1. Who We Are majiklTrust Market Intelligence, LLC is a limited liability company organized under the laws of the State of Illinois. We operate a business-to-business Software-as-a-Service (SaaS) platform that assists organizations in generating and publishing professional content to LinkedIn and other social media platforms. Our principal place of business is in Illinois. Questions about this policy may be directed to accountadmin@citeprose.com. 2. Information We Collect 2a. Information You Provide Account registration: Business or organization name, business email address, and workspace name during tenant provisioning. Platform configuration: Content topics, RSS feed subscriptions, publishing preferences, and API credentials you supply (such as your Anthropic API key). When you register a new workspace, the platform automatically provisions a set of broad-coverage RSS feeds to support content research across common business and technology topics. You may modify, disable, or remove these feeds at any time. Administrator-provisioned credentials: If your workspace was created by a platform administrator, the administrator may have supplied an Anthropic API key on your behalf during the registration process. This key is encrypted at rest and stored temporarily (typically no more than 15 minutes) until your workspace provisioning is complete, at which point the temporary copy is deleted. Communications: Any messages you send to us via email or support channels. 2b. Information Collected Automatically Usage data: Pages visited, features accessed, actions taken within the platform, timestamps, and session duration. Device and log data: IP address, browser type, operating system, referral URL, and server log data. Public website statistics: When you visit our public website, we record the pages you view, the links and buttons you click, the site that referred you, campaign tags in the page address, your browser and device type, and, only when we have enabled location statistics, your approximate location (derived from your IP address). Unless we have enabled location statistics, your IP address is not sent to the analytics service. We use the product analytics service named in Section 5a for this. Page addresses are shortened in your browser before they are sent, so tokens or other parameters in an address are not recorded. Product usage statistics: When we have enabled product usage statistics, the Service records six kinds of events about each workspace as they happen: a workspace is created, a trial starts, a trial ends, a content generation run finishes, a topic is created, and a post is published. Each event carries the workspace's internal identifier, a word saying whether it came from our production or development systems, and short descriptive values only: the AI provider and model names selected, how the workspace was created (self service or invited) and where its API key came from, the subscription tier word, counts (such as the number of content angles on a topic), durations in days, outcome words (such as generated, held, or failed), and yes or no flags (such as whether a post carried an image). These events never contain the content you create, your topic names or descriptions, AI responses, the reasons behind a decision, your name, your email address, your IP address, or any credential. We use the product analytics service named in Section 5a for this. Cookies: See Section 9 for details. 2c. Information from Third Parties LinkedIn: When you connect your LinkedIn account, we receive OAuth tokens and, subject to the permissions you grant, basic profile information (name and public profile details) and the ability to publish content on your behalf. See Section 4 for details. Identity providers: If you authenticate via Auth0, WorkOS, or a similar identity provider, we receive authentication tokens and the profile attributes those services share (such as name, email address, and a unique user identifier). RSS and web content feeds: We collect publicly available content from third-party news and media sources configured for your workspace, including both feeds you configure and feeds provisioned by the platform at registration. 3. How We Use Your Information We use the information we collect to: Provision, operate, and improve the Service; Authenticate users and manage tenant accounts; Generate AI-assisted research summaries and draft social media content on your behalf; Publish content to LinkedIn or other platforms at your direction and with your authorization; Respond to support requests and communicate service updates; Monitor system performance, detect errors, and ensure platform security; Understand how visitors use our public website so we can improve it; Comply with applicable legal obligations; and Enforce our Terms of Service. We do not use your data to train external AI models, sell your data to advertisers, or engage in behavioral advertising. 4. LinkedIn Integration and Data Use Our Service integrates with the LinkedIn API. This section describes specifically how we handle LinkedIn data in compliance with LinkedIn's API Terms of Service. 4a. Data We Access from LinkedIn When you connect your LinkedIn account to our Service, we access, consistent with the permissions you grant: Basic profile information for the authenticated user (name and public profile details) as returned by LinkedIn's userinfo endpoint; OAuth access tokens required to perform actions on your behalf; and The ability to publish content to LinkedIn on your behalf using the authorized posting scope; Your email address and your first-degree connection count, which the Service uses to estimate the reach of posts you share as a member of an employee advocacy program; and For LinkedIn organization pages you administer and connect: the list of pages you administer, the ability to publish on each page's behalf, performance statistics for the page's posts (impressions, clicks, reactions, comments, and shares), and aggregate follower statistics for the page (follower counts, including counts by industry, seniority, and country). These aggregate statistics do not identify individual followers. 4b. How We Use LinkedIn Data To publish content to LinkedIn at your explicit direction; To display your basic profile information within your dashboard for account identification; To display post performance and follower statistics in the Service's analytics features and, when you request it, to generate an AI-written summary of those statistics (see Section 5b); and To maintain authentication tokens necessary to sustain your connected session. 4c. Restrictions on LinkedIn Data We do not sell LinkedIn member data to third parties; We do not use LinkedIn member data for advertising or retargeting; We do not combine LinkedIn member data with data from other sources to build profiles of individual members; We do not store LinkedIn member personal data beyond the period required to render the Service features you have requested; and We comply with LinkedIn's data storage and deletion requirements. 4d. Revoking LinkedIn Access You may revoke LinkedIn access directly through your LinkedIn account settings at linkedin.com/psettings/permitted-services. Upon revocation, we will delete stored LinkedIn OAuth tokens within 30 days. You may also disconnect your own LinkedIn profile from within the Service. 5. Sharing and Disclosure We do not sell, rent, or trade your personal information. We may share information in the following limited circumstances: 5a. Service Providers We engage vetted third-party service providers who process data on our behalf, including cloud hosting providers (AWS), authentication services (Auth0, WorkOS), payment processing (Stripe), product analytics for our public website (PostHog), and email delivery services. These providers are contractually restricted from using your data for any purpose other than performing services for us. Stripe processes subscription payments. Payment card details are entered on Stripe's pages and are not received or stored by us. PostHog receives the public website statistics and the product usage statistics described in Section 2b. It does not receive the content you create, your posts, your topics, AI responses, your credentials, your name, or your email address. Product usage events are recorded against your workspace's internal identifier only, and PostHog holds no profile of you or of your workspace. Our web pages also load fonts from Google Fonts and, within the Service, code libraries from cdnjs (operated by Cloudflare). As with any web request, these providers receive your IP address and browser information when your browser fetches those files. 5b. AI Processing The Service uses AI model providers to research, draft, and illustrate content: Anthropic by default, OpenAI for image generation, and OpenAI or another supported provider for text when a workspace selects one of that provider's models. Research content (articles and topic data from RSS feeds, and web search results the provider retrieves) is transmitted to the selected provider for processing. When you request an AI-written analytics summary, your LinkedIn post performance figures are transmitted to the provider for that purpose. API keys are transmitted to their provider solely for the purpose of authenticating API requests on your behalf. We do not transmit your authentication passwords, session tokens, or LinkedIn access tokens to any AI provider. Each provider's use of data is governed by its privacy policy and API terms. 5c. Legal Requirements We may disclose information if required by law, subpoena, court order, or governmental authority, or when we believe in good faith that disclosure is necessary to protect the rights, property, or safety of the Company, our users, or the public. 5d. Business Transfers In the event of a merger, acquisition, sale of assets, or similar transaction, your information may be transferred as part of that transaction. We will provide notice before your information is transferred and becomes subject to a different privacy policy. 6. Data Retention We retain account and usage data for as long as your account is active or as needed to provide the Service, plus a reasonable period thereafter to comply with legal obligations, resolve disputes, and enforce agreements. LinkedIn OAuth tokens are retained for as long as your LinkedIn account remains connected to the Service. Upon account cancellation or LinkedIn disconnection, LinkedIn OAuth tokens and cached profile data are deleted within 30 days. Temporary registration data (including any administrator-provisioned API keys stored during the registration process) is automatically purged after the registration window expires, typically within 15 minutes. Billing records (such as subscription status, plan, and payment references) are retained in accordance with applicable Illinois law and standard accounting practices. Public website statistics and product usage statistics are retained by PostHog under the retention terms of our PostHog plan. 7. Your Privacy Rights Depending on your location, you may have the following rights with respect to your personal information: Access: Request a copy of the personal information we hold about you. Correction: Request correction of inaccurate or incomplete information. Deletion: Request deletion of your personal information, subject to legal retention requirements. Portability: Request a machine-readable export of data you have provided to us. Objection / Restriction: Object to or request restriction of certain processing activities. Withdrawal of consent: Where processing is based on consent, withdraw that consent at any time without affecting the lawfulness of prior processing. Illinois residents may have additional rights under the Illinois Personal Information Protection Act (PIPA) and, where applicable, the Illinois Biometric Information Privacy Act (BIPA). We do not collect biometric data. To exercise any of these rights, contact us at accountadmin@citeprose.com. We will respond within 30 days. We may need to verify your identity before processing your request. 8. Security We implement technical and organizational measures to protect your information, including: Encryption of credentials and secrets at rest using AES-256-GCM with per-tenant key derivation; Encrypted transmission of data in transit via TLS; Tenant-level data isolation enforced at the database layer; Role-based access controls and least-privilege principles; Secure, httpOnly session cookies; and Security testing during development and prior to production deployments. A limited number of designated platform administrators have elevated access to perform account provisioning operations such as creating registration invites. Platform administrator status is controlled through server-side configuration and is not accessible through the user interface. No method of transmission or storage is 100% secure. While we strive to protect your information, we cannot guarantee absolute security. You are responsible for maintaining the confidentiality of your account credentials. 9. Cookies We use the following cookies: Essential cookies: Two encrypted, httpOnly cookies are used. A session cookie is used for authentication and session management, and a short-lived sign-in cookie (valid for about ten minutes and used only while you sign in) protects the sign-in process. These cookies are required for core platform functionality and cannot be disabled without impairing the Service. We do not use third-party advertising trackers, analytics cookies, or any cookies beyond those required for authentication and session management. Browser storage: Our public website keeps a random visit identifier in your browser's session storage for the statistics described in Section 2b. It is erased when you close the browser tab, it is not a cookie, and it is not used for advertising. The Service also remembers small display preferences (such as whether you have already seen the features menu or dismissed a notice) in your browser's local storage. You can manage cookie preferences through your browser settings. Disabling the session cookie will prevent you from logging in to the Service. 10. Children's Privacy Our Service is designed for business use and is not directed to individuals under the age of 18. We do not knowingly collect personal information from minors. If you believe a minor has provided us with personal information, please contact us at accountadmin@citeprose.com and we will promptly delete it. 11. Changes to This Policy We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last Updated" date at the top of this page and, where appropriate, notify active account holders by email. Your continued use of the Service after the effective date of a revised policy constitutes your acceptance of the changes. We encourage you to review this page periodically. 12. Contact Us If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at accountadmin@citeprose.com.