How we handle personal data

1. Introduction

This Privacy Policy explains how Mizu Technologies, Inc. (“we,” “us”), operator of the MizuAlign product under Mizu Technology, collects, uses, shares, and protects personal information when you visit our websites, use our applications, or interact with us. It applies together with our Terms of Service, Security overview, and - for Enterprise procurement - our Data Processing Agreement.

Controller. For account and workspace data you provide as a customer, Mizu Technologies, Inc. acts as the data controller (or business, under California law) unless a signed Enterprise agreement states otherwise. When we process personal data strictly on your documented instructions as part of the Service for your organization, we act as a processor - see the Data Processing Agreement.

2. Scope

This policy covers:

• The public marketing site (for example pages under mizualign.com)
• Authenticated product workspaces and APIs
• Support, sales, and security communications you initiate with us

Third-party websites linked from MizuAlign (such as payment or bank login flows) are governed by their own policies. Read those policies before submitting information to them.

3. Personal information we collect

Depending on how you use MizuAlign, we may collect:

• Account and profile data: name, email address, password hash, workspace name, role, timezone, and notification preferences
• Financial and business records you enter or upload: receipts, invoices, transactions, budgets, vendors, clients, projects, documents, and related metadata
• Connected account data (optional): when you link a bank or card through our aggregation partners, account identifiers, balances, and transaction details as permitted by the connection
• Billing data: subscription status, plan, and payment method tokens processed by our payment processor - we do not store full card numbers on MizuAlign servers
• Usage and device data: pages viewed, feature interactions, IP address, browser type, operating system, referral URLs, and diagnostic logs
• Support and sales communications: messages, attachments, and contact details you send us
• Consent records: cookie preference choices and timestamps stored in your browser

We do not knowingly collect personal information from children under 18.

4. Sources of information

• Directly from you when you register, configure a workspace, or contact us
• Automatically through cookies, logs, and similar technologies described below
• From collaborators you invite to a workspace, subject to your access controls
• From service providers that help us operate the Service (hosting, email, payments, bank aggregation)

5. How we use personal information

We use personal information to:

• Provide, maintain, secure, and improve the Service
• Authenticate users, enforce tenant isolation, and prevent fraud or abuse
• Process subscriptions and send transactional messages (receipts, security alerts, product notices)
• Respond to support requests and honor privacy or security rights
• Generate aggregated or de-identified analytics that do not identify individuals
• Comply with legal obligations and enforce our Terms

We do not sell personal information. We do not use advertising cookies or ad pixels on the marketing site.

6. Legal bases (EEA / UK visitors)

Where GDPR or UK GDPR applies, we rely on:

• Contract: to provide the Service you request
• Legitimate interests: security, product improvement, and fraud prevention, balanced against your rights
• Consent: optional diagnostics cookies and certain marketing communications where required
• Legal obligation: tax, accounting, or regulatory requests we must honor

7. How we share information

We share personal information only as needed to operate the Service:

• Sub-processors and infrastructure providers listed on our Security page (hosting, database, email, payments, optional AI and monitoring)
• Collaborators you authorize inside a workspace according to roles you assign
• Professional advisers (lawyers, accountants) under confidentiality when necessary
• Authorities when required by law or to protect rights, safety, and integrity of the Service
• Business transfers in connection with a merger, acquisition, or asset sale with notice where required

8. International transfers

MizuAlign is operated from the State of Florida. We serve customers globally. If you access the Service from outside the United States, your information may be transferred to, stored, and processed in the United States and other countries where our sub-processors operate.

For transfers of personal data from the European Economic Area (EEA), United Kingdom, or other jurisdictions that restrict cross-border transfers, we rely on appropriate transfer mechanisms where required, including Standard Contractual Clauses (SCCs) approved by the European Commission or the relevant authority. Nothing in this policy limits mandatory data-protection rights you may have under local law, including rights under the GDPR, UK GDPR, or other applicable privacy legislation.

Specific data-residency commitments for Enterprise customers are documented in executed agreements. For questions about international transfers, contact privacy@mizualign.com.

EEA and UK representative (GDPR Art. 27 / UK GDPR Art. 27). Mizu Technologies, Inc. is not established in the European Economic Area (EEA) or the United Kingdom. Prior to actively marketing or offering the Service to EEA or UK residents, Mizu Technologies, Inc. will designate a representative in the EEA and, separately, in the UK as required by applicable law. Until such designations are in effect, the Service is not actively targeted at EEA or UK residents. EEA and UK data subjects may contact Mizu Technologies, Inc. directly at privacy@mizualign.com in the interim. Enterprise customers requiring an EU or UK representative contact for DPA purposes should raise this during contract negotiation.

9. Retention

• Active accounts: we retain workspace data while your subscription or free workspace remains active and as needed to provide features you use
• Deleted accounts: after confirmed deletion, Customer Content is scheduled for permanent removal within 30 days unless a legal hold or longer retention requirement applies
• Billing and security logs: retained as needed for tax, fraud prevention, and dispute resolution, typically for limited periods defined in internal retention schedules
• Marketing contacts: retained until you unsubscribe or ask us to delete your details

10. Security

We implement technical and organizational measures described on Security, including TLS in transit, encryption at rest on hosted databases, tenant-scoped access controls, and optional Enterprise features such as SSO and audit export. No method of transmission or storage is 100% secure; report concerns to security@mizualign.com.

11. Your privacy rights

Depending on your location, you may have the right to:

• Access a copy of personal information we hold about you
• Correct inaccurate information
• Delete information, subject to legal exceptions
• Export portable copies of workspace data where the product provides export tools
• Object to or restrict certain processing
• Withdraw consent where processing is consent-based
• Not receive discriminatory treatment for exercising privacy rights (California)

Submit requests to privacy@mizualign.com. We may verify your identity before fulfilling a request. Authorized agent requests (California) require proof of authorization as permitted by law.

12. Cookies and similar technologies

We use cookies, local storage, and similar browser technologies for essential operation and - with your permission - optional product diagnostics. We do not use advertising cookies or cross-site tracking pixels on the marketing site.

Your analytics/diagnostics choice is stored in browser local storage for about 12 months. When it expires, we may show the banner again so you can review preferences.

Essential cookies and storage are set by MizuAlign directly. When you opt into diagnostics, Sentry may process technical data according to their privacy policy. We configure Sentry to mask sensitive fields where possible.

Full details also appear on our dedicated Cookie Policy page.

See also our dedicated Cookie Policy for managing preferences and third-party diagnostic details.

13. AI and automated processing

When you enable or use AI features, we may send relevant workspace context to our AI sub-processor(s) to generate suggestions or responses. We configure prompts to minimize unnecessary personal data. AI outputs are probabilistic - review before relying on them for compliance or financial decisions. You can limit use by not enabling AI features or by controlling which data you enter into prompts.

14. Breach notification

If we become aware of a personal data breach affecting your account, we will investigate, contain the incident, and notify you and regulators where required by law, typically without undue delay and within 72 hours where GDPR timelines apply.

15. Enterprise customers

Organizations requiring processor terms, sub-processor notice workflows, or audit language should review our Data Processing Agreement with counsel. It is a procurement draft pending final counsel approval and is not a fully executed agreement until your organization accepts a counsel-approved version.

16. Changes to this policy

We may update this Privacy Policy to reflect product, legal, or operational changes. We will revise the effective date above and provide additional notice for material changes when appropriate.

17. Contact

Privacy questions and rights requests: privacy@mizualign.com · General: hello@mizualign.com · About

Mizu Technologies, Inc. · Mailing address on file with Florida Division of Corporations (set COMPANY_LEGAL_ADDRESS env var to display here)