MyMai Privacy Notice

---

1. Overview

MyMai provides an AI-driven enterprise intelligence platform (the “Services”). This Privacy Notice explains how MyMai collects, uses, shares, and protects personal information when:

• you visit our website, and/or
   
• you use the Services through an organization that has a subscription with MyMai (our “Client”).
   

If you use the Services through a Client, your primary relationship regarding account administration and certain privacy choices is with your employer or organization.

2. Roles: MyMai and Our Clients

For Client-provisioned use of the Services, the Client typically determines what personal information is submitted to the Services and how it is used. In that context, the Client generally acts as the “controller” (or equivalent) and MyMai acts as a “processor,” processing personal information on the Client’s instructions to provide and secure the Services.For certain activities (such as operating our website, managing sales inquiries, and maintaining platform security), MyMai may act as an independent controller.

3. Personal Information We Collect

We collect personal information from three main sources: (a) information you provide, (b) information collected automatically, and (c) information provided by a Client or identity provider.

A. Information you provide

• Contact information: name, business email, and information you provide when you contact us or request information.
   
• Support communications: information you provide in support requests or other communications.
   

B. Information collected automatically

• Device and network information: IP address, browser type, device identifiers, operating system, and similar technical information.
   
• Log and usage information: authentication events, access logs, and in-application activity necessary to operate, maintain, and secure the Services.
   
• Website usage information: information about how you interact with our website (e.g., pages viewed, approximate location derived from IP address).
   

C. Information provided by Clients / identity providers
When a Client onboards users to the Services, we may process:

• Identity and account information: business email address and identifiers associated with enterprise authentication (such as a user principal name and tenant/user identifiers) to provision and manage access.
   
• Authentication and authorization attributes: information received from the Client’s identity provider (e.g., single sign-on assertions, role/group membership used for access control).
   

We do not collect or store user passwords for single sign-on scenarios.

Client Data / user-submitted content: Depending on how a Client uses the Services, the Services may process information a Client or its authorized users submit (which could include personal information). MyMai processes such information to provide the Services to the Client and as instructed by the Client.

4. How We Use Personal Information

We use personal information to:

• Provide and operate the Services (including provisioning accounts, enabling access, and delivering requested functionality).
   
• Secure the Services (including monitoring for unauthorized access, investigating suspicious activity, and preventing abuse).
   
• Support and respond to inquiries and support requests.
   
• Improve and maintain the Services and our website (including troubleshooting, performance, and product development).
   
• Comply with legal obligations and enforce our agreements.
   

5. How We Share Personal Information

We do not sell personal information.

We may share personal information in the following circumstances:

• With service providers (subprocessors/vendors) that help us host, operate, secure, or support the Services. These providers are authorized to process personal information only as needed to provide services to MyMai.
   
• With Clients (your organization) in connection with your use of the Services (e.g., account administration, security, and usage reporting for their authorized users).
   
• For legal, security, and safety reasons if we believe disclosure is necessary to comply with law, protect rights and safety, investigate fraud/security issues, or respond to lawful requests.
   
• Business transfers in connection with a merger, acquisition, financing, reorganization, or sale of all or part of our business.
   

6. Data Protection and Security

We use administrative, technical, and organizational safeguards designed to protect personal information, including controls intended to support:

• encryption in transit,
   
• encryption at rest (where applicable),
   
• access controls and least-privilege practices, and
   
• logging and monitoring for security and reliability.
   

No security measures can guarantee absolute security.

7. Data Retention

We retain personal information for as long as necessary to:

• provide the Services and operate our business,
   
• maintain security logs and audit trails, and
   
• comply with legal and contractual obligations.
   

In general, security and application logs are retained for a limited period consistent with operational and compliance needs (often up to 12 months, depending on the log type and purpose). When a Client relationship ends, we follow contractual instructions regarding return or deletion of Client data, subject to applicable law and legitimate retention requirements (e.g., security, audit, or legal obligations).

8. Your Rights and Choices

Your rights depend on your location and relationship to MyMai.

If you use the Services through a Client:
Please direct requests to access, correct, delete, or export information associated with your account to your organization’s administrator, since the Client typically controls the account relationship and many processing decisions. If you contact MyMai directly, we may redirect your request to the Client or coordinate with them to respond.

Website communications:
You may opt out of marketing communications by using the unsubscribe mechanism in our emails (where available) or by contacting us.

9. International Processing

MyMai and its service providers may process and store personal information in the United States and other locations where we or our providers operate. Where required, we use appropriate safeguards for cross-border transfers (see Section 10).

10. EU/UK Privacy Information (EEA, Switzerland, and the United Kingdom)

10.1 Legal Bases (GDPR / UK GDPR)

Where MyMai acts as a controller, we rely on the following legal bases (as applicable):

• Contract performance (Article 6(1)(b)): to respond to your requests and provide website features or services you request (e.g., demo requests, support).
   
• Legitimate interests (Article 6(1)(f)): to secure our website and Services, prevent fraud/abuse, maintain availability, and improve our Services (balanced against your rights).
   
• Legal obligation (Article 6(1)(c)): to comply with applicable laws and lawful requests.
   
• Consent (Article 6(1)(a)): where required for certain website technologies (e.g., non-essential cookies) or specific communications/preferences.
   

Where MyMai acts as a processor for a Client, the Client determines the legal bases for processing personal information in the Services. MyMai processes personal information on the Client’s documented instructions (subject to applicable law).

10.2 Your Rights

Subject to applicable law and certain exceptions, you may have the right to:

• request access to your personal information,
   
• request correction or deletion,
   
• object to processing or request restriction,
   
• request data portability, and
   
• withdraw consent where processing is based on consent.
   

How to exercise rights:
If you use the Services through a Client, please contact your organization first. If you contact MyMai directly at security@mymai.ai, we may need to coordinate with (or redirect to) the Client as controller.

10.3 International Transfers

If personal information is transferred outside the EEA/UK to a country not recognized as providing an adequate level of protection, MyMai relies on appropriate safeguards, which may include:

• the European Commission Standard Contractual Clauses (SCCs), and
   
• the UK International Data Transfer Addendum to the SCCs (or other approved UK transfer mechanism),
  as applicable.
   

10.4 Complaints

If you are located in the EEA/UK, you have the right to lodge a complaint with your local supervisory authority. In the UK, this is the Information Commissioner’s Office (ICO).

11. Children

The Services and website are not directed to children, and we do not knowingly collect personal information from children.

12. Changes to This Notice

We may update this Privacy Notice from time to time. If we make material changes, we will update the “Last Updated” date and may provide additional notice as appropriate.

13. Contact Us

Questions about this Privacy Notice or our privacy practices: security@mymai.ai

Last Updated: December 2025