1. Introduction

MegaCorp, Inc. ("MegaCorp," "we," "us," or "our") operates Curated Data, available at https://curateddata.megacorp.company (the "Service"). This Privacy Policy explains what information we collect when you use the Service, how we use and share that information, and the rights and choices available to you.

This policy applies to information we collect through the Service, including the website at curateddata.megacorp.company, our application programming interfaces, and any related communications. By using the Service, you acknowledge that your information will be handled as described in this policy. If you do not agree with this policy, please do not use the Service.

2. Information We Collect

Account information

When you create an account, we collect the information you provide during registration, such as your name, email address, and password. If you join or create an organization or team within the Service, we also record your role and membership in that organization.

Information you provide / your content

We collect and store the content you submit to the Service in the course of using it — for example, profile details, documents, messages, settings, preferences, and any other material you upload, enter, or create ("Your Content"). We also collect information you provide when you contact us, respond to surveys, or otherwise communicate with us.

Usage and device information

When you use the Service, we automatically collect certain technical information, including your IP address, browser type and version, operating system, device identifiers, the pages and features you access, the dates and times of your visits, and referring URLs. We use this information to operate, secure, and improve the Service, and to understand how it is used in the aggregate.

Cookies and similar technologies

We use cookies to operate the Service:

• Session cookies. We set a session cookie to keep you signed in. These cookies are httpOnly, sent only over encrypted connections (Secure), and restricted to same-site requests (SameSite=Lax). They are essential to providing the Service and cannot be disabled while using it.
• Analytics. We use analytics tools to understand how the Service is used — for example, which pages are visited and how features perform. Analytics data is used in aggregate to improve the Service.

You can control cookies through your browser settings, though disabling essential cookies will prevent you from signing in.

Payment information

If you purchase a paid plan, payments are processed by a third-party payment processor. Your full card number and payment credentials are collected and stored by the payment processor, not by us. We receive and retain limited billing information, such as your plan, transaction history, billing contact details, and the last four digits and expiration date of your payment card, so that we can manage your subscription and provide support.

Information from third parties

If you sign in or connect the Service through a third-party account (for example, an OAuth or single sign-on provider), we receive the information that provider makes available to us, such as your name, email address, and account identifier, in accordance with the authorization you grant. We may also receive information about you from service providers that help us operate the Service, such as fraud-prevention or email-delivery status information.

3. How We Use Your Information

We use the information we collect for the following purposes:

We do not use your information for automated decision-making that produces legal or similarly significant effects about you without human involvement.

4. How We Share Information

We share personal information only in the following circumstances:

• Service providers and subprocessors. We use third-party providers to operate the Service — including cloud hosting and infrastructure, data storage, payment processing, email delivery, and analytics. These providers process personal information on our behalf under data processing agreements that limit their use of the information to providing services to us.
• Legal and safety. We may disclose information if we believe in good faith that disclosure is required by law, regulation, legal process, or governmental request, or is necessary to protect the rights, property, or safety of MegaCorp, our users, or the public.
• Business transfers. If we are involved in a merger, acquisition, financing, reorganization, or sale of all or part of our assets, personal information may be transferred as part of that transaction. We will notify you of any change in ownership or in the use of your personal information.
• With your consent. We share information for other purposes when you direct us to or otherwise consent.

We do not sell your personal information, and we do not share it with third parties for their own marketing purposes.

5. Data Retention

We retain personal information for as long as your account is active or as needed to provide the Service. When you delete your account, we delete or de-identify your personal information within a reasonable period, except where we must retain it to comply with legal, tax, accounting, or reporting obligations, to resolve disputes, to enforce our agreements, or where the information exists in routine backups, which are overwritten on a rolling schedule. Aggregated or de-identified information that cannot reasonably be used to identify you may be retained indefinitely.

6. Security

We use administrative, technical, and physical safeguards designed to protect personal information, including encryption of data in transit, access controls, credential hashing, and isolation between customer environments. Our infrastructure providers maintain industry-standard physical and network security. No method of transmission or storage is completely secure, however, and we cannot guarantee absolute security. If we learn of a breach of security affecting your personal information, we will notify you as required by applicable law.

7. Your Rights and Choices

Depending on where you live, you may have some or all of the following rights with respect to your personal information:

• Access — request a copy of the personal information we hold about you.
• Correction — request that we correct inaccurate or incomplete information.
• Deletion — request that we delete your personal information.
• Portability — request your information in a structured, commonly used, machine-readable format.
• Objection and restriction — object to, or request that we restrict, certain processing of your information.
• Withdraw consent — where processing is based on consent, withdraw that consent at any time without affecting the lawfulness of processing before withdrawal.

You can exercise many of these rights directly through your account settings. For anything else, contact us at privacy@megacorp.company. We will respond within the timeframe required by applicable law, and we may need to verify your identity before acting on a request. We will not discriminate against you for exercising your rights.

8. California Privacy Rights

If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act (CCPA/CPRA), gives you additional rights, including the right to know what personal information we collect, use, and disclose; the right to request deletion or correction of your personal information; and the right to opt out of the sale or sharing of personal information.

We do not sell personal information, and we do not share personal information for cross-context behavioral advertising, as those terms are defined under California law. We also do not use or disclose sensitive personal information for purposes other than those permitted by the CCPA. The categories of personal information we collect and the purposes for which we use them are described in Sections 2 and 3 above.

To exercise your California rights, contact us at privacy@megacorp.company. You may designate an authorized agent to submit a request on your behalf; we may require proof of the agent's authorization and verification of your identity.

9. GDPR (EEA and UK)

If you are located in the European Economic Area or the United Kingdom, MegaCorp, Inc. is the controller of the personal information described in this policy, except where we process information on behalf of a business customer, in which case that customer is the controller and we act as processor under our agreement with them.

We process personal information only where we have a legal basis to do so: performance of a contract with you, our legitimate interests (such as securing and improving the Service), compliance with legal obligations, or your consent. The legal basis for each category of processing is set out in the table in Section 3.

Where we transfer personal information from the EEA or UK to the United States or other countries that have not received an adequacy decision, we rely on appropriate safeguards, including the European Commission's Standard Contractual Clauses and the UK Addendum or International Data Transfer Agreement, together with supplementary measures where appropriate.

You have the rights described in Section 7, and you also have the right to lodge a complaint with your local data protection supervisory authority. We would appreciate the chance to address your concerns first — you can reach us at privacy@megacorp.company.

10. International Data Transfers

We are based in the United States, and the Service is hosted on cloud infrastructure that may store and process information in the United States and other countries. Wherever we transfer personal information, we take steps designed to ensure it receives a consistent level of protection, including the contractual safeguards described in Section 9 and data processing agreements with our providers.

11. Children's Privacy

The Service is not directed to children. You must be at least 16 years old to use the Service. We do not knowingly collect personal information from anyone under that age. If you believe a child under 16 has provided us with personal information, please contact us at privacy@megacorp.company and we will delete it.

12. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email or through the Service before the changes take effect. The "Last updated" date at the top of this policy indicates when it was most recently revised. Your continued use of the Service after an update means the revised policy applies to you.

13. Contact Us

If you have questions about this Privacy Policy or our data practices:

• Privacy inquiries and rights requests: privacy@megacorp.company
• General support: support@megacorp.company
• Legal notices: legal@megacorp.company

You can also write to MegaCorp, Inc. at the address published at https://curateddata.megacorp.company.

Your Organization's Knowledge Stays Yours

Curated Data exists to host the knowledge your organization curates — concept docs, definitions, policies, and the other approved content your workspace publishes for retrieval by AI agents and other systems ("Customer Content"). Customer Content belongs to your organization. We process it only to provide the Service: to store it, version it, index it for retrieval, and serve it to the applications, agents, and endpoints your organization connects.

We do not sell Customer Content. We do not use your organization's private Customer Content to train shared or foundation machine-learning models, and we do not make it available to other customers. Where the Service uses AI providers to power retrieval or processing features (for example, generating embeddings for search), Customer Content is sent to those providers only to perform the requested operation for your workspace, under agreements that prohibit them from using it to train their models.

Tenant Isolation

Each workspace on Curated Data is an isolated tenant. Customer Content, memberships, tokens, and configuration are scoped to the workspace they belong to, and every read and write is checked against the requesting credential's workspace. One organization's approved knowledge cannot be read using another organization's credentials. Aggregated, de-identified operational metrics (for example, request volumes) may be used across tenants to operate and improve the Service, but they never expose one customer's content to another.

API Tokens and Scoped Access

Programmatic access to a workspace — over the REST API or the MCP server — uses scoped bearer tokens issued by workspace administrators. Each token serves only its workspace's current approved document revisions, subject to the scopes granted at issuance. We log token usage (token identifier, endpoint, and timestamp) for security, billing, and abuse prevention.

Your organization is responsible for safeguarding its tokens, granting them only to systems it trusts, and rotating or revoking them when personnel or integrations change. If you believe a token has been compromised, revoke it in your workspace settings and contact support@megacorp.company.

Subprocessors

We use a limited set of third-party subprocessors to operate Curated Data, each bound by a data processing agreement:

A current list of subprocessors is available on request at privacy@megacorp.company. We will provide notice of subprocessor changes where our agreement with your organization requires it.