Privacy Notice

Effective date: February 27, 2026
Last updated: September 22, 2026

This Privacy Notice explains how Magister AI LLC (“Magister AI,” “we,” “us,” or “our”) collects, uses, discloses, retains, and protects personal data when you use Magister AI’s websites, Companions, files, connected tools, support services, and related features (collectively, the “Service”).

Magister AI is responsible for the personal data covered by this Notice. If you use an organization-managed version of the Service, the organization may control some personal data and its own privacy notice may also apply.

This Notice should be read together with our Consumer Terms and Acceptable Use Policy.

1. Personal data we collect

The personal data we collect depends on the features you use and the information you choose to provide.

1.1 Account and profile information

We collect information used to create, secure, and administer your account, such as:

• your name, email address, username, and account identifier;
• authentication and account-security information;
• account settings, preferences, plan, and status; and
• information you provide to verify or recover your account.

1.2 Billing and transaction information

If you purchase a subscription or usage credits, we collect transaction information such as your plan, purchase amount, currency, payment status, billing dates, credit balance, invoices, and limited payment-method details.

A payment provider may collect and process payment-card or financial-account information directly. We generally do not need to receive or store full payment-card numbers.

1.3 Content and conversation history

We collect and store Content you provide to or receive from the Service, including:

• prompts, messages, instructions, and responses;
• files, images, code, data, links, and other materials you upload or retrieve;
• Outputs generated for you;
• conversation history;
• feedback and ratings; and
• information produced, accessed, changed, or transmitted when a Companion uses a tool or takes an Action at your direction.

Content may contain personal data about you or another person. Please provide personal data only when you have the right and authority to do so.

1.4 Connections, permissions, and securely stored credentials

If you connect a third-party service or use a feature expressly designed to store credentials or secrets, we may collect:

• connection details and identifiers;
• the permissions and access scopes you authorize;
• access tokens, API keys, passwords, private keys, or other credentials you choose to store using the supported secure-storage feature; and
• metadata about when a connection or credential was created, accessed, changed, or revoked.

We treat credentials and secrets as sensitive data and process them only to secure your account, maintain the supported storage feature, connect services, and carry out Actions you authorize. Please do not place credentials or secrets in ordinary conversation Content when the supported secure-storage feature can be used instead.

1.5 Activity, device, and system-log data

When you use the Service, we automatically collect operational and technical information, which may include:

• Internet Protocol address and general location derived from it;
• browser, operating system, device type, language, and user-agent information;
• dates and times of access, session and request identifiers, referring pages, and pages or features used;
• model, Companion, tool, integration, and Action activity;
• usage, performance, latency, error, debugging, security, and audit information; and
• account, subscription, credit, rate-limit, and abuse-prevention events.

We do not collect precise device location unless a feature clearly asks for it and you choose to provide it.

1.6 Communications and marketing information

If you contact us, report an issue, make a privacy request, participate in a survey, or provide feedback, we collect your contact details and the contents and metadata of the communication.

We may also record whether you received, opened, or interacted with a service or feature-announcement email, where permitted by law and technically supported.

1.7 Information from other sources

We may receive personal data from:

• a person or organization that invites you to or administers an account;
• a connected service you authorize a Companion to access;
• payment, security, fraud-prevention, and identity-verification providers;
• public sources where necessary to provide a requested feature; and
• another user who includes information about you in Content.

2. How we use personal data

We use personal data to:

1. 1. provide, operate, maintain, personalize, and troubleshoot the Service;
2. 2. create and secure accounts and authenticate access;
3. 3. preserve conversation history and other account features you use;
4. 4. route requests to models, generate Outputs, and allow Companions to perform authorized Actions;
5. 5. operate supported credential and secret storage and connected services;
6. 6. process subscriptions, usage credits, payments, refunds, and taxes;
7. 7. provide support and respond to questions, reports, privacy requests, and appeals;
8. 8. monitor performance, capacity, reliability, and product usage;
9. 9. detect, investigate, prevent, and respond to fraud, abuse, policy violations, security threats, and unlawful activity;
10. 10. enforce our agreements and protect the rights, safety, privacy, and property of users, Magister AI, and others;
11. 11. comply with law, valid legal process, and regulatory obligations;
12. 12. develop, test, and improve features, interfaces, routing, reliability, and security without training artificial-intelligence models on your Content;
13. 13. send transactional, security, billing, service, and legal communications; and
14. 14. send information about new or changed features and related Magister AI services, subject to your marketing choices.

Where applicable law requires a legal basis, we process personal data as needed to provide the Service you request, with consent, to comply with legal obligations, and for legitimate interests such as security, support, fraud prevention, service operation, and product improvement, provided those interests are not overridden by applicable rights.

3. No model training on your Content

We do not use your Content to train or fine-tune artificial-intelligence models. We do not authorize model providers that process your Content for the Service to use it to train or fine-tune their models.

We may analyze operational metadata and may review Content when reasonably necessary to provide support, investigate an error, protect security, prevent abuse, enforce our policies, or comply with law. Those operational uses do not authorize model training.

We may create aggregated or de-identified information that does not reasonably identify you. We may use that information to understand Service operation, improve features and reliability, conduct research, and protect security. We maintain de-identified information in de-identified form and do not attempt to reidentify it except where permitted or required by law to test our de-identification processes.

4. Review by artificial intelligence and people

We use artificial-intelligence systems to operate the Service and may use them to assist with support, security, fraud detection, abuse prevention, policy enforcement, and privacy-request handling.

Relevant information may be reviewed by artificial-intelligence systems and, where appropriate or required by law, by authorized human reviewers. A review may be conducted by artificial intelligence, a human reviewer, or a combination of both. Human access is strictly limited to authorized personnel where necessary for escalation, troubleshooting, legal compliance, safety, or responding to a request from you.

We do not promise that every support request, moderation decision, enforcement action, or appeal will receive human review. Where applicable law requires human involvement or another safeguard, we will provide it.

5. How we disclose personal data

We do not sell personal data. We do not share personal data for cross-context behavioural advertising or targeted advertising, and the Service does not display advertising.

We may disclose personal data as follows.

5.1 Model and infrastructure providers

We use model providers and cloud, compute, storage, networking, and hardware-infrastructure providers to operate the Service. The provider used for a request may depend on the selected model or Companion, availability, routing, performance, and feature requirements.

These providers may process Content, technical data, and request metadata to return model responses, execute requested functions, host data, maintain infrastructure, prevent abuse, or comply with law. We use contractual and technical controls intended to limit their processing to these purposes and do not authorize them to train or fine-tune models on your Content.

Provider configurations and legally required security or abuse-retention practices may vary. We do not incorporate a provider’s changing privacy policy into this Notice. We remain responsible for describing Magister AI’s own practices and for selecting and configuring providers consistent with our commitments.

5.2 Other service providers

We may use service providers for functions such as authentication, payment processing, communications, customer support, security, fraud prevention, compliance, and professional advice. They may process personal data only as needed to perform services for us, follow our instructions, protect their systems, or comply with law.

5.3 Connected services and recipients you choose

If you connect or direct a Companion to interact with another service, person, or organization, we disclose the information reasonably necessary to follow your instruction. The recipient’s own terms and privacy practices apply after it receives the information.

5.4 Organization administrators

If an organization manages your account, its authorized administrators may be able to access, export, retain, delete, or control Content and account information; configure features and permissions; monitor activity; and restrict access, subject to applicable law and the organization’s agreement with us.

5.5 Legal, safety, and enforcement disclosures

We may preserve or disclose personal data where we reasonably believe doing so is necessary to:

• comply with applicable law, a court order, or valid legal process;
• respond to a regulator or lawful government request;
• detect, prevent, investigate, or address fraud, abuse, security incidents, or unlawful conduct;
• enforce our terms and policies;
• protect the rights, safety, privacy, or property of a person, Magister AI, or the public; or
• establish, exercise, or defend legal claims.

5.6 Corporate transactions

Personal data may be disclosed to advisers, counterparties, or successors in connection with due diligence, financing, a merger, acquisition, reorganization, bankruptcy, sale of assets, or transfer of all or part of the Service. Any successor will be required to handle the data consistently with applicable law and the commitments that continue to apply.

6. Cookies and similar technologies

We may use cookies, local storage, and similar technologies that are reasonably necessary to:

• keep you signed in and secure your account;
• remember preferences;
• route requests and balance Service traffic;
• prevent fraud and abuse; and
• understand and troubleshoot Service performance.

We do not use advertising cookies or similar technologies to serve targeted ads. Because we do not sell personal data or share it for targeted advertising, browser-based opt-out preference signals generally do not change our practices. We will recognize such signals where applicable law requires a different response.

6.1 Optional website analytics

We use optional Google Analytics 4 on magisterai.com to measure website visits and clicks on “Try it free” links. This helps us understand which pages and campaigns encourage visitors to try Magister AI. This setup does not track signups or activity inside the portal.

Google receives information such as the public pages you visit, campaign tags, browser and device information, and cookie identifiers. On visits we identify as originating in the United States, analytics may start automatically unless you have declined or your browser sends a Global Privacy Control signal. For other visits, including when we cannot determine your country, we ask first and keep Google Analytics blocked until you choose “Allow.” We use an approximate country lookup from our website’s delivery provider to apply this setting; we do not request your device’s precise location. Declining has no effect on your access to the website. We do not enable Google signals, advertising personalization, or user-provided data collection for this analytics setup, and we do not send account details or conversation content.

You can change your choice at any time using “Cookies” in the website footer. Withdrawing consent stops future analytics collection in this browser and removes this website’s analytics cookies; it does not erase data already collected. We remember your consent choice for up to 180 days and limit these analytics cookies to 180 days. Event-level analytics data is retained for two months; aggregated reports may be retained longer.

For more information, see how Google uses information from sites that use its services.

7. Data retention

We retain personal data only for as long as reasonably necessary for the purposes described in this Notice, including to provide the Service, maintain security, comply with law, resolve disputes, and enforce our agreements.

7.1 Content, conversation history, and stored credentials

Content, conversation history, connected-service information, and supported stored credentials are generally retained while needed to provide the relevant feature or until you delete them, disconnect the service, close your account, or ask us to delete them.

When you delete Content or close your account, we delete the affected Content from our active systems within 30 days, unless a longer period is reasonably necessary to comply with law, respond to a security or abuse incident, resolve a dispute, enforce our agreements, or protect rights and safety.

7.2 Activity and system logs

Activity, performance, error, debugging, security, and similar system logs are generally retained for up to 60 days. We may retain particular records for longer where reasonably necessary to investigate an incident, prevent fraud or abuse, preserve security, comply with law, resolve a dispute, or establish, exercise, or defend legal claims.

7.3 Account, billing, support, and legal records

We retain account, transaction, tax, billing, support, privacy-request, consent, opt-out, enforcement, and legal records for as long as reasonably necessary for the relevant purpose and any period required by law.

After account deletion, we may retain limited identifiers or records where reasonably necessary to prevent fraud or repeated abuse, maintain a marketing opt-out, document compliance, collect valid amounts owed, or comply with law. We do not use retained records to reconstruct deleted conversation history.

7.4 Providers and backups

Model and infrastructure providers may retain limited information under their service configurations, agreements, security and abuse-prevention requirements, and legal obligations. We select configurations intended to minimize retention and prohibit model training on your Content, but a provider’s legally required or security-related retention may differ from ours.

Residual copies may remain temporarily in encrypted or otherwise protected backups until they are overwritten in the ordinary course. Data retained only in backups is not restored to active use except for disaster recovery, security, or legal necessity.

7.5 De-identified information

We may retain aggregated or de-identified information for longer because it does not reasonably identify you.

8. Your choices and privacy rights

Depending on where you live, you may have the right to:

• request access to or a copy of your personal data;
• request correction of inaccurate personal data;
• request deletion of personal data;
• request information about how we collect, use, and disclose personal data;
• receive certain personal data in a portable format;
• withdraw consent where processing is based on consent;
• object to or request restriction of certain processing;
• opt out of certain profiling or automated decisions where applicable;
• appeal a refusal of a privacy request; and
• complain to a privacy or data-protection regulator.

To exercise a privacy right or request account deletion, email [email protected]. Account deletion currently requires a support-assisted process. You may also contact [email protected] for account assistance.

We may ask for information reasonably necessary to verify your identity, authority, account, and request. An authorized agent may submit a request where permitted by law, but we may require proof of authorization and direct identity verification. We will not discriminate against you for exercising a privacy right.

Some information may be exempt from a request, such as information we must retain for security, fraud prevention, legal compliance, transactions, or the rights of another person. If we deny a request, we will explain the decision and any available appeal right where required by law.

8.1 Marketing choices

You may unsubscribe from feature announcements and other promotional email using the link in the message or by contacting us. You may continue to receive essential security, billing, transactional, service, and legal communications while you maintain an account.

8.2 Connection and Content controls

Where the relevant controls are available, you may delete Content, revoke a connected service, change a permission, or remove a stored credential through the Service. You may also contact support for assistance.

Revoking a connection stops new access through that connection but does not require a third party to delete information it already received under your instructions. Please contact the third party regarding its copy.

9. Additional US state disclosures

This section supplements the rest of this Notice for residents of US states with applicable comprehensive privacy laws.

During the preceding 12 months, we may have collected the following categories of personal data, depending on Service use:

Category	Examples	Purposes	Categories of recipients
Identifiers	Name, email, account ID, IP address	Account operation, security, support, communications	Infrastructure, authentication, communications, security, and legal providers
Customer and transaction records	Subscription, invoices, purchases, credit balance, limited payment details	Billing, accounting, fraud prevention, support	Payment, infrastructure, accounting, security, and legal providers
Internet or electronic activity	Usage, device, browser, logs, feature and Action activity	Service operation, reliability, security, support	Infrastructure, model, security, and support providers
User Content and communications	Inputs, Outputs, files, conversation history, support messages	Provide the Service, support, safety, legal compliance	Model, infrastructure, connected-service, support, security, and legal providers
Approximate location	General location derived from IP address	Security, routing, fraud prevention, regional availability	Infrastructure and security providers
Inferences	Security, fraud, abuse, or feature-preference signals derived from activity	Security, personalization, support, enforcement	Infrastructure, model, security, and support providers
Sensitive personal data	Account credentials; supported stored API keys, passwords, tokens, or private keys; sensitive Content you choose to provide	Authentication, secure storage, authorized Actions, security, support	Infrastructure, model or connected-service providers only as needed for the requested function

We collect these categories from you, your device and Service activity, organizations and users that interact with you, connected services you authorize, service providers, and public sources used at your direction.

We have not sold personal data or shared it for cross-context behavioural advertising or targeted advertising. We do not use or disclose sensitive personal data to infer characteristics about you for advertising. We do not offer financial incentives in exchange for personal data.

10. Canadian privacy information

For Canadian users, Magister AI is responsible for personal data under its control and has designated a privacy contact reachable at [email protected].

We obtain meaningful consent where required, limit collection to appropriate purposes, use contractual and other safeguards for service providers, and provide access and correction rights subject to lawful exceptions. You may withdraw consent to optional processing, but doing so may prevent us from providing a feature that depends on that information.

Because our systems and providers are located primarily in the United States, Canadian personal data may be transferred to, stored in, and processed in the United States. It may be accessible to US courts, law-enforcement agencies, or other authorities under applicable law.

If you are not satisfied with our response to a privacy concern, you may contact the Office of the Privacy Commissioner of Canada or an applicable provincial privacy regulator.

The consumer Service is not presently offered to residents of Québec.

11. Children and teenagers

The Service is intended for a general audience and is not directed to children under 13. We do not knowingly collect personal data online from a child under 13 without verified parental consent or another lawful basis.

If we learn that we collected personal data from a child under 13 without the required consent or authorization, we will take reasonable steps to delete it and may restrict the account. A parent or guardian who believes a child provided personal data may contact [email protected].

Teenagers may use the Service where permitted by applicable law. A parent or guardian should be involved where consent or supervision is required. We do not sell children’s or teenagers’ personal data, share it for targeted advertising, or display advertising in the Service.

12. Security

We use reasonable administrative, technical, and organizational safeguards designed to protect personal data against unauthorized access, loss, misuse, alteration, or disclosure. These safeguards may include access controls, encryption, logging, monitoring, separation of sensitive credentials, and incident-response procedures, as appropriate to the data and Service feature.

No method of transmission or storage is completely secure. You are responsible for protecting your account credentials, configuring Companion permissions carefully, and using the supported credential-storage feature rather than placing secrets in ordinary Content where practicable.

Please report a suspected account compromise or security issue to [email protected].

13. International processing

Magister AI is based in the United States, and the Service and its providers currently process and store personal data primarily in the United States. Data-protection laws in the United States may differ from those where you live.

Where applicable law requires a transfer safeguard, we use an approved contractual or other lawful mechanism. We will update our practices and disclosures before materially changing the primary processing locations or launching in a jurisdiction that requires additional transfer measures.

14. Third-party services and links

The Service may connect to or display third-party services, websites, models, or Content. When you direct us to disclose information to a third party or leave the Service, that third party’s own privacy practices apply. We are not responsible for a third party’s independent privacy practices.

15. Changes to this Notice

We may update this Notice to reflect changes to the Service, law, providers, security practices, or data handling.

For a material change, we will provide reasonable advance notice through the Service, by email, or by another appropriate method unless an urgent legal or security reason requires an earlier effective date. We will not materially expand our use of previously collected personal data without providing any notice or consent required by law.

The date at the top identifies the latest revision. Previous versions will be retained as required by law and according to our versioning practices.

16. Contact us

Questions, privacy requests, account-deletion requests, and complaints may be sent to:

Magister AI LLC Attn: Privacy 2093 Philadelphia Pike, Suite #4099 Claymont, DE 19703 United States

Email: [email protected] Support: [email protected]