account numbers typed into the concierge are removed before the message is processed or stored; please do not send them. Each Client's data is separated and access is enforced on the server. Staff access is by named login with lockout and optional two-step verification. No system is perfectly secure; if a breach affects your information we will notify the Client and, where required, you and the regulator.
11. useiris.ai
On our own website we record page views and approximate location in the same way, without advertising trackers. If you request early access, we keep the name, email address, company and ticker you enter so we can reply to you, and we screen the request for spam the same way as other sign-up forms. We keep these details for up to 24 months, or until you ask us to delete them.
12. Changes and contact
We will post changes here and update the date above. Questions: [email protected], or Nu Haus Digital Marketing LLC, 165 Eucalyptus Avenue, Hillsborough, CA 94010, USA.