Effective Date: October 13, 2026

Last Updated: October 13, 2026

This Website Privacy Policy and Data Processing Notice ("Privacy Notice") sets forth the policies and practices of Avalanche Computing Taiwan Inc. ("Avalanche Computing", "we", "us", or "our") regarding the collection, use, processing, and safeguarding of personal data obtained from visitors to our official website (https://www.avalanc.com), individuals requesting product demonstrations, subscribers to corporate insights, and users accessing our online AI developer portals and sandbox environments (collectively, the "Services").For individuals residing within the European Economic Area (EEA), the United Kingdom, or jurisdictions governed by equivalent data privacy legislation (such as Regulation (EU) 2016/679, the "GDPR"), this Notice fulfills our statutory transparency obligations under Articles 13 and 14 of the GDPR.

1. Identity of the Data ControllerUnless explicitly stipulated otherwise in an executed enterprise agreement, Avalanche Computing Taiwan Inc. serves as the Data Controller for all personal data collected through this website and associated corporate communications channels:Company Name: Avalanche Computing Taiwan Inc. (奎景運算科技股份有限公司) Registered Address: 2F., No. 34, Sec. 4, Renai Rd., Daan Dist., Taipei City 106092, Taiwan Representative & Chief Executive Officer: Chun Chieh Chen (Jay Chen) Designated Data Protection Contact: contact@avalanc.com

2. Categories of Data Subjects and Personal Data CollectedWe collect and process personal data directly provided by you or automatically recorded through your interaction with our website infrastructure:Website Visitors (General Browsing)Technical and Network Telemetry: IP address, browser type and version, operating system, referring URL, pages viewed, device identifiers, time-zone settings, and approximate geolocation derived from IP routing.Prospective Clients, Partners, and Inquirers (Leads & Contacts)Contact and Professional Identifiers: Full name, corporate email address, telephone number, job title, company name, industry vertical, and unstructured text details provided within consultation or demo request submissions.Registered Users of Web Tools and Developer EnvironmentsAccount and Credential Data: Corporate login identifiers, authentication tokens, API request logs, session duration, and telemetry.Transient Query Inputs (Interactive Demos): Text prompts, code snippets, or parameters input to benchmark or evaluate our edge acceleration and orchestration tools.

3. AI Data Sovereignty and Integrity GuaranteesIn accordance with Avalanche Computing’s core commitment to Sovereign AI, enterprise compliance, and data confidentiality, we enforce strict architectural boundaries on all incoming data:Strict Ban on Foundation Model Training: Prompts, business queries, proprietary documents, code snippets, and personal data submitted through our website or online tools are strictly never used to train, re-train, fine-tune, or align public or proprietary base Large Language Models (LLMs).Ephemeral Processing Architecture: Data submitted via web-based interactive demonstrations is processed transiently within isolated, ephemeral containers and wiped upon session completion pursuant to our "Process and Forget" data sanitization principles.

4. Purposes of Processing and Legal Bases (GDPR Article 6)

We process personal data solely when supported by a valid legal basis recognized under GDPR Article 6(1):

Secure Operation and Delivery of the Website

Categories of Data: IP address, session telemetry, technical device identifiers, essential cookies.Legal Basis: Legitimate Interests (GDPR Article 6(1)(f)) to maintain cybersecurity, mitigate denial-of-service risks, and ensure proper content delivery.

Managing Inquiries, Product Demos, and Commercial Follow-ups

Categories of Data: Name, corporate email, phone number, company name, inquiry notes.Legal Basis: Consent (GDPR Article 6(1)(a)) and taking steps prior to entering into a commercial agreement at the request of the data subject (GDPR Article 6(1)(b)).

Provision of Sandbox, Developer Tools, and Portal Access

Categories of Data: Account credentials, authentication tokens, transient test inputs.

Legal Basis: Contractual Necessity (GDPR Article 6(1)(b)) for delivering platform evaluation tools requested by the user.

Aggregated Website Analytics and Performance Optimization

Categories of Data: Anonymized browsing behavior, performance metrics, aggregated click paths.

Legal Basis: Freely given Consent (GDPR Article 6(1)(a)) collected via our cookie preference mechanism.

Statutory Compliance, Export Control, and Legal Governance

Categories of Data: User logs, audit records, transactional history, and screening verifications.

Legal Basis: Compliance with Legal Obligations (GDPR Article 6(1)(c)) applicable to cross-border technology providers.

5. Cookies and Tracking Technologies

Our website deploys limited categories of cookies to balance functionality with privacy:

Strictly Necessary Cookies: Essential for page routing, session continuity, and network defense. These cannot be deactivated in our systems.

Performance and Analytical Cookies: Deployed exclusively upon affirmative opt-in consent to evaluate anonymous visitor engagement and optimize user experience.

Cookie preferences can be adjusted at any time via your browser controls or through the dedicated cookie management interface accessible in our site footer.

6. Data Recipients and Third-Party Processors

We do not sell, rent, or monetize personal data under any circumstances. Disclosures are limited to vetted service providers bound by strict confidentiality and GDPR-compliant processing addenda:

Cloud and Hosting Infrastructure: Tier-1 infrastructure providers hosting our web servers and databases under enterprise encryption standards.

Customer Relationship and Communication Tools: Enterprise CRM systems utilized solely to manage corporate inquiries and correspondence.

Professional Legal and Technical Advisors: External auditors, legal counsel, and cybersecurity consultants when strictly required for compliance or legal defense.

7. International Data Transfers and EU SCCs

Avalanche Computing is headquartered in Taiwan. Because Taiwan has not yet received a formal adequacy decision from the European Commission, transfers of personal data originating from the EEA to our infrastructure are governed by appropriate safeguards under GDPR Article 46:

We integrate and abide by the European Commission Standard Contractual Clauses (SCCs) (Implementing Decision (EU) 2021/914, Module 2: Controller-to-Processor and Module 1: Controller-to-Controller as applicable).

EEA data subjects may request a redacted copy of our executed transfer safeguards by writing to contact@avalanc.com.

8. Data Retention and Disposal Schedules

Personal data is retained only for the duration necessary to satisfy the specific purposes outlined in this Notice:

Web Server Security Logs: Retained for a rolling period not exceeding 90 days, after which records are purged or irreversibly pseudonymized.

Business Inquiries and Commercial Leads: Retained for the active duration of the business relationship or up to 24 months following the last documented interaction, unless superseded by an active enterprise contract.

Interactive Sandbox Session Data: Erased immediately upon session termination or within 24 hours of execution.

9. Statutory Rights of Data Subjects under the GDPR

Individuals within the European Economic Area possess actionable rights under Chapter III of the GDPR:

Right of Access (Article 15): Request confirmation of ongoing processing and obtain an export of your personal data.

Right to Rectification (Article 16): Demand the prompt correction of incomplete or inaccurate data records.

Right to Erasure ("Right to be Forgotten", Article 17): Request the deletion of personal data when retention is no longer legally justified.

Right to Restriction of Processing (Article 18): Restrict processing operations under verified statutory conditions.

Right to Data Portability (Article 20): Obtain your personal data in a structured, commonly used, and machine-readable format.

Right to Object (Article 21): Object to processing founded upon legitimate interests or direct marketing outreach.

Right to Withdraw Consent (Article 7(3)): Revoke previously granted consent without impacting the legality of processing conducted prior to withdrawal.

To exercise these rights, submit a formal written request to contact@avalanc.com. We verify identity prior to disclosure and respond within thirty (30) calendar days as required by law.

10. Regulatory Recourse and Supervisory Authorities

If you believe that our processing of your personal data infringes GDPR mandates, you maintain the right to lodge a complaint with an EU Supervisory Authority, specifically within the EU Member State of your habitual residence, place of employment, or the location of the alleged infringement.

11. Amendments and Revisions

We reserve the right to amend this Privacy Notice to reflect adjustments in technical operations, product features, or regulatory standards. Material updates will be published on this page alongside a refreshed revision date.