Privacy Policy

This Privacy Policy explains how Multify Inc. ("Multify," "we," "us," or "our") collects, uses, shares, and protects information when you use Multify, our websites, dashboards, agents, bots, and APIs (collectively, the "Service"). It supplements our Terms of Use, which include defined terms used here.

1. Scope, Controller, and Processor Role

Multify Inc., a Delaware corporation, is the controller of personal information processed through the Service. When we process User-Directed Content and Connected Account content to carry out a task you requested — such as answering a chat, drafting text, or summarizing an account you connected — we act on your instructions as your service provider and data processor. We use that content to perform your requested task, operate and secure the Service, and comply with law, and we do not sell it or share it for cross-context behavioral advertising. The one exception is the contextual advertising on the free tier: there, the text of a conversation may be used to choose ads as described in Section 7, except for email you attach from the extension, which is never used for ads. Our service providers and subprocessors are bound by written contracts that limit their use of personal information to performing services for us and require appropriate confidentiality and security measures. If you need a data processing addendum (DPA) for your organization, contact us at [email protected]. You can also reach us at [email protected] or through our Contact page. If you are in the EU, UK, Switzerland, or another jurisdiction with similar laws, see Sections 12 and 13 for transfer mechanisms and your rights.

2. Information We Collect

We collect the following categories of information:

• Account information: name, email address, phone number (where you sign up or communicate with the Service by text or iMessage, or otherwise provide one), password or authentication credentials, profile preferences, and billing details (collected and stored by Stripe; we do not store full payment-card numbers).
• Invite rewards / fraud checks: if you use our invite-a-friend program, we store the personal share code, who referred whom, reward status, and a coarse phone line type (for example mobile vs. VOIP) from a carrier lookup on a number you just verified. We do not keep the full lookup payload longer than needed to make that decision.
• Telegram identifiers: Telegram user ID, username, chat IDs, and bot tokens you provide or that our managed-bot infrastructure generates on your behalf.
• Agent metadata: agent display names, configuration files (such as SOUL.md and IDENTITY.md), assigned server IPs, SSH keys, and VNC credentials. We encrypt sensitive credentials such as OAuth and integration tokens, and we restrict access to the rest.
• Conversation and command data: prompts, messages, files, code, and Outputs exchanged between you and your Agent, plus command and audit logs of agent activity.
• Content you direct the Service to process ("User-Directed Content"). The browser extension and related writing helpers act only when you choose to use them — for example, when you attach page text, a selection, a screenshot, an open message, a draft you are writing, or one of your own tasks, pages, files, or stash items to a chat or request. We receive the content your action sends, use it once to perform the task you asked for (such as answering, summarizing, researching, or drafting text for your review), and store the resulting chat under the retention period in Section 10. Directing content to the Service does not publish it and does not add it to your Stash unless you save it there. The Service never sends email, posts messages, completes purchases, or changes other accounts on your behalf through these helpers; anything inserted into a page or compose window is a draft for your review, and only your own further action sends, inserts, or attaches it. Apart from the features described in the bullets below and the Gmail hints in Section 8, these helpers do not read your mailbox, other tabs, or background pages on their own, and they do not keep a separate login to your accounts. (The optional Pulse summaries below are separate and off unless you turn them on.) Email you attach, and the chat started from it, is not shared with advertising providers; Section 7 explains how other free-tier chats are used for ads. Multify does not use User-Directed Content to train AI models; Section 6 explains how AI model providers handle it. You can turn these helpers off in the extension under Settings.
• Saved-notes check. To show you whether you have saved anything from the site you are on, the extension sends the address of the page you open to our servers, which check it against your own Stash. We use the address for that lookup and do not store it.
• Minimal contextual signals for on-page suggestions. To offer contextual help (such as suggesting a relevant action for the page you are on, which may include coupon or task suggestions where available), the extension may assess the kind of page open in your active tab from its structure — for example, whether it looks like a checkout, an article, a statement, or a recipe — using the page address without query or fragment parts, the title and site-provided description, headings, and control labels. It never collects what you type into forms (including payment details), password fields, or the body text of the page for this purpose. Any contact details in such signals are masked before any automated decision step (Section 7). These signals are kept only briefly to avoid repeat checks, are not added to your account or Stash, and are not shared with anyone else unless you click a suggestion — in which case only that resulting chat is processed as User-Directed Content above, which may include a lookup in connected accounts you authorized (for example, recent promotional messages from the same store, used only to surface codes and linked back to your mailbox). Some suggestions are decided entirely in your browser and send nothing until you click (for example, an offer to check a sign-up page’s terms and privacy policy); that click sends the links to those documents, which the Service then retrieves and reviews for you. Site-level preferences for these hints are kept in your browser and can be changed in Settings.
• Pages you send with a private link. If you pick "Send this to someone" in the browser extension, Multify saves the page to your Stash and makes a link to it that you can paste anywhere. Anyone who has the link can open a page on Multify that shows that page's address, title, preview picture and description, any public caption you wrote for it, and your first name. It never shows your private notes, your tags, your email address, or your last name, and it is not listed on your public profile or in search engines. You can turn the link off in the extension at any time, and removing the page from your Stash turns it off too. We keep the link with the stash item until then.
• Ad cleanup. Where it is available, the browser extension can spot pages that are crowded with ads and offer to hide them, or hide them automatically if you choose that. It works out whether a page is ad-heavy inside your browser, by looking for the parts of the page that ad networks put there, and it sends nothing about the page to us or anyone else. Your choices (whether to offer, whether to clean up automatically, and the sites where you picked "Never show on this site") are kept in your browser, and you can change them in the extension under Settings. We receive only a count of how often an offer is shown, used, or undone, without the site or the page.
• Pulse, if you turn it on. Pulse is an optional feature that checks the email, calendar, and Slack accounts you have connected (see Section 8) a few times a day and tells you what needs your attention. To do that, it reads recent messages and events using the access you granted when you connected the account. It also learns what matters to you over time, such as the people you reply to most, who you meet with, and when you usually work. In Slack, it reads the channels you are in and your direct messages, and you can mute any channel. Pulse does not store the emails or messages themselves. It keeps short notes about them: who a message is from, its subject and date, a one-line summary, and whether it still needs you. It also keeps the people and routines it has learned, the instructions you give it, and the feedback you give on what it shows you (for example, marking something "not important"). If you allow it in the extension, Pulse can also learn from which emails you open in Gmail. When this option is on, the extension notes which conversations you open and sends only the sender domain, a shortened subject shape, and the time. It does not send the email text, your full address list, or attachments. Pulse uses these counts to learn which senders and topics matter to you. It stays off unless you allow it. You choose how often Pulse runs, and you can turn it off at any time. To help draft emails that sound like you, Pulse also reads the emails you sent in the last 60 days and keeps a short description of how you write (for example, how you usually greet people and sign off, and whether you write differently to people inside and outside your organization). It keeps that description, not the emails, and you can have it re-learn your tone from settings. If you have linked a phone number to Multify, Pulse can also send these check-ins to you by text (iMessage or SMS). A text holds the same short notes, such as who wrote and a one-line summary, never the full email. This is on unless you turn it off: switch off "Text me too" in Pulse settings, or reply STOP to stop the texts.
• Connected Account credentials: OAuth tokens and API keys for third-party integrations you authorize (typically through Composio, which holds those tokens); we receive only the scopes you grant.
• Bank account data, if you connect a bank: account names, balances, and transactions, received through our bank-connection provider (Quiltt) with your permission, and used to answer your questions about your own finances.
• Feedback and reactions: reactions you leave on replies (such as a thumbs up or down), feedback on suggestions, and what you tell Pulse about what it showed you.
• Usage and telemetry: feature usage, credit consumption, session frequency, error reports, and audit events.
• Device and technical data: IP address, browser type and version, device identifiers, language, time zone, and access logs. To prevent fraud and abuse, our fraud-prevention provider may also collect device and browser characteristics (a device fingerprint) when you sign up or use certain features.
• Advertising and marketing identifiers: if you reach one of our sites from an ad, the click identifier the ad network added to the link and the campaign and page you landed on, stored in cookies for up to 30 days; on our websites, the cookies and pixels described in Section 9; and in our mobile app, your device's advertising identifier, but only if you allow tracking when your device asks.
• Communications: support tickets, survey responses, and other correspondence with us.

3. Sources of Data

We collect information directly from you when you sign up, configure agents, or contact us; automatically when you use the Service (such as logs and telemetry); from Connected Accounts and Third-Party Services you authorize; from our payment, infrastructure, and communication providers (such as Stripe webhooks and our texting providers); and from advertising networks, which add a click identifier to the link when you reach us from one of their ads.

4. Legal Bases for Processing (EU/UK Users)

Where the GDPR or UK GDPR applies, we process personal information on the following bases:

• Performance of a contract: to provide the Service you request, including provisioning agents, processing payments, and responding to support requests;
• Legitimate interests: to secure the Service, prevent fraud and abuse, debug and improve the Service, and communicate with users about their accounts;
• Consent: for optional features and marketing communications, where required by law;
• Legal obligation: to comply with tax, accounting, anti-money-laundering, and other legal requirements.

5. How We Use Your Information

We use the information we collect to:

• Provide, operate, secure, and improve the Service;
• Provision, manage, and (when needed) repair agent infrastructure;
• Authenticate users and protect accounts;
• Process payments and manage subscriptions;
• Respond to support requests and communicate about your account;
• Detect, investigate, and prevent fraud, abuse, and security incidents;
• Enforce our Terms of Use;
• Comply with legal obligations and respond to lawful requests;
• Send transactional messages (such as receipts, security notices, trial reminders) and, with your consent where required, marketing messages;
• Display, personalize the relevance of, and measure the performance of advertising shown within the free, ad-supported tier of the Service, including through the use of identifiers and the content of your recent messages as described in Section 7. We do not use your messages to target advertising based on sensitive characteristics, and we do not send separately uploaded files to advertising providers. Paid, ad-free subscribers are not shown advertising and have no content used for this purpose. An email conversation you attach from the browser extension, and the chat started from it, are not used for advertising (see Section 7);
• Measure which of our own ads and marketing campaigns bring people to Multify, by reporting steps such as installing the extension, signing up, or starting your first chat to the ad networks we advertise with (see Section 7);
• Generate aggregated, de-identified analytics about Service usage;
• Answer chats you start from the browser extension, including chats about User-Directed Content you chose to attach.
• If you turn on the optional Pulse summaries, show you a short summary of what may need your attention in connected accounts you chose, and use your feedback and instructions to make later summaries more useful to you. Pulse content is not used for advertising.
• Tune how Multify responds to you, as described below.

Why we collect data, and the limits we put on it. We want Multify to give you the best possible experience, and much of that depends on the data you share with it. When we use your data to improve the Service, we do it to tune how Multify responds to your requests. Examples: remembering facts you ask it to remember, matching your writing tone if you turn that on, learning which messages and people matter to you in Pulse, and using your reactions to replies and aggregated, de-identified metrics (such as counts, latency, and error rates) to improve our prompts, model choices, and features. We do not use your data for anything else, apart from operating, securing, and billing for the Service, complying with law, and the ad-supported uses described in Section 7. We do not use your Content to train or fine-tune AI models (Section 6), and we do not build profiles of you to sell.

6. AI Model Processing and Training

To generate responses, your prompts, conversation context, and Outputs are sent to one or more third-party AI model providers. Most requests go through OpenRouter; some features go through FreeRouter (including our automated decision provider, TypeSafe) or, for some image features, Vercel AI Gateway. Depending on routing, the upstream model providers may include Anthropic, OpenAI, Google, xAI, Mistral, Moonshot AI, DeepSeek, and others. Moonshot AI is also used directly to generate initial agent persona files. Depending on the feature, what we send can include your messages and chat history, files and images you attach, page content and email you direct to the Service, memory you asked Multify to keep, and results from tools and Connected Accounts the request uses.

How AI model providers handle your data. Each model provider processes the data we send it under its own terms and privacy policy. Depending on the model and the provider, those terms may allow the provider to log or retain prompts and responses, to review them (for example, for abuse monitoring), or to use them to train or improve its own models. We do not control those practices, and we cannot promise that every provider will delete your data right away or not use it for training. Please review the providers' policies, and do not include information you are not comfortable having processed on those terms.

If you direct private content to the Service through the browser extension or a connected account (for example, User-Directed Content), that content is sent to the model provider as part of the prompt, so the model can perform the task you requested. The rules in this section apply to it.

When Pulse checks your connected accounts, the text of recent messages is sent to a model provider so it can be sorted and summarized for you. We use that text for the check and do not keep it afterward; only the short notes described in Section 2 are saved. Multify does not use your email, calendar, or Slack content to train AI models.

We use customer Content to generate the response or Output you requested and to operate the Service. Multify does not use your prompts, conversations, files, or Outputs to train or fine-tune AI models, and does not sell or license them to others for training, unless, before you use a specific model or feature, we clearly state that data submitted through that model or feature may be used for AI training. A general notice that data is collected, stored, or processed does not by itself permit training. Today, no model or feature in the Service is labeled for training by Multify.

If you are a paid, ad-free subscriber, Multify does not use your Content for AI training. This section describes what Multify does. What a model provider does with the data it receives is governed by that provider's own terms, as described above.

7. How We Share Your Information

We share information only as needed to operate the Service, to run and measure the advertising described below, to comply with law, or with your consent. Categories of recipients include:

• AI model and AI infrastructure providers: OpenRouter and the upstream model providers it routes to (including Anthropic, OpenAI, Google, xAI, Mistral, Moonshot AI, DeepSeek, and others, depending on configuration); FreeRouter, our routing service for some features, and our automated decision provider reached through it (currently TypeSafe), which supports contextual suggestions, Gmail hints, Pulse sorting, and suggested tags; Vercel AI Gateway for some image features; and Moonshot AI directly for persona generation. How these providers handle data is described in Section 6.
• Messaging transport: Photon (iMessage) and Twilio (SMS, and the phone line-type lookup in Section 2), which carry texts between you and Multify, including Pulse check-ins if you get them by text; and Telegram, if you use Multify there.
• Payment processing and financial data: Stripe (payments) and Quiltt (bank connections you choose to make).
• Email: Postmark and Loops, which send our transactional and product emails, and Postmark for email you send to a Multify address.
• Cloud and agent infrastructure: Render (application hosting and our primary database, in the United States), Cloudflare (DNS and network services), Bunny (file storage and content delivery), Hetzner and OVH (agent servers), and E2B (code sandboxes).
• Connected Account integration broker: Composio, which mediates third-party API integrations you authorize, and the services you connect (such as Google, Slack, GitHub, or X).
• Web search and page retrieval: providers that run web searches, fetch public web pages, look up public information, or shorten links for us when a request needs them. They receive the search query, page address, or link, not your account details.
• Analytics, notifications, and security: Appizer (product analytics; receives your user ID and, to connect your activity across our apps, your name, email address, and phone number), WonderPush (push notifications), Singular (mobile app install attribution), PostHog (website analytics), and Sentinel (fraud and bot detection at sign-up and sign-in; receives device signals and, at sign-up, your email address).
• Advertising providers (free tier): third-party advertising partners (currently Gravity) that help us choose, serve, and measure the ads displayed within the free, ad-supported tier of the Service. To select, deliver, cap the frequency of, personalize the relevance of, and measure the performance of these ads, we may share with these providers a hashed, pseudonymized (SHA-256) version of your email address, your Multify user ID, your IP address, your device and browser information, a session or conversation identifier, and the content of your recent messages and Agent responses in the current conversation (including any page title and address the extension adds to a message) for contextual matching. On texting surfaces, where there is no live connection, we use the IP address we last saw from you. We do not send separately uploaded files to these providers; however, if a reply in a free-tier conversation quotes or summarizes material from a file or Connected Account, that reply is part of the conversation text. We share this information to display and attribute advertising within the Multify experience, and not to enable these providers to build cross-service profiles of you. Paid, ad-free subscribers have no information sent to advertising providers for ads. An email conversation attached from the browser extension, and the chat started from it, are also withheld from these providers, as described below.
• Ad-measurement partners: we report steps such as installing the extension, signing up, saving your first item, or starting your first chat to ad networks we advertise with (for example Gravity, Reddit, or AdsPostX, and others we may add), so they can measure our ads and improve how they are delivered. When you reach Multify from an ad, we report to the network that sent you. Some networks (such as Reddit) also receive sign-up events from people who did not arrive from one of their ads. Depending on the network, we send the click identifier, your Multify user ID, the event and its time, your IP address and device information, and, for some networks (such as Reddit), your email address and phone number, which the network uses to match the event to its own users. On our websites, the advertising pixels described in Section 9 send page-visit and sign-up events to the networks that run them. You can opt out of this (Section 13.5).
• Professional advisors: auditors, lawyers, and accountants.
• Legal and safety: when required by law, court order, or to protect the rights, property, or safety of Multify, our users, or the public.
• Business transfers: in connection with a merger, acquisition, financing, or sale of assets. We will take reasonable steps to notify you and to have the recipient honor this Privacy Policy or a comparable replacement.
• With your consent: any other recipient you direct, including people you share a page, link, Stash item, or team space with.

Service providers are contractually bound to protect your information and to use it only for the purposes we specify. The ads we display are contextual: they are chosen from your current conversation, not by tracking you across other companies' websites or apps. We do not sell your Content, and we do not sell personal information to data brokers. The ad measurement described above, and the advertising pixels on our websites, may count as "sharing" for cross-context behavioral advertising, or as a "sale," under some U.S. state privacy laws; Section 13 explains your rights and how to opt out.

Email content you direct to the Service from the browser extension's Gmail controls (an attached conversation, or one Multify read for you there), and the chat started from it including later messages in the same conversation, is not shared with advertising providers and is not used to select ads. Your other chats on the free tier are unchanged.

Affiliate links. When a reply includes a link to Amazon.com, we add our Amazon Associates tag to it. If you buy something after following that link, we may earn a commission. Amazon learns that you arrived through our link, as it would from any affiliate link; we do not send Amazon your chats or account details.

Access by Multify personnel. Our admin tools are not built to show staff your chats, Stash, email, or pages. A small number of authorized personnel can reach systems that hold that data (for example, the database, an agent server and its logs, or a remote session on an agent you asked us to fix) when it is needed to give you support you asked for, investigate abuse or a security incident, or comply with law. That access requires extra verification, is limited to what the task needs, and is bound by confidentiality obligations.

8. Connected Accounts

When you authorize a Connected Account (such as a Gmail or other third-party app via Composio), we receive only the scopes you grant and act on your instructions as your service provider and data processor. Tokens and credentials are held by our integration broker or stored encrypted by us, and are used only to do what you ask — for example, an optional background summary you turn on, or a lookup in accounts you connected when you click a suggestion (Section 2). You can revoke a Connected Account at any time, which terminates our access except as needed for legal-retention or security purposes. Disconnecting an account also stops Pulse from checking it. Notes Pulse already made from that account stay until they expire (Section 10), you reset Pulse, or you turn Pulse off, which deletes all of them.

Multify's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

The Gmail control in the browser extension is separate from a Connected Account. It does not ask you for an OAuth grant and it does not keep a token. It sends the conversation you chose, once, into the chat you start. Writing helpers work the same way: they send the text you are writing only when you pick an action. See Section 2.

Gmail disclosure (Google API Limited Use). Optional contextual hints in Gmail, where available, may assess an open conversation when you open it, to decide which actions to offer (such as looking someone up, summarizing, drafting a reply, or creating a task). For this check the extension sends our servers the subject, the names, email addresses, and roles of the people in the conversation, and short excerpts of the conversation (up to a few hundred characters of what each person last wrote, and the start of the newest message). Other email addresses and phone numbers in the excerpts are masked before the automated decision step, which runs with our automated decision provider (Section 7). The result is kept in memory for a few minutes to avoid repeat checks and is not saved to your account, and nothing more is sent unless you pick an action. Each hint can be turned off in the extension under Settings. Separately, learning from which emails you open stays off unless you allow it (see Section 2). Multify's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

9. Cookies and Similar Technologies

We and our partners use cookies, pixels, local storage, and similar technologies on our websites and apps:

• Strictly necessary: session authentication, CSRF protection, and load balancing.
• Functional: remembering preferences such as theme and the look you chose for Stash.
• Analytics: PostHog on our websites, and Appizer in our apps, to understand which pages and features people use.
• Advertising and measurement: our websites load advertising pixels from Gravity and OpenAI, and some landing pages also load Reddit's pixel. These tell those networks about visits to our pages and clicks on sign-up buttons so they can measure and improve the delivery of our ads, and the networks may combine that with what they know about you from other sites. When you arrive from an ad, we also store the ad network's click identifier, campaign, and landing page in first-party cookies (named x_click_id, x_campaign, and x_lander) for up to 30 days, so we can report a later install or sign-up to that network (Section 7). In our mobile app, Singular measures which campaigns lead to installs and, only if you allow tracking when your device asks, uses your device's advertising identifier.
• Fraud prevention: Sentinel on sign-up and sign-in pages, and Stripe during checkout.

You can block or delete cookies through your browser settings, use a content blocker to stop pixels, decline the tracking prompt on your phone (or turn off "Allow Apps to Request to Track"), and opt out of ad measurement as described in Section 13.5. Blocking strictly necessary cookies may break the Service.

10. Data Retention

We keep personal information for as long as you use the Service, unless you delete it sooner or a shorter period is listed below. When you delete your account, we delete it as described in Section 10.1.

• Account data: while your account is open.
• Conversations, Stash, pages, memory, tasks, files, and Agent content: kept until you delete them or close your account, so that your history and context are there when you come back. User-Directed Content processed through the browser extension is part of that conversation and is kept with it. It is not kept as a separate stash item unless you save it to your Stash. Chats you start in private mode are deleted automatically about an hour after they go quiet.
• Pulse: notes about messages and calendar changes you have dealt with (resolved, done, dismissed, or expired) are cleared after about 30 days; run records after about 14 days; email-open signals after about 90 days; feedback after about 12 months. Notes about items that still need you, and the people, routines, writing-style description, and instructions Pulse has learned, are kept while Pulse is on, and you can reset them from settings. Turning Pulse off or closing your account deletes all of it, including open counts.
• Some images used in chat replies (such as product images we store to show you): about 60 days.
• System, security, and audit logs: as long as reasonably needed for security, fraud prevention, and legal purposes. Some of these records, including a record that an account was deleted, can outlast the account.
• Billing and tax records: as long as required by tax and accounting law (typically up to 7 years), mostly held by Stripe.
• Backups: our hosting providers keep backups of our database for a limited period. Deleted information can remain in a backup until it rolls off, and we do not restore deleted data from backups except to recover from an incident.

10.1 Deleting your account. You can delete your account in the Multify mobile app (Settings, then Delete account) or by emailing [email protected] from the address on your account (we may ask you to confirm it is you). Deletion happens right away and is permanent. We delete your account and the content associated with it from our active systems, including your chat history, Stash, pages, memory, tasks, projects, files, Pulse data, reminders, phone numbers, sessions, websites, agent servers, and sandboxes. We also revoke your Connected Accounts and bank connections, cancel any subscription, and delete your customer record at Stripe. It cannot be undone, so export anything you want to keep first. The limited exceptions are:

• copies in backups, until they roll off as described above;
• records we are required or reasonably need to keep, such as billing and tax records, security and audit logs (including a record of the deletion), records needed to prevent fraud or abuse (for example, so a deleted account cannot claim the same rewards again), and information subject to a legal hold or claim;
• messages, comments, and other content you contributed to a team or shared space that someone else owns, which stay with that team without your account attached;
• aggregated or de-identified data that no longer identifies you, such as usage counts;
• a small number of operational records keyed to your email address or phone number (such as records of emails and texts we sent you and past sign-up or verification attempts), and a profile photo you uploaded, which we remove on request. Email [email protected] and we will erase them;
• information that third parties already received before you deleted your account (for example, an AI model provider, an advertising partner under Section 7, or someone you shared a link with), which is governed by their own policies. Deleting your account stops us from sending them anything further.

11. Data Security

We implement reasonable technical and organizational measures designed to protect personal information, including encryption in transit (TLS), encryption at rest for our primary database, additional encryption for sensitive credentials such as OAuth tokens, role-based access controls, audit logging, SSH key management, and least-privilege access for personnel. We will notify affected users of confirmed breaches of personal information without undue delay, consistent with applicable law. No security control is perfect; we cannot guarantee absolute security.

Be careful what you share. Anything you put in a chat may be processed by our service providers and AI model providers as described in Sections 6 and 7. Please do not paste passwords, full payment-card or bank-account numbers, government ID numbers, health records, or other highly sensitive information into a chat unless the task needs it, and do not share other people's personal information unless you have the right to. You are responsible for the information you choose to submit.

12. International Data Transfers

We are based in the United States and operate globally. Your information may be processed in the United States, the European Union (including Hetzner data centers in Germany or Finland), and other countries where our service providers operate. For transfers from the EEA, UK, or Switzerland to other jurisdictions, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses (SCCs) and the UK International Data Transfer Addendum, where applicable.

13. Your Rights and Choices

13.1 EU/UK/Swiss Residents. Subject to applicable law, you have the right to:

• Access the personal information we hold about you;
• Request correction of inaccurate or incomplete information;
• Request erasure ("right to be forgotten");
• Request restriction of processing;
• Receive a portable copy of your data in a machine-readable format;
• Object to processing based on legitimate interests;
• Withdraw consent (where processing is based on consent), without affecting prior lawful processing;
• Lodge a complaint with your supervisory authority.

13.2 California Residents (CCPA/CPRA). You have the right to know what personal information we collect, use, and disclose; to request deletion; to request correction; and to limit use of "sensitive personal information." You also have the right to opt out of the "sale" or "sharing" of personal information. We do not sell your Content or sell personal information to data brokers. However, the ad measurement and website advertising pixels described in Sections 7 and 9 may be considered "sharing" for cross-context behavioral advertising, or a "sale," under California law. In the past 12 months, for those purposes, we have disclosed identifiers (such as email address, phone number, user ID, IP address, device information, and ad click identifiers) and internet or other activity information (such as page visits, installs, sign-ups, and first uses) to advertising and measurement partners. The contextual ads in the free tier are chosen from your current conversation; we use the message content shared with our advertising partner only to serve and measure ads within the Multify experience. You can opt out as described in Section 13.5. We do not knowingly sell or share the personal information of anyone under 16. We will not discriminate against you for exercising these rights. You may designate an authorized agent to make a request on your behalf.

13.3 Other U.S. State Laws. We honor equivalent rights to know, correct, delete, and opt out of targeted advertising and profiling provided to residents of Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Iowa, Delaware, Nebraska, New Hampshire, New Jersey, Tennessee, Minnesota, Maryland, Indiana, Kentucky, Wisconsin, Rhode Island, and other states with comprehensive privacy laws, to the extent applicable to your data. Mention of a state does not by itself determine applicability; where a state law applies, we honor its requirements, including any right to appeal a denial — you may appeal by replying to our decision email, and we will respond within the period required by applicable law. We do not use or disclose sensitive personal information (such as precise geolocation, racial or ethnic origin, religious beliefs, union membership, contents of mail, email, or text messages, health, sex life, sexual orientation, citizenship or immigration status, or criminal history) for the purpose of inferring characteristics about you, and we do not sell sensitive personal information.

13.4 How to Exercise Rights. To get a copy of your data, correct it, or delete it, email us at [email protected]. You may designate an authorized agent to make a request on your behalf; we will verify both your identity (usually by confirming control of the email on your account) and the agent's authority. We respond within 30 days, or within the time required by law if an extension applies, and we will explain any denial and how to appeal it. Some rights have legal limits, and if one applies we will tell you why.

13.5 Opting Out of Ad Measurement, "Sale," "Sharing," and Targeted Advertising. To opt out, email [email protected] with the subject line "Do Not Sell or Share" from the address on your account. Once we process your request, we stop sending your email address, phone number, and ad identifiers to advertising and measurement partners, and we stop reporting your activity to ad networks. You can also block our websites' advertising pixels and cookies in your browser (Section 9), and decline tracking in our mobile app when your device asks. The free tier may still show contextual ads chosen from your current conversation; a paid, ad-free subscription removes them.

14. Automated Decision-Making

The Service uses automated systems (large language models) to generate Agent responses. These responses are advisory; you and your Agent operators retain control over what actions are taken. Pulse uses the same kind of automated systems to decide which messages to show you; it only suggests, and you can tell it when it got something wrong. The Service does not use solely automated decision-making to produce legal or similarly significant effects on you within the meaning of GDPR Article 22.

15. Children's Privacy

The Service is not directed to individuals under 18, and we do not knowingly collect personal information from minors. If you believe a minor has provided us with personal data, please contact us and we will take steps to remove that information.

16. Marketing Communications

We may send you transactional communications (such as receipts, trial reminders, and security notices) regardless of marketing preferences. With your consent where required, we may also send marketing communications; you can unsubscribe at any time using the link in any marketing email or by contacting us.

17. Telegram and Bot Operation

Where it is available, you can use Multify Agents through Telegram. Messages sent through Telegram are routed through Telegram's infrastructure and are subject to Telegram's privacy policy in addition to ours. Please review Telegram's Privacy Policy.

18. Changes to This Policy

We may update this Privacy Policy from time to time. For material changes, we will provide at least 14 days' notice by email or by prominent notice within the Service before the changes take effect. Continued use of the Service after the effective date constitutes acceptance of the updated policy.

19. Contact Us

For questions, requests, or concerns about this Privacy Policy or our data practices, contact us at [email protected] or through our Contact page. If we are required to designate an EU/UK representative, we will identify them in this Policy.

Multify is a product of Multify Inc, a Delaware corporation.