How we handle your data.

Controller: Management OS, Inc.
Address: 1111B S Governors Ave, # 95842, Dover, DE 19904
Email: privacy@mgmt-os.ai

For data-protection matters in the EU, UK, or Switzerland, our representative under Article 27 GDPR / UK GDPR is: to be appointed prior to offering the Service to EU/UK customers. Until then, EU/UK data-protection enquiries may be directed to privacy@mgmt-os.ai.

Data lifecycle at a glance: personal and Customer Data enters only from sources you connect; it is stored encrypted in the United States; it is processed to generate your briefs, alerts, and answers (never to train AI models); and it is delivered back to you. You can disconnect a source, or request export or deletion, at any time. For a plain-language overview of our security practices, see our Trust & Security page.

We use personal information to:

Important: We do not use Customer Data, prompts, or AI Output associated with a Customer account to train, fine-tune, or improve any AI model, including our own.

We share personal information with:

• Sub-processors and service providers that help us operate the Service (cloud hosting, AI model providers, payment processing, support, analytics, communications). The current list is at mgmt-os.ai/subprocessors. They are contractually required to protect personal information and use it only as we instruct.
• The Customer (when you use the Service as part of an organization's workspace), for whom we process the data.
• Affiliates and successors in connection with a merger, acquisition, financing, reorganization, or asset sale.
• Professional advisors (lawyers, auditors, accountants) under confidentiality.
• Authorities and other parties when we believe in good faith that disclosure is required to comply with law, enforce our agreements, protect rights, property, or safety, or respond to lawful requests.

We do not sell personal information for money. Some online tracking activities for marketing analytics may constitute a "sale" or "share" under the CCPA; see Section 7 for your rights and our opt-out.

We are based in the United States and host the Service in the United States. If you access the Service from outside the United States, your personal information will be transferred to and processed in the United States.

For transfers from the EEA, UK, or Switzerland, we rely on the Standard Contractual Clauses (and the UK Addendum, where applicable), supplementary measures where needed, and other lawful transfer mechanisms. Our DPA at mgmt-os.ai/dpa describes these in detail. You can request a copy of the safeguards we use by emailing privacy@mgmt-os.ai.

We retain personal information only as long as needed for the purposes for which we collected it, to comply with legal obligations, resolve disputes, and enforce our agreements. Specific retention:

• Customer Data in your workspace: for the duration of the Customer's subscription, plus a deletion window of up to 30 days after termination (or as set forth in the Customer's contract or DPA).
• Backups: rolling backups for up to 90 days in encrypted form.
• Account and billing records: typically up to seven (7) years after last activity for tax, accounting, and legal purposes.
• Marketing data: until you opt out or after a period of inactivity.
• Security logs: generally 12 months.

When data is no longer needed, we delete or de-identify it.

Depending on the state where you live, you may have rights to:

• Know / Access: the personal information we have about you and how we process it.
• Correct: inaccurate personal information.
• Delete: your personal information.
• Portability: receive a copy in a portable format.
• Opt out of "sale" or "sharing" of personal information for cross-context behavioral advertising (where applicable).
• Limit the use of sensitive personal information (where applicable).
• Non-discrimination for exercising your rights.

To exercise your rights, email privacy@mgmt-os.ai with the subject line "Privacy Request" and the information necessary to verify your identity. We will respond within the timeframes required by law.

If you are a user of a Customer's workspace, please contact the Customer first; we will assist them in responding.

Authorized agents: California, Colorado, Connecticut, and certain other state residents may use an authorized agent. We will require written authorization and may need to verify your identity.

Appeals: If we decline a request, residents of states that grant an appeal right (e.g., Virginia, Colorado, Connecticut, Texas) may appeal by replying to our decision; we will respond within the time required by law.

California "Shine the Light": California residents may request a list of categories of personal information disclosed for direct-marketing purposes (none in our case).

You have rights to access, rectify, erase, restrict, object to, and port your personal data, and to withdraw consent where processing is based on consent. You also have the right to lodge a complaint with a Supervisory Authority — typically the one in your country of residence, place of work, or place of the alleged infringement.

To exercise your rights, email privacy@mgmt-os.ai. If you use the Service as part of a Customer's workspace, contact the Customer first.

We use cookies and similar technologies to operate our website and Service (essential), remember your preferences (preferences), measure performance and usage (analytics), and where applicable, deliver and measure marketing (marketing).

You can manage cookies through your browser, our cookie banner (where displayed), and any "Do Not Sell or Share My Personal Information" or "Limit the Use of My Sensitive Personal Information" link on our website. We honor Global Privacy Control ("GPC") signals where required.

We maintain administrative, technical, and physical safeguards designed to protect personal information, including encryption in transit and at rest, access controls, logging, secure development practices, regular vulnerability scanning, and annual penetration testing. No system is perfectly secure, however. If we become aware of a security incident affecting your personal information, we will notify you and, where required, regulators.

The Service is not directed to children under 16 and we do not knowingly collect personal information from children. If you believe we have collected information from a child, contact us at privacy@mgmt-os.ai and we will delete it.

The Service uses AI to generate suggestions, content, and outputs. AI Output is probabilistic and may be inaccurate. We do not use Customer Data to train AI models. We apply output filters to AI responses, including attribution-constraint rules that may be configured by the workspace administrator (for example, to prevent inappropriate references to prior employers or clients). We do not engage in solely automated decision-making that produces legal or similarly significant effects on individuals; if we ever do, we will provide notice and the rights required by law.

If you opt in, we deliver alerts, briefs, and other notifications to your WhatsApp phone number using the WhatsApp Business Cloud API operated by Meta Platforms, Inc. and its affiliates. To do this, we send Meta your phone number (in E.164 format) and the content of the message we are delivering, and we receive back delivery-status callbacks and, when applicable, any messages you send to us in reply. Message content and delivery metadata are stored in our audit ledger.

Message frequency varies by the alerts and cadences you configure — typically a daily brief plus event-triggered notifications (deal-slip alerts, meeting-prep-ready, etc.). Message and data rates may apply depending on your mobile carrier and plan. You can opt out at any time by replying STOP, or by disconnecting the channel in Settings; reply HELP for assistance. We do not sell, rent, or share your mobile phone number with third parties for their marketing or promotional purposes. Mobile-originated opt-in data and consent are not shared with any third parties for any purpose. Your use of the WhatsApp channel is additionally governed by Meta's WhatsApp Business Terms and Business Messaging Policy.

Voice notes and the app microphone. When you send a voice note on WhatsApp, or speak to Management OS with the microphone in the app, we send the audio to Deepgram to turn it into text so our AI can answer. When we answer out loud, we send the text of the answer to ElevenLabs (or, if ElevenLabs is unavailable, to Deepgram) to turn it into speech.

Live calls. When you call Management OS on WhatsApp, Twilio carries the call to ElevenLabs, which hosts the voice agent you talk to. ElevenLabs processes the call audio in real time to recognize your speech, runs the conversation using Anthropic's Claude as the agent's model, requests from Management OS the workspace data your questions need while the call lasts, and speaks the answers. When the call ends, ElevenLabs sends us the transcript, which we keep in your conversation history so the app and your next message have the context. Neither Management OS nor ElevenLabs keeps a recording of the call audio, and ElevenLabs deletes its copy of the call transcript after 30 days.

These providers are contracted not to train on your data. Transcripts and generated audio are Customer Data under our retention rules and are used only to serve you. Only phone numbers connected to a workspace can reach that workspace's data by voice. If a voice note or call includes other people's voices, you are responsible for any consent the law requires. You can avoid voice processing entirely by not using the voice features.

If you connect a personality-intelligence provider such as Crystal Knows or Humantic AI, we send contact identifiers you elect to enrich (name, email address, LinkedIn URL) to that provider under your credentials. The provider returns DISC and, where available, Big Five (OCEAN) personality assessments. These assessments constitute inference and profiling. You represent that you have a lawful basis under applicable law (including, where applicable, GDPR Article 6 and Article 22 restrictions on solely-automated decision-making with legal or similarly significant effects) for enriching each contact. We use the returned assessments only within your workspace, do not resell them, and cache them for six months per each provider's guidance. Individuals may opt out directly with the provider; where a provider surfaces an opt-out signal, we honor it and do not display an assessment.

You can use Management OS from an AI assistant that supports the Model Context Protocol (MCP), such as ChatGPT or Claude. You connect by signing in with your Management OS account. The assistant receives an access token, never your password. Access is limited to your workspace and your seat, and you can disconnect Management OS at any time in the assistant's settings.

• What we receive: only what the assistant sends in a tool call: the deal or rep details and the evidence items for that request (for example, a CRM record, call notes, or an email you share), plus any request ID the assistant attaches. We do not request or receive your conversation history.
• Evidence: used for that call only. We store a fingerprint of it (a one-way hash), never the text.
• Results: the read we return (scores, findings, and short verified quotes from your evidence) is kept for up to 24 hours so that a retried request returns the same answer, then cleared.
• Call records: for each call we keep the tool used, the outcome, the result of our quality checks, timing, cost, and which assistant app made the call. These are Customer Data, kept and deleted as described in Section 6. Security events for each call, including IP address and browser or app details, are kept as security logs under Section 6.
• AI processing: evidence is processed by Anthropic, our AI model provider, under its Commercial Terms, which prohibit training on it. Under Anthropic's standard policy, inputs and outputs are kept for up to 30 days for safety and abuse monitoring, then deleted, with narrow exceptions Anthropic publishes. See our sub-processor list.
• No training: as stated in Section 3, we do not use this data to train, fine-tune, or improve any AI model, including our own.

The assistant's provider (for example, OpenAI for ChatGPT or Anthropic for Claude) handles your conversation, including anything you share in it, under its own terms and privacy policy, not this one.

Our Service may link to or integrate with third-party sites and services. Their privacy practices are governed by their own policies, not this Privacy Policy.

We may update this Privacy Policy from time to time. We will post the updated version with a new "Last Updated" date and, for material changes, provide additional notice (for example, by email or in-product notice). Your continued use of the Service after the effective date constitutes your acceptance.

For privacy questions, requests, or complaints:

Email: privacy@mgmt-os.ai
Mail: Management OS, Inc., Attn: Privacy, 1111B S Governors Ave, # 95842, Dover, DE 19904

Patent Pending — U.S. Provisional Patent Application No. 64/075,451. MANAGEMENT OS is a trademark subject of pending USPTO Application Serial No. 99848258, owned by Management OS, Inc.