Privacy Policy

Last updated: November 6, 2026

Effective date: October 13, 2026

This Privacy Policy explains how Webomax LLC ("Webomax", "we", "us", "our") collects, uses, discloses, retains and protects personal information in connection with Simurg, and the choices and rights you have. Simurg is a product of Webomax LLC.

What this Privacy Policy covers. It applies to:

• our website at simurg.me, including the pricing page and our legal pages;
• the Simurg web application, including sign-up, onboarding, Workspaces, Agents, knowledge, records, routines, connectors and settings;
• the consent page we provide, currently in beta, for authorizing third-party applications to access a Simurg Account; and
• the emails and other communications we send in connection with any of these,

(together, the "Service"). It does not apply to Connected Services, to AI providers you engage directly through BYO Keys, or to other third-party websites and services, which have their own privacy policies (see Section 18).

Our two roles. We handle personal information in two different capacities:

• As a controller. For information about our Customers, Authorized Users and website visitors that we process for our own purposes (for example, Account, billing, website, support, security and usage information), Webomax is the controller (and the "business" under US state privacy laws).
• As a processor for our Customers. For Customer Content, including Customer Personal Data, we act as a processor (or "service provider") on behalf of the Customer and on its instructions. The Customer is the controller and decides what information goes into its Workspaces, why, and what its Agents do with it. That processing is governed by our Terms of Service and our Data Processing Addendum. This Privacy Policy describes how the Service handles Customer Content so that Customers can understand it and explain it to others, but a Customer's own privacy notice governs the Customer's use of that information. If your information is in a Customer's Workspace, please read Section 9.

To the limited extent we use Customer Content for our own purposes permitted by the Terms and the DPA (security, fraud and abuse prevention, billing, legal compliance, improving the Service and creating aggregated or de-identified information), we do so as an independent controller or, under US state privacy laws, as permitted for service providers.

Business use only. The Service is offered for business and professional use by people who are 18 or older. It is not intended for personal, family or household use. This does not limit any privacy rights you have under applicable law.

Words we use. Capitalized terms that are not defined here have the meanings given in the Terms of Service. In this Privacy Policy:

• "Account" means a user account registered for the Service.
• "Agent" means an AI software agent in the Service, including the built-in specialist Agents, the ARCHITECT builder Agent and any custom Agent created in a Workspace.
• "Authorized Users" means individuals a Customer permits to access its Account or Workspaces. Today each Workspace has a single owner, the Account holder, and the Service has no feature for adding team members. If we add such features, this Privacy Policy will apply to Authorized Users as well.
• "BYO Keys" means API keys for your own accounts with AI providers that you add to a Workspace.
• "Connected Services" means third-party applications and services connected to a Workspace, including apps connected through Composio and MCP servers you add.
• "Credits" and "Subscription" have the meanings given in the Terms of Service.
• "Customer" means the individual or entity that creates an Account and agrees to the Terms. If you sign up on behalf of a company or other organization, that organization is the Customer.
• "Customer Content" means all data and content submitted to, uploaded to, connected to, received by or generated in a Workspace, including messages, instructions, files, records, knowledge, Agent configurations, routines, data from Connected Services, data received through webhooks and app events, and Output.
• "Customer Personal Data" means personal information within Customer Content that we process on behalf of a Customer.
• "Output" means content generated by or through the Service in response to Customer Content, including text, deliverables, images, summaries, scores and proposed actions.
• "personal information" means information that identifies, relates to, describes or could reasonably be linked, directly or indirectly, to an identified or identifiable individual, and includes "personal data" and "personal information" as defined by applicable privacy laws.
• "Third-Party AI Providers" means the third parties that provide the AI models and AI-based services the Service uses, including those listed in Section 8, and any AI provider you use through a BYO Key.
• "Workspace" means a separate business space within an Account, with its own Agents, content, plan and Credits.
• "you" means the individual visiting our website or using the Service and, where this Privacy Policy refers to responsibilities under the Terms, the Customer.

Summary of key points

This summary is for convenience only. Please read the full Privacy Policy.

• Who we are. Webomax LLC, a Delaware limited liability company, operates Simurg. You can reach us at info@simurg.me.
• What we collect. Your Account details (name, email address, password or Google sign-in), your business profile, everything you and your Agents put into or produce in your Workspaces, data from the apps you connect, billing details handled by Stripe, and records of how the Service is used.
• AI processing is how the Service works. To run your Agents we send Customer Content to Third-Party AI Providers. Some features always use providers we choose, even if you add your own BYO Keys. See Section 4.
• Automated checks. A third-party service (TypeSafe) checks tasks, content and proposed actions to route work, screen outside content and flag risky actions. Previews of the checked content are kept for 30 days and can be viewed by authorized Webomax personnel. See Section 4.6.
• No training, no sale, no ads. We do not use Customer Content to train or fine-tune AI models. We do not sell personal information or share it for targeted advertising, and we use no analytics or advertising trackers.
• Connected Services. Apps are connected through Composio, which holds the access tokens. Agents act in those apps on your behalf, according to the autonomy and approval settings you choose. See Section 5.
• People in your Workspace. For information about your own customers, leads and contacts, you are the controller and we are your processor. See Section 9.
• Retention. Most content is kept until you delete it or delete your Workspace or Account. Deletion is immediate, but some records are kept for legitimate reasons, such as billing records and a one-way hash of your email address used to prevent free-Credit abuse. See Section 10.
• Where data is stored. In the United States. Some providers process data in other countries. See Section 12.
• Your rights. Depending on where you live, you can access, correct, delete or export your information and object to or restrict some processing. Email info@simurg.me. See Sections 13 and 14.

1. Who we are and how to contact us

1.1 The controller

The controller of personal information processed under this Privacy Policy is:

• Webomax LLC, 2810 N Church St PMB 93469, Wilmington, Delaware 19802-4447, United States
• Email: info@simurg.me

1.2 How to contact us

For questions, requests or complaints about this Privacy Policy or our handling of personal information, email info@simurg.me or write to us at the postal address above. Please include "Privacy" in the subject line. Section 13 and Section 14 explain how to make a request to exercise your rights.

1.3 If a Customer holds your information

If your information is in a Workspace because a Customer put it there or connected an app that holds it (for example, you are one of the Customer's customers, leads or email correspondents), the Customer controls that information. Please contact the Customer first. Section 9 explains how we handle such requests.

2. Information we collect

2.1 Information you give us

Account information. When you create an Account with an email address, we collect your name, email address and password. Your password is handled by our authentication provider and stored only in hashed form; we cannot read it. Before an Account is created, we check whether your email address belongs to a known disposable email domain, and we refuse sign-ups from those domains.

Business profile and Workspace settings. During onboarding we collect your business or Workspace name, a description of what your business does and for whom, the jobs you want your Agents to take on and, if you choose, the names of apps you use (nothing is connected at that stage). Later you may add or change settings such as your time zone, working hours, "red lines" (things your Agents must never do), autonomy and approval settings, token limits and notification preferences.

Customer Content. We collect the content you put into the Service and the content generated for you, including:

• messages and instructions you give Agents, task briefs, comments and requests for changes;
• files you attach to conversations, tasks or records, such as images, documents and videos;
• the text of documents you add to your knowledge base (text is extracted on your device and we store the text, not the original file), notes you write and web links you add;
• records you create or import (for example from a CSV file), which often contain information about your own customers, leads and contacts;
• Agent configurations, custom Agents, skills, routines and record types;
• your approval decisions, including any edits you make to an action an Agent proposes; and
• pictures you upload for Agents.

Credentials you provide. BYO Keys for your AI provider accounts, and the address and any access token or header you provide for an MCP server. The Service also generates secret webhook links for your routines.

Payment and billing information. When you buy a Subscription, you enter payment details directly on pages hosted by Stripe, our payment processor. Stripe collects your payment card details and, where tax is calculated, your billing address and tax ID. When you cancel, Stripe may ask you for an optional reason. We do not receive or store full payment card numbers.

Communications with us. If you email us, we collect your message, your contact details and anything else you choose to tell us, including information needed to handle a privacy request.

2.2 Information collected automatically

Service usage and activity records. The Service creates records as it works, including tasks and their status, task timelines, Agent activity logs, the tools Agents use and the details of what they send (for example, an email's recipient and text), approval requests and their outcomes, the AI model used for each run, token counts, estimated costs and Credits charged, Credit balance entries, and the time you last opened a Workspace (recorded at most once an hour).

Device and connection information. When your browser connects to the Service, our hosting and authentication providers (Cloudflare and Supabase) receive and log technical information such as your IP address, browser type, user agent, the address requested and the time. Our own application code does not collect IP addresses or browser details, and we do not use analytics, advertising, session-recording or error-reporting tools. The first time you open a Workspace that has no time zone set, the app reads your device's time zone and saves it to the Workspace; you can change it in Settings.

Browser storage. The Service stores your sign-in session and some preferences in your browser. See Section 15.

File metadata. Files are stored and processed as you upload them. We do not remove embedded metadata, so a photo may carry information such as the date, the camera used and the location where it was taken.

Automated-check records. Our automated checks create records described in Section 4.6.

2.3 Information from third parties and Connected Services

Google sign-in. If you choose to sign in with Google, where that option is offered, Google shares with us, through our authentication provider, your name, email address, profile picture address and Google account identifier, using Google's basic sign-in permissions (OpenID, email and profile). Google sign-in does not give us access to your Gmail, Calendar, Drive or other Google data.

Connected Services. When you connect an app, we receive data from it as needed to run what you set up, for example emails, calendar events, files, spreadsheet rows, CRM contacts and deals, support tickets, chat messages, orders, payment and accounting data. We also receive information about the connection itself, such as its identifier, status, permissions and the connection details Composio returns to us.

App events and webhooks. If you set up a routine that starts when something happens in a connected app (for example, a new email arrives) or when a webhook link is called (for example, by a form on your website), we receive the content that is sent, such as the incoming email or the submitted form. This content may come from people who have no relationship with us.

MCP servers. We receive whatever the MCP servers you add return when your Agents use them.

Web pages. We receive the content of public web pages that your Agents fetch, or that you add to your knowledge base, at your direction.

Stripe. Stripe sends us information about your Subscription and payments, such as payment status, Subscription status, plan, billing period and invoice identifiers.

Third-Party AI Providers. We receive the Output that AI models return.

We do not buy personal information from data brokers.

2.4 Information about other people

Customer Content often includes personal information about people other than you, such as your customers, leads, contacts, the people who email you and the people who submit your forms. We process that information on your behalf as described in Section 9.

2.5 Sensitive information

We do not ask for sensitive information. The Terms of Service prohibit putting certain categories of data into the Service without a separate written agreement with us, including health information (such as HIPAA protected health information), payment card data, government identification numbers, biometric data, children's personal information and other special-category or sensitive data. The Service does not technically block such data. If it is uploaded anyway, that is at the Customer's sole risk and responsibility, and we treat it as Customer Content. For you as an Account holder, the sensitive information we routinely process is limited to your Account login credentials and, if you connect them, the contents of your email and other communications in Connected Services (see Section 14.4).

2.6 What we do not collect

The Service does not use your microphone or camera, does not collect your device's precise location, does not collect biometric information, does not track you across other websites and does not use advertising identifiers.

2.7 Whether you must provide information

You need to provide an email address and password, or use Google sign-in, to create an Account. Onboarding asks for a business name and description because the Service uses them to set up your Workspace. Payment details are required for a paid Subscription. Other information is optional, but some features will not work without it; for example, an Agent cannot work on an app you have not connected. No law requires you to provide information to us.

3. How we use information and our legal bases

3.1 Purposes and legal bases

We use personal information for the purposes below. If you are in the European Economic Area (EEA), the United Kingdom or Switzerland, the table also shows the legal basis we rely on. Where we process Customer Personal Data on a Customer's behalf, the Customer is responsible for having a legal basis, and we process it on the Customer's instructions under the Data Processing Addendum.

We do not use the Service to make decisions about you that are based solely on automated processing and produce legal or similarly significant effects. Some automated checks do affect how you can use the Service; for example, sign-ups from disposable email domains are refused, and the free Credit grant is given only once per person. If you think such a check was applied to you in error, contact us and a person will review it.

3.2 Our legitimate interests

Where we rely on legitimate interests, those interests are: providing a secure, reliable and well-functioning Service; preventing fraud, abuse and misuse, including repeated claims of free Credits; understanding how the Service is used so we can price it, set fair limits and improve it; improving the accuracy of our automated checks; communicating with our Customers about the Service; protecting our legal rights and those of others; and running and developing our business. We have weighed these interests against your rights and expectations, and we limit what we use to what is needed. You can object to processing based on legitimate interests (see Section 13).

3.3 Aggregated and de-identified information

We create and use aggregated and de-identified information, such as token counts, costs, approval and decline rates, error rates and performance measures, to operate, secure, price and improve the Service, including tuning our automated checks. Aggregated or de-identified information does not identify you or any other individual. We keep de-identified information in de-identified form, do not attempt to re-identify it except as permitted by law, and require anyone we share it with to do the same.

3.4 What we do not do

• We do not sell personal information.
• We do not share personal information for cross-context behavioral advertising or use it for targeted advertising.
• We do not show advertising in the Service.
• We do not use Customer Content to train or fine-tune AI models, whether our own or anyone else's.
• We do not use information received from Google APIs for advertising (see Section 6).

4. AI processing

4.1 How the Service uses AI

Agents work by sending information to AI models run by Third-Party AI Providers and acting on what those models return. We do not build our own foundation models. The included models shown in the app (for example "Standard" and "Advanced") are third-party models that we select. The Service cannot run Agents without sending Customer Content to Third-Party AI Providers, so by using Agents you direct us to do so.

4.2 What we send to AI models

Depending on the feature, a request to an AI model can include:

• Agent context: the Agent's name, role, personality and instructions; your Workspace's business profile; the list of your connected apps and of your Agents; knowledge notes you marked as always included and knowledge excerpts relevant to the job; knowledge folder names; recent memory notes of the Agent and of other Agents in the Workspace; unread internal notes between Agents; a summary of your record types and how many records each holds; and the current date, time and working hours;
• your request: the task brief or chat message and, in chats, the recent conversation history, which is sent again with each new message;
• attachments: images as image data; text extracted from documents (which is also saved in the conversation and sent again on later turns); and, for files without readable text such as videos, a temporary link, valid for about one hour, that lets the provider fetch the file; and
• tool results: everything the Agent reads while working, such as records, knowledge, fetched web pages, results from Connected Services (for example emails, contacts, spreadsheet rows or payments) and MCP server results.

We do not add your Account name or email address to these requests, but they may appear in the content itself.

4.3 Which providers are used for which features

4.4 Included models and changes

We decide which third-party model powers each included model tier, and we may change models at any time without notice. We add new service providers as described in Section 8. If a provider fails or is unavailable, a request may be retried with another provider listed in Section 8. Models we may use include those from Google (Gemini), OpenAI and Anthropic, and models made available through OpenRouter from other developers, such as Z.ai, DeepSeek, Xiaomi and Meta. OpenRouter routes each request to a host that runs the model, which may be located outside the United States, including in China.

4.5 BYO Keys

On paid plans you can add BYO Keys for OpenAI, Anthropic, Google or OpenRouter. When an Agent is set to use your provider, its task work, chats and document summaries are sent to that provider through your key. Your provider processes that content under your own agreement with it, bills you directly and is not our sub-processor for that processing.

Using a BYO Key does not keep all of your content with your chosen provider. The features marked "No" in the table in Section 4.3 always run on providers and accounts we choose: ARCHITECT, conversation titles, weekly summaries, knowledge suggestions, search embeddings, image generation and automated checks. If your key is missing and the Agent is set to fall back to the included model, the work runs on our accounts instead.

We store BYO Keys in our database. Our hosting provider encrypts the database at rest, and database access rules limit access through the app to your Account and to our back-end systems. BYO Keys are not separately encrypted by our application. The app shows only a short hint of each key after it is saved. Authorized technical personnel with database access could technically access stored keys; we access them only as described in Section 11.3. When you use the "Test" button, your browser sends the key directly to the provider to check that it works.

4.6 Automated checks

The Service uses automated checks, run by TypeSafe's "Jev" model, to route work and add safeguards. Depending on the check, TypeSafe receives task titles and briefs, chat messages and recent conversation, job descriptions, knowledge passages, attachment text, fetched web pages, results from Connected Services and MCP servers, incoming app events and webhook content, proposed actions and deliverables (for example an email's recipient and text), your red lines, summaries of finished tasks and the actions taken, and record fields when records are scored.

These checks can change what happens in your Workspace. They:

• rate how urgent and complex a task is, which affects its place in the queue and how much reasoning effort the model uses;
• choose skills, apps, tools, knowledge and teammates for a job, and rank knowledge excerpts by relevance;
• screen outside content for hidden instructions or attempts to send data out; if content is flagged, or the check cannot run, the run is marked untrusted and every action affecting outside systems waits for your approval;
• assess proposed actions and deliverables for risk (for example, actions that cannot be undone, unfilled placeholders, money commitments, legal or medical claims, harsh tone, a wrong recipient or a breach of your red lines); for Agents set to "Ask unless it's routine", this decides whether a routine action runs without asking you, and for Agents set to "Auto" or tools set to "Always allow", it can hold an action for your approval;
• compare a finished task's summary with what was actually done and send the task back for your review if they do not match;
• in routines with cases, decide which case fits an incoming item, skip items that fit no case, or set uncertain items aside for you; and
• produce 0 to 100 scores for records when you or an Agent use "Score with AI".

These checks act on the content of your Workspace to route and safeguard the work you configure. They are not used to make decisions about you that produce legal or similarly significant effects, and you can review and override their outcomes, for example by approving a held action, re-running a task or undoing a score. They are probabilistic, can be wrong, may be switched on or off by us, and are conveniences rather than guarantees; the Terms of Service explain who is responsible for Agent actions. If a Customer uses "Score with AI" or other features to evaluate individuals, the Customer is responsible for that use, including any profiling or automated decision-making obligations (see Section 9).

Each check creates a record of what was checked, the result, timing and cost, together with a preview of up to the first 4,000 characters of the content the check was shown. These records are not shown in your Workspace. Authorized Webomax personnel can view them to monitor, evaluate and improve the checks and for the other purposes in Section 11.3. We delete the content previews after 30 days. The rest of the record, without the preview, is kept until the Workspace is deleted. We also record whether you later approved or declined an action, so that we can compare the checks with your decisions and tune them.

4.7 Training and how providers use data

We do not use Customer Content to train or fine-tune AI models, and we do not pool Customer Content across Workspaces. Each Workspace's knowledge, memory and records are searched only within that Workspace.

Third-Party AI Providers process content under their own terms. For the commercial API services we use, those terms generally do not permit the provider to train its models on API data by default. Providers may keep inputs and outputs for a limited period to monitor for abuse, ensure safety and comply with law, and some briefly cache parts of requests to process them efficiently. OpenRouter routes requests to model hosts whose terms vary. We do not currently offer zero-data-retention processing, so please do not put information into the Service that must not be held by an AI provider for those purposes.

4.8 Web pages fetched by Agents

At your direction, Agents and the knowledge "add a link" feature fetch individual public web pages from our servers, identifying themselves as "SimurgBot". They do not sign in to websites. The content of the page becomes Customer Content.

4.9 Limits of AI

Output is generated by AI and may be inaccurate, incomplete, out of date or inappropriate, and may contain incorrect information about people. Review Output before you rely on it, use it or send it to anyone. Output is not legal, financial, tax, medical or other professional advice. If Output contains inaccurate personal information, you can correct or delete it in your Workspace. The Terms of Service set out further terms on Output.

5. Connected Services, Composio and MCP servers

5.1 How connections work

Apps such as Gmail, Google Calendar, Slack, HubSpot, Stripe or Shopify are connected through Composio, our connector provider. When you connect an app, you sign in and grant access on a page hosted by Composio or by the app's provider. Because we generally use Composio's managed connection apps, the consent screen may name Composio rather than Simurg. The access tokens for these connections are held by Composio. We store an identifier for each connection, its status and permissions, and the connection details Composio returns to us. We identify your Workspace to Composio only by a random Workspace identifier; we do not send Composio your name or email address. Composio necessarily processes the data that passes between the Service and your Connected Services.

5.2 What Agents can do in Connected Services

Once an app is connected, every Agent in the Workspace can use the actions that app makes available through Composio, which can include reading, creating, sending, publishing, changing, deleting and paying, unless you switch the app off for an Agent or block a specific action. Actions that only read data run without asking you. Other actions follow the autonomy and approval settings you choose for each Agent and tool ("Auto" is the default for a new Agent). The Service decides automatically whether an action only reads data, and that classification may occasionally be wrong. Data an Agent reads from a Connected Service is sent to Third-Party AI Providers and to TypeSafe as described in Section 4, and is stored in the task's records. For actions that change something, we store the details the Agent sent and the app's response. Messages an Agent sends through a Connected Service are sent from your account.

5.3 App events and webhooks

If a routine starts from an app event or a webhook link, we store each incoming item (up to a limited size) as soon as it arrives, even if the routine then skips or ignores it, for example because the routine is off, your Agents are halted, it fits no case or a limit has been reached. Items that are skipped are not processed later. The content is passed to the Agent that handles the routine and may be sent to Third-Party AI Providers and to TypeSafe. A webhook link works like a password: anyone who has it can send data into your Workspace, so keep it secret and replace it if it is exposed.

5.4 MCP servers

You can add MCP servers of your choice by address. We store the address and any access token or header you provide, and send your Agents' requests to that server when they use it. The operator of an MCP server is a third party you choose, not our sub-processor, and its own terms and privacy practices apply.

5.5 Disconnecting and revoking access

You can disconnect an app at any time from the Integrations page. Disconnecting asks Composio to delete the connection and stops future access. Data already retrieved from the app stays in your Workspace until you delete it or delete the Workspace. Disconnecting an MCP server deletes the stored address and credentials.

Deleting a Workspace or your Account does not automatically revoke your app connections at Composio. Before deleting, disconnect each app in the Service. You can also revoke access in each app's own security settings, for example in your Google Account's third-party access page.

5.6 Third-party applications you authorize (beta)

We are developing a feature that lets you authorize third-party applications, such as AI assistants, to access your Simurg Account through a consent page. The feature is in beta and may not be available. If you approve an application, it may be able to access the information in your Account that the approval covers, which can include all Workspaces you own. The application is a third party you choose, and its own terms and privacy policy apply. The Service does not yet have a screen for reviewing or revoking approved applications; to revoke one, contact us at info@simurg.me.

5.7 Third-party terms

Connected Services, Composio, MCP servers and the AI providers you use through BYO Keys are governed by their own terms and privacy policies. We are not responsible for their privacy or security practices. The Terms of Service describe your responsibilities for the access you grant.

6. Google API Services: Limited Use disclosure

Simurg's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

This applies to information we receive from Google APIs, whether through Google sign-in or through Google Workspace apps (such as Gmail, Google Calendar, Google Drive, Google Sheets and Google Docs) that you connect as Connected Services, and whether the Google consent screen names Simurg or Composio. In particular:

• Use. We use information received from Google APIs only to provide and improve the user-facing features of the Service that you use and that are visible in the app: for Google sign-in, to create and sign in to your Account; for connected Google apps, to let your Agents read and act in those apps as you direct, to run routines triggered by events in them, and to apply the automated checks that safeguard that work.
• Transfers. We transfer such information only as necessary to provide or improve those features (for example, to Composio to connect the app, to Third-Party AI Providers and TypeSafe to process the content your Agents work on, and to our hosting provider to store it), to comply with applicable law, for security purposes, or as part of a merger, acquisition or sale of assets with notice to you.
• No advertising. We do not use or transfer such information to serve advertising, including personalized, retargeted or interest-based advertising.
• No sale. We do not sell such information, and we do not use it to determine creditworthiness or for lending purposes.
• No AI model training. We do not use such information, and do not transfer it for the purpose of using it, to develop, improve or train generalized or non-personalized AI or machine-learning models.
• Storage and protection. Information from Google sign-in is kept with your Account. Information from connected Google apps is stored only as part of your Workspace content (for example, in task records, records, knowledge or routine event logs) on our hosting provider's servers in the United States, protected as described in Section 11, and kept and deleted as described in Section 10.
• Human access. Our personnel do not read such information unless you give us your affirmative agreement for specific information (for example, when you ask us for support), it is necessary for security purposes such as investigating abuse or a security incident, it is necessary to comply with applicable law, or it has been aggregated and anonymized for internal operations in accordance with applicable law. This restriction also applies to the automated-check previews described in Section 4.6.

You can stop our access at any time by disconnecting the Google app in the Service and by removing access in your Google Account's security settings. Information already retrieved is kept and deleted as described in Section 10.

7. How we disclose information

We disclose personal information only as described in this Privacy Policy.

7.1 Our service providers

We use service providers to host, run and support the Service. They process personal information on our behalf and under our instructions, subject to contractual obligations of confidentiality and data protection. Section 8 lists them.

7.2 At your direction

The Service discloses information to third parties when you or your Agents direct it to, including:

• Connected Services and MCP servers you connect, including the content of actions your Agents take in them;
• the recipients of emails, messages, posts and other communications your Agents send on your behalf;
• the AI providers you use through BYO Keys;
• third-party applications you authorize to access your Account; and
• websites your Agents fetch pages from, which receive a request from our servers.

These recipients are not our service providers. Their use of the information is governed by their own terms and privacy policies, and you are responsible for these disclosures under the Terms of Service.

7.3 Independent controllers

Some providers also process information for their own purposes as independent controllers under their own privacy policies. Stripe does so for purposes such as fraud prevention, compliance and managing its relationship with you, as described in the Stripe Privacy Policy. Google does so for Google sign-in and for its own services you use, as described in the Google Privacy Policy.

7.4 Legal requirements and protection of rights

We may disclose information if we believe in good faith it is reasonably necessary to: comply with a law, regulation, legal process or enforceable government request; enforce our Terms of Service or other agreements, or investigate possible violations; detect, prevent or address fraud, security or technical issues; or protect the rights, property or safety of Webomax, our Customers or others. Where we receive a request from a public authority for Customer Content, we will, where legally permitted and practicable, refer the authority to the Customer or notify the Customer, as further described in the Data Processing Addendum.

7.5 Business transfers

If we are involved in, or are evaluating, a merger, acquisition, financing, reorganization, bankruptcy, receivership, sale of all or part of our assets, or transfer of the Service, personal information may be disclosed to the other parties and their advisers (subject to confidentiality obligations) and transferred as part of that transaction. Any successor will be required to honor this Privacy Policy for information collected under it, or to give you notice of any change.

7.6 Professional advisers

We may disclose information to our lawyers, accountants, auditors and insurers where needed for their services, under obligations of confidentiality.

7.7 Aggregated or de-identified information, and with your consent

We may disclose aggregated or de-identified information that does not identify any individual. We may also disclose personal information with your consent or at your request.

8. Service providers and sub-processors

We use the following service providers to provide the Service. Each acts on our behalf and, for Customer Personal Data, as our sub-processor, except to the extent a provider acts as an independent controller (Section 7.3). The location shown is where each provider mainly processes data for us; providers may also use facilities and their own sub-processors in other countries.

Other third parties your browser contacts. Your browser also loads some resources directly from third parties: app logos from image hosts supplied by Composio, and, inside the app only, a picture for a custom Agent from DiceBear (which receives the code used to draw it). These third parties receive your IP address and browser information. See Section 15.

Not our sub-processors. Connected Services, MCP servers, AI providers you use through BYO Keys, third-party applications you authorize and websites your Agents fetch are third parties you choose (see Section 7.2).

Changes to this list. We will update this list when we add or replace a service provider that processes personal information, and change the "Last updated" date. Customers have the additional notice and objection rights set out in the Data Processing Addendum.

9. Information about other people in your Workspace

9.1 Our role

Customers use the Service to hold and work with information about other people, such as their customers, clients, leads and contacts, people who email them, people who submit their forms and people whose details appear in connected apps or imported files. For this Customer Personal Data, the Customer is the controller and Webomax is a processor or service provider acting on the Customer's instructions under the Terms of Service and the Data Processing Addendum. We do not sell Customer Personal Data, use it for advertising, or use it to train AI models.

9.2 Customers' responsibilities

Each Customer is responsible, as controller, for the information it puts into or connects to the Service and for what its Agents do with it, including:

• having a lawful basis, and any consent required, for collecting the information and for having it processed by the Service, including by Third-Party AI Providers and the other providers listed in Section 8;
• giving people any notice the law requires, including that their information may be processed using AI and by these providers;
• complying with laws on marketing and outbound communications (such as CAN-SPAM, the TCPA, CASL, and GDPR, PECR and other ePrivacy rules) and on disclosing the use of AI when Agents communicate with people;
• responding to requests from the people whose information it holds;
• not using the Service to make solely automated decisions that produce legal or similarly significant effects on people (such as decisions about employment, credit, housing, insurance, education, healthcare, legal services or government benefits) without a separate written agreement with us, and complying with any rules on profiling and automated decision-making that apply to its use of features such as "Score with AI"; and
• not putting the categories of sensitive data listed in Section 2.5 into the Service without a separate written agreement with us. We are not a HIPAA business associate and do not sign business associate agreements.

9.3 If your information is in a Customer's Workspace

If you want to access, correct or delete information a Customer holds about you, or to object to how it is used, please contact that Customer. If you contact us, we will, where we can identify the Customer, refer you to the Customer or pass your request on to it, and we will help the Customer respond as the law and the Data Processing Addendum require. We may not be able to act on your request ourselves without the Customer's instructions. We are not responsible for Customers' privacy practices.

10. Retention

10.1 General rule

We keep personal information for as long as needed for the purposes described in this Privacy Policy. Most information is kept until you delete it, or until you delete the Workspace or Account it belongs to. Apart from the specific periods below, the Service does not delete information on a fixed schedule. We may keep information for longer where the law requires it, to resolve disputes, to enforce our agreements, or while it is subject to a legal hold.

10.2 Retention periods

10.3 Deleting your Workspace or Account

You can delete a Workspace or your whole Account at any time in Settings under Your account. Deletion takes effect immediately and cannot be undone. Deleting a Workspace or Account also cancels any paid Subscription for it immediately, without a refund for the unused period (see the Terms of Service). Before you delete:

• export anything you want to keep (Section 13.1);
• disconnect your Connected Services and revoke access in each app's settings (Section 5.5); and
• permanently delete any Agent for which you uploaded a picture, or ask us to delete the pictures.

Deletion removes the Workspace's content, files and settings from our active systems, subject to the exceptions in Section 10.2. If a step of a deletion fails, some data may remain; contact us and we will complete the deletion.

11. Security

11.1 How we protect information

We use administrative, technical and organizational measures designed to protect personal information, including:

• Workspace isolation. Database and file-storage access rules limit each Account, through the app and our API, to the Workspaces it owns.
• Private file storage. Files are kept in private storage and opened through signed links that expire after about one hour. (Pictures you upload for Agents are an exception; see Section 11.2.)
• Encryption in transit. Connections to the Service and between the Service and our service providers use HTTPS/TLS encryption.
• Encryption at rest. Our hosting provider encrypts stored data at the storage level. We do not apply additional application-level encryption to BYO Keys, MCP credentials or webhook secrets.
• Protected platform credentials. Our own keys for service providers are kept as server-side secrets, not in the database or in code sent to browsers.
• Verified inbound messages. Notifications from Stripe and Composio are checked for valid signatures, routine webhooks require a secret key, and incoming items are rate-limited.
• Agent safeguards. Content from outside sources is marked as untrusted and screened; web fetching is limited to public addresses; new Agents ask before acting in Connected Services by default; unanswered approval requests expire without the action running; and you can halt all Agents in a Workspace. These safeguards reduce risk but can fail, and they do not change who is responsible for Agent actions under the Terms of Service.
• Limited personnel access. Access to personal information is limited to authorized personnel who need it (Section 11.3).

11.2 Limits and your responsibilities

No method of transmission or storage is completely secure, and we cannot guarantee the security of information. In particular:

• The Service does not currently offer multi-factor authentication. Use a strong, unique password, keep it confidential and protect any Google account you use to sign in.
• Your sign-in session is stored in your browser. Sign out when you finish on a shared device. Some preferences, which can include internal identifiers for your Workspaces and files, stay in browser storage after you sign out; clear your browser data on shared devices.
• Signed file links and webhook links are bearer links: anyone who has one can use it while it is valid. Do not share them. Temporary file links may be included in requests to AI providers (Section 4.2).
• Pictures you upload for Agents are stored at public web addresses that anyone with the address can open. Do not upload pictures of real people unless you have the right to do so.
• You decide which apps to connect, which permissions to grant them and how much autonomy your Agents have. You are responsible for the security of your own devices, accounts and systems and of your Connected Services.

If you believe your Account has been compromised, contact us immediately at info@simurg.me.

11.3 Who at Webomax can access your information

Authorized Webomax personnel can access personal information and Customer Content only where needed to provide support you request, maintain, secure and debug the Service, investigate security incidents, fraud and abuse, comply with law and enforce our Terms of Service. In particular:

• our internal administration tools show, across all Workspaces, Workspace names, plan, billing and usage records, and, for recent failed tasks and routines, their titles and error messages;
• the automated-check records described in Section 4.6 include previews of up to 4,000 characters of the content checked, which may include text from emails, files and records, including personal information about other people; authorized personnel can view these previews to monitor, evaluate and improve the checks until we delete the previews after 30 days, subject to Section 6 for information received from Google APIs; and
• our technical administrators can access the databases and infrastructure that store all Customer Content, BYO Keys and MCP credentials, and use that access only for the purposes above.

We limit this access to personnel who need it for these purposes and who are bound by confidentiality obligations. The Service has no feature that lets our personnel sign in as you.

11.4 Security incidents

If we become aware of a security incident affecting personal information, we will investigate it, take steps to contain it and notify affected Customers, individuals and authorities as required by applicable law. The Data Processing Addendum sets out our commitments for incidents affecting Customer Personal Data.

12. International transfers

We are based in the United States, and the Service stores data in the United States (Amazon Web Services region us-east-1 in Northern Virginia, through Supabase). Our service providers process data in the United States and in other countries, as shown in Section 8, including, for some AI models routed through OpenRouter, countries such as China. If you use the Service from outside the United States, your information will be transferred to, stored in and processed in the United States and those other countries, whose data protection laws may differ from those where you live.

The European Commission has not found that the United States provides an adequate level of data protection, except for organizations certified under the EU-U.S. Data Privacy Framework. Webomax is not certified under the Data Privacy Framework. Where the law of the EEA, the United Kingdom or Switzerland requires a transfer mechanism, we rely on:

• for Customer Personal Data, the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum and the Swiss adjustments, as incorporated into our Data Processing Addendum;
• for onward transfers to our service providers, the Standard Contractual Clauses or other lawful mechanisms included in their data processing terms, or their certification under the Data Privacy Framework where they hold one; and
• where no other mechanism applies, the derogations the law permits, such as a transfer that is necessary to perform our contract with you or that you request (for example, when you connect a Connected Service or send a message to someone in another country).

You can ask for more information about these safeguards, or a copy of the relevant clauses, by emailing info@simurg.me.

13. Your rights and choices

13.1 Choices available in the Service

• Update your information. You can change your display name and your business and Workspace details in Settings. Your email address cannot currently be changed in the app; contact us if it needs correcting.
• Export your information. You can download files and deliverables individually. For other information, such as your records, Agents, tasks, knowledge, conversations, files in bulk or your Account details, email us.
• Delete information. You can delete individual items such as records, tasks, conversations, knowledge, memory notes and routines, delete a Workspace or delete your Account (see Section 10 for what remains after deletion).
• Control your Agents. You can set each Agent's autonomy, choose which tools and apps each Agent may use, set red lines and token limits, turn weekly summaries on or off, and halt all Agents in a Workspace.
• Control connections. You can disconnect apps and MCP servers at any time (Section 5.5).
• Browser storage. You can clear your browser storage at any time (Section 15).

13.2 Rights in the EEA, the United Kingdom and Switzerland

If you are in the EEA, the United Kingdom or Switzerland, you have the right, subject to conditions and exceptions in the law, to:

• access your personal information and receive a copy;
• correct inaccurate or incomplete personal information;
• delete your personal information;
• restrict our processing of your personal information;
• data portability, meaning to receive personal information you provided to us in a structured, commonly used, machine-readable format and have it sent to another controller where technically feasible;
• object to processing based on our legitimate interests, on grounds relating to your particular situation, and to object at any time to processing for direct marketing;
• withdraw consent at any time where we rely on consent, without affecting processing before the withdrawal; and
• not be subject to a decision based solely on automated processing that produces legal or similarly significant effects on you. We do not make such decisions about you (see Section 3.1).

You also have the right to lodge a complaint with a supervisory authority, in particular in the country where you live, work or where an alleged infringement took place. In the EEA, this is your national data protection authority; in the United Kingdom, this is the Information Commissioner's Office; in Switzerland, the Federal Data Protection and Information Commissioner. We would appreciate the chance to address your concern first, so please contact us.

13.3 Rights in other places

Depending on where you live, you may have similar rights under local law, for example in Canada, Brazil, Australia or other countries. We will respond to requests as those laws require. Residents of US states should also read Section 14.

13.4 How to make a request

Email info@simurg.me from the email address linked to your Account, with "Privacy request" in the subject line, and tell us what you are asking for. To protect your information, we will verify your identity before acting, usually by confirming that the request comes from your Account email address, and we may ask for more information where needed. We will not ask for more information than necessary, and we use what you provide only to verify and respond to your request.

We respond within one month of receiving a request, which we may extend by up to two further months for complex or numerous requests (or within the time other applicable laws set; see Section 14). We do not charge a fee unless a request is manifestly unfounded or excessive, in which case we may charge a reasonable fee or decline it, as the law allows. If we cannot fully meet a request, for example because we must keep information for legal reasons or because it would affect other people's rights, we will explain why.

13.5 Requests about Customer Content

If your request concerns information a Customer controls (Section 9), we will refer you to the Customer or pass the request on to it, and help the Customer respond.

14. Additional information for US residents

14.1 Who this section applies to

This section applies to residents of California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Iowa, Delaware, New Hampshire, New Jersey, Tennessee, Minnesota, Maryland, Indiana, Kentucky, Rhode Island, Nebraska and any other US state with a comparable consumer privacy law, to the extent those laws apply to our processing of your personal information. It supplements the rest of this Privacy Policy, and in the case of California residents it is our notice at collection. It does not apply to Customer Personal Data we process as a service provider or processor for a Customer (Section 9).

14.2 Personal information we collect, sources, disclosures and retention

In the last 12 months we have collected the categories of personal information below. We collect them for the business and commercial purposes described in Section 3, which include providing the Service you request, maintaining security and integrity, debugging, short-term transient use, verifying and improving quality and safety, internal research and development, auditing, billing and legal compliance.

We do not collect biometric information, precise geolocation, or information about protected characteristics or education except where you choose to include it in your content. We do not draw inferences from personal information to create a profile about you.

14.3 No sale, sharing or targeted advertising

We do not sell personal information, share it for cross-context behavioral advertising, or process it for targeted advertising, and we have not done so in the last 12 months. We have no actual knowledge of selling or sharing personal information of consumers under 16. We do not use personal information for profiling in furtherance of decisions that produce legal or similarly significant effects.

14.4 Sensitive personal information

We use and disclose sensitive personal information only for purposes permitted without a right to limit under California law (Cal. Code Regs. tit. 11, § 7027(m)) and comparable state laws, such as providing the Service you request, ensuring security and integrity, and preventing fraud. We do not use it to infer characteristics about you.

14.5 Your rights

Subject to conditions and exceptions in the applicable law, you have the right to:

• know and access the categories and specific pieces of personal information we have collected about you, the categories of sources, our purposes, and the categories of third parties to which we disclosed it;
• delete personal information we collected from you;
• correct inaccurate personal information;
• data portability, meaning to receive your personal information in a portable and, where technically feasible, readily usable format;
• opt out of the sale of personal information, sharing for cross-context behavioral advertising, targeted advertising, and profiling in furtherance of decisions with legal or similarly significant effects (we do none of these);
• limit the use of sensitive personal information (we use it only for permitted purposes, see Section 14.4);
• where state law provides it, obtain a list of the specific third parties to which we have disclosed personal information, and question the result of profiling; and
• not be discriminated or retaliated against for exercising your rights. We will not deny you the Service, charge you different prices or provide a different quality of service because you exercised your rights.

We do not offer financial incentives in exchange for the collection, retention or sale of personal information.

14.6 How to exercise your rights

Because we operate exclusively online and have a direct relationship with our Customers, you can make a request by emailing info@simurg.me with "Privacy request" in the subject line. We verify requests as described in Section 13.4, matching the information you give us with information we hold. For requests for specific pieces of information or for deletion, we may ask for additional information to reach a higher degree of certainty. We do not require you to create an Account to make a request, but if you have one, we may ask you to send the request from its email address.

Authorized agents. You may use an authorized agent to make a request. We will ask the agent for proof of your signed permission and may ask you to verify your identity directly with us or confirm that you gave the agent permission, unless the agent holds a valid power of attorney under applicable law.

Timing. We will confirm receipt of a request within 10 business days where California law requires and respond within 45 days. If we need more time, we may extend this by up to a further 45 days and will tell you why.

14.7 Appeals

If we decline to act on your request, in whole or in part, you can appeal by replying to our decision or emailing info@simurg.me with "Privacy request appeal" in the subject line within a reasonable time after our decision. We will respond in writing within the time required by your state's law (generally 45 to 60 days), explaining any action taken and the reasons. If you are not satisfied with the outcome, you may contact your state Attorney General.

14.8 Global Privacy Control and Do Not Track

Because we do not sell or share personal information or use it for targeted advertising, there is nothing for an opt-out preference signal such as Global Privacy Control to opt you out of. If we ever begin any of those practices, we will treat such signals as valid opt-out requests where the law requires. The Service does not respond differently to "Do Not Track" browser signals, because we do not track users across third-party websites. We do not allow third parties to collect personal information about your online activities over time and across websites through the Service for advertising; third parties whose resources your browser loads receive your IP address and browser information under their own policies (Section 15).

14.9 California Shine the Light and Nevada

We do not disclose personal information to third parties for their own direct marketing purposes, as described in California Civil Code § 1798.83. We do not sell covered information as defined under Nevada law.

15. Cookies and similar technologies

15.1 What we store on your device

We use one cookie and your browser's local storage and session storage, only to make the Service work and to remember your choices.

Our hosting provider, Cloudflare, may also set strictly necessary security cookies to protect the site from malicious traffic.

15.2 Third-party resources your browser loads

Some pages load content directly from third parties. When they do, your browser connects to that third party, which receives your IP address and browser information. Our site tells browsers to send these third parties only our site's address, not the full address of the page you are on.

We use these resources to present and run the Service as designed, based on our legitimate interests (or, for Stripe, Composio and Google sign-in pages, because you choose to use them).

15.3 What we do not use

We do not use analytics cookies or tools, advertising cookies, social media pixels, session recording, browser fingerprinting or any other tracking technology, and we do not allow advertising networks to collect information through the Service.

15.4 Your choices

Because the cookie and storage described in Section 15.1 are strictly necessary to provide the Service or remember choices you make, we do not ask for consent to use them. You can delete cookies and clear local and session storage through your browser settings at any time. If you block local storage, you will not be able to sign in.

16. Children

The Service is intended for people who are 18 or older and is not directed to children. We do not knowingly collect personal information from children under 13, and we do not allow anyone under 18 to create an Account. If we learn that an Account belongs to someone under 18, or that we have collected personal information from a child under 13, we will delete the Account and that information. Customers must not put children's personal information into the Service without a separate written agreement with us (Section 2.5). If you believe a child has given us personal information, contact us at info@simurg.me.

17. Communications from us

Service emails. We send emails you need in order to use the Service, such as sign-up confirmation and, where available, password-reset emails, through our authentication provider and Resend. Stripe sends payment receipts and billing emails, such as notices of failed payments, on our behalf where enabled. We may also email you about your Account, security, changes to the Service, the Terms of Service or this Privacy Policy, and in reply to your requests. Because these messages are part of providing the Service, you cannot opt out of them while you have an Account.

In-app notifications. Approval requests, Agent questions, failure alerts and weekly summaries appear inside the app only. We do not send them by email, text message or push notification. You can turn some of them off in Settings under Notifications. Because notifications are only in the app, check the app regularly for approvals and alerts.

Marketing. We do not currently send marketing emails. If we start, we will comply with applicable law, ask for your consent where the law requires it, and include a simple way to opt out in every marketing message.

18. Third-party links and services

The Service links to and works with third-party websites and services, including Connected Services, MCP servers, AI providers you use through BYO Keys, third-party applications you authorize, Stripe, Google, Composio's connection pages and websites that appear in Output. Their own terms and privacy policies govern how they handle your information, and we are not responsible for their practices. Please review their policies before you use them or give them information.

19. Changes to this Privacy Policy

We may update this Privacy Policy from time to time, for example to reflect changes to the Service, our service providers or the law. We will post the updated version on this page and change the "Last updated" date. If we make a material change, we will notify you before it takes effect, by email to the address associated with your Account or by a prominent notice in the Service or on our website. We will not make a material change to how we use personal information collected under an earlier version without notice and, where the law requires, your consent. Changes take effect on the date stated. If you keep using the Service after that date, the updated Privacy Policy will apply to your use. Earlier versions are available on request.

20. Contact us

For any question, request or complaint about this Privacy Policy or our privacy practices, contact:

• Webomax LLC, 2810 N Church St PMB 93469, Wilmington, Delaware 19802-4447, United States
• Email: info@simurg.me

Please include "Privacy" in the subject line so we can route your message quickly.