Contacting Law Enforcement Guidelines

Hayati AI — Hayati Labs Limited

Document Type: Internal Compliance and Operational Guidelines Operator: Hayati Labs Limited Website: https://hayati.ai Contact: info@hayati.ai

Purpose and Scope

These Contacting Law Enforcement Guidelines (“Guidelines”) establish the procedures for identifying circumstances requiring contact with law enforcement or other competent authorities, assessing official requests, preserving relevant information, and making lawful disclosures in connection with Hayati AI (“Hayati,” “we,” “us,” or “our”).

Hayati is operated by Hayati Labs Limited, a company registered in the State of New York, United States, with an office at 2004 Brockwell Ave, Monterey Park, CA 91754, United States.

These Guidelines apply to suspected criminal activity, child sexual exploitation, non-consensual intimate content, human trafficking, imminent threats, fraud, and other matters that may require contact with competent authorities.

They are intended to support internal compliance and reviews by payment processors, acquiring banks, and authorized stakeholders.

These Guidelines complement Hayati's CSAM, Non-Consensual or Illegal Content Procedures, Content Monitoring & Prohibited Content Policy, Privacy Policy, and related safety procedures.

General Principles

Hayati follows the principles below when communicating with law enforcement:

1. Lawfulness: Disclosures and reporting must comply with applicable law.

2. Necessity: Only information reasonably necessary for the relevant purpose should be disclosed.

3. Verification: Official requests should be authenticated before non-emergency disclosure.

4. Confidentiality: User information and sensitive records must be protected from unauthorized access.

5. Urgency: Credible imminent threats and suspected child exploitation require prompt assessment.

6. Accountability: Material decisions and disclosures should be documented where lawful and practicable.

7. Proportionality: Responses should be proportionate to the nature and seriousness of the matter.

Hayati does not provide unrestricted access to user accounts, private conversations, or internal systems merely because a person claims to represent law enforcement.

Circumstances Requiring Assessment for Law Enforcement Contact

Hayati may assess the need to contact competent authorities in connection with:

3.1 Child Sexual Abuse Material and Exploitation

• Suspected actual child sexual abuse material (“CSAM”);

• Credible evidence of ongoing child sexual exploitation;

• Grooming, trafficking, or other serious offenses involving minors;

• Circumstances triggering a mandatory reporting obligation under applicable law.

3.2 Human Trafficking and Sexual Exploitation

• Credible indicators of human trafficking;

• Forced or coerced sexual activity;

• Exploitation involving threats, confinement, or abuse;

• Other serious conduct that may require lawful referral.

3.3 Non-Consensual Intimate Content

• Non-consensual intimate imagery;

• Unauthorized sexual deepfakes involving identifiable real individuals;

• Sexual extortion or threats to distribute intimate material;

• Other suspected criminal misuse of personal identity or likeness.

3.4 Imminent Threats

• Credible threats of imminent death or serious physical harm;

• Immediate danger to a child or vulnerable person;

• Other emergencies where lawful disclosure may help prevent serious harm.

3.5 Fraud and Other Criminal Activity

• Serious payment fraud;

• Account compromise connected to suspected criminal conduct;

• Extortion, threats, or coordinated unlawful activity;

• Other matters where reporting is required or lawfully appropriate.

A suspected policy violation does not automatically require a police report. Each case must be assessed according to applicable legal obligations, the available facts, and the seriousness of the risk.

Initial Incident Assessment

When Hayati identifies or receives a credible report of potentially criminal conduct, the responsible authorized person should assess:

1. The nature of the allegation;

2. Whether a minor or identifiable real individual may be involved;

3. Whether there is an imminent risk of serious harm;

4. Whether the incident involves content accessible through Hayati;

5. Whether immediate platform restrictions are necessary;

6. Whether a mandatory reporting or preservation obligation may apply;

7. Which authority or reporting channel is legally appropriate.

The assessment should be limited to information lawfully available to Hayati.

Hayati should not conduct an independent criminal investigation or attempt to determine criminal guilt.

Emergency Situations

5.1 Imminent Danger

Where credible information indicates an imminent threat to life or serious physical safety, Hayati should promptly assess whether contacting emergency services or competent law enforcement is legally appropriate or required.

Emergency response should not be delayed solely to complete ordinary complaint handling.

5.2 Emergency Disclosures

Where applicable law permits emergency disclosure, Hayati may disclose information reasonably necessary to address an imminent risk of death or serious physical injury.

Before making a disclosure, the responsible person should consider:

• The credibility and urgency of the threat;

• The identity and authority of the recipient;

• The legal basis for disclosure;

• The minimum information reasonably necessary;

• Whether immediate legal advice is practicable.

Where time permits, legal advice should be sought before disclosure.

5.3 Emergency Contact Channels

Hayati should use the official emergency or law enforcement channels appropriate to the relevant jurisdiction.

A private email, informal message, or unverified social media account must not be treated as an authenticated emergency law enforcement channel without appropriate verification.

Suspected CSAM and Child Exploitation

6.1 Immediate Protective Response

Suspected CSAM or child exploitation must be treated as a critical safety matter.

Hayati should promptly assess and, where appropriate, restrict relevant content, generation requests, or account access through available platform mechanisms.

6.2 Avoid Unnecessary Handling

Personnel must avoid unnecessary viewing, copying, downloading, transmitting, or redistributing suspected CSAM.

Complainants should not be asked to send suspected CSAM through ordinary email.

6.3 Reporting Obligations

Hayati must comply with applicable mandatory reporting obligations.

For matters involving the United States, the National Center for Missing & Exploited Children (“NCMEC”) CyberTipline may be the appropriate reporting channel, including where obligations under 18 U.S.C. § 2258A apply.

Whether a particular reporting obligation applies depends on Hayati's legal status, the nature of its services, and the circumstances of the incident.

Hayati does not claim to maintain an automated NCMEC reporting integration.

6.4 Preservation and Follow-Up

Relevant information should be preserved where legally required or permitted, using appropriately secured methods.

Hayati should cooperate with valid follow-up requests from competent authorities in accordance with applicable law.

Preservation and disclosure must not result in unnecessary circulation of unlawful material.

Receiving Requests from Law Enforcement

Law enforcement requests may include:

• Requests for subscriber or account information;

• Requests for specific records;

• Preservation requests;

• Subpoenas;

• Court orders;

• Search warrants;

• Emergency disclosure requests;

• Other legally recognized investigative demands.

Requests must be assessed according to their legal form, issuing authority, jurisdiction, and scope.

Hayati should not assume that every informal request creates a legal obligation to disclose information.

Verification of Official Requests

Before responding to a non-emergency request involving user information, Hayati should take reasonable steps to verify:

1. The identity of the requesting official;

2. The agency and its jurisdiction;

3. The authenticity of the request;

4. The legal authority cited;

5. The information requested;

6. The applicable deadline;

7. The authorized response channel.

Verification may involve independently contacting the relevant agency using official published contact information.

Where authenticity or legal authority is uncertain, Hayati should request clarification or seek legal advice.

Legal Review and Disclosure Authorization

Requests involving personal information, conversation records, or sensitive account data should be assessed for legal validity and proportionality.

Relevant considerations include:

• Whether the request is legally binding;

• Whether the requesting authority has jurisdiction;

• Whether the requested information is available;

• Whether the scope is sufficiently specific;

• Whether disclosure is permitted or required;

• Whether cross-border data transfer restrictions apply;

• Whether user notification is permitted or prohibited.

Material non-emergency disclosures should be authorized by Hayati's responsible management or an appropriately designated representative, with legal advice where necessary.

Hayati must not disclose information beyond what is lawfully required or otherwise lawfully justified.

Preservation of Information

10.1 Preservation Requests

Where a legally valid preservation obligation applies, Hayati should take reasonable steps to preserve relevant information within its possession or control.

10.2 Scope

Preservation should be limited to information relevant to the lawful request or incident.

Depending on availability, this may include:

• Account identifiers;

• Registration and authentication records;

• Relevant conversation or content records;

• Security-related records;

• Payment transaction references;

• Moderation and enforcement records.

This list does not imply that all categories are always collected, retained, or technically retrievable.

10.3 Security

Preserved information should be protected against unauthorized access, modification, or unnecessary disclosure.

10.4 Retention

Preservation must follow applicable legal requirements and should not be interpreted as authorization for indefinite retention.

Where a legal hold applies, ordinary deletion processes may need to be suspended for the specific records subject to that hold.

Responding to Valid Legal Process

When a request has been verified and its legal basis assessed, Hayati should:

1. Identify the responsive information lawfully available;

2. Confirm the permitted scope of disclosure;

3. Apply appropriate confidentiality and security controls;

4. Use an authenticated and secure transmission channel;

5. Record the disclosure decision and relevant legal basis;

6. Retain documentation as required or reasonably necessary.

Where a request is defective, overbroad, or unsupported, Hayati may seek clarification, request narrower scope, challenge it through lawful means, or decline disclosure where legally permitted.

Cross-Border Law Enforcement Requests

Hayati may receive requests from authorities outside the United States.

Such requests should be assessed in light of:

• Applicable United States law;

• The legal authority of the requesting jurisdiction;

• International cooperation procedures where relevant;

• Applicable privacy and data protection requirements;

• Restrictions on cross-border disclosures.

A foreign authority's request does not automatically authorize direct disclosure of all requested user information.

Where appropriate, Hayati may require the requesting authority to use a legally recognized international cooperation mechanism.

User Notification

Where legally permissible and appropriate, Hayati may notify affected users of law enforcement requests involving their information.

Notification may be delayed or withheld where:

• Prohibited by a valid legal order;

• Restricted by applicable law;

• Likely to compromise an investigation;

• Likely to create a serious safety risk;

• Otherwise legally inappropriate.

Hayati does not guarantee advance notification of every law enforcement request.

Confidentiality and Data Protection

All disclosures must be handled in accordance with applicable privacy and data protection requirements.

Hayati should:

• Limit access to authorized personnel;

• Minimize unnecessary disclosure;

• Protect sensitive records;

• Use appropriate transmission safeguards;

• Avoid sharing user information through unverified channels;

• Retain disclosure-related records only as legally required or reasonably necessary.

These Guidelines do not create unrestricted access rights for third parties.

Documentation and Accountability

Where lawful and practicable, Hayati should document material law enforcement interactions, including:

• Date of receipt or initiation;

• Requesting agency or reporting recipient;

• Nature of the incident or request;

• Legal basis or emergency justification;

• Verification steps;

• Information preserved or disclosed;

• Internal authorization;

• Date and method of response;

• Relevant follow-up actions.

These are recordkeeping requirements for the procedure and do not represent that Hayati currently operates a dedicated law enforcement request management system.

Roles and Responsibilities

Hayati Labs Limited is responsible for maintaining these Guidelines and assigning appropriate authority for their implementation.

Depending on operational scale, responsibilities may be carried out by authorized management personnel, designated staff, external legal advisers, or appropriately contracted service providers.

Responsibilities include:

• Receiving and assessing serious safety reports;

• Identifying possible mandatory reporting obligations;

• Verifying law enforcement requests;

• Authorizing lawful disclosures;

• Coordinating legal advice where necessary;

• Protecting preserved records;

• Maintaining appropriate documentation.

Hayati does not represent that it currently operates a separately staffed 24-hour law enforcement response team.

Cooperation with Payment Partners

Hayati may cooperate with payment processors, acquiring banks, and other authorized financial partners in relation to suspected illegal content, fraud, or other serious compliance concerns.

Such cooperation must respect applicable confidentiality, contractual, and data protection requirements.

A payment partner's request for information does not automatically authorize disclosure of unrelated personal data.

Review and Updates

These Guidelines should be reviewed when material changes occur, including:

• Changes to applicable criminal reporting laws;

• New payment processor or acquiring bank requirements;

• Changes to Hayati's content or account systems;

• Serious incidents involving law enforcement contact;

• New categories of user-generated or real-person content;

• Changes to relevant privacy or data preservation requirements.

Relevant personnel should receive guidance appropriate to their responsibilities.

Related Documents

These Guidelines should be read with:

• Terms and Conditions;

• Privacy Policy;

• User Registration Policy;

• Identity Verification (ID&V) and Consent Procedures;

• CSAM, Non-Consensual or Illegal Content Procedures;

• Content Monitoring & Prohibited Content Policy;

• Report Policy;

• Complaints, Content Removal & Appeals Policy;

• Anti-Human Trafficking & Sexual Exploitation Policy;

• Copyright & DMCA Policy;

• 18 U.S.C. § 2257 Statement.

Contact Information

Hayati Labs Limited Registered in the State of New York, United States Office: 2004 Brockwell Ave, Monterey Park, CA 91754, United States

Email: info@hayati.ai Website: https://hayati.ai

Document Status: Internal compliance guidelines for payment processor and acquiring bank review.

© 2026 Hayati Labs Limited. All rights reserved.

حياتي AI — Hayati Labs Limited