Privacy Policy

This Privacy Notice for MAGNETIC Global, LLC ("we," "us," or "our") describes how and why we might access, collect, store, use, and/or share ("process") your personal information when you use our services ("Services"), including when you:

• Visit our website at https://mag-os.com/ or any website of ours that links to this Privacy Notice
• Use MAG OS, a brand-intelligence platform operated by MAGNETIC Global, LLC, 27419 Via Industria, Temecula, CA 92590, United States. We operate in the United States and South Africa.
• Engage with us in other related ways, including any marketing or events.

Questions or concerns? Reading this Privacy Notice will help you understand your privacy rights and choices. If you do not agree with our policies and practices, please do not use our Services. If you have questions, contact us at os@mag.cr.

SUMMARY OF KEY POINTS

What personal information do we process? When you visit, use, or navigate our Services, we may process personal information depending on how you interact with us, the choices you make, and the features you use.

Do we process any sensitive personal information? We do not process sensitive personal information as defined by applicable law (e.g., racial/ethnic origin, health, sexual orientation).

Do we process our clients' connected business data? Yes. As a core function, our business and agency clients connect their own third-party accounts (such as advertising and analytics accounts) so MAG OS can read that data on their behalf and provide them insights. We act as a processor of that data on our clients' instructions. See CLIENT-CONNECTED BUSINESS DATA below.

Do we collect information from third parties? We may collect information from public databases, marketing partners, social media platforms, and other outside sources.

How do we process your information? To provide, improve, and administer our Services, communicate with you, for security and fraud prevention, and to comply with law. We process your information only when we have a valid legal reason.

In what situations and with which parties do we share personal information? We may share information in specific situations and with specific third parties. See WHEN AND WITH WHOM DO WE SHARE YOUR PERSONAL INFORMATION?

How do we keep your information safe? We have organizational and technical measures in place. However, no system is 100% secure.

What are your rights? Depending on where you are located, applicable privacy law may give you rights regarding your personal information.

How do you exercise your rights? By contacting us at os@mag.cr.

1. WHAT INFORMATION DO WE COLLECT?

Personal information you disclose to us

In Short: We collect personal information that you provide to us.

We collect personal information that you voluntarily provide when you register on the Services, express interest in our products/Services, participate in activities on the Services, or otherwise contact us. This may include: names, email addresses, job titles, billing addresses, and debit/credit card numbers (processed by our payment processor, not stored by us).

Sensitive Information. We do not process sensitive information.

Information automatically collected

In Short: Some information — such as your IP address and/or browser and device characteristics — is collected automatically when you visit our Services.

We automatically collect certain information when you visit, use, or navigate the Services (device and usage information: IP address, browser/device characteristics, OS, language preferences, referring URLs, country, and information about how and when you use our Services). This is primarily for security, operation, and internal analytics. We collect this through cookies and similar technologies.

Google API

Our use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Information collected from other sources

In Short: We may collect limited data from public databases, marketing partners, social media platforms, and other outside sources.

To enhance our ability to provide relevant marketing and services, we may obtain information about you from public databases, marketing partners, data providers, social media platforms, and other third parties.

2. CLIENT-CONNECTED BUSINESS DATA (ADS, ANALYTICS, AND OTHER CONNECTED ACCOUNTS)

In Short: When a client connects their own third-party account, we access only what they authorize, via the platform's official API, to analyze their data and provide them insights. We act as a processor on the client's behalf.

MAG OS is a business-to-business platform used by agencies and brands ("Clients"). A core function is allowing a Client to connect their own third-party accounts so MAG OS can read that data on that Client's behalf and surface analysis and insights back to that Client.

What we access. With the Client's explicit authorization, and limited to the permissions the Client grants, we may access read-only data from connected accounts, including:

• Advertising accounts (e.g., Meta Ads, Google Ads, TikTok Ads): campaign/ad set/ad structure and names, performance metrics (spend, impressions, reach, clicks, and derived metrics), reported results/conversions, and associated dates.
• Analytics accounts (e.g., Google Analytics): site/marketing performance metrics for the Client's own properties.
• Other connected sources a Client chooses to link.

How we use it. Solely to provide analytics and insights to the Client who owns the connected account — analyzing their marketing performance against their goals. Our advertising integrations are read-only; we do not create, edit, or manage campaigns.

Our role and commitments.

• We act as a data processor / service provider on the Client's instructions; the Client is the controller of their connected data.
• We access connected data only via the platform's official API under the Client's own authorization (OAuth), and only for accounts the Client explicitly connects.
• Per-Client isolation: each Client's connected data and access credentials are stored separately and are never pooled with, or made accessible to, other Clients. Access tokens are stored encrypted.
• We do not sell connected data, do not use one Client's connected data to benefit another Client, and do not use it for advertising targeting or cross-Client profiling.
• A Client may disconnect a connected account at any time, which stops further access; we then delete or de-identify the associated data per our retention practices.

Platform-specific (Meta). Consistent with Meta's Platform Terms and Developer Policies, Meta advertising data is accessed only with the Client's authorization via Meta's official API, limited to granted permissions (read-only), used only to provide analytics/insights to the Client, and never sold, transferred, or used for cross-Client profiling.

Platform-specific (Google). Our use of Google Ads and Google Analytics data received through Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google user data is used only to provide and improve the Client-facing features that the Client authorized, and is not transferred or used except as those requirements allow.

3. HOW DO WE PROCESS YOUR INFORMATION?

In Short: We process your information to provide, improve, and administer our Services, communicate with you, for security and fraud prevention, and to comply with law. We may also process your information for other purposes with your consent.

We process your personal information for a variety of reasons, including to: facilitate account creation and authentication; deliver and facilitate delivery of services; respond to inquiries and offer support; request feedback; send marketing and promotional communications (which you can opt out of); evaluate and improve our Services, products, marketing, and your experience; and identify usage trends.

4. WHEN AND WITH WHOM DO WE SHARE YOUR PERSONAL INFORMATION?

In Short: We may share information in specific situations described in this section and/or with the following third parties.

We may share your personal information in the following situations:

• Service providers / subprocessors. With vendors who host and operate the platform under contract and confidentiality (cloud hosting, database, authentication, and the AI providers listed in Section 6).
• Within the Client's own organization. The Client controls who on their team can access their data.
• Business Transfers. In connection with a merger, sale of assets, financing, or acquisition.
• Affiliates. With our parent company and any subsidiaries or entities under common control, who must honor this Privacy Notice.
• Business Partners. To offer certain products, services, or promotions.

We never share one Client's connected business data with another Client.

5. DO WE USE COOKIES AND OTHER TRACKING TECHNOLOGIES?

In Short: We may use cookies and other tracking technologies to collect and store your information.

We may use cookies and similar tracking technologies (like web beacons and pixels) to gather information when you interact with our Services, to maintain security, prevent crashes, save preferences, and support basic functions. We may permit third parties and service providers to use tracking technologies for analytics and advertising. Where applicable US state law treats such technologies as a "sale"/"sharing," you can opt out as described in Section 13.

Google Analytics

We may share information with Google Analytics to track and analyze use of the Services. You can opt out of Google Analytics via https://tools.google.com/dlpage/gaoptout. For more information, see the Google Privacy & Terms page.

6. DO WE OFFER ARTIFICIAL INTELLIGENCE-BASED PRODUCTS?

In Short: We offer products, features, or tools powered by artificial intelligence, machine learning, or similar technologies.

As part of our Services, we offer AI-powered products, features, or tools ("AI Products"). We provide these through third-party AI service providers, which may include: Anthropic, Amazon Web Services (AWS) AI, ElevenLabs, Google Cloud AI, Groq, Perplexity, xAI, DALL-E, Midjourney, and OpenAI. Your input, output, and personal information may be shared with and processed by these providers to enable your use of our AI Products, as outlined in Section 4.

Our AI Products are designed for functions such as: AI applications, automation, insights, predictive analytics, research, text/image/video analysis, and machine learning models.

All personal information processed using our AI Products is handled in line with this Privacy Notice and our agreements with third parties. To opt out, contact us using the details provided.

7. HOW DO WE HANDLE YOUR SOCIAL LOGINS?

In Short: If you choose to register or log in using a social media account, we may have access to certain information about you.

If you register or log in using a third-party social media account, we receive certain profile information (typically name, email, and profile picture). We use it only as described in this Notice. We do not control the social media provider's own use of your information.

8. HOW LONG DO WE KEEP YOUR INFORMATION?

In Short: We keep your information as long as necessary unless otherwise required by law.

We keep your personal information only as long as necessary for the purposes in this Notice, unless a longer period is required or permitted by law. No purpose will require keeping your personal information longer than twenty-four (24) months past the termination of the user's account. When we have no ongoing legitimate business need, we will delete or de-identify it, or securely store and isolate it until deletion is possible.

9. HOW DO WE KEEP YOUR INFORMATION SAFE?

In Short: We aim to protect your personal information through organizational and technical security measures.

We have implemented appropriate and reasonable technical and organizational security measures, including encryption of access credentials and per-Client data isolation. However, no transmission or storage is 100% secure; transmission to and from our Services is at your own risk.

10. DO WE COLLECT INFORMATION FROM MINORS?

In Short: We do not knowingly collect data from or market to children under 18 years of age.

We do not knowingly collect, solicit, or market to children under 18, nor knowingly sell such information. By using the Services, you represent you are at least 18 or the parent/guardian of a minor consenting to their use. If we learn we have collected data from a user under 18, we will deactivate the account and delete the data. Contact os@mag.cr with concerns.

11. WHAT ARE YOUR PRIVACY RIGHTS?

In Short: You may review, change, or terminate your account at any time, depending on your location.

Withdrawing consent. Where we rely on your consent, you may withdraw it at any time by contacting us (Section 16). This won't affect the lawfulness of prior processing.

Opting out of marketing. Unsubscribe via the link in our emails or by contacting us; we may still send service-related messages.

Account information. You can review/change your account or request termination; upon termination we deactivate/delete your account, though we may retain some information to prevent fraud, comply with law, or enforce terms.

Cookies. Most browsers accept cookies by default; you can set yours to remove/reject them, which may affect some features.

Questions about your privacy rights? Email os@mag.cr.

12. CONTROLS FOR DO-NOT-TRACK FEATURES

Most browsers and some mobile OS/apps include a Do-Not-Track ("DNT") feature. No uniform technology standard for recognizing DNT signals has been finalized, so we do not currently respond to them. California law requires us to disclose this; because there is no industry/legal standard, we do not respond to DNT signals at this time.

13. DO UNITED STATES RESIDENTS HAVE SPECIFIC PRIVACY RIGHTS?

In Short: If you are a resident of certain US states, you may have rights to access, correct, delete, or obtain a copy of your personal information, and to opt out of certain processing.

Residents of California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, or Virginia may have these rights, which may be limited by law.

Your rights include: the right to know whether we process your personal data; to access it; to correct inaccuracies; to request deletion; to obtain a copy; to non-discrimination for exercising rights; and to opt out of processing for targeted advertising, sale, or profiling with legal/significant effects. Depending on your state you may have additional rights (categories of data processed, lists of third parties, profiling review, limits on sensitive data use).

We have not sold or shared personal information to third parties for a business/commercial purpose in the preceding 12 months, and will not sell or share it in the future.

How to exercise your rights. Email os@mag.cr, or use the contact details below. You may use an authorized agent. We will verify your identity before acting. Appeals: if we decline, you may appeal by emailing os@mag.cr, and may contact your state attorney general.

California "Shine The Light." California residents may request, once a year and free of charge, information about categories of personal information disclosed to third parties for direct marketing. Submit requests via Section 16.

14. DO OTHER REGIONS HAVE SPECIFIC PRIVACY RIGHTS?

In Short: You may have additional rights based on the country you reside in.

Republic of South Africa

At any time you may request access to or correction of your personal information via Section 17. If unsatisfied with how we handle a complaint, you may contact the regulator:

The Information Regulator (South Africa) — General enquiries: enquiries@inforegulator.org.za · Complaints (POPIA/PAIA form 5): PAIAComplaints@inforegulator.org.za & POPIAComplaints@inforegulator.org.za

15. DO WE MAKE UPDATES TO THIS NOTICE?

In Short: Yes, we will update this notice as necessary to stay compliant with relevant laws.

We may update this Privacy Notice from time to time, indicated by an updated date at the top. Material changes may be notified by posting a notice or contacting you directly.

16. HOW CAN YOU CONTACT US ABOUT THIS NOTICE?

If you have questions or comments, email os@mag.cr or contact us by post at:

17. HOW CAN YOU REVIEW, UPDATE, OR DELETE THE DATA WE COLLECT FROM YOU?

Based on applicable laws, you may have the right to request access to the personal information we collect, details on how we process it, correct inaccuracies, or delete your personal information, and to withdraw consent. To request this, contact us at os@mag.cr.