Privacy Policy

1. Personal Data We Collect

We collect the following categories of personal data. To the extent permitted by applicable law, we may combine information collected directly from you with information obtained automatically or from authorized third-party integrations.

Data You Provide to Us Directly

• Identity and Contact Data: When you create an account, we collect identifiers such as your name and email address. If you enable voice features, we collect your phone number. Account creation and sign-in are managed through our centralized authentication provider.

• Payment Information: If you purchase a subscription or license content, our payment processor collects and processes your payment details. We receive limited billing information such as the last four digits of your card, billing contact, and transaction history. We do not store full payment card numbers on our systems.

• Your Professional Profile: The core of our Services is the professional profile you build with us. The profile is a set of fields, facts, data points and preferences, organized across a database comprised of various professional domains each of which has multiple subcategories. The domains include but are not limited to professional identity, business and practice, clients and engagements, work and focus, goals and growth, communication and working style, and domain and market. This is populated from information you supply during onboarding (e.g., details you enter directly or import from a resume or professional profile), your answers to interview-style prompts from our in-product assistant, Sage, documents and files you upload, and relevant items from the sources you connect. Conversations with Sage may also produce a small, capped set of short written notes about how you work.

• Inputs and Outputs: When you use the Services, you submit requests, prompts, and other content (“Inputs”), and the Services return synthesized responses (“Outputs”). If you include personal data in your Inputs or reference content from connected sources, we process that information to produce your Outputs.

• Voice Data and Telephony Features: If you use Sage Voice or integrated call features, we and our telephony providers process your call audio, voice dynamics, and the text transcripts generated from those interactions to deliver the voice-synthesis features. We do not extract, generate, or retain voiceprints or other biometric identifiers from this audio.

• Feedback and Communications: If you rate an Output, submit suggestions, or contact customer support, we collect your contact details, the contents of your messages, and the related session logs required to understand the context of your inquiry.

Data from the Tools and Sources You Connect

A central feature of the Services is the ability to connect third-party tools and data sources, including through the Model Context Protocol (MCP). When you authorize a connection, you direct us to transiently access data from that tool or source so the Services can use it as part of your context layer (for example, email, calendar, internet browser activity, and messaging context from services such as Slack or Notion).

We do not retain the underlying raw content of your connected sources. Incoming items are screened transiently for relevance to your profile fields. When an item fills or updates a field, we keep only the extracted field value, a short note of its source, our confidence metric, and the timestamp of capture. The underlying email, chat message, or document itself is not stored on our systems, and items that match no profile fields are immediately discarded.

Data We Receive Automatically

• Device and Connection Information: We receive technical data such as device type, operating system, browser configuration, mobile network, internet service provider, time zone, and IP address (including approximate location derived from it), along with unique device identifiers.

• Usage Information: We collect information about how you interact with the Services, such as access timestamps, features utilized, active Brains, custom agents built, pages viewed, and links clicked.

• Log and Troubleshooting Information: We collect log files and error reporting metadata, including the application state and feature in use when an error occurred, to diagnose and remediate performance issues.

• Cookies and Tracking Technologies: We and our service providers use cookies, pixel tags, local storage objects, and similar tracking mechanisms to operate the Services, maintain session security, remember configuration preferences, and evaluate platform usage trends. We honor Global Privacy Control (GPC) and similar opt-out preference signals as a valid request to opt out of the sale or sharing of your personal information, to the extent applicable. You may review or change your cookie preferences at any time through the cookie settings link in the Services footer.

“Sale” or “Sharing” of Personal Information

MyGentic does NOT sell your personal data for monetary consideration, and we do NOT share or disclose your personal data to third parties for cross-context behavioral or targeted advertising purposes. We do NOT utilize tracking systems to profile your activities across non-affiliated applications or websites. If our practices change, we will integrate a "Do Not Sell or Share My Personal Information" mechanism and respect global opt-out preference signals (such as the Global Privacy Control).

2. Description of Personal Information Collected and Disclosed

The table below describes the categories of personal information we collect, the statutory categories under California law, the operational sources, the business purposes for processing, and the categories of third-party recipients to whom the data is disclosed for a business purpose.

Right to Limit the Use of Sensitive Personal Information

MyGentic processes sensitive personal information (specifically, account credentials) strictly to deliver the essential operational functionalities of the platform and to execute user-requested AI features (such as Sage Voice). Because we only utilize and disclose sensitive personal information for this legally permitted, consumer-requested purpose, MyGentic is not required to provide a statutory "Limit the Use of My Sensitive Personal Information" link or opt-out mechanism on our platform.

3. International Transfers & EU/UK/Swiss GDPR Disclosures

If you interact with our platform from the European Economic Area (EEA), the United Kingdom (UK), or Switzerland, your data is processed in accordance with the General Data Protection Regulation (GDPR) and the UK Data Protection Act 2018.

GDPR Lawful Bases for Processing Operations

The table below maps the specific operational streams executed by MyGentic to their corresponding categories of personal data and authorized statutory lawful bases.

International Data Transfers and Safeguards

MyGentic, Inc. maintains its foundational technical infrastructure and database systems within the United States. The personal data we collect will be systematically transferred to, housed in, and processed by our cloud provider AWS in their global data centers.

To provide adequate data protection for cross-border transfers originating from the EEA or UK, we utilize approved Standard Contractual Clauses (SCCs) alongside supplemental technical and organizational security measures to ensure your fundamental data rights travel securely with your information.

EU and UK Representative. Because MyGentic does not have an establishment in the European Union or the United Kingdom, we have designated GDPR Local as our representative for purposes of Article 27 of the GDPR and Article 27 of the UK GDPR. You may contact our representative regarding matters relating to the processing of your personal data at https://gdprlocal.com/about-us/

Data Security and Technical Retention Thresholds

Operational Security Controls: We implement robust technical and organizational protection matrices, including AES 256-bit encryption for data states at rest and TLS 1.3 encryption for information streams moving in transit. Access to platform servers is gated by zero-trust multi-factor authentication networks. However, because no electronic transmission array is totally invulnerable, we cannot guarantee absolute data security.

Data Retention and Minimization:

We retain personal data only for as long as necessary for the purposes described in this Policy. Account and profile data is kept while your account is active and for 90 days after closure to allow for reactivation, after which it is deleted or anonymized; billing and transaction records are kept for 7 years to meet U.S. and Canadian tax and accounting requirements; usage, log, and diagnostic data is kept for 24 months and then deleted or anonymized; and backup copies may persist for up to 90 days after deletion from our active systems as part of our routine backup cycle. We do not separately retain the underlying content of your connected tools and sources, only the extracted profile fields noted above. We may retain data longer where necessary to comply with a legal obligation, resolve a dispute, or respond to legal process, and we will otherwise delete or anonymize your data within 30 days of a verified deletion request or account closure.

4. Your Statutory Rights and Choices

4.1 U.S. State-Specific Consumer Privacy Rights Addendum

This section provides specific statutory disclosures and outlines consumer rights under the comprehensive data privacy frameworks enacted across the United States. We provide these disclosures to provide transparency for our users, allowing you to easily identify the protections available to you based on your state of residence and applicable state laws, which include but are not limited to the rights in the below table.

U.S. State Privacy Laws, Rights and Appeals Table

NOTE: THE US STATE PRIVACY RIGHTS ABOVE ARE LISTED FOR YOUR EASE OF REFERENCE, BUT PLEASE NOTE THAT MYGENTIC DOES NOT ENGAGE IN THE SALE OR SHARING OF DATA FOR CROSS-CONTEXT BEHAVIORAL ADVERTISING OR TARGETED ADVERTISING.

4.2. Canadian Privacy Rights & Disclosures

If you access the Services from Canada, your personal data is processed in accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial frameworks, including Quebec's Act Respecting the Protection of Personal Information in the Private Sector (Law 25).

• Your Rights: Canadian residents maintain the right to access, correct, or challenge the accuracy of their personal data in our possession. You may withdraw your consent to data processing at any time (such as by disabling integrated third-party MCP tools or voice toggles), subject to legal or contractual restrictions.

• Cross-Border Transfers: Your personal data will be transferred out of Canada to our secure infrastructure hosted by our cloud provider AWS in their global data centers. By utilizing the Services, you acknowledge that your information may be subject to U.S. laws and federal authorities.

• No Biometric Data (Quebec Users): If you reside in Quebec, in compliance with Law 25, we conduct formal Privacy Impact Assessments (PIAs) for cross-border data flows. We do NOT process any biometric data.

5. Summary of Your Rights

If you are a resident of a jurisdiction maintaining comprehensive privacy, you possess the following statutory rights regarding your personal data, subject to identity verification, where applicable:

• Right to Know and Access: The right to confirm whether we are processing your data and to access a portable copy of the specific pieces of information we hold.

• Right to Delete: The right to request the deletion of personal data collected from or maintained about you.

• Right to Correct: The right to request the rectification of inaccurate details within your profile records.

• Right to Opt-Out of profiling: The right to opt-out of the processing of your data for profiling or automated decision-making frameworks. MyGentic does NOT use your data for automated decision purposes.

• Right to Opt-Out of Sale/Sharing: The right to opt-out of the processing of your data for cross-context behavioral advertising. As noted above, MyGentic does not sell or share data for targeted advertising or cross context behavioral advertising.

• Right to Object or Restrict Processing: You have the right to object to our handling of data based on legitimate interests, or demand that we restrict our processing pathways under specific statutory circumstances.

• Right to Withdraw Consent: Where our processing is built on your affirmative consent, you can withdraw that authorization at any time.

• Right to Revoke Connections: You can disconnect any integrated third-party tool, data folder, or MCP connection at any time. Disconnection instantly stops all transient data ingestion and automated field updates from that source.

• Right to Appeal: The right to appeal our decision if we decline to take action on your consumer rights request. Links to applicable relevant authorities in the US for appeals are provided in the US laws table above.

Identity Verification Process

To safeguard user data security, we execute a rigorous identity verification protocol before taking action on any request to access, correct, or delete personal data. Upon receipt of your request via privacy@mygentic.io, you must provide information that matches the verified registration parameters linked to your active user account. We may request that you sign in directly to your user workspace to authenticate identity parameters. We may also require completion of two-factor authentication on your account before we action a request. If we cannot successfully verify your identity using a high degree of certainty, we reserve the right to deny the request to prevent malicious exfiltration of data. We do NOT require verification for you to exercise your other rights.

Authorized Third-Party Agents

You may designate an Authorized Agent to submit a privacy rights request on your behalf. To process a request from an Authorized Agent, the agent must submit a written power of attorney or formal authorization document signed by the consumer, and the agent business must be legally registered to execute business operations in the consumer's applicable state of residence. We reserve the right to connect with the consumer directly to verify the validity of the agent's credentials and confirm the consumer's identity through standard account access metrics before executing any data deletion or transfer requests.

To submit a formal request to exercise your rights, please contact our privacy compliance team via email at privacy@mygentic.io. We verify identity requests using verified account credentials before executing changes. We do not discriminate or apply differential pricing matrices against any individual for exercising their privacy choices.

6. No Biometric Information Notice

This section is in response to the statutory disclosure requirements of the Illinois Biometric Information Privacy Act (BIPA), Texas Capture or Use of Biometric Identifier Act (CUBI), and similar global biometric regulations. We do NOT engage in biometric data processing.

7. Expert Brain Marketplace Structure & Third-Party Disclosures

The Expert Brain Marketplace is an open knowledge marketplace composed of independent, third-party authors and entities (“Creators”) who list their custom-packaged analytical knowledge modules (“Brains”).

• Brain Content Hosting: Expert Brains are content licensed to MyGentic by their Creators and hosted on MyGentic's own infrastructure. When you query a Brain, your query is processed entirely within MyGentic's systems; it is not transmitted to, and does not otherwise reach, the Creator or any system the Creator controls. Creators do not receive your queries, your professional profile, or any other personal data about you — they receive only aggregated, de-identified reporting on how often their Brain was drawn upon.

• Querying a Brain: Brains are further defined and explained in our Terms of Use. When you license or query a specific Brain, MyGentic processes your query using that Brain's content on our own infrastructure and returns the resulting Output to you. You do not enter into any separate agreement with and are not required to accept any separate terms of service or privacy notice from, the Creator of that Brain.

• Related-Party Listing: At present, the Expert Brain Marketplace includes one listing, Industry Rockstar, which is owned by a co-founder of MyGentic. We disclose this affiliation for transparency. Industry Rockstar is treated the same as any other Creator under this Section 7, including with respect to the hosting and data-handling practices described above.

8. AI Deployer Disclosures & Profile Governance

Because MyGentic acts as an AI Deployer and intermediary context platform rather than a primary developer of foundational large language models, we explicitly implement the following operational safeguards and algorithmic transparency rules:

• Active Interaction Transparency: Whenever you interface with the platform, you are explicitly notified that you are communicating directly with an automated machine-learning program (such as our assistant, Sage). Responses are generated via algorithmic synthesis and do not represent a human correspondent.

• Synthetic Output and Voice Labeling: Any voice responses generated by the Services via Sage Voice or telephony channels are embedded with distinct metadata tags or explicit disclosures identifying the output as machine-generated, synthetic media. This ensures downstream compliance with state and federal applicable laws.

• Downstream Model Context Routing: To generate your operational Outputs, the platform explicitly transmits your formatted context fields and localized Inputs to our third-party model sub-processors (such as Anthropic, OpenAI, and Google). These transmissions are governed by agreements that contractually prohibit these vendors from retaining, utilizing, or processing your data to train their commercial foundation models.

• Automated Decisions and Profiling Controls: The generation of the professional profile involves automated inference processing to extract facts from your connected accounts. MyGentic does not use this automated profiling or Automated Decision-Making Technology (ADMT) to enforce choices that result in legal or similarly significant effects concerning your status, employment eligibility, or legal rights. Users retain the absolute right to manually override, rewrite, edit, or delete any automatically derived field within the application interface.

9. Children

The Services are not directed to, and we do not knowingly collect personal data from, anyone under 18. If you believe a person under 18 has provided us personal data, please contact us at privacy@mygentic.io and we will investigate and take appropriate action, including deletion.

10. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. If we make material changes, we will provide notice as appropriate and update the Effective Date above. Your continued use of the Services after an update means you accept the revised Policy.

Contact Us

MyGentic, Inc. is the formal legal entity responsible for the collection and processing of your personal data. If you have questions, complaints, or seek clarifications regarding our platform rules or this policy, please connect with us via the following channel:

MyGentic, Inc.

Attention: Privacy Compliance Department

Email Address: privacy@mygentic.io