Privacy Policy

1. Introduction

Ainur B.V. ("we", "us", "our", or "Magnetic") is committed to protecting your privacy and ensuring the security of your personal data. This Privacy Policy explains how we collect, use, store, and protect your information when you use the Magnetic platform and services.

This policy complies with the General Data Protection Regulation (GDPR) (EU) 2016/679, the Dutch Uitvoeringswet Algemene Verordening Gegevensbescherming (UAVG), and other applicable data protection laws.

2. Data Controller Information

3. Data We Collect

3.1 Information You Provide

• Account Information: Your name, email address, and the phone number or Apple ID you pair with your assistant
• Your Conversations: The texts, WhatsApp messages, voice notes, photos and web messages you send your assistant, and its replies; a voice call is kept as a written transcript, not as audio
• Connected Accounts: When you connect Gmail, Google Calendar, Outlook or another service, what your assistant reads there on your behalf (mail, events, contacts) to answer you, and what it sends or creates there on your instruction
• What You Ask It to Keep: Memories ("remember that I prefer the train"), contacts you save, standing permissions you give in words, and reminders and routines you set
• Saved Details (Vault): Addresses, phone numbers, payment cards and site logins you choose to store; card numbers, passwords and authenticator seeds are encrypted and never shown to the AI model
• Payment Information: Billing address and payment method details for your subscription (processed by Stripe)
• Communications: Support requests, feedback, survey responses

3.2 Information We Collect Automatically

• Usage Data: Features used, queries made, reports generated, interaction patterns
• Device Information: IP address, browser type, operating system, device identifiers
• Log Data: Access times, pages viewed, app crashes, system activity
• Cookies and Tracking: Session cookies, preferences, authentication tokens
• Analytics Data: Performance metrics, feature adoption, user journey data

3.3 Information from Third Parties

• Authentication Providers: Profile information from WorkOS/SSO providers
• Payment Processors: Transaction confirmations from Stripe
• Messaging Providers: Delivery receipts, reactions and the handle a message came from (iMessage, RCS, SMS, WhatsApp)
• Other People's Assistants: When you connect with a trusted person, the questions and answers exchanged between your assistants on your behalf
• Services You Connect: Data from the Google, Meta (Facebook and Instagram), Slack and Apple iCloud accounts you connect, limited to the permissions you approve; what each service gives us and why is set out in sections 6.5 to 6.8
• Public Sources: Publicly available business information for analysis
• AI Platforms: Response data from integrated AI services

4. Legal Basis for Processing

We process your personal data based on the following legal grounds:

• Contract Performance: To provide the services you've subscribed to
• Legitimate Interests: To improve our services, ensure security, and prevent fraud
• Legal Obligations: To comply with tax, accounting, and other legal requirements
• Consent: For marketing communications and certain cookies (you can withdraw consent anytime)
• Vital Interests: In rare cases where processing is necessary to protect someone's life

5. How We Use Your Data

5.1 Service Provision

• Answer your messages and calls, and do what you ask: draft and send mail, manage your calendar, look things up, plan, and run errands on websites
• Read your connected mail and calendar so your assistant can notice what needs you (a clash, an unanswered invitation, a delivery) and tell you
• Remember what you tell it, so it asks less over time; you can see, correct and delete what it keeps
• Act on your behalf only with your confirmation for each action, or under a standing permission you gave in words and can withdraw at any time; a purchase is never made without your yes
• If you connect your business tools (such as Google Analytics, Search Console, Google Ads, Business Profile, Facebook Pages, Instagram or Meta ads), report on them and make the changes you ask for, for example how your ads and website did last week, replying to a review or a comment, pausing a campaign or publishing a post; anything that is published, sent to someone or spends money waits for your confirmation
• If you add your assistant to a Slack workspace, answer you there and the colleagues who message it, within the limits you set
• Manage your account, subscription and credits

5.2 Communication

• Send service updates and important notifications
• Respond to support requests and inquiries
• Provide onboarding and training materials
• Send marketing communications (with consent)

5.3 Improvement and Development

• Analyze usage patterns to improve features
• Conduct research and development
• Test new functionalities
• Optimize performance and user experience

5.4 Legal and Security

• Prevent fraud and abuse
• Ensure platform security
• Comply with legal obligations
• Enforce our Terms of Service

6. Data Sharing and Disclosure

We share your data only in the following circumstances:

6.1 Service Providers (Sub-processors)

We engage trusted third-party service providers ("sub-processors") to help us deliver the Magnetic platform. These sub-processors are bound by data processing terms that require them to protect your data and process it only on our instructions.

The current list of our sub-processors:

This list does not include third-party services that you yourself connect through the Magnetic integrations dashboard (for example Google Ads, Meta Ads, Shopify, HubSpot, Slack, your CMS, etc.). Those are data destinations under your direct control, not Magnetic sub-processors. Data flows to and from them only at your explicit OAuth direction, governed by each provider's own terms.

Where you have a Data Processing Agreement (DPA) with us, we will notify you of material changes to this list in accordance with that DPA. For a DPA or for any questions about a specific sub-processor, contact comms@addmagnetic.com.

6.2 Legal Requirements

We may disclose data when required by law, court order, or governmental request, or when necessary to protect our rights, property, or safety.

6.3 Business Transfers

In case of merger, acquisition, or sale of assets, your data may be transferred to the successor entity, subject to the same privacy protections.

6.4 Consent

We may share data with your explicit consent or at your direction.

6.5 Google User Data

If you connect a Google account, Magnetic accesses only the Google data covered by the permissions you approve on Google's consent screen, and only to provide the features you use. Depending on what you connect:

• Gmail: reads and searches your mail, applies labels and archives on your instruction, reads attachments you ask about, and drafts, sends, replies to and forwards mail you ask for
• Google Calendar: reads your calendars and events, and creates, changes or deletes events you ask for; guests are invited only after you confirm
• Google Drive, Docs, Sheets and Slides: finds and reads files you ask about and creates or edits files for you; sharing or deleting a file happens only after you confirm
• Google Contacts and Google Tasks: reads, adds and updates your contacts and tasks; deleting one happens only after you confirm
• Google Analytics: read-only reports on your properties, such as traffic, sources and conversions
• Google Search Console: read-only search performance and indexing status for your sites
• Google Ads: reads your campaigns, ads, keywords, budgets and their performance, and creates or changes them only on your instruction; a change that spends money is confirmed by you first and stays within the spend limits you set
• Google Business Profile: reads your business information, reviews and performance, and replies to reviews or publishes updates on your instruction
• Google Merchant Center: reads your product listings and their approval status
• Google Tag Manager: reads your containers and tags, and makes or publishes changes only on your instruction
• YouTube: read-only information about your channel, videos and their statistics

How we use it. We use Google user data to answer your questions, to do what you ask, and to notice things that need you (a clash in your calendar, an unanswered invitation, a campaign that overspends) and tell you. We use it for nothing else.

Who receives it. We transfer Google user data only to provide the features you use, to the sub-processors listed in section 6.1 that host and run the service (including the AI model providers that write your assistant’s replies, under contracts that forbid them from using it for any other purpose or training on it), when required by law, or as part of a merger or acquisition after notice to you.

What we never do. We do not sell Google user data. We do not use or transfer it for advertising, including retargeting and personalised ads, to determine credit-worthiness, or for lending. We do not use it to develop, improve or train generalised artificial intelligence or machine-learning models. No person at Ainur B.V. reads your Google user data unless you ask us to (for example in a support request), it is needed for security purposes such as investigating abuse, it is required by law, or it has been aggregated and anonymised for internal operations.

Storage and retention. Access tokens are encrypted at rest. Mail, calendar and files are read from your account when needed and are not copied into a store of their own; what your assistant tells you, including what it quotes, stays in your conversation history until you delete it or your account. Reports from Google Analytics, Search Console, Google Ads and Merchant Center may be kept to show trends and compare periods, until you delete your account or ask us to delete them.

Limited Use. Magnetic's use of information received from Google APIs, and its transfer to any other app, will adhere to the Google API Services User Data Policy, including the Limited Use requirements. The use of raw or derived user data received from Google Workspace APIs will adhere to the same policy, including the Limited Use requirements.

6.6 Meta: Facebook, Instagram and Meta Ads

If you connect Facebook or Instagram through Facebook Login for Business, Magnetic accesses only the permissions you approve, for the Pages, Instagram professional accounts and ad accounts you choose:

• Your profile: your name and Facebook ID, to link the connection to your account (public_profile)
• Business assets: the business portfolios, Pages and ad accounts you manage, so you can choose which to connect (business_management, pages_show_list)
• Meta ad accounts: your campaigns, ad sets, ads, budgets and their performance (ads_read), and creating, changing or pausing them only on your instruction, with a change that spends money confirmed by you first (ads_management)
• Facebook Pages: your Page's posts, engagement and insights (pages_read_engagement, read_insights)
• Instagram professional accounts: your profile, media and insights (instagram_basic, instagram_manage_insights), and publishing posts, replying to comments and answering direct messages on your instruction, each confirmed by you first (instagram_content_publish, instagram_manage_comments, instagram_manage_messages)

We use this data only to answer your questions and do what you ask. We do not sell it, do not use it to build advertising profiles, do not use it to train any artificial intelligence model, and share it only with the sub-processors in section 6.1 that run the service. Access tokens are encrypted at rest. Ad performance copied to show trends is deleted when you disconnect Meta. We process this data in line with the Meta Platform Terms.

6.7 Slack

If you connect your Slack, Magnetic uses its own Slack app with the permissions you grant on Slack's screen. To search and read, it acts as you: when you ask your assistant something, it searches and reads the messages, people and channels you can already see: public channels always, and private channels and direct messages only if you allow them when you connect. It reads them at that moment to answer you and does not copy, store or index them; the records of that step keep only how many messages were read. It does not read your Slack on its own, for example in a morning summary.

Connecting also adds the Magnetic app to your Slack workspace, so you can write to your assistant there and tag @Magnetic in channels it was added to. The app receives only what is written to it: your messages in its chat and messages that mention it. Each person is answered by their own assistant; someone in the workspace without a connected Magnetic account gets one line on how to get one and nothing of yours. What you write to it is read at that moment to answer you and is not kept: we keep a record that you wrote (when and where), the assistant's own answer, and nothing of it in your assistant's memory. In a channel everyone there reads the answer, so it uses only what it can look up and keeps your mail, calendar and other conversations out of it.

If you allow sending, your assistant can post a message or a thread reply in your name. It always shows you the exact text and waits for your yes first. It never shares what it reads in your Slack with anyone else.

About the connection itself we keep the access Slack grants (stored encrypted), the name of your Slack workspace, your Slack member ID and the permissions you granted, until you disconnect Slack or close your account; either one deletes them and revokes the access at Slack. The app's own access to your workspace (also stored encrypted) is shared by the colleagues who connect theirs and is deleted when the app is removed from the workspace. If the app is removed on Slack's side instead, the access stops working at once and your assistant tells you so when it next tries; disconnecting on the Connectors page then deletes what we kept. What your assistant reads to answer you is passed, at that moment, to the AI model that writes the answer (section 6.1), which does not keep it. Slack also sends details we do not use, such as profile fields beyond a person's name, title, email address and time zone, and message metadata beyond what an answer needs, and we do not keep them.

We use Slack data only to provide your assistant. We do not use it to train any artificial intelligence model, do not export it in bulk, and never combine one workspace's data with another's. Your assistant's answers to you are kept in your conversation history like any other answer. You can disconnect Slack at any time on the Connectors page, which revokes the access at Slack, and a workspace administrator can remove the app too.

6.8 Apple iCloud

You can connect your iCloud account with an app-specific password you create at Apple (never your Apple password itself). With it your assistant reads and changes your calendars and reminders, searches and reads your iCloud Mail, sends and replies from it when you say yes to each message, files messages into your folders, and searches, adds and updates your iCloud contacts. Someone who connected only their calendar keeps calendar access until they choose to add Mail and Contacts.

The password is checked with Apple before we keep it, stored encrypted, and used only to reach your own iCloud account; it is never shown to an AI model or to anyone else. We keep your Apple ID, your iCloud Mail address and the names of your calendars. Mail and contacts are read when your assistant needs them and are not copied in bulk; what it reads to answer you becomes part of that conversation. We do not use your iCloud data to train any artificial intelligence model. Disconnecting deletes the password.

6.9 Disconnecting and Deleting Your Data

• Disconnect a service: on the Connectors page in Magnetic, choose the service and disconnect it. We stop accessing it and delete the stored access tokens.
• Remove access at the provider: Google at myaccount.google.com/connections; Facebook and Instagram under Business integrations in your Facebook settings; Slack by a workspace administrator under Manage apps; Apple by revoking the app-specific password at account.apple.com, under Sign-In and Security.
• Delete your data: delete your account under Settings, You, or email comms@addmagnetic.com with the subject "Delete my data". We delete your account and everything we hold from the services you connected within 30 days, and from backups within 90 days, keeping only records the law requires (such as invoices). For a request by email, we confirm when it is done.

7. International Data Transfers

Your data may be transferred to and processed in countries outside the European Economic Area (EEA). We ensure appropriate safeguards are in place:

• EU-approved Standard Contractual Clauses (SCCs)
• Adequacy decisions by the European Commission
• Binding Corporate Rules where applicable
• Your explicit consent for specific transfers

8. Data Retention

We retain your data for as long as necessary to provide our services and comply with legal obligations:

• Account Data: Duration of account plus 30 days after deletion
• Usage Data: 24 months for analytics purposes
• Financial Records: 7 years as required by Dutch tax law
• Marketing Data: Until consent is withdrawn
• Legal Claims: As needed for statute of limitations periods
• Backups: Maximum 90 days in backup systems
• Your Conversations and Memories: For as long as your account exists, so your assistant can refer back; you can archive or delete threads and remove memories at any time, and everything goes with the account when it is deleted
• Connected Mail and Calendar: Read live from your account when needed and held in short-lived caches (minutes); your assistant does not keep a copy of your mailbox
• Saved Details (Vault): Until you remove the item or delete your account
• Services You Connect: Access tokens until you disconnect the service; reports kept to show trends until you delete your account or ask us to (Meta ad data is deleted when you disconnect Meta); see section 6.9

9. Your Rights Under GDPR

As a data subject, you have the following rights:

9.1 Access Right

Request a copy of your personal data we hold and information about how we process it.

9.2 Rectification Right

Request correction of inaccurate or incomplete personal data.

9.3 Erasure Right ("Right to be Forgotten")

Request deletion of your personal data under certain circumstances.

9.4 Restriction Right

Request limitation of processing your personal data in specific situations.

9.5 Data Portability Right

Receive your personal data in a structured, machine-readable format and transfer it to another controller.

9.6 Objection Right

Object to processing based on legitimate interests or for direct marketing purposes.

9.7 Automated Decision-Making Rights

Not be subject to decisions based solely on automated processing that significantly affect you.

9.8 Consent Withdrawal

Withdraw consent at any time where processing is based on consent.

To exercise these rights, contact us at comms@addmagnetic.com. We will respond within one month, extendable by two months for complex requests.

10. Data Security

We implement appropriate technical and organizational measures to protect your data:

• Encryption: Data encrypted in transit (TLS/SSL) and at rest (AES-256)
• Access Controls: Role-based access, multi-factor authentication, regular access reviews
• Infrastructure: Secure cloud hosting with Google Cloud Platform
• Monitoring: 24/7 security monitoring and intrusion detection
• Testing: Regular security assessments and penetration testing
• Training: Regular security training for all employees
• Incident Response: Documented breach response procedures
• Compliance: SOC 2 Type II certification (in progress)

11. Cookies and Tracking

11.1 Essential Cookies

Required for platform functionality, authentication, and security. Cannot be disabled.

11.2 Analytics Cookies

Help us understand usage patterns and improve the service. Can be disabled in settings.

11.3 Preference Cookies

Remember your settings and preferences. Enhance user experience.

11.4 Marketing Cookies

Used with consent to deliver relevant advertisements and measure campaign effectiveness.

You can manage cookie preferences through your browser settings or our cookie preference center.

12. Children's Privacy

Our services are not directed to individuals under 16 years of age. We do not knowingly collect personal data from children. If we become aware of such collection, we will delete the data immediately.

13. Data Processing Agreement

For enterprise customers where we act as a data processor, we offer a Data Processing Agreement (DPA) that meets GDPR requirements. Contact comms@addmagnetic.com to request a DPA.

14. Breach Notification

In the event of a personal data breach that poses a risk to your rights and freedoms, we will:

• Notify the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) within 72 hours
• Notify affected users without undue delay when required
• Document all breaches and remedial actions taken
• Implement measures to prevent future occurrences

15. Supervisory Authority

You have the right to lodge a complaint with a supervisory authority. In the Netherlands:

16. Changes to This Policy

We may update this Privacy Policy periodically. Material changes will be notified via email or platform notification at least 30 days before taking effect. The "Last Updated" date at the top reflects the most recent revision.

17. Contact Us

For privacy-related questions, requests, or concerns:

We aim to respond to all privacy requests within 30 days. For complex requests, we may extend this period by up to 60 additional days, with notification of the extension and reasons.

18. Language

This Privacy Policy is provided in English. In case of any discrepancy between the English version and any translation, the English version shall prevail.