Compliance

Any California resident who signs up for JCIL.AI is protected by the California Consumer Privacy Act as amended by the California Privacy Rights Act. We honor:

• Right to know, you can request a copy of all data we hold about you via the account settings page.
• Right to delete, you can delete your account and all associated data, either scheduled (30-day window, recoverable) or immediate hard delete.
• Right to correct, inaccurate profile fields can be corrected in account settings.
• Right to opt out of "sale" and "sharing", we don't sell or share personal information for cross-context behavioral advertising, so there's nothing to opt out of by default. A formal opt-out toggle is available on the privacy settings page.
• Right to non-discrimination, we don't degrade service for customers who exercise their rights.

The Children's Online Privacy Protection Act regulates the collection of personal information from children under 13. JCIL.AI is not directed at children under 13, and signup requires users to be 13 or older. No ad targeting, no profile building on children, no training on kids' content, and parents can request deletion of a child's data at any time. The full posture, written for parents, is on the Kids' Safety page.

JCIL.AI is not a HIPAA Business Associate and does not sign BAAs. A few plain-language consequences:

• Do not submit Protected Health Information (PHI), full names combined with diagnoses, treatment notes, prescription details, or insurance identifiers.
• JCIL.AI is a good fit for general health questions, resource referrals, prayer support, and thinking out loud, none of which require PHI.
• Our moderation pipeline flags crisis signals in conversations and points to real human help; we do not provide medical advice or clinical triage.

Multiple US states require disclosure that a user is interacting with an AI system. We comply by default:

• Every chat interface clearly labels the assistant as AI.
• Asked whether it is an AI, a bot, or a human, the assistant is instructed to answer truthfully that it is an AI: JCIL.AI, powered by Claude from Anthropic. It never claims to be human.
• Utah's AI Consumer Protection Act and Colorado SB205 obligations are met without operator configuration.

SOC 2 is on the roadmap as we scale. We are not SOC 2 certified today. The controls a Type 1 audit expects, least-privilege access, segregation of environments, encryption, change management, vulnerability scanning, incident response, are in place as practice; the third-party audit comes next.

If you want detail on where we stand, submit the contact form with topic SOC 2 statusand we'll share our current controls and projected audit window.

• We respond to valid legal process, subpoenas, court orders, warrants, within the timeframes required by law.
• We notify the account owner of requests concerning their account unless legally prohibited from doing so.
• We report Child Sexual Abuse Material (CSAM) to NCMEC (National Center for Missing & Exploited Children) as required by 18 U.S.C. §2258A.
• Legal process requests may be submitted via the compliance contact form with topic law enforcement.