Snapshot 19874
Normalized text
Scripts and page chrome removed; this is what change detection compares.
mxHERO | Privacy Privacy Policy mxHERO Inc. (“mxHERO”, “We”, “Us”, or “Our”) is committed to protecting the privacy of your personal information while using our Web sites (www.mxhero.com, www.mail2cloud.io) and when using our on-demand support platform, tools and services offered on the Web site and through our servers (the “Service”). mxHERO has established this Privacy Policy Statement to help you understand how we collect and use personally identifiable information if and when you use our Web site as a “Visitor” or provide information to us in connection with your use of the Service as a “Subscriber”. By using our Web site you are agreeing to the collection and use of personal information in the manner described in this Privacy Policy Statement. By registering for our Service, you are agreeing to the collection and use of personal information in the manner described in this Privacy Policy Statement and the mxHERO Terms of Service. Does mxHERO participate in the EU-U.S. Data Privacy Framework Principles? mxHERO complies with the EU-U.S. Data Privacy Framework (EU-U.S. DPF) and the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF) as set forth by the U.S. Department of Commerce. mxHERO has certified to the U.S. Department of Commerce that it adheres to the EU-U.S. Data Privacy Framework Principles (EU-U.S. DPF Principles) with regard to the processing of personal data received from the European Union and the United Kingdom in reliance on the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF. mxHERO has certified to the U.S. Department of Commerce that it adheres to the Swiss-U.S. Data Privacy Framework Principles (Swiss-U.S. DPF Principles) with regard to the processing of personal data received from Switzerland in reliance on the Swiss-U.S. DPF. If there is any conflict between the terms in this privacy policy and the EU-U.S. DPF Principles and/or the Swiss-U.S. DPF Principles, the Principles shall govern. To learn more about the Data Privacy Framework (DPF) program, and to view our certification, please visit https://www.dataprivacyframework.gov/ Privacy Complaints & Dispute Resolution In compliance with the EU-US Data Privacy Framework Principles, mxHERO commits to resolve complaints about your privacy and our collection or use of your personal information transferred to the United States pursuant to the DPF Principles. European Union, Swiss and United Kingdom individuals with DPF inquiries or complaints should first contact mxHERO at [email protected]. mxHERO has further committed to refer unresolved privacy complaints under the DPF Principles to an independent dispute resolution mechanism, Data Privacy Framework Services, operated by BBB National Programs. If you do not receive timely acknowledgment of your complaint, or if your complaint is not satisfactorily addressed, please visit https://bbbprograms.org/programs/all-programs/dpf-consumers/ProcessForConsumers for more information and to file a complaint. This service is provided free of charge to you. If your DPF complaint cannot be resolved through the above channels, under certain conditions, you may invoke binding arbitration for some residual claims not resolved by other redress mechanisms. See https://www.dataprivacyframework.gov/s/article/G-Arbitration-Procedures-dpf?tabset-35584=2 The United States Federal Trade Commission (FTC) is the enforcement authority with jurisdiction over this compliance with the privacy policy. mxHERO may be liable for appropriate onward transfers of personal data to third parties. Please be aware that mxHERO may be required to disclose an individual’s personal information in response to a lawful request by public authorities, including to meet national security or law enforcement requirements. Finally, as a last resort and in limited situations, EU and Swiss individuals may seek redress from the Privacy Panel, a binding arbitration mechanism. mxHERO acknowledges the right of individuals to access their personal data. If you want to access your personal data held by mxHERO, please contact us at [email protected]. What information do we collect? INFORMATION YOU PROVIDE: We collect information from you when you register on our site, place an order, subscribe to our newsletter, respond to a survey, fill out a form or download or use our product. When ordering or registering on our site, as appropriate, you may be asked to enter your: name, e-mail address, mailing address, phone number or credit card information. You may, however, visit our site anonymously. INFORMATION COLLECTED FROM EMAIL SERVICES: mxHERO’s Mail2Cloud product does not collect and retain email content, whether the message body or any attachments. Mail2Cloud is deployed much like a network router in that the service processes information then forwards the result of that processing towards the intended destination. All email content processed by Mail2Cloud follows the client’s configuration of the product and is permanently erased after processing and retransmission. This process normally takes a few seconds per message. The only information collected from emails are the standard email headers stored by email server logs. In the case of Mail2Cloud, these headers are the email address of the sender and the email address of the recipient. This information is stored on your behalf and exclusively for your use. Mail2Cloud Advanced is a separate product, purchased under a separate subscription, that does retain email content in a vector database in order to provide AI-powered search. Email content is retained only for customers who have subscribed to Mail2Cloud Advanced. If your organization uses Mail2Cloud without a Mail2Cloud Advanced subscription, the paragraph above describes our handling of your email in full and no email content is retained. The section titled “Mail2Cloud Advanced — AI Search of Email” below describes what is stored, where it is stored, and which service providers are involved. mxHERO does not use customer data to train its AI-enabled technology. COOKIES: When you visit the Web site or use the Service, we use session “cookies” – a piece of information stored on your computer – to allow the Web site or Service to uniquely identify your browser while you are logged in and to enable mxHERO to process your online transactions. We do not link the information we store in cookies to any personally identifiable information you submit while using the Web site other than the email address you provide. Session cookies also help us verify your identity and are required in order to use the Service. mxHERO uses persistent cookies, that only mxHERO can read and use, to identify you as a valid user of a mxHERO Subscription plan and make it easier for you to log in to the Service. Analytical cookies and similar technologies are also used to allow mxHERO to recognize how visitors move around the Web site and the Service when they’re using it. We use this information, which does not identify end users, to analyze trends, to troubleshoot the Web site and Service, to track end users’ movements while on the site and to gather demographic information about our user base as a whole. Various browsers may offer their own management tools for removing these types of tracking technologies. This helps us improve the overall user experience. The use of cookies by our partners is not covered by our Privacy Policy Statement; we do not have access or control over these cookies. The following sections (Clear Gifs, Analytics & Remarketing) refer only to usage of the mxHERO website (https://mxhero.com) and do not refer to mxHERO’s products and services, nor mxHERO’s administrative dashboards used by mxHERO client’s to configure and administer their mxHERO service. In addition, when mxHERO is used with Google services (e.g. GSuite, Google Drive), Mail2Cloud’s use of information received from Google Restricted scopes APIs will adhere to Google’s Limited Use requirements. CLEAR GIFS: We also use third party advertising and tracking tools that employ a software technology called clear gifs (a.k.a. Web Beacons/Web Bugs), to help us better manage content on our mxhero.com website by informing us what content is effective. Clear gifs are tiny graphics with a unique identifier, similar in function to cookies, and are used to track the movements of the visitors to our Web site. In contrast to cookies, which are stored on a user’s computer hard drive, clear gifs are embedded invisibly on Web pages and are about the size of the period at the end of this sentence. We tie the information gathered by clear gifs to our Visitors and Subscribers in order to optimize and enhance the Web site and Service experience. We use clear gifs in our HTML-based emails to let us know which emails have been opened by recipients. This allows us to gauge the effectiveness of certain communications and the effectiveness of our marketing campaigns. Log Files: As is true of most Web sites, we gather certain information automatically and store it in log files. This information includes Internet protocol (IP) addresses, browser type, Internet service provider (ISP), referring/exit pages, operating system, date/time stamp and clickstream data. ANALYTICS & REMARKETING: mxHERO uses remarketing on the web site with Google Analytics to advertise online. We use Google’s services to show our ads on sites across the Internet. mxHERO and Google, use first-party cookies (such as the Google Analytics cookie) together to inform, optimize, and serve ads based on your past visits to our website. You can opt-out of Google Analytics for Display Advertising and customize Google Display Network ads using Google’s Ads Preferences Manager. If you wish to not have your information used for the purpose of serving you interest-based ads, you may opt-out by emailing [email protected] and indicating the accounts or domains that you wish to opt-out. Please note this does not opt you out of being served advertising. You may continue to receive generic ads. Mail2Cloud Advanced — AI Search of Email This section applies only to organizations that have purchased a Mail2Cloud Advanced subscription. Mail2Cloud Advanced is a separate SKU from Mail2Cloud. If your organization has not subscribed to Mail2Cloud Advanced, mxHERO does not retain your email content and this section does not apply to you. What we store For subscribing organizations, Mail2Cloud Advanced retains the email content selected by the Customer’s own configuration — which mailboxes, which date ranges, and which content are determined by the Customer, not by mxHERO. The retained data may include message bodies, standard message headers (sender, recipients, subject, date), thread and reference identifiers, and text extracted from attachments. This content is indexed into a vector database so that it can be searched. Customer data is stored in per-Customer isolated indexes. Access is gated by authentication, and a given user’s searches return results only from the tenant their account belongs to. Where it is stored and which service providers are involved mxHERO uses the following service providers (“subprocessors”) to deliver Mail2Cloud Advanced. Each is bound by contract to process data only on mxHERO’s instructions and to maintain appropriate security. Service provider What it processes Purpose Amazon Web Services (AWS) Application infrastructure Hosting of the Mail2Cloud Advanced service Zilliz Cloud (managed Milvus), hosted on AWS in the EU (eu-central-1, Frankfurt) Email content, attachment text, and associated metadata Vector index that makes email searchable OpenAI Email content at the time it is indexed; search query text at the time a search is run Generation of vector embeddings, via the vector database’s embedding integration Couchbase Account records, registered application clients, short-lived authorization codes and sign-in state, and refresh-token usage records Authentication and account management Amazon Simple Email Service (SES) Email address of the person signing in Delivery of sign-in verification codes mxHERO does not sell customer email content, and does not use customer email content — or any data derived from it — to train mxHERO’s own AI models. mxHERO’s agreements with the providers above prohibit their use of customer content to train their models. Connecting an AI assistant (MCP and similar protocols) Mail2Cloud Advanced can be connected to third-party AI assistants — for example Anthropic’s Claude — using the Model Context Protocol (MCP) or comparable protocols such as A2A. Authorization. Connecting an AI assistant requires the user to sign in to mxHERO and to approve the connection on a consent screen that names the application requesting access and the address it will return to. No connection is established without that approval. The connection can be revoked by the user or by the Customer’s administrator at any time. Access is read-only. The tools exposed to a connected AI assistant only search and read email. They cannot send, modify, or delete messages. What is transmitted to mxHERO. When a user asks a connected AI assistant a question that requires an email search, the assistant sends mxHERO the search request, which includes the user’s question text together with any search parameters the assistant has derived from it (such as sender, recipient, date range, or a document identifier). That query text is processed by the embedding provider identified in the table above in order to run the search. What mxHERO does not receive. mxHERO does not receive, collect, or store the wider conversation between a user and their AI assistant. Only the individual search requests described above reach mxHERO. What is returned to the AI assistant. mxHERO returns the matching messages, metadata and attachment text from the Customer’s own tenant. That material is then handled by the AI assistant provider under that provider’s own privacy policy and terms, which mxHERO does not control. Customers should review the privacy terms of any AI assistant they choose to connect. Retention and deletion Retained email content is held for the duration of the Customer’s Mail2Cloud Advanced subscription, and is deleted following termination in accordance with the Customer’s agreement with mxHERO. Records of refresh-token usage, which are held to detect replayed credentials, are retained for no more than 30 days. Short-lived authorization codes and sign-in state expire within minutes of issuance. A Customer may request deletion of their data from our vector databases at any time by contacting [email protected]. Individual users may request access to, or deletion of, personal data held about them by contacting [email protected]. Security mxHERO maintains a SOC 2 Type II attestation covering the Service. Data is encrypted in transit and at rest. Access to production systems is restricted to authorized personnel, requires multi-factor authentication, and is logged. Customer indexes are isolated from one another. International transfers The vector index for Mail2Cloud Advanced is hosted in the European Union. Other elements of the Service, and mxHERO personnel, are located in the United States, and personal data may therefore be transferred to and processed in the United States. Such transfers are made in reliance on mxHERO’s certification under the EU-U.S. Data Privacy Framework, the UK Extension, and the Swiss-U.S. Data Privacy Framework, as described earlier in this policy. What do we use your information for? Any of the information we collect from you may be used in one of the following ways: If you are using a paid service, including service that is otherwise pay but provided without cost due to a trial period or offered free of charge by mxHERO, your information, whether public or private, will not be sold, exchanged, transferred, or given to any other company. If you are using a freely offered service, meaning a service that is offered to the market without fee or other monetary expenses of any kind, then your information, whether public or private, will not be sold, exchanged, transferred, or given to any other company that is not a contractual partner of mxHERO for any reason whatsoever, without your consent, other than for the express purpose of delivering the purchased product or service requested or to do anonymized statistical analysis. mxHERO partner companies sign non-disclosure agreements and other instruments guaranteeing adherence to the principles and directives established herein. If you wish to explicitly restrict the sharing of any and all data with third parties, you may do so by requesting said exclusion in writing to [email protected]. Please note that we cannot guarantee our ability to fully provide our Services in the event that such an exclusion is requested. Further, we use information we collect from our users for the following purposes: TO PERSONALIZE YOUR EXPERIENCE Your information helps us to better respond to your individual needs TO IMPROVE CUSTOMER SERVICE Your information helps us to more effectively respond to your customer service requests and support needs TO PROCESS TRANSACTIONS Any billing information you provide through our payment systems, whether public or private, will not be sold, exchanged, transferred, or given to any other company. TO SEND PERIODIC EMAILS The email address you provide for order processing, may be used to send you information and updates pertaining to your order, in addition to receiving occasional company news, updates, related product or service information, etc. Note: If at any time you would like to unsubscribe from receiving future emails, we include detailed unsubscribe instructions at the bottom of each email. Can I opt out? You may set your browser to block all cookies, including cookies associated with our Service. You may also disconnect or otherwise configure your system such that information is not passed through Users who disable their browsers’ ability to accept cookies will be able to browse our Web site, but will not be able to access or take advantage of the Service. You can also opt out of our newsletters and surveys and you may follow the unsubscribe/opt out instructions contained in each of those communications. If your organization subscribes to Mail2Cloud Advanced, you may disconnect any AI assistant you have authorized at any time, and your Customer administrator may disable the integration for your organization. How will you notify me of changes to this policy? mxHERO may update this policy from time to time. You can review the most current version of this Privacy Policy at any time at https://mxhero.com/privacy. If we make any material changes we will notify you by email (sent to the e-mail address specified in your account) or by means of a notice on this Site prior to the change becoming effective. Your only remedy, if you do not accept the terms of this Privacy Policy, is to discontinue use of the Site and Service. Contact Us If you have any questions regarding this Privacy Policy you may contact us at [email protected] or via postal mail at: mxHERO, Inc 100 Pine St., Suite 1250 San Francisco, CA 94111