Privacy Policy

The MacrosLM ("Company", "we" or "us") is a company building AI-powered tools designed to help people understand and work with their data.

This Privacy Policy explains how we collect, use, disclose, and process your personal data when you use MacrosLM and other places where MacrosLM acts as a data controller — for example, when you interact with MacrosLM as a consumer for personal use ("Services"), or when MacrosLM operates and provides our commercial customers and their end users with access to our commercial products ("Commercial Services").

This Privacy Policy does not apply where MacrosLM acts as a data processor and processes personal data on behalf of commercial customers using MacrosLM' Commercial Services — for example, if your employer has provisioned you a team account, or you're using an app that is powered on the back-end by MacrosLM. In those cases, the commercial customer is the controller, and you can review their policies for more information about how they handle your personal data.

1. Changes to this Privacy Notice

We may modify this Privacy Notice from time to time, in which case we will update the "Last Updated" date at the top of this Privacy Notice. If we make material changes to how we use or disclose information we collect, we will use reasonable efforts to notify you (such as by emailing you at the last email address you provided us, by posting notice of such changes on the Services, or by other means consistent with applicable law) and will take additional steps as required by applicable law. If you do not agree to any updates to this Privacy Notice, please do not continue using or accessing the Services.

2. Collection and use of information

When you use or access the Services, we collect certain categories of information about you from a variety of sources.

Information You Provide to Us

Some features of the Services may require you to directly provide certain information about yourself. You may elect not to provide this information, but doing so may prevent you from using or accessing these features. Information that you directly submit through our Services includes:

• Basic contact details, such as name and email address. We use this information to create and maintain your account and provide the Services and to communicate with you (including to tell you about products or services that may be of interest to you).
• Account information, such as username (email address), password, and if provided, user's company information. We use this information to provide the Services and to maintain and secure your account with us. If you choose to register an account, you are responsible for keeping your account credentials safe. We recommend you do not share your access details with anyone else. If you believe your account has been compromised, please contact us immediately.
• Payment information, such as bank account, credit or debit card information, and billing address, which we collect using a third party payment processor. We use this information to process your payment and provide the Services, as required to perform our contract with you.
• Applicant details, such as information included in your resume or CV, references, and job history. We use applicant details to process your application for employment and to evaluate your candidacy.
• User-generated content, such as text, videos, images, or files ("input"), submitted by you as well as new content that is generated and output based on such prompts ("output"). Your Input may include personal information however, we will use commercially reasonable efforts to filter this information out before our Services process your Input to generate your deliverables and outputs. We may use your input and output to improve the Services, except where prohibited by applicable third-party platform policies (see Section 4, "Google User Data," below).
• Any other information you choose to include in communications with us, for example, when sending us a message.

Information Collected Automatically

We may also use cookies or other tracking technologies to automatically collect certain information about your interactions with the Services. We collect and use this information to tailor your experience with the Services, run analytics, better understand user interactions with the Services. Such information includes:

• Device information, such as device type, operating system, unique device identifier, and internet protocol (IP) address.
• Location information, such as approximate location.
• Other information regarding your interaction with the Services, such as browser type, log data, date and time stamps.

Most browsers accept cookies automatically, but you may be able to control the way in which your devices permit the use of cookies. If you so choose, you may block or delete certain of our cookies from your browser; however, blocking or deleting cookies may cause some of the Services, including any portal features and general functionality, to work incorrectly. Your browser settings may also allow you to transmit a "Do Not Track" signal when you visit various websites. Like many websites, our website is not designed to respond to "Do Not Track" signals received from browsers. To learn more about "Do Not Track" signals, you can visit http://www.allaboutdnt.com/.

To opt out of tracking by Google Analytics, click here.

Information Collected From Other Sources

We may obtain information about you from outside sources, including information that we collect directly from third parties and information from third parties that you choose to share with us. Such information includes:

• Analytics data we receive from analytics and product-experience providers such as Google Analytics and PostHog (including aggregated heatmaps and privacy-masked session recordings) which we use in our legitimate interests to improve our communications and the Services.
• Information we receive from career websites, such as LinkedIn, Monster, or Indeed, which we use in our legitimate interests to process your application for employment.
• Information we receive when you choose to link any third party account to our services, such as Google or Okta, which we use to maintain your account and login information. For details on how we handle data received through Google sign-in or Google APIs, see Section 4, "Google User Data," below.

Any information we receive from outside sources will be treated in accordance with this Privacy Notice. We are not responsible for the accuracy of the information provided to us by third parties and are not responsible for any third party's policies or practices. For more information, see the section below, Third Party Websites and Links.

In addition to the specific uses described above, we may use any of the above information to provide you with the Services and to maintain our business relationship, as a matter of our legitimate interests, including by enhancing the safety and security of our Services (e.g., troubleshooting, data analysis, testing, system maintenance, and reporting), providing customer support, sending service and other non-marketing communications, monitoring and analyzing trends, conducting internal research and development, complying with applicable legal obligations, enforcing any applicable terms of service, and protecting the Services, our rights, and the rights of our employees, users or other individuals.

3. Disclosure of your information

We may disclose your information for legitimate purposes subject to this Privacy Notice, including the following categories of third parties:

• Our affiliates or others within our corporate group, as a matter of our legitimate interests to efficiently provide the Services.
• Vendors or other service providers who help us provide the Services, including for system administration, cloud storage, security, customer relationship management, marketing communications, web analytics, payment networks, information filtering, and payment processing.
• Third parties to whom you request or direct us to disclose information, such as when we disclose your input to third-party AI providers to help fulfill your request to generate your deliverables and outputs.
• Professional advisors, such as auditors, law firms, or accounting firms, as a matter of our legitimate interests to assess, protect, enforce and defend our rights and to comply with our legal and regulatory obligations.
• Third parties in connection with or anticipation of an asset sale, merger, bankruptcy, or other business transaction, as a matter of our legitimate interests to run a successful and efficient business.

When you book a session with an expert through the Services, we create a calendar event and a Google Meet video link for the session and share your email address and the session details (such as the scheduled time and subject) with the expert you book, who joins the session as an invited participant. We create the calendar event and Meet link using our own Google Workspace account; we do not access your personal Google Calendar to do so.

We may also disclose your information as needed to comply with applicable law or any obligations thereunder or in our legitimate interests to cooperate with law enforcement, judicial orders, and regulatory inquiries, to enforce any applicable terms of service, and to ensure the safety and security of our business, employees, and users.

4. Google User Data

This section describes how MacrosLM accesses, uses, stores, and shares Google user data when you connect your Google account to our Services. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. In the event of any conflict between this section and other parts of this Privacy Notice, this section controls with respect to Google user data.

4.1 Data Accessed

When you sign in with Google or connect your Google account to MacrosLM, we may request access to the following categories of Google user data, depending on the features you use:

• Basic profile information, including your name, email address, profile picture, and Google account ID, accessed through the openid, email, and profile OAuth scopes. This is used to authenticate you and create or maintain your MacrosLM account. Google sign-in is handled on our behalf by our identity provider, Zitadel.
• Google Drive files, accessed read-only through the https://www.googleapis.com/auth/drive.readonly OAuth scope, when you choose to connect Google Drive to your workspace. We use this to let you browse and select files (including files in shared drives you can access) and to import the files you select so they can be processed within MacrosLM. We do not create, modify, or delete your Google Drive files.

We request only the minimum scopes necessary to provide the features you use, and we prompt you for consent before accessing any Google user data.

4.2 Data Usage

We use Google user data solely to provide and improve the user-facing features of MacrosLM. Specifically, we use Google user data for:

• Authentication and account management: to verify your identity, create your account, and let you sign in.
• Feature delivery: to provide the specific functionality you request, such as reading the Google Drive files you select so they can be processed within MacrosLM.
• Service maintenance and troubleshooting: to diagnose technical issues, prevent abuse, and maintain the security of your account.

Limited Use commitment. Our use of Google user data is subject to the Google API Services User Data Policy, including the Limited Use requirements. We do not:

• Use Google user data to serve advertisements.
• Sell or rent Google user data to any third party.
• Use Google user data for purposes unrelated to the user-facing features of MacrosLM.
• Allow humans to read Google user data, except (a) with your explicit consent for specific messages or files, (b) where necessary for security purposes such as investigating abuse, (c) to comply with applicable law, or (d) where the data has been aggregated and anonymized and is used for internal operations.
• Use Google user data to develop, improve, or train generalized or non-personalized AI and/or machine learning models. The general statement in Section 2 about using user input and output to improve the Services does not apply to Google user data.

4.3 Data Sharing

We do not sell, rent, or trade Google user data. We only share Google user data in the limited circumstances described below:

• With service providers that help us operate the Services (such as cloud hosting and infrastructure providers), strictly bound by confidentiality and data protection obligations and only to the extent necessary to provide the Services.
• With you or at your direction, for example when you choose to export or share content within the Services.
• For legal reasons, where required by law, regulation, legal process, or enforceable governmental request.
• In connection with a business transaction, such as a merger, acquisition, or asset sale, subject to standard confidentiality obligations and applicable law.

We do not share Google user data with third parties for advertising, marketing, or AI/ML model training purposes.

4.4 Data Storage and Protection

Google user data is stored on secure servers hosted by our cloud infrastructure providers, located in the United States. We protect Google user data using industry-standard safeguards, including:

• Encryption in transit using TLS for all data transmitted between your device, Google, and our servers.
• Encryption at rest for stored data and credentials.
• Access controls that restrict access to Google user data to authorized personnel who require it to operate the Services.
• Secure handling of OAuth tokens, which are stored encrypted and never exposed to client-side code or third parties.
• Regular security reviews of our systems and practices.

While we take these measures, no method of transmission or storage is completely secure. If you believe your account or Google data has been compromised, please contact us immediately at contact@macroslm.com.

4.5 Data Retention and Deletion

We retain Google user data only for as long as necessary to provide the Services to you, or as required by applicable law.

You may revoke our access to your Google data and delete your data at any time by:

• Disconnecting MacrosLM from your Google Account at https://myaccount.google.com/permissions; or
• Deleting your MacrosLM account through your account settings within the Services; or
• Emailing us at contact@macroslm.com to request deletion of your account and any associated Google user data.

Upon revocation or deletion, we will delete the OAuth tokens and any Google user data that has not been imported into your workspace from our active systems within 30 days, except where we are required to retain it to comply with legal obligations, resolve disputes, or enforce our agreements. Backups containing this data are overwritten in the ordinary course of our backup cycle, typically within 90 days.

Files you choose to import from Google Drive become part of your workspace content once imported, so that the deliverables and analyses you produce remain grounded in their source material. We retain those imported files under the general retention practices described in Section 7, "Data security and retention," rather than the 30-day period above. You can delete an imported file at any time from within the Services, or delete your account to remove your imported files, subject to the exceptions described in Section 7.

4.6 Questions About Google User Data

If you have questions about how we handle Google user data, or wish to exercise any of the rights described above, please contact us at contact@macroslm.com.

5. Third party websites and links

We may provide links to third-party websites or platforms. If you follow links to sites or platforms that we do not control and are not affiliated with us, you should review the applicable privacy notice, policies and other terms. We are not responsible for the privacy or security of, or information found on, these sites or platforms. Information you provide on public or semi-public venues, such as third-party social networking platforms, may also be viewable by other users of the Services and/or users of those third-party platforms without limitation as to its use. Our inclusion of such links does not, by itself, imply any endorsement of the content on such platforms or of their owners or operators.

6. Children's privacy

Our Services are not intended for children, and we do not seek or knowingly collect any personal information about children. If we become aware that we have unknowingly collected information about a child, in particular any child under 13 years of age, we will make commercially reasonable efforts to delete such information from our database. If you are the parent or guardian of a child under 13 years of age who has provided us with their personal information, you may contact us using the below information to request that it be deleted.

7. Data security and retention

Despite our reasonable efforts to protect your information, no security measures are impenetrable, and we cannot guarantee "perfect security." Any information you send to us electronically, while using the Services or otherwise interacting with us, may not be secure while in transit. We recommend that you do not use unsecure channels to send us sensitive or confidential information.

We retain your information for as long as is reasonably necessary or until you delete your files or account for the purposes specified in this Privacy Notice. When determining the length of time to retain your information, we consider various criteria, including whether we need the information to continue to provide you the Services, resolve a dispute, enforce our contractual agreements, prevent harm, promote safety, security and integrity, or protect ourselves, including our rights, property or products. You may choose to delete your account and files at any time by going into your account settings, or request we delete your account and files by contacting us at the email found in Section 9. For Google user data specifically, see also Section 4.5 above.

8. California privacy rights

California law permits users in California to request certain details about how their "personal information" (as defined in California Civil Code Section 1798.83) is disclosed to third parties for direct marketing purposes. We may from time to time elect to disclose certain "personal information" about you to third parties for those third parties' direct marketing purposes. California users may, under certain circumstances, request and obtain certain information regarding our disclosure, if any, of personal information to third parties for their direct marketing purposes. If this applies, you may obtain the categories of personal information disclosed and the names and addresses of all third parties that received personal information for their direct marketing purposes during the immediately prior calendar year. To make such a request, please contact us using the information listed below. Please note that we are only required to respond to one request per California resident each year.

Any California residents under the age of 18 who have registered to use the Services and who have posted content or information on the Services can request that such information be removed from the Services by contacting us at the information provided below. Such request must state that they personally posted such content or information and detail where the content or information is posted. We will make reasonable good faith efforts to remove the post from prospective public view or anonymize it so the minor cannot be individually identified. This removal process cannot ensure complete or comprehensive removal. For instance, third parties may have republished the post and archived copies of it may be stored by search engines and others that we do not control.

9. How to contact us

Should you have any questions about our privacy practices or this Privacy Notice, please email us at contact@macroslm.com.