The rules for using Management OS.

1.1 This Policy applies to Customer (the organization that accepts the Agreement), to each User (an individual Customer permits to use the Service under its account, including through WhatsApp, the voice line or an AI assistant connected to the Service), and to anyone else who uses or accesses the Service. Customer is responsible for its Users’ compliance.

1.2 “Customer Data”, “AI Output” and other capitalized terms not defined here have the meanings given in the Agreement. “Connected Source” means a third-party system Customer or a User connects to the Service, such as a CRM, calendar, email, meeting-recording or messaging system. “Including” means including without limitation.

2.1 The Service is a management system for business leaders and their teams. It reads the business data Customer connects and produces briefs, alerts, coaching, analysis and answers to help leaders develop their business, their team and themselves. It may be used only for Customer’s internal business purposes, in compliance with law and the Agreement.

2.2 The Service is not designed for personal, household or consumer use, for use by anyone under 18, or for any use in which a failure of AI Output could lead to death, personal injury or severe physical or environmental damage.

Neither Customer nor any User may use the Service, or permit it to be used, to do any of the following. The examples in each group illustrate the rule; they do not limit it.

4.1 Unless we agree otherwise in writing, Customer and its Users must not submit to the Service, or connect a Connected Source in a way that sends to the Service:

1. (a) special categories of personal data under Article 9 of the GDPR or its equivalents (data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership; genetic data; biometric data used to identify a person; data concerning health; and data concerning a person’s sex life or sexual orientation), or personal data relating to criminal convictions and offences;
2. (b) protected health information under HIPAA;
3. (c) payment card numbers, card verification codes or full magnetic-stripe data;
4. (d) government-issued identification numbers, such as Social Security, passport or driver’s license numbers, or financial account credentials;
5. (e) personal data of children under 16; or
6. (f) classified information, or data controlled under the International Traffic in Arms Regulations or controlled under the Export Administration Regulations above EAR99.

4.2 Workplace data will sometimes contain an incidental mention of a fact in Section 4.1, for example in a note or an email. Customer must take reasonable steps not to connect sources whose purpose is to hold that data (such as an HR health file), must not ask the Service to infer it, and must delete it where it learns the Service holds it. Personal data is otherwise handled as set out in the Data Processing Addendum.

5.1 The Service can analyze the work of Customer’s personnel and suggest who to coach, how a deal or a person is performing, and what to do next. That output is decision support. It is probabilistic, can be wrong, and is not a finding of fact about anyone.

5.2 Before AI Output is used in a decision that produces legal or similarly significant effects for an individual, including a decision about hiring, compensation, promotion, discipline, territory or quota assignment, or termination, Customer must ensure that a human with the authority and the information to reach a different outcome reviews the decision and the evidence behind it. AI Output must not be the sole basis of the decision.

5.3 Customer is responsible for complying with laws that govern automated or AI-assisted decisions about individuals and the use of AI in employment, including, where they apply, the rights of individuals under Article 22 of the GDPR, Regulation (EU) 2024/1689 (the EU AI Act), New York City’s law on automated employment decision tools, and comparable laws. Where such a law requires an assessment, an audit, a notice to the individual or an opportunity to request human review, Customer is responsible for it.

5.4 Customer must not use the Service to infer a characteristic protected by law, or to rank, score or screen individuals on such a characteristic.

Customer is responsible for:

1. (a) having the authority to connect each Connected Source, and the lawful basis, notices and consents required to process the personal data that flows from it into the Service;
2. (b) deciding who in its organization may use the Service and see what it produces, and removing access promptly when someone leaves or changes role;
3. (c) reviewing AI Output before acting on it or sending it to anyone, as the Agreement requires; and
4. (d) telling us promptly at security@mgmt-os.ai if it learns of a violation of this Policy or a compromise of its account.

Report a suspected violation to the right address:

1. (a) security issues, account compromise or abuse of the Service: security@mgmt-os.ai;
2. (b) privacy or data protection concerns: privacy@mgmt-os.ai; and
3. (c) intellectual property complaints: legal@mgmt-os.ai.

Please include what happened, when, the evidence you have and how to reach you. Reports made in good faith are welcome even when they turn out to be mistaken. A report made in bad faith to harm another user is itself a violation of this Policy.

8.1 We may investigate a suspected violation. To do so we may review account activity, logs, workspace configuration and other operational records. We access the content of Customer Data only to the extent needed to investigate the specific matter, to respond to Customer’s request, or to comply with law.

8.2 Customer will cooperate reasonably, including by preserving relevant records, identifying the Users involved and taking corrective action. We may cooperate with law enforcement and regulators where the law requires it or where we reasonably believe it is needed to prevent serious harm.

9.1 We respond in proportion to the severity, duration and intent of a violation, and to the risk it poses. Our responses include, in rising order: (a) a written notice to Customer’s account owner identifying the violation and what to fix; (b) limiting a feature, a connector or usage; (c) removing or quarantining specific content; (d) suspending a User; (e) suspending Customer’s workspace; and (f) terminating the Agreement under its terms.

9.2 Except where Section 10 applies, we will give Customer notice and a reasonable opportunity to cure before we suspend a workspace or terminate for a violation that can be cured. Nothing in this Policy limits our rights under the Agreement or the law.

We may suspend a User or Customer’s workspace without prior notice where we reasonably believe that (a) continuing access poses an imminent risk of harm to any person, to other customers or to the Service; (b) an account has been compromised; (c) the violation involves content described in Section 3.2(a) or 3.2(d); or (d) the law or a valid order requires it. We will tell Customer promptly afterwards, limit the suspension to what the risk requires, and restore access once the risk is resolved.

Customer may contest an enforcement decision by writing to legal@mgmt-os.ai within thirty (30) days of being notified, explaining why it believes the decision was wrong. A person who was not involved in the original decision will review it and reply in writing with the outcome and the reasons. This route does not limit Customer’s rights under the Agreement, including its dispute resolution provisions.

We may update this Policy as the Service, the law and patterns of misuse change. We will give Customer’s account owner at least fifteen (15) days’ notice of a material change by email or in the Service, except where a change is needed sooner to comply with law or to address an imminent risk of harm. The version history below records each change.

1. (a) This Policy is part of the Agreement. If they conflict, the Agreement prevails, except that this Policy prevails on what uses are prohibited.
2. (b) The Data Processing Addendum governs how we process personal data on Customer’s behalf; the Privacy Policy describes our own handling of personal data; and the sub-processor list names the providers that help us run the Service.
3. (c) Our failure to enforce any part of this Policy in a particular case does not waive our right to enforce it later.