Privacy Policy

1. Introduction and Scope

This Privacy Policy explains how Operon Core AI LLC, a Florida limited liability company ("Operon", "we", "us", "our"), collects, uses, shares, protects, keeps and deletes information in connection with:

• our website at operoncoreai.com;
• Mission Control (the "Platform"), our governed AI operations platform, including pilot and evaluation programs; and
• the support, onboarding and communications we provide with them (together with the Platform and our websites, the "Services").

Mission Control is a business-to-business service. It is offered to businesses and organizations (each a "Customer") and to the individuals a Customer permits to use its account ("Authorized Users"). It is not intended for personal, family or household use.

The Platform works this way: AI reads business events, classifies them and drafts proposed actions; a person approves the action (or an explicit rule the Customer has configured permits it) before anything is carried out; and every step is recorded in an audit log. Automatic execution is off by default and must be turned on by the Customer.

In this Policy:

• "Customer Data" means all data submitted to, or retrieved into, the Platform by or for a Customer, including Connected Account Data, drafts, approvals, workflow configuration and AI Output generated for that Customer.
• "Connected Account" means a third-party account (for example, Google Workspace or Gmail, Microsoft 365 or Outlook, or HubSpot) that an Authorized User links to the Platform by OAuth or by supplying an API key.
• "Connected Account Data" means data the Platform retrieves from, or sends to, a Connected Account.
• "Third-Party Provider" means the company that operates a Connected Account or a sign-in service.
• "AI Output" means content, classifications, summaries or proposed actions generated by AI models in the Platform.
• "Sub-processor" means a vendor we engage to process Customer Data on our behalf. Third-Party Providers of Connected Accounts are not Sub-processors; the Customer chooses them.

This Policy is published at https://operoncoreai.com/privacy.

2. Our Role

Privacy laws treat an organization differently depending on whether it decides why and how personal information is used (a "controller" or "business") or handles it on someone else's instructions (a "processor" or "service provider").

Where we are the controller. We decide how to use information about visitors to our website, people who request a demo or sign up, account and billing contacts, Authorized Users' account and sign-in details, and people who communicate with us. This Policy fully describes those uses.

Where we are a processor or service provider. When a Customer uses the Platform, we process Customer Data, including Connected Account Data, on behalf of and on the instructions of that Customer. For example, if a Customer connects its mailbox, the people who send it email are the Customer's correspondents, and the Customer decides how their information is used. Our Data Processing Addendum with the Customer (Document MC-05) governs that processing. If you are an individual whose information a Customer processes through Mission Control and you want to exercise privacy rights, please contact that Customer directly. If you contact us instead, we will refer you to the Customer and help the Customer respond.

Even where we act for a Customer, the commitments in Section 6 (AI processing) and Section 7 (Connected Accounts) apply to how we handle Connected Account Data, including the specific rules for Google user data and Microsoft data.

3. Information We Collect

3.1 Account and contact information

When a Customer sets up an account or adds Authorized Users, we collect name, business email address, company name, role or job title, and similar details. For sign-in with email and password, we store your password only in hashed form using a modern one-way algorithm; we cannot read it.

3.2 Sign-in through a Third-Party Provider

If we offer, and you choose to use, sign-in through a Third-Party Provider (for example, "Sign in with Google" or "Sign in with Microsoft"), we receive your name, email address, and an account identifier from that provider, and, if the provider sends them, your profile photo and an organization or tenant identifier. We request only basic sign-in permissions (openid, email and profile). We never receive your password for that provider. See Section 7.5.

3.3 Connected Account Data

If an Authorized User connects a Connected Account, the Platform retrieves data from, and sends data to, that account, limited to the permissions shown on the provider's consent screen and to the features the Customer uses. We also store the OAuth token or API key needed to keep the connection working. Section 7 describes, provider by provider, what we access and why.

3.4 Customer Data and AI Output

We store the content Customers and Authorized Users create or submit in the Platform, including workflow configuration, rules, drafts, approval and rejection decisions, execution results, and AI Output generated for the Customer, together with audit records of approvals, executions, connector events and administrative actions (with time and actor).

3.5 Payment information

Payments and subscriptions are handled by Stripe. Stripe collects and processes payment card details directly; we do not store full card numbers. We receive and keep billing contact details and information about subscriptions, invoices and payment status.

3.6 Usage, device and log information

When you use the website or the Platform, our systems record technical information such as IP address, browser and device type, pages or screens accessed, timestamps, and error and diagnostic data. We use this to operate, secure and troubleshoot the Services.

3.7 Cookies and similar technologies

We use cookies as described in Section 14.

3.8 Communications with us

When you email us, request support, or report a security issue, we keep the message, your contact details and our response.

3.9 Sign-up and demo requests

When you request a demo, join a waitlist, or apply for a pilot, we collect the details you provide, such as name, business email, company, role and a description of your needs.

We do not ask for, and Customers must not submit, protected health information or payment cardholder data unless we have agreed to it separately in writing.

4. How We Use Information

We use information to:

• provide, operate and maintain the Services, including the features a Customer chooses to use;
• create and administer accounts, authenticate Authorized Users, and keep sessions secure;
• connect to Connected Accounts at the Customer's direction and carry out actions a person has approved or a Customer-configured rule permits;
• generate classifications, summaries and draft actions using AI models, as described in Section 6;
• keep audit records so Customers can see what was proposed, approved and done, by whom and when;
• process payments and manage subscriptions;
• respond to demo requests, support requests and other communications;
• send service messages, such as approval requests, security notices and changes to our terms or this Policy;
• detect, investigate and prevent security incidents, abuse and fraud;
• operate and improve the Services using aggregated, de-identified usage and performance metrics (for example, page load times or feature usage counts), which never include the content of Customer Data or Connected Account Data;
• comply with law, enforce our agreements, and protect the rights, property and safety of our users, Customers, Operon and others.

We do not use Customer Data or Connected Account Data for advertising, and we do not sell it.

5. Legal Bases (EEA and UK)

If the EU or UK General Data Protection Regulation applies to our processing as a controller, we rely on these legal bases:

• Contract: to provide the Services, create accounts, process payments and respond to requests you make.
• Legitimate interests: to secure the Services, prevent abuse, understand aggregated usage of our website and Services, and communicate with business contacts about our Services. We balance these interests against your rights and you can object (Section 13).
• Consent: for non-essential cookies where consent is required, and for any other processing where we ask for consent. You can withdraw consent at any time.
• Legal obligation: to keep tax and accounting records and respond to lawful requests.

Where we process Customer Data as a processor, the Customer is responsible for determining the legal basis.

6. AI Processing

How AI is used. Mission Control uses AI models provided by Anthropic, PBC and OpenAI through their commercial APIs. When a feature you use needs to classify a message, summarize information or draft a proposed action, we send the content needed for that task to one of these providers and receive the result. We send content to AI providers only for features the Customer uses, and only to generate the output for that feature.

No training by AI providers. Under the commercial API terms that apply to our use, Anthropic and OpenAI do not use the content we send them, or the results they return, to train their models. These providers may keep API data for a limited period to monitor for abuse, after which it is deleted under their terms.

No training by us. We do not use Customer Data or Connected Account Data to train, fine-tune, or improve any AI or machine-learning model, whether ours or a third party's. If we ever offer per-account personalization, we will describe it in advance, it will be off unless the Customer opts in, and it will never use Google user data or any other provider's data where that provider prohibits it.

Sensitive-data restrictions. A Customer account flagged as handling sensitive data can be restricted to approved AI providers.

Human approval. By default, AI Output is a proposal. A person reviews and approves an action before the Platform carries it out, unless the Customer has affirmatively enabled a rule that permits automatic execution. AI Output can be inaccurate or incomplete and is not professional advice; Customers should review it before relying on it or sending it.

7. Connected Accounts

7.1 How connections work

• You choose what to connect. An Authorized User connects an account by signing in to the Third-Party Provider and approving access, or by entering an API key or webhook address the Customer controls. Customers must connect only accounts they control or are authorized to connect.
• The consent screen shows the exact permissions. For OAuth connections, the provider's consent screen lists the exact permissions Mission Control requests before you approve.
• Least privilege. We request only the permissions needed for the features each connector supports, and we access Connected Account Data only when needed for a feature the Customer uses.
• Credentials are encrypted. OAuth tokens and API keys are encrypted with AES-256-GCM using a fresh data key for each write, and that data key is protected by a platform master key held in a restricted secret store. Each credential is bound to the Customer and the specific connection. Credentials are never written to logs, error messages or events.
• Disconnecting. When you disconnect, we delete the stored credentials; you can also revoke Mission Control's access directly with the provider at any time. For complete removal, we recommend doing both. See Section 10 for step-by-step instructions.
• Not every connector is available to every Customer. The tables below describe the connectors we offer or may offer. The consent screen for each connection is the authoritative list of permissions requested.

We do not use Connected Account Data to train, fine-tune, or improve any AI or machine-learning model, whether ours or a third party's. We comply with the developer terms of each Third-Party Provider; where a provider's terms are stricter than this Policy for data from that provider, the stricter terms apply.

7.2 Google user data

This section applies when an Authorized User connects a Google account (Gmail, Google Calendar or Google Drive) to Mission Control. "Google user data" means information we receive through Google APIs.

What we access and how we use it.

Mission Control does not modify, move, or delete messages in your Gmail account. It does not send email from your Gmail account unless a person has approved that email or an administrator of your organization has expressly turned on a rule permitting it. Automatic sending is off by default.

How we store and protect it. Google user data we retrieve is stored on our hosting infrastructure in the United States (DigitalOcean), tagged to your organization's account, and protected by database row-level security that limits each request to that organization's records. Stored data is encrypted at rest by our hosting provider, and data moving between Google, our systems and your browser is protected with TLS. When a multi-step job uses Google user data, we encrypt the job's data before it is sent to our workflow orchestration provider (Temporal Cloud). Your Google OAuth tokens are encrypted as described in Section 7.1 and never appear in logs, error messages or events.

How we share it. We share Google user data only with the Sub-processors needed to provide the feature you use: our hosting provider, our workflow orchestration provider, and our AI model providers (Anthropic and OpenAI). We send Google user data to AI providers only to generate the output for that feature, under terms that do not permit them to train models on it. We do not otherwise transfer Google user data, except as necessary for security purposes, to comply with applicable law, or as part of a merger, acquisition or sale of assets, in which case we will notify you and the recipient must continue to protect the data as this Policy describes.

What we never do with Google user data. We do not:

• sell Google user data;
• use or transfer Google user data to serve advertising, including retargeting, personalized or interest-based advertising;
• use or transfer Google user data to determine creditworthiness or for lending purposes;
• transfer Google user data to data brokers, advertising platforms or information resellers;
• use Google user data to develop, improve or train generalized or non-personalized AI or machine-learning models; or
• store Google user data with, or make it available to, any such model.

We use Google user data only to provide the user-facing features of Mission Control that you use.

Human access. Operon personnel do not read Google user data unless:

• you give us your affirmative agreement to view specific messages, files or other items (for example, to help with a support request);
• it is necessary for security purposes, such as investigating a bug or abuse;
• it is necessary to comply with applicable law; or
• the data has been aggregated and anonymized and is used for internal operations, in line with applicable law.

Retention and deletion. Google OAuth tokens are deleted immediately when you disconnect Google in Mission Control or when the account is closed. Google user data retrieved into the Platform is kept while the related work item is open and for up to 90days after it closes, unless the Customer deletes it sooner; then it is deleted or reduced to the audit record of what was approved and done, by whom and when. When data is deleted at Google and we learn of the deletion or next sync, we delete or update our copy within a reasonable time (our target is 30 days). You can ask us to delete Google user data at any time by following Section 10.

Revoking access. You can disconnect Google in Mission Control at any time, and you can revoke Mission Control's access directly at https://myaccount.google.com/permissions.

New uses. If we want to use Google user data in a way not described in this Policy, or request additional Google permissions, we will update this Policy, notify you, and obtain your consent before the new use.

Limited Use. Mission Control's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements. Information received from Google Workspace APIs is used in accordance with the Google Workspace API User Data and Developer Policy.

7.3 Microsoft data

This section applies when an Authorized User connects a Microsoft 365 account (Outlook or OneDrive) to Mission Control through the Microsoft identity platform.

What we access and how we use it.

Consent. We ask for your consent through Microsoft's consent screen before accessing any Microsoft data. If we change how we process Microsoft data or need additional permissions, we will update this Policy and obtain your consent again before the change takes effect.

Keeping copies in sync. When data is deleted or changed in your Microsoft account, we delete or update our stored copy within a reasonable time (our target is 30 days) when we next sync or learn of the deletion or change. We keep only the copies a feature needs.

Deletion. When you disconnect Microsoft in Mission Control, we delete the stored credentials immediately and stop retrieving data. Microsoft data already retrieved is deleted on the schedule in Section 9, or sooner if you ask. When a Customer's account is closed, we delete Microsoft data with the rest of the Customer Data as described in Section 9 and follow the Customer's deletion instructions.

No advertising, no resale. We do not use data obtained through Microsoft APIs for advertising or marketing, including in aggregated, de-identified or derived form. We do not sell, resell or otherwise transfer it except to provide the Services as described in this Policy.

Revoking consent. You can disconnect Microsoft in Mission Control at any time. You can also revoke Mission Control's access at any time at https://myapps.microsoft.com (work or school accounts) or https://account.live.com/consent/Manage (personal Microsoft accounts).

The AI processing, human access, storage, protection and sharing commitments in Sections 6 and 7.2 apply equally to Microsoft data.

7.4 Other Connected Accounts

For connections that use an API key or webhook, the Customer supplies the credentials, and the same encryption and deletion rules apply as for OAuth tokens.

Provider rules. We do not use data from any Third-Party Provider to train, fine-tune or improve any AI or machine-learning model. We follow each provider's developer terms, and where a provider's terms are stricter than this Policy for its data, the stricter terms apply. For example:

• HubSpot: when the Mission Control app is uninstalled or the Customer's agreement ends, we promptly delete the stored tokens and HubSpot data.
• Shopify: when a merchant uninstalls Mission Control, we delete the stored credentials immediately and the merchant's Shopify data within 30 days. We honor Shopify customer data request and customer redaction requests we receive.
• Messaging and payroll data: Customers that send texts or process employee data are responsible for giving any required notices and obtaining any required consents from the people involved.

If we add connections to other providers, we will update this Policy before offering them.

7.5 Sign-in providers

If we offer, and you choose to use, sign-in through a Third-Party Provider such as Google or Microsoft, we receive the information described in Section 3.2. We use it only to authenticate you and administer your account, and not for any other purpose. You can ask us to unlink provider sign-in from your account by contacting privacy@operoncoreai.com, and you can revoke Mission Control at the provider at any time (Google: https://myaccount.google.com/permissions; Microsoft: https://myapps.microsoft.com for work or school accounts, or https://account.live.com/consent/Manage for personal accounts).

8. How We Share Information

8.1 Sub-processors

We use Sub-processors to host and operate the Services. They may process personal information only on our instructions and under written terms that protect it. Our current Sub-processors are DigitalOcean, LLC (cloud hosting, database, file storage, backups and logs); Temporal Technologies, Inc. (Temporal Cloud) (workflow orchestration, receiving payloads encrypted by us); Anthropic, PBC and OpenAI, L.L.C. / OpenAI OpCo, LLC (AI model inference); Stripe, Inc. (payments and subscription billing); a transactional email provider (account and approval emails from Operon); and an uptime monitoring provider (availability checks, with no Customer Data). The full list, including the name and location of each, and the vendors that support our marketing website, is published in our Sub-processor List (Document MC-13) at https://operoncoreai.com/subprocessors. We give Customers at least 10 business days' notice before adding or replacing a Sub-processor that processes personal information.

8.2 The Customer and its Authorized Users

Information in a Customer's account is available to that Customer and the Authorized Users it permits to use its account.

8.3 Connected Accounts, at the Customer's direction

When a person approves an action, or a Customer-configured rule permits it, we send data to the relevant Connected Account (for example, sending an approved email or updating a CRM record). Third-Party Providers handle that data under their own terms and privacy policies.

8.4 Legal requirements and safety

We may disclose information if we believe in good faith it is required by law, subpoena or other legal process, or necessary to protect the rights, property or safety of our users, Customers, Operon or others, or to investigate security incidents or abuse. Where a request concerns Customer Data, we will notify the Customer unless the law prohibits it.

8.5 Business transfers

If Operon is involved in a merger, acquisition, financing or sale of assets, information may be transferred as part of that transaction. We will notify affected Customers before their information becomes subject to a different privacy policy, and any recipient must continue to protect Google user data, Microsoft data and other Connected Account Data under the commitments in Section 7.

8.6 With consent

We may share information for other purposes with your consent or at your direction.

8.7 No sale, no cross-context behavioral advertising

We do not sell personal information, and we do not share personal information for cross-context behavioral advertising. We have not done so in the past 12 months.

9. Retention

We keep information only as long as needed for the purposes in this Policy, then delete it or keep it only in de-identified form.

Where a Third-Party Provider requires faster deletion of its data, we follow that requirement (Section 7.4). We may keep information longer where the law requires it or to establish, exercise or defend legal claims.

10. Deleting Your Data and Disconnecting Accounts

These instructions explain how to disconnect a Connected Account, revoke Mission Control's access, and ask us to delete your data. You can use any or all of these steps at any time.

10.1 Step 1: Disconnect the account in Mission Control

• Sign in to Mission Control.
• Go to Settings → Connections.
• Select the connection (for example, Google, Microsoft or HubSpot) and choose Disconnect.

When you disconnect, we immediately delete the stored OAuth token or API key and mark the connection disconnected, and Mission Control stops retrieving data from that account. Data already retrieved stays in your organization's workspace only for the retention periods described below, unless you ask us to delete it sooner (Step 3).

10.2 Step 2: Revoke access at the provider

Disconnecting in Mission Control deletes our copy of the credentials. To make sure the provider has also withdrawn Mission Control's access, revoke it there too:

• Google: go to https://myaccount.google.com/permissions, select Mission Control, and remove access.
• Microsoft work or school accounts: go to https://myapps.microsoft.com and revoke Mission Control's permissions.
• Microsoft personal accounts: go to https://account.live.com/consent/Manage and remove Mission Control.
• HubSpot, Shopify and other providers: uninstall or remove Mission Control from the connected apps or installed apps settings of that provider's account. For API-key connections, delete or rotate the key in the provider's settings.

10.3 Step 3: Ask us to delete your data

Email privacy@operoncoreai.com with the subject line "Data deletion request". Please include:

• your name and the email address used with Mission Control;
• your organization's name; and
• what you want deleted: all of your data, the data from a specific Connected Account (for example, "all Google data"), or your entire account.

We may need to confirm your identity or your authority to act for the organization before we delete anything. We will respond within 30 days of receiving your request, confirming what we deleted and anything we kept, and why.

If a business uses Mission Control to process your information (for example, you emailed a company that uses Mission Control), please send your request to that business. If you send it to us, we will pass it to the business and help it respond.

10.4 Step 4: Close your organization's account

A Customer can close its account by contacting us or as provided in its agreement. After closure or termination, Customer Data is available for export for 30 days and is deleted within 90 days after termination. Backup copies roll off within 35 days after that. Connector credentials are deleted immediately on closure.

10.5 What we keep and why

After deletion, we keep only:

• approval, execution and audit records, for up to 24 months after account closure, for security, dispute and legal purposes, then deleted or archived in de-identified form;
• billing records, for up to 7 years, for tax and accounting;
• backup copies, until they roll off as described above; and
• information we must keep to comply with law or to establish, exercise or defend legal claims, including a record of your deletion request.

Google user data and other Connected Account Data retrieved into the Platform are kept while the related work item is open and for up to 90 days after it closes, unless you ask us to delete them sooner. Where a Third-Party Provider requires faster deletion (for example, Shopify data within 30 days of uninstall), we follow that requirement.

11. Security

We use administrative, technical and organizational measures designed to protect information, including:

• Tenant isolation: each record is tagged to its Customer, and row-level security policies in our database restrict each request to that Customer's records;
• Credential encryption: OAuth tokens and API keys are encrypted with AES-256-GCM as described in Section 7.1 and never written to logs, error messages or events;
• Encryption in transit and at rest: TLS for browser traffic and calls to providers; our database, backups and file storage are hosted on managed services that encrypt stored data at rest; workflow data sent to our orchestration provider is encrypted by us first;
• Sign-in protections: hashed passwords, account lockout after repeated failed attempts, server-side sessions that expire after inactivity and after a maximum lifetime, and single-use, expiring approval links;
• Limited, logged personnel access: access across Customer accounts is limited to authorized personnel for administration, support and security, and that access is logged;
• Audit logging: approvals, executions, connector events and administrative actions are recorded with time and actor;
• Human approval by default: automatic execution is off unless the Customer turns it on;
• Backups: automated daily database backups with point-in-time recovery, and versioning for file storage.

We do not currently hold security certifications such as SOC 2 or ISO 27001. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If we confirm a security incident affecting Customer Data, we will notify the affected Customer without undue delay and no later than 72 hours after confirmation. To report a vulnerability, email security@operoncoreai.com.

12. International Transfers

We are based in the United States and host the Platform in the United States. If you access the Services from outside the United States, your information will be transferred to, stored and processed in the United States, where privacy laws may differ from those in your country. Where we transfer personal information from the European Economic Area, the United Kingdom or Switzerland on behalf of a Customer, we rely on the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum, as provided in our Data Processing Addendum. Where we act as controller, we rely on appropriate safeguards permitted by applicable law.

13. Your Privacy Rights

13.1 United States residents

Depending on the state where you live, including California, you may have the right to:

• Know and access: request the categories and specific pieces of personal information we have collected about you, the sources, the purposes, and the categories of recipients;
• Delete: request deletion of personal information we collected from you, subject to legal exceptions;
• Correct: request correction of inaccurate personal information;
• Portability: receive a copy of your personal information in a usable format;
• Opt out of sale, sharing and targeted advertising: we do not sell personal information, share it for cross-context behavioral advertising, or use it for targeted advertising, so there is nothing to opt out of, but you may still submit a request;
• Limit use of sensitive personal information: we use sensitive personal information (such as account login credentials) only to provide the Services and for other purposes the law permits, and not to infer characteristics about you;
• Non-discrimination: we will not deny you service, charge you a different price, or provide a different quality of service because you exercised your rights.

In the past 12 months we have collected the categories of personal information described in Section 3: identifiers and contact details; commercial information (billing and subscription records); internet and electronic activity information (usage and log data); professional information (company and role); sensitive personal information limited to account login credentials; and, when a Customer uses the Platform, the categories of Connected Account Data in Section 7. We collect this information from you, from the Customer you work with, from Connected Accounts at the Customer's direction, and from Stripe. We use it for the purposes in Section 4 and disclose it to the recipients in Section 8.

Authorized agents. You may use an authorized agent to submit a request. We will ask for proof of the agent's written permission and may ask you to verify your identity directly.

Appeals. If we decline your request, you may appeal by emailing privacy@operoncoreai.com with the subject line "Privacy request appeal". We will respond within the time required by law. If your appeal is denied, you may contact your state attorney general.

13.2 EEA and UK residents

If the EU or UK GDPR applies, you have the right to access, correct or delete your personal information; to restrict or object to our processing; to data portability; and to withdraw consent at any time without affecting earlier processing. You also have the right to lodge a complaint with your local data protection supervisory authority.

13.3 How to exercise your rights

Email privacy@operoncoreai.com. We will verify your request by matching information you provide against information we hold, such as confirming control of the email address on the account. We respond within the time required by applicable law (for example, 45 days under California law or one month under the GDPR, which may be extended where the law allows).

13.4 When we act for a Customer

If your personal information is in Customer Data (for example, you are a contact or correspondent of a business that uses Mission Control), that business controls it. Please direct your request to that business. If you contact us, we will refer your request to the Customer and assist it as required by our Data Processing Addendum.

14. Cookies and Similar Technologies

14.1 What cookies are

Cookies are small text files placed on your device when you visit a website. Similar technologies include local storage and pixels. We refer to all of them as "cookies".

14.2 How we use cookies

• Strictly necessary: needed for the website and Platform to work and to stay secure, such as keeping you signed in. These cannot be switched off.
• Preferences: if we use them, preference cookies remember choices you make on the website. These are optional.
• Analytics: help us understand, in aggregate, how visitors use our marketing website, such as pages viewed and traffic sources. These are optional.

The Mission Control Platform application uses only strictly necessary cookies, such as the session cookie that keeps you signed in. It does not use advertising, analytics or tracking cookies. We do not use cookies for advertising on our website or in the Platform.

14.3 Managing cookies

You can block or delete cookies through your browser settings. Blocking strictly necessary cookies will stop the Platform from keeping you signed in. Where we provide a cookie preference tool on our website, you can use it to accept or decline optional cookies at any time.

14.4 Global Privacy Control and Do Not Track

We honor Global Privacy Control signals on our website as a request to opt out of the sale or sharing of personal information for the browser or device sending the signal. Because we do not sell or share personal information, the practical effect is that we switch off optional analytics and preference cookies for that browser. Browsers' older "Do Not Track" signal has no agreed standard, and we do not currently respond to it.

15. Children

The Services are for businesses and are not directed to anyone under 18. We do not knowingly collect personal information from children. If you believe a child has given us personal information, contact privacy@operoncoreai.com and we will delete it.

16. Changes to This Policy

We may update this Policy from time to time. We will post the updated Policy at https://operoncoreai.com/privacy with a new "Last Updated" date. For material changes that reduce your protections, we will give Customers at least 30 days' advance notice by email or in the Platform. We will not use Google user data, Microsoft data or other Connected Account Data in a new way, or for a purpose not described in this Policy, without first notifying you and obtaining your consent.

17. Contact Us

For privacy questions, data requests or concerns about AI processing:

• Email: privacy@operoncoreai.com
• Security and vulnerability reports: security@operoncoreai.com
• Mail: Operon Core AI LLC, 5956 Sandbirch Way Lake Worth, FL 33463