ASRIX MINDGATE: PRIVACY POLICY AND DATA PROTECTION NOTICE

1. Identity of Data Controller & Governing Legal Baselines

This Privacy Policy and Data Protection Notice governs the collection, processing, storage, cross-border transfer, and statutory retention of personal data and submission materials by Asrix Prime Berhad, the operating entity of the Asrix Mindgate self-service intellectual property (IP) comparison and preservation platform.

Asrix Prime Berhad is committed to transparent, lawful, and mathematically verifiable data protection practices. The multi-jurisdictional legal baselines governing this Policy comprise:

• Primary Legal Standard: The Malaysia Personal Data Protection Act 2010 (PDPA) and the PDPA Amendments 2024.

• Secondary & Global Frameworks: The European Union General Data Protection Regulation (EU GDPR Regulation 2016/679), the United Kingdom General Data Protection Regulation (UK GDPR / Data Protection Act 2018), and applicable United States federal and state privacy statutes.

Legal Notice: Asrix Prime Berhad operates in a dual statutory capacity under applicable data protection legislation:

1. Data Controller: For account credentials, identity verification records (KYC), billing and financial transactions, click-wrap agreement records, and platform operational metadata.

2. Data Processor / Service Provider: For user-submitted manuscripts, files, raw text, vector embeddings, and automated multi-vendor AI evaluation workflows executed on behalf of the Claimant.

This Policy applies to all platform submissions, public registry views, API calls, and account interactions within the Asrix Mindgate ecosystem.

Mandatory IP Disclaimer Notice: "This page is a public cryptographic record establishing prior art and a verifiable timeline of authorship. It is not a patent, patent-pending application, or statutory IP grant."

2. Dual-Tier Data Architecture: Off-Chain Storage vs On-Chain Immutable Ledger

To reconcile statutory data deletion mandates (such as EU GDPR Article 17) with the requirement of immutable prior-art timestamp preservation, Asrix Mindgate enforces an absolute architectural separation between off-chain storage and on-chain ledger anchoring.

• Off-Chain Storage Tier: All Personally Identifiable Information (PII), raw submission text, uploaded file attachments (PDF, DOCX, plain text), vector embeddings (Postgres with pgvector), and AI evaluation/comparison reports reside strictly in secure, encrypted off-chain environments.

• On-Chain Anchoring Tier: The public blockchain ledger (utilising OpenTimestamps anchored to Bitcoin, or an Ethereum Layer 2 network such as Base, Arbitrum, or Polygon) holds ONLY canonical SHA-256 Merkle root hashes representing batched cryptographic fingerprints.

NO Personally Identifiable Information (PII), raw submission text, unhashed content, or unencrypted metadata ever touches the blockchain ledger.

Cryptographic Leaf Construction & Dual Timestamping

Each Merkle leaf anchored to the public ledger is constructed using the following deterministic formula: $$\text{Merkle Leaf} = \text{SHA-256}(\text{Certificate ID} + \text{Content Hash} + \text{Report Hash} + \text{Certificate Hash})$$

To ensure multi-layered legal admissibility across international judicial forums, every off-chain record is cryptographically bound via an RFC 3161 Trusted Timestamp Authority (TSA) signature operating alongside the decentralized public blockchain anchor.

3. Categories of Personal & Submission Data Collected

Asrix Mindgate processes specific categories of personal and operational data strictly necessary to execute intake, automated repository searching, AI similarity scoring, and certificate issuance.

Every individual data point collected is enumerated below:

• Claimant Identifiers:

  • Full Legal Name

  • Corporate Entity Identifier

  • Email Address

  • Identity Verification / KYC Status

  • Display Preferences

• Billing & Payment Data:

  • Stripe Transaction Tokens

  • Payment Verification References

  • Up-Front Fee Records (USD 1,000)

  • Partial Refund Transaction Records (USD 500 / 50% Refund)

  • Invoicing Records

  • Tax Compliance Data (Note: In cases where content is refused publication for policy/safety breaches, a 50% refund of USD 500 is disbursed; the original submission metadata, certificate, and timestamp remain permanently anchored and retained off-chain).

• Submission Materials:

  • Uploaded Content Files (PDF, DOCX, Text)

  • 200,000 Character Cap Metrics

  • 10 File Cap Metrics

  • 20 MB Per-File Limit Metrics

  • Categorised IP Types (Patents, Trademarks, Copyright Works, Designs, Ideas, Concepts, Theories, Hypotheses, Predictions, Research Papers)

  • Public Display Selections

• Metadata & Cryptographic Fingerprints:

  • SHA-256 Content Hashes

  • Report Hashes

  • Certificate Hashes

  • UTC Timestamp Logs

  • Merkle Proof Trees

  • Merkle Leaf Index Numbers

• Participant Agreement Acceptance Evidence:

  • Terms Version Number

  • Click-Wrap Acceptance Timestamp

  • Acceptance Evidence Hash

  • IP Address Log at Execution (Recorded in the participant_agreement database table to enforce a contractually binding priority rule between platform participants).

4. Third-Party Processing, Abstracted Queries & Three-Vendor AI Pipeline Rules

To guarantee confidentiality for unpublished inventions, research papers, and trade secrets, Asrix Mindgate enforces strict data minimisation protocols across external search interfaces and artificial intelligence evaluation pipelines.

• Abstracted Search Queries: When querying external repository APIs—including EPO OPS, PatentsView/USPTO, EUIPO, Semantic Scholar, OpenAlex, Crossref, DataCite, CORE, and GitHub—Asrix Mindgate NEVER transmits raw submission text. The system extracts and transmits ONLY abstracted keyword queries, IPC/CPC classification codes, or public-safe search strings.

• Three-Vendor AI Pipeline: Submissions undergo automated similarity evaluations across three independent Large Language Model (LLM) vendor environments running distinct architectures:

  1. LLM 1 (Analyst): Conducts initial semantic mapping, prior-art match ranking, and draft scoring.

  2. LLM 2 (Independent Validator): Re-scores the submission, checks for missed prior art, and validates matching claims using an independent model infrastructure.

  3. LLM 3 (Adjudicator): Reconciles outputs from LLM 1 and LLM 2, calculates agreement metrics, and determines final originality scores or triggers human review escalation.

• Mindgate Peer Review Notes & Defamation Protocols: Where users opt into manuscript publication within the publication portal, the system synthesises a permanent Mindgate Peer Review Note. Generated notes and user responses are stored in encrypted off-chain storage. In the event of legal challenges or alleged defamation, Asrix Mindgate enforces an administrative takedown protocol allowing court-ordered redactions, administrative blocks, or full content removals while preserving the underlying cryptographic timestamp proof.

Zero-Retention & No-Training Contractual Guarantee

All three AI vendors within the Asrix Mindgate evaluation pipeline operate under executed enterprise Data Processing Agreements (DPAs) incorporating strict zero-data-retention and zero-model-training sub-processor obligations.

Under these binding guarantees:

• User submission data is processed in ephemeral memory strictly for the execution duration of the API call.

• No submission text, abstract, file excerpt, or evaluation output is stored by AI vendors post-execution.

• AI vendors are legally prohibited from using user submissions for model training, fine-tuning, or algorithmic alignment.

5. Statutory Data Retention & Deletion Schedule

Asrix Prime Berhad enforces a formal Data Retention Schedule balancing statutory compliance (such as the Malaysia PDPA Retention Principle under Section 10 and corporate tax acts) with data minimisation principles under EU/UK GDPR Article 5(1)(c).

6. Data Subject Rights & Cryptographic Shredding Procedure

Data protection laws grant specific statutory rights to individuals, which Asrix Prime Berhad honours across jurisdictions:

• EU / UK GDPR: Explicit Right to Erasure / Right to be Forgotten under Article 17, Right to Access under Article 15, and Right to Rectification under Article 16.

• Malaysia PDPA 2010 / 2024 Amendments: Right to Correction of personal data under Section 34, Right of Access under Section 30, Data Integrity Principle under Section 11, Data Retention Principle under Section 10, and operational erasure achieved through Withdrawal of Consent under Section 38.

To satisfy statutory erasure requirements without invalidating the mathematical integrity of the underlying prior-art timestamp, Asrix Mindgate executes a formal Cryptographic Shredding Procedure:

1. Erasure Request Intake: The data subject submits a verified erasure or consent-withdrawal request to the Asrix Prime Berhad Data Protection Officer (DPO).

2. Off-Chain Cryptographic Shredding: Asrix Prime Berhad cryptographically deletes the decryption keys and purges all off-chain PII, raw submission files, contact details, and identifying user records from Postgres/pgvector databases and S3 object storage.

3. Public Registry Anonymisation: Public registry listings associated with the Certificate ID instantly update to display a neutral, anonymised Claimant ID displaying the explicit mandatory statement: "ownership not verified".

4. Ledger Preservation: The on-chain SHA-256 Merkle root hashes remain 100% intact on the public blockchain. This guarantees that historical prior-art timestamp proof remains verifiable while being permanently and irreversibly decoupled from the personal identity of the Claimant.

Mandatory Registry Display Notice: "This page is a public cryptographic record establishing prior art and a verifiable timeline of authorship. It is not a patent, patent-pending application, or statutory IP grant."

7. Public Disclosures, DOIs & The 200/410/451 Tombstone Protocol

When a Claimant explicitly opts into public disclosure or manuscript publication—and subsequently exercises a statutory right to withdraw content or submit an erasure request—the platform invokes the 200/410/451 Tombstone Protocol for registered DataCite Digital Object Identifiers (DOIs) and portal resolution endpoints.

Digital Object Identifiers (DOIs) registered with DataCite cannot have their underlying web resolution URIs deleted without violating global scholarly infrastructure standards. Upon valid erasure, withdrawal, or court order, the resolution endpoint converts into an anonymised tombstone notice.

8. Technical Security Measures, Encryption & Access Controls

Asrix Prime Berhad implements rigorous technical and organizational security protocols to maintain system confidentiality and integrity:

• Enforced Data in Transit Protection:

  • TLS 1.3 encryption mandated across all portal interfaces, system APIs, and background worker channels.

• Data at Rest Encryption:

  • AES-256 bit encryption applied across all Postgres relational databases, pgvector vector stores, and S3-compatible object storage repositories.

• Browser-Side SHA-256 Pre-Hashing:

  • Hash calculation occurs in the user's browser prior to upload for public registry verification lookups, ensuring file contents are pre-hashed locally before transmission.

• PAdES Digital Signatures & Key Isolation:

  • PDF certificates and disclosure documents are cryptographically signed using PAdES standards with Ed25519 signing keys held in dedicated Hardware Security Modules (HSM) or Key Management Services (KMS).

• Prompt-Injection Defense & Input Sanitisation:

  • Automated text sanitisation and detection filters strip instruction-like text from submitted manuscripts prior to vector embedding, treating all inputs strictly as data vectors.

• Access Control & Granular Audit Trails:

  • Private evaluation reports are accessible exclusively via per-submission access tokens.

  • Staff access is governed by strict Role-Based Access Control (RBAC) and logged in immutable, append-only operational audit trails.

9. International Data Transfers & Cross-Border Compliance

Asrix Mindgate operates globally. Personal data and submission materials are processed across distributed cloud nodes and global repository search APIs subject to statutory transfer safeguards:

• Malaysia PDPA Section 129 Compliance: Cross-border processing across international infrastructure relies on statutory transfer exceptions under Section 129(2) of the PDPA—specifically where transfer is necessary for the performance of the contract between the Claimant and Asrix Prime Berhad, or executed with explicit data subject consent.

• EU / UK GDPR Chapter V Safeguards: Transfers outside the European Economic Area (EEA) or UK are secured via standard data protection clauses, Standard Contractual Clauses (SCCs), and Data Processing Agreements (DPAs) executed with all cloud providers and API vendors.

• Localized Cloud Region Selection: System operations execute within designated primary cloud regions, with configurable data-residency options available to enforce localized storage constraints where required by enterprise agreements.

10. Contact Information, Dispute Resolution & Data Protection Officer (DPO)

For inquiries regarding this Privacy Policy, data subject access or correction requests under PDPA/GDPR, or privacy disputes, please contact the designated Asrix Prime Berhad Privacy Office:

ASRIX PRIME BERHAD

Attn: Data Protection Officer (DPO) / Privacy Office

Email: [email protected]

Official Notice Channel: https://asrix.com/privacy-notice

Postal Address: Asrix Prime Berhad, Privacy Office, Kuala Lumpur, Malaysia

Privacy Dispute & Escalation Ladder

1. Initial Notice & Acknowledgment: Privacy inquiries or formal erasure requests receive automated acknowledgment immediately upon receipt.

2. Resolution Response Windows:

   • Urgent Requests / Severe Privacy Breaches / Court Orders: Actioned within 24 to 48 hours.

   • Standard Data Subject Requests / Contractual Claims: Actioned within 3 to 5 business days.

3. Arbitration Escalation: If a privacy dispute or data ownership claim cannot be resolved through internal administrative review, the matter may be escalated to independent binding arbitration administered by the Asian International Arbitration Centre (AIAC) in Kuala Lumpur, Malaysia, in accordance with the AIAC Arbitration Rules and the applicable participant contract terms.