Privacy Policy

Mach Five Magnet (“Mach Five Magnet”, “we”, “us”, or “our”) is a conversational lead capture service operated by Arcanus 55 Inc, d/b/a Mach Five Marketing, a Mach Five Group brand. This Privacy Policy explains what information we collect, how we use it, and the choices you have.

This policy covers two different relationships:

• When you are our customer or visit our website. If you create an account, use the dashboard, or browse machfivemagnet.com, we act as the controller of your information and this policy governs directly.
• When you are a visitor to a customer’s website. If you interact with a magnet that one of our customers has placed on their own site, we process the information you provide on that customer’s behalf and under their instructions. In that case the customer is the controller, their privacy notice governs, and you should direct requests about that data to them. We describe this “lead data” below and will assist our customers in responding to you.

If you do not agree with this policy, please do not use the service.

Information we collect

Account information you provide. When you create an account we collect your name, email address, and password (stored only as a non-reversible hash), and optionally your company name and phone number. Within a workspace we also store your role and organization membership.

Content and configuration. We store the magnets, conversation flows, settings, and other content you create in the service.

Communications. If you contact us for support or send us messages, we keep those communications and our replies.

Usage and device information. When you use the service we automatically collect log and device information such as IP address, browser and device type, pages viewed, actions taken, and timestamps. We use cookies and similar local storage technologies as described below.

Lead data processed for our customers. When a visitor interacts with a customer’s magnet, the magnet collects the information the customer configured its conversation to request. This can include a visitor’s name, email address, phone number, and answers to the conversation’s questions, along with campaign attribution parameters (such as UTM tags and advertising click identifiers), session and progress telemetry (for example whether a conversation was opened, engaged with, or completed), and IP address. We process this lead data to provide the service to the customer and according to the customer’s instructions. We do not use lead data to build our own marketing profiles and we do not sell it.

How we use information

We use the information we collect to:

• Provide, operate, secure, and maintain the service.
• Authenticate you and manage your account, workspace, and roles.
• Send transactional and service messages, such as email verification, password resets, invitations, and important notices.
• Respond to support requests and communicate with you about the service.
• Monitor, analyze, and improve the performance, features, and security of the service.
• Detect, prevent, and address fraud, abuse, and technical issues.
• Comply with our legal obligations and enforce our agreements.

We do not sell personal information, and we do not use lead data collected through our customers’ magnets for our own advertising.

Legal bases for processing

Where data protection laws such as the GDPR apply, we rely on the following legal bases: performance of a contract (to provide the service you or your organization requested), our legitimate interests (to operate, secure, and improve the service), your consent (where we ask for it, such as certain communications), and compliance with legal obligations. For lead data, our customer is responsible for establishing the legal basis for collecting it.

Cookies and local storage

We use cookies and browser local storage that are necessary to operate the service, including keeping you signed in and remembering essential preferences. The embeddable magnet uses local or session storage on a customer’s site to maintain conversation continuity for a visitor. We do not use third party advertising cookies to track you across unrelated websites. Campaign attribution identifiers that appear in lead data originate from the customer’s own advertising and links, not from tracking we perform.

You can control cookies through your browser settings, though disabling essential cookies may prevent the service from working.

How we share information

We share information only in these circumstances:

• Service providers (subprocessors). We use vetted third parties to host and operate the service and to deliver email. These currently include our cloud hosting and database provider and our transactional email provider. They may process information only to provide services to us and under obligations of confidentiality and security. See “Subprocessors” below.
• Within our corporate group. We may share information with affiliated Mach Five Group entities that help us operate the business, subject to this policy.
• Legal and safety. We may disclose information if required by law, regulation, legal process, or governmental request, or where we believe disclosure is necessary to protect rights, safety, or property, or to investigate fraud or abuse.
• Business transfers. If we are involved in a merger, acquisition, financing, or sale of assets, information may be transferred as part of that transaction. We will provide notice as required by law.

We do not sell or rent personal information.

Subprocessors

We currently rely on the following categories of subprocessors to deliver the service:

[Confirm and complete this list with the specific vendor names and regions your deployment uses, for example the hosting platform and the email provider. Keep it current, since customers and their visitors rely on it.]

Data retention

We retain account information for as long as your account is active and for a reasonable period afterward to comply with legal obligations, resolve disputes, and enforce our agreements. When you delete content or close your account, we mark the affected records for removal and delete or de-identify them in the ordinary course, subject to backups and legal requirements. For lead data, we retain it according to the customer’s instructions and delete it when the customer directs or when the account is closed.

Security

We take reasonable technical and organizational measures to protect information, including transport encryption, hashed passwords, access controls, and restricted administrative access. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If you believe your account has been compromised, contact us at [security@machfivemagnet.com].

International data transfers

We operate from and process information in the United States. If you access the service from outside the United States, you understand that your information may be transferred to, stored in, and processed in the United States and other locations where our subprocessors operate. Where required, we use appropriate safeguards for such transfers.

Your rights and choices

Depending on where you live, you may have rights to access, correct, delete, or receive a copy of your personal information, to object to or restrict certain processing, and to withdraw consent. To exercise these rights for information we control (your account and website use), contact us at [privacy@machfivemagnet.com]. We will respond as required by applicable law and may need to verify your identity.

If your request concerns lead data collected through a customer’s magnet, that customer is the controller. Please contact the customer directly. If you contact us, we will refer your request to the relevant customer and assist them in responding.

You can also unsubscribe from non-essential emails using the link in those messages. We will still send necessary transactional messages related to your account.

Children’s privacy

The service is not directed to children, and we do not knowingly collect personal information from children under the age of 16 (or the minimum age required in your jurisdiction). Customers must not configure magnets to collect information from children. If you believe a child has provided us information, contact us and we will take appropriate steps to delete it.

Responsibilities of our customers

Customers who deploy magnets are responsible for their use of the service, including establishing a lawful basis for collecting lead data, providing their own privacy notice to their visitors, obtaining any required consent, honoring visitor requests, and not collecting sensitive or special category data or data from children through their magnets. Customers are the controllers of the lead data they collect.

Third party websites

Magnets appear on our customers’ websites, and our website may link to third party sites. Those sites are governed by their own privacy policies, and we are not responsible for their practices.

Changes to this policy

We may update this policy from time to time. When we make material changes, we will update the effective date above and, where appropriate, provide additional notice. Your continued use of the service after an update means you accept the revised policy.

Contact us

If you have questions about this policy or our privacy practices, contact us at:

Arcanus 55 Inc [REGISTERED ADDRESS] [privacy@machfivemagnet.com]