Legal
SageOps Privacy Policy
This Privacy Policy explains how Eve-Marketing, LLC, a Nevada limited liability company and wholly-owned subsidiary of MindHYVE.ai, Inc., a Nevada C-Corporation (collectively, "Company," "we," "us," or "our"), collects, uses, discloses, and protects personal information in connection with SageOps, including the SageOps website and web application and the Digital Employee known as Sage (the "Services"). Capitalized terms not defined here have the meanings given in the SageOps Terms of Service (the "Terms").
1. Scope and Our Roles
1.1. Controller for Account Data. We are the controller (or "business," under California law) for personal information we collect to create and administer accounts, bill customers, secure the Services, communicate with customers, and comply with law ("Account Data"). This Policy describes that processing.
1.2. Processor for Customer Content. SageOps customers use the Services to create and publish marketing content, and in doing so may submit or connect personal information about their own customers, contacts, prospects, reviewers, commenters, and others, including contact lists, email recipients, reviews, comments, messages, and knowledge-base documents ("Customer Content"). We process Customer Content on behalf of and at the direction of the customer, as a processor (or "service provider," under California law), under the Terms and the SageOps Data Processing Addendum. The customer, not Company, is responsible for the privacy notices, consents, and lawful basis for Customer Content. If your information is in a SageOps customer's Customer Content and you wish to exercise a privacy right, please contact that customer; we will assist the customer as required by our agreement with it and by law.
1.3. Agencies. Where an agency uses the Services for its clients, the agency's client is typically the controller of Customer Content in that client's workspace, the agency is its processor, and Company is a sub-processor.
1.4. Other MindHYVE policies. This Policy applies to SageOps. Other MindHYVE.ai, Inc. products and websites are covered by their own notices.
2. Information We Collect
2.1. Information you provide.
(a) Account and profile information: name, email address, password (stored in hashed form), organization name, role, workspace and brand names, and account preferences.
(b) Billing information: billing name, billing address, plan, transaction history, and tax information. Payment card details are collected and processed by our payment processor, Stripe, Inc.; we do not receive or store full card numbers.
(c) Communications: information you provide when you contact support, respond to surveys, or send feedback.
2.2. Information collected automatically.
(a) Usage and log data: IP address, browser and device type, operating system, access times, pages and features used, actions taken in the Services, Credit consumption, errors, and diagnostic data.
(b) Cookies and browser storage: see Section 10.
2.3. Information from Connected Channels. When you connect a Connected Channel, we receive the access tokens and account identifiers you authorize, and, at your direction, data from that account such as profile details, posts, comments, messages, reviews, and analytics. Data about third parties obtained this way is Customer Content (Section 1.2).
2.4. Information from web research. When you direct Sage to research a topic, the Services retrieve publicly available web pages, which may incidentally contain personal information. That material is processed as Customer Content for your workspace.
2.5. Information from service providers. We receive payment status and limited billing information from Stripe.
2.6. Information from sign-in providers. If you choose to sign up or sign in with Google or Microsoft, we receive from that provider your name, email address, whether the provider has verified that email address, and a provider account identifier, and we use them only to create, secure, and sign you in to your account. We do not receive your password for that provider, and we do not request access to your mailbox, files, calendar, or contacts through sign-in. Your use of Google or Microsoft sign-in is also governed by that provider's own terms and privacy policy.
2.7. Campaign measurement for customers (tracked links and the website snippet). At a customer's direction, the Services measure how the customer's published posts perform. We do this as the customer's processor (Section 1.2), and the records are Customer Content.
(a) Tracked links. Links in posts that Sage publishes can be replaced with short links on the SageOps domain (addresses beginning with /l/) that redirect to the customer's page with campaign tags added. When someone follows one, we record the time, the post, the domain of the referring site, whether the request came from an automated link-preview service, and a one-way hash of a shortened form of the IP address. The address is shortened first (the last part of an IPv4 address and the last 80 bits of an IPv6 address are removed), and the hash key changes every day and differs for every customer, so the hash cannot be reversed or used to recognize a person over time or across websites. We do not store the IP address itself, the browser's user-agent string, or any cookie or identifier. When the browser sends Do Not Track or Global Privacy Control, the click is counted without the hash.
(b) Website snippet. A customer may install a SageOps script on its own website. For a visit that starts a browsing session, and for form submissions and goals the customer defines, it sends us the page's domain and path (never the query string or the page's content), the campaign tags the visitor arrived with, the time, and the same daily hashed shortened IP address. It does not set cookies, does not use a persistent or cross-site identifier, does not read what visitors type into forms, and does not fingerprint devices. It keeps the campaign tags only for the current browser tab (session storage, cleared when the tab closes). It sends nothing when the browser sends Do Not Track or Global Privacy Control, and we discard any event that arrives with either signal.
(c) Platform metrics. We read aggregate performance numbers for the customer's own posts and accounts (such as impressions, reach, reactions, comments, shares, clicks and follower counts) from each platform's insights interface, through the account the customer connected.
(d) The customer's responsibilities. A customer who installs the snippet or uses tracked links is responsible for describing that measurement in its own privacy notice and for obtaining any consent its visitors' laws require.
3. How We Use Information
We use Account Data to:
3.1. provide, operate, maintain, and support the Services, including authenticating users and administering subscriptions and Credits;
3.2. process payments, send invoices and receipts, and provide automatic-renewal and price-change notices;
3.3. send service, security, and administrative communications, and, where permitted by law, information about SageOps features (you may opt out of marketing communications at any time);
3.4. secure the Services, detect and prevent fraud, abuse, and violations of the Terms and Acceptable Use Policy, and investigate security incidents;
3.5. analyze and improve the Services using aggregated or de-identified information;
3.6. comply with legal obligations, respond to lawful requests, and establish, exercise, or defend legal claims; and
3.7. for any other purpose disclosed to you at the time of collection, with your consent where required.
We do not use Customer Content or Output to train, fine-tune, or otherwise improve foundation models or general-purpose reasoning models. We process Customer Content only to provide the Services to the customer and as otherwise permitted by the Terms and the Data Processing Addendum.
4. Legal Bases (EEA, UK, and Switzerland)
Where the GDPR, the UK GDPR, or Swiss data-protection law applies, we rely on the following legal bases for Account Data: performance of a contract (to provide the Services and process payments); legitimate interests (to secure and improve the Services, prevent fraud and abuse, and communicate with business customers about the Services, where those interests are not overridden by your rights); compliance with legal obligations (tax, accounting, and responding to lawful requests); and consent (where required, such as for certain marketing communications or non-essential cookies). You may withdraw consent at any time without affecting processing that occurred before withdrawal.
5. How We Disclose Information
5.1. Service providers (sub-processors). We disclose information to service providers that process it on our behalf under contracts that restrict their use to providing services to us. By category, they are:
| Category | Provider | Purpose |
|---|---|---|
| Cloud infrastructure and AI model services | Microsoft Azure (Microsoft Corporation) | Hosting, storage, compute, security, and the AI model services on which Eve-Fusion™, MindHYVE's compound reasoning system, operates |
| Payment processing | Stripe, Inc. | Payments, subscriptions, fraud prevention |
| Email delivery | Microsoft Azure Communication Services | Delivery of account, transactional, and customer-directed email |
| Affiliates | MindHYVE.ai, Inc. and its subsidiaries | Billing, support, engineering, and administration |
A current list of sub-processors is available on request at the contact address below.
5.2. Connected Channels at your direction. When you connect a Connected Channel and publish, send, or reply through the Services, the relevant content and associated information are transmitted to that Platform Provider (for example, Instagram, Facebook, Threads, LinkedIn, X, TikTok, Pinterest, Reddit, or Google Business Profile) or to the email recipients you select. Those disclosures occur at your direction, and each Platform Provider's use of that information is governed by its own terms and privacy policy.
5.3. Within your organization. Information in a workspace is visible to the Authorized Users of that workspace, including, for agency workspaces, invited client users, according to the permissions the account administrator sets.
5.4. Legal and safety. We may disclose information if we believe in good faith that it is necessary to comply with law, legal process, or a governmental request; to enforce our agreements; or to protect the rights, property, or safety of Company, our customers, or others.
5.5. Corporate transactions. We may disclose information in connection with a merger, acquisition, financing, reorganization, or sale of assets, subject to confidentiality obligations, and will require any successor to honor this Policy for information it receives.
5.6. With consent. We may disclose information for other purposes with your consent.
6. No Sale or Sharing of Personal Information
We do not sell personal information, and we do not share personal information for cross-context behavioral advertising, as those terms are defined under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (the "CCPA"), and we have not done so in the preceding twelve (12) months. We do not knowingly sell or share the personal information of consumers under sixteen (16). Because we do not sell or share personal information, we do not offer a "Do Not Sell or Share My Personal Information" link; we nonetheless honor Global Privacy Control signals as a valid opt-out request for the browser or device that sends them.
7. California Privacy Notice
This Section supplements this Policy for California residents and serves as our notice at collection.
7.1. Categories collected. In the preceding twelve (12) months, we have collected the following categories of personal information as a business (Account Data):
| CCPA category | Examples | Source | Business purpose | Disclosed to |
|---|---|---|---|---|
| Identifiers | Name, email address, IP address, account ID | You; automatically | Providing and securing the Services; billing; communications | Service providers; affiliates |
| Customer records (Cal. Civ. Code § 1798.80(e)) | Name, billing address, limited payment information | You; Stripe | Billing | Service providers (Stripe) |
| Commercial information | Plan, purchases, Credit usage, transaction history | You; automatically | Billing; account administration | Service providers; affiliates |
| Internet or network activity | Log data, feature usage, errors | Automatically | Security; operation; improvement | Service providers |
| Professional or employment-related information | Organization, role | You | Account administration | Service providers; affiliates |
| Sensitive personal information | Account login credentials (email and password) | You | Authentication and security only | Service providers (hosting) |
We do not collect precise geolocation, biometric information, or other categories of sensitive personal information as a business. We use sensitive personal information only for purposes permitted by Cal. Code Regs. tit. 11, § 7027(m), and therefore do not offer a right to limit its use.
7.2. Retention. See Section 9.
7.3. Your rights. California residents have the right to: (a) know the categories and specific pieces of personal information we have collected, its sources, the purposes for collection, and the categories of recipients; (b) delete personal information we collected from them, subject to exceptions; (c) correct inaccurate personal information; (d) opt out of sale or sharing (which we do not do); (e) limit the use of sensitive personal information (which we use only for permitted purposes); and (f) not be discriminated or retaliated against for exercising these rights.
7.4. How to exercise rights. Submit a request to privacy@mindhyve.ai. Because we operate exclusively online and have a direct relationship with the individuals whose information we collect, email is our designated method for submitting requests. We will verify your request by matching information you provide with information in our records, which may include confirming control of your account email address. You may use an authorized agent, who must provide proof of your written permission; we may still ask you to verify your identity directly. We will respond within the time required by law.
7.5. Customer Content. Where we process personal information as a service provider for a SageOps customer, please direct requests to that customer (Section 1.2).
8. Other Privacy Rights
8.1. Other U.S. states. Depending on your state of residence, you may have rights similar to those described in Section 7, including rights to access, correct, delete, and obtain a copy of personal information, and to opt out of targeted advertising, sale, and certain profiling. We do not engage in targeted advertising, sale, or profiling that produces legal or similarly significant effects. If we deny your request, you may appeal by replying to our decision or writing to the address below; if your appeal is denied, you may contact your state attorney general.
8.2. EEA, UK, and Switzerland. Subject to applicable law, you have the right to access, rectify, erase, restrict, or object to processing of your personal data, to data portability, and to withdraw consent. You also have the right to lodge a complaint with a supervisory authority in your country of residence, place of work, or the place of an alleged infringement. Where Article 27 of the GDPR or of the UK GDPR requires us to appoint a representative, we will identify the representative in this Policy; until then, direct inquiries to dpo@mindhyve.ai.
8.3. Account export. Account holders can obtain a copy of their account data in JSON format through the account export function of the Services, or by contacting us.
9. Data Retention
9.1. We retain Account Data for as long as the account is active and thereafter for as long as necessary for the purposes described in this Policy, including to comply with tax, accounting, and legal obligations, resolve disputes, and enforce our agreements. When we no longer need it, we delete or de-identify it.
9.2. Retention periods:
| Data | Retention |
|---|---|
| Account profile | Life of the account plus thirty (30) days, then removed from backups within a further fourteen (14) days |
| Billing and transaction records | Seven (7) years after the transaction, or as required by tax law |
| Security and access logs | Thirty (30) days in our logging systems; longer only where needed to investigate a specific security incident |
| Customer Content | Life of the account; export available for thirty (30) days after termination; deleted or de-identified within thirty (30) days thereafter, and from backups within a further fourteen (14) days |
| Campaign measurement records (tracked-link clicks, website snippet events, platform metrics) | As Customer Content (above) |
| Shared report links | Until they expire (at most ninety (90) days) or the customer switches them off; the report's figures are deleted with the customer's other Customer Content |
| Unsubscribe and suppression records | As long as needed to honor the opt-out |
| Trial workspaces not converted to a paid plan | Retained while the account remains open, so the customer can subscribe later; deleted on account deletion as above |
9.3. Content already published to a Connected Channel remains with that Platform Provider under its own retention practices, and must be removed there.
10. Cookies and Similar Technologies
10.1. Strictly necessary cookie. The SageOps application sets a first-party, HTTP-only session cookie named sage_session, which authenticates your signed-in session and protects the Services. It is strictly necessary for the Services to function and cannot be disabled while you are signed in.
10.2. Browser local storage. The application stores interface preferences and temporary working state in your browser's local storage so the interface works as you expect. This information stays on your device and is not used for advertising.
10.3. No advertising or third-party analytics. The SageOps website and application do not use third-party advertising cookies, advertising pixels, or third-party analytics trackers. Tracked links and the website snippet described in Section 2.7 set no cookies and use no cross-site identifiers. Pages operated by Stripe during checkout or in the billing portal are governed by Stripe's own cookie practices.
10.4. Controls. You can block or delete cookies through your browser settings, but blocking sage_session will prevent you from signing in.
11. International Transfers
11.1. We are based in the United States, and the Services are hosted on Microsoft Azure in Canada (Canada Central) and the United States (East US and East US 2); AI processing runs on Microsoft Azure infrastructure, which may process data in other regions. MindHYVE.ai, Inc. and its affiliates have personnel and operations in other countries, including Pakistan and Kenya, and authorized personnel there may access personal information to operate and support the Services, subject to the safeguards in Section 11.2.
11.2. Where we transfer personal data from the EEA, the UK, or Switzerland to countries that have not been found to provide adequate protection, we use appropriate safeguards, such as the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, and supplementary measures where appropriate. You may request a copy of the relevant safeguards by contacting us.
12. Security
We maintain administrative, technical, and physical safeguards designed to protect personal information, including encryption in transit, access controls, and logging. No system is completely secure, and we cannot guarantee the security of information. You are responsible for keeping your account credentials and Connected Channel credentials secure. If we become aware of a security incident affecting your personal information, we will notify you as required by law.
13. Children
The Services are intended for business use and are not directed to individuals under eighteen (18). We do not knowingly collect personal information from anyone under eighteen (18) as a business. If you believe a person under eighteen (18) has provided personal information to us, contact us and we will delete it. Customers must not use the Services to direct marketing to children in violation of applicable law, including the Children's Online Privacy Protection Act.
14. Automated Processing
Sage generates content, research summaries, and recommendations using automated systems, at the direction of the customer. We do not use Account Data to make decisions about individuals that produce legal or similarly significant effects.
15. Changes to This Policy
We may update this Policy. If we make material changes, we will notify account holders by email or in-app notice before the changes take effect and update the "Last updated" date above.
16. Contact
Privacy inquiries and rights requests:Email: privacy@mindhyve.ai Eve-Marketing, LLC
(a wholly-owned subsidiary of MindHYVE.ai, Inc.)
c/o MindHYVE.ai, Inc.
1501 Quail St, Suite 130
Newport Beach, CA 92660
United States of America
Data protection contact: dpo@mindhyve.ai