IRIS Privacy Notice

Version 0.5 · Effective September 13, 2026

Who we are. Saccadic LLC, trading as Saccadic ("we," "us," or "our"), provides IRIS (Intrinsic Rank Inspection System) and its licensing portal. This notice explains how we collect, use, and disclose personal information when you register for an account, obtain or use an IRIS license, purchase credits, or contact us.

For privacy questions or requests, contact [email protected] or write to 19319 W Missouri Ave, Litchfield Park, AZ 85340.

Information we collect

We collect the following information:

• Registration and account information: your name, institution or organization, email address, professional or academic title, account category, authentication information, and records of license-agreement acceptance and account verification. Required fields are identified during registration.
• Licensing and usage information: your license and account identifiers, credit balances, transaction history, and information needed to authorize and meter IRIS use. This includes your Run Key, a random session identifier, the model's total parameter count, the IRIS software version, an optional machine fingerprint, the time of the first recorded diagnostic frame, the number of diagnostic frames delivered, a cryptographic hash of the last recorded frame (never its content), and, when a Run resumes or ends before recording, its signed licensing receipt and lease or a cancellation notice. These records may be associated with your account.
• Payment information: purchase amounts, payment status, and transaction references. Payments are processed by Stripe; your payment-card details go to the payment processor directly, and Saccadic never receives or stores them.
• Information you provide voluntarily: support correspondence, feedback, files you choose to share, and information submitted in academic-license or credit-grant applications, such as an advisor's details, institution, research abstract, and intended publication venue.
• Portal technical information: a signed session cookie used only to keep you logged in to the portal; the IP address recorded with agreement acceptances and account activity; and standard web-server access logs (IP address, request, and time) used for security and troubleshooting. The portal sets no advertising or analytics cookies and runs no analytics or tracking scripts.

Your models and research data

IRIS performs diagnostic collection and analysis in your computing environment. Its standard licensing communications do not upload your models, weights, training data, gradients, source code, or diagnostic results to Saccadic. They also do not transmit user-chosen model names, run names, or file and directory names.

If you voluntarily send us logs, diagnostic files, or other materials for support, we receive the information those materials contain. Review files before sharing them and remove information unnecessary for your request.

Where your institution operates a private deployment, its handling of personal information may also be governed by its own privacy notice.

How we use information

We use personal information to create and administer accounts; verify license eligibility; issue and authenticate licenses; calculate and manage credits; process purchases; maintain agreement and transaction records; provide support; review academic applications and credit requests; protect the service against misuse; and meet legal obligations.

We may send account, licensing, security, and service communications, including an automated weekly usage summary sent to accounts with activity, which you can opt out of at any time. We do not send marketing communications.

How we share information

We share information with service providers only as necessary to operate the service, and never for marketing purposes. We may also disclose information where legally required, to protect legal rights or investigate misuse, or in connection with a merger, acquisition, or business transfer, subject to applicable protections.

We do not sell personal information, do not share it for targeted advertising, and do not disclose it to institutional account administrators.

Retention and security

We retain information for the periods needed to administer your account and licenses, maintain purchased-credit and transaction records, resolve disputes, and satisfy applicable legal requirements. Specifically:

• Account records (your name, institution or organization, email address, title, and account category) are kept while your account is active and are removed when you delete your account.
• Agreement-acceptance records (the date and time of acceptance, the version and exact text you accepted, each box you ticked, and the IP address the acceptance was made from) are kept for seven years after your account is closed, so that we can show what was agreed.
• Licensing and transaction records (credit purchases, grants, and the metering record of each Run, including any machine fingerprint the IRIS client sent with that Run) are kept for seven years after the transaction.
• Support materials and portal technical logs: support materials are kept for as long as needed to resolve your request and are deleted on request; portal access logs are routine operational logs, rotated automatically and not retained long-term.

We use technical and organisational safeguards to protect personal information, including encrypted connections (TLS), signed session cookies, licence credentials stored as cryptographic hashes rather than in plain text, cryptographically signed licensing records, and access controls that restrict administrative access. No method of transmission or storage is completely secure.

Your choices and rights

You may contact us to request access to, correction of, or deletion of your personal information. Depending on applicable law, you may also have rights to restrict or object to processing, obtain a portable copy, withdraw consent where processing relies on consent, or complain to a privacy regulator. We may verify your identity before responding. Some information may need to be retained for legal obligations or to establish or defend legal claims.

International processing

Personal information is hosted and processed in the United States on Google Cloud Platform infrastructure. If you use the service from outside the United States, your information is transferred to and processed in the United States.

Changes to this notice

We may update this notice as our services or practices change. We will post the revised notice with its effective date and provide additional notice where required by law.