Myuser Privacy Policy

1SCOPE OF THIS NOTICE; RELATED AGREEMENTS

Part of the Legal Terms. This Notice is incorporated into and forms part of the Myuser Terms of Service (the "Legal Terms") available at https://main.gotdelivra.com/legal. Any dispute, claim, or controversy relating to privacy, data protection, or this Notice is governed by the Legal Terms, including the governing law, limitation of liability, indemnification, and dispute resolution provisions (binding arbitration, class action waiver, jury trial waiver, and one-year time limit in Section 26 of the Legal Terms). If you use any Payment Services, the Myuser Payment Services Legal Terms at https://main.gotdelivra.com/payment_legal also apply, and data handling in connection with Payment Services is additionally subject to the policies of our payment processors, banking partners, and card networks.

Two capacities. We process information in two distinct capacities:

• As a controller - for information relating to our own operations: Site visitors, account registration and administration, billing and collections, identity verification, marketing, security, and analytics. This Notice describes that processing.
• As a processor / service provider - for Customer Data and Outbound Communications Data that our customers upload to, connect to, generate in, or transmit through the platform. In that capacity we act on our customers' instructions, and the customer - not Myuser - is the controller responsible for the data and for compliance (Section 3 and Section 18). This Notice does not govern our customers' own privacy practices, and we are not responsible for them.

Third parties. The Site and Services may link to or interoperate with third-party websites, products, and services that have their own privacy policies. This Notice does not apply to any third party, and we accept no responsibility or liability for their practices (Section 19).

2INFORMATION WE COLLECT

Information you provide to us

We collect information that you voluntarily provide when you register for an account, purchase AI Credits or Services, complete verification, connect accounts, participate in onboarding, contact support, or otherwise communicate with us. Depending on how you use the Services, this may include:

• Name, email address, phone number, job title, and company or organization details;
• Passwords and authentication data, and contact preferences;
• Billing address, payment instrument details, and transaction information. Payment card data is handled through PCI-DSS-aligned payment infrastructure and our payment processors and banking partners;
• Business and identity verification data we request to satisfy legal, underwriting, risk, and financial-partner requirements, which may include legal entity name, formation documents, tax identifiers, beneficial ownership information, government-issued identification, and date of birth;
• Content of your communications with us, including support requests and chats with Myuser agents or AI assistants;
• Data you upload to or generate in the platform, including contact lists, campaign content, templates, and configurations;
• Information in mailboxes, calendars, and other accounts you connect to the platform (Section 9).

All information you provide must be true, complete, and accurate, and you must notify us of any changes. We may decline, suspend, or terminate Services where information cannot be verified.

Information collected automatically

When you visit or use the Site and Services, we automatically collect certain information, including: log and usage data (IP address, browser type and settings, pages viewed, features used, date/time stamps, error and diagnostic data); device data (device and application identifiers, operating system, language, Internet service provider or carrier, system configuration); and approximate location inferred from your IP address. This information is needed to maintain the security and operation of the Services and for internal analytics, and is collected via server logs, cookies, and similar technologies (Section 8).

Information from other sources

We may receive information about you from other sources, including public databases and registries, data enrichment and intent-data providers, joint marketing partners, affiliate programs, social media platforms, identity verification and fraud prevention services, credit reporting agencies and banking partners (in connection with account approval, underwriting, and risk), and other third parties. We may combine this with information we already hold.

Sensitive information

We do not seek to collect, and you must not submit to the Services, sensitive information or special categories of data (such as racial or ethnic origin, political opinions, religious beliefs, health data, biometric identifiers, or sexual orientation), except for identity and verification data we explicitly request as described above. If you nonetheless submit sensitive information about yourself or any other person, you represent and warrant that you have a valid lawful basis and all required consents to do so, and you remain solely responsible for that data. We may delete such data at any time without notice or liability.

3DATA WE PROCESS ON BEHALF OF CUSTOMERS (OUTBOUND COMMUNICATIONS DATA)

Outbound Communications Data typically includes business contact information such as name, professional email address, phone number, job title, company affiliation, and related professional information, and may be sourced from the customer directly or from third-party data enrichment providers made available through the Services. Myuser does not independently verify the consent status, contact preferences, or accuracy of any recipient data, and assumes no obligation to assess any data or use case against the customer's compliance requirements. As set out in the Legal Terms, customers indemnify Myuser for claims arising from their data, their communications, and their use of data made available through the Services.

If you are an individual who has received a communication sent through the platform and wish to exercise your rights, see Section 18.

4HOW WE USE INFORMATION

We process information for the following purposes, depending on how you interact with the Services:

• To provide, operate, administer, and maintain the Services, including account creation, authentication, and delivery of features you request;
• To process purchases of AI Credits, payments, invoicing, billing, offsets, and collections;
• To verify identity and business information and to perform know-your-customer, anti-money-laundering, sanctions screening, underwriting, credit, and risk assessments, including through third-party providers;
• To respond to inquiries, provide support, and send administrative information such as changes to our terms and policies;
• To send marketing and promotional communications, which you may opt out of at any time (Section 15);
• To protect the Services and our business, including fraud monitoring and prevention, abuse and spam detection, deliverability and sender-reputation management, security investigations, and enforcement of the Legal Terms and our policies;
• To operate and improve the Services, including analytics, usage-trend analysis, research and development, and measuring the effectiveness of our marketing;
• To operate AI-powered features and improve our AI systems as described in Section 5;
• To comply with legal obligations, respond to lawful requests from courts, regulators, and authorities, and establish, exercise, or defend legal claims;
• To protect the vital interests of an individual, such as preventing harm; and
• For any other purpose disclosed to you at the time of collection or with your consent.

We may de-identify or aggregate information so it can no longer reasonably be linked to you; we may use and retain de-identified and aggregated data for any lawful purpose without restriction, and we commit to maintaining it in de-identified form and not attempting re-identification except as permitted by law (e.g., to test de-identification).

5ARTIFICIAL INTELLIGENCE AND AUTOMATED PROCESSING

Third-party AI providers. We integrate with external large language model and AI providers (including OpenAI, Anthropic, and other model providers as necessary). Data - including usage patterns, prompts, content, and interaction data - may be submitted to these providers at inference time to deliver the Services, under data protection agreements designed to safeguard it.

Model improvement. We may use information to train, fine-tune, evaluate, and improve our AI systems and algorithms. Where personal information is used for general model improvement, we use it in aggregated or de-identified form consistent with Section 4 and the Legal Terms. Google user data is not used to train generalized AI or machine learning models (Section 10).

Automated decisions. Our systems make automated decisions that are core to the Services - for example content generation, send-time and deliverability optimization, routing, and fraud, risk, spam, and abuse scoring, which may result in limits, holds, suspension, or termination as described in the Legal Terms. Where applicable law grants you rights in relation to automated decision-making, you may contact us and we will honor those rights to the extent required by law.

Outputs. AI-generated outputs may be inaccurate, incomplete, or unsuitable. As set out in the Legal Terms, you must independently review and verify all AI-generated content before use or reliance, and you are solely responsible for all consequences of AI outputs and any content or communications generated or sent through your account.

6LEGAL BASES FOR PROCESSING (EEA, UK, SWITZERLAND, CANADA)

If you are located in the European Economic Area, United Kingdom, or Switzerland, we process your personal information only when we have a valid legal basis, including:

• Contract - processing necessary to provide the Services you requested, or to take steps at your request before entering into a contract;
• Legitimate interests - operating, securing, and improving the Services; preventing fraud, spam, and abuse; protecting deliverability and network integrity; marketing our services to business contacts; enforcing our agreements; and defending our legal rights - where not overridden by your interests, rights, and freedoms;
• Legal obligation - compliance with laws applicable to us, including financial, anti-money-laundering, sanctions, tax, and accounting requirements;
• Consent - for processing where consent is required (e.g., certain cookies or marketing); you may withdraw consent at any time, without affecting processing already performed; and
• Vital interests - protecting the safety of any individual.

Where we act as a processor on behalf of a customer (Section 3), the customer is responsible for establishing the legal basis, and inquiries should be directed to the customer as controller.

If you are located in Canada, we process information with your express or implied consent, or where processing is otherwise permitted or required by applicable law (for example, for investigations, fraud detection and prevention, business transactions, legally required disclosures, or where information is publicly available as specified by regulation). You may withdraw consent at any time, subject to legal or contractual restrictions and reasonable notice; withdrawal may limit our ability to provide the Services.

7WHEN AND WITH WHOM WE SHARE INFORMATION

We may share information with the following categories of recipients, under contracts designed to safeguard it where required:

• Cloud computing, hosting, storage, and infrastructure providers;
• Large language model and AI providers (data may be submitted as part of AI inference operations - Section 5);
• Payment processors, payment networks, banking partners, and financial institutions;
• Identity verification, know-your-customer, credit, fraud prevention, and risk management services;
• Communications infrastructure providers (email delivery, deliverability and warmup networks, SMS and telephony, domain registrars, and messaging or social/professional network integration providers);
• Data enrichment and business contact data providers;
• Analytics, performance monitoring, and testing providers;
• Advertising, retargeting, and marketing platforms (Section 8 and Section 17);
• CRM, support, communication, and collaboration tools;
• Finance, accounting, professional advisors, auditors, insurers, and collection agencies (including credit reporting agencies where you fail to pay for Services); and
• Our employees, contractors, affiliates, and subsidiaries.

We may also disclose information: (a) in connection with any merger, financing, acquisition, reorganization, bankruptcy, or sale of all or a portion of our business or assets (Section 19); (b) to comply with law or lawful requests from courts, regulators, law enforcement, or other authorities; (c) where we believe disclosure is necessary to enforce the Legal Terms, collect amounts owed, prevent or investigate fraud, spam, abuse, or security issues, or protect the rights, property, or safety of Myuser, our users, our partners, or others; (d) to sponsors or partners of promotions you participate in; and (e) at your direction or with your consent.

8COOKIES AND TRACKING TECHNOLOGIES

We and our partners use cookies, pixels, web beacons, scripts, and similar technologies to operate the Site and Services, remember your preferences, keep you signed in, analyze traffic and usage, measure and improve marketing, and deliver relevant advertising. Third-party analytics and advertising providers (for example, Google Analytics and Meta pixel/analytics tools) may set their own cookies and collect information about your online activity over time and across sites.

Cookies may be session cookies (which expire when you close your browser) or persistent cookies (which remain until deleted or expired). The categories we use are:

• Essential - required for the Site and Services to function (authentication, security, fraud prevention); these cannot be disabled through our systems;
• Analytics / performance - help us understand usage and improve the Services;
• Preference - remember your settings and choices; and
• Advertising / targeting - used to deliver and measure relevant ads, including through third-party partners.

You can control cookies through your browser settings, which typically allow you to refuse or delete some or all cookies; your ability to limit cookies depends on your browser's capabilities, and blocking cookies may affect the availability and functionality of the Services. To opt out of interest-based advertising, you may also use industry tools such as optout.aboutads.info and networkadvertising.org/choices, adjust your ad settings with the relevant platforms, use an opt-out preference signal (Section 16), or contact us at [email protected].

9CONNECTED ACCOUNTS AND SOCIAL LOGINS

Social logins. If you register or sign in using a third-party account (such as Google), we receive certain profile information from that provider - typically your name, email address, and profile picture - and use it as described in this Notice. We do not control, and are not responsible for, the provider's own processing of your information; review their privacy policy.

Connected accounts and mailboxes. The Services allow you to connect mailboxes, calendars, domains, phone numbers, and messaging or social/professional network accounts (including through integration providers). By connecting an account, you instruct and authorize Myuser to access, read, store, organize, and transmit data through that account as needed to operate the features you use, including to:

• Send outbound messages and campaigns on your behalf to recipients you or the platform identify;
• Send and receive automated warmup messages between participating accounts to build and protect sender reputation, where the warmup feature is enabled;
• Detect, thread, analyze, and surface replies, bounces, unsubscribes, and engagement; and
• Configure sending identities, signatures, and related settings.

Your responsibility. You are solely responsible for complying with the terms, policies, and acceptable use rules of every provider whose account you connect, and you must not connect an account or enable a feature where doing so is prohibited by the provider's terms (including the Google API Services User Data Policy - see Section 10). Violations may result in action by the provider against your account, for which Myuser has no liability, and Myuser may disconnect any account or disable any feature that it determines creates risk. Access tokens and credentials are stored using encryption; you may revoke Myuser's access at any time through the provider or your dashboard, which may disable dependent features.

10GOOGLE USER DATA (API LIMITED USE)

Data we access. When you connect a Google account, we request access depending on the features you use, which may include: account information (email address and basic profile) to authenticate you and associate the account with your workspace; sending email through your connected mailbox on your behalf; reading and organizing mailbox messages to detect, thread, and surface replies, bounces, and engagement for your campaigns; and basic settings access to read and configure your send-as identity and email signature. The specific scopes requested are presented on the Google consent screen when you connect your account.

How we use it. We use Google user data solely to provide and improve user-facing features of the platform - sending and managing outbound email, detecting and threading replies, managing deliverability and sender identity, and maintaining your connection. We do not use Google user data for serving advertisements (including retargeting, personalized, or interest-based advertising); we do not sell or transfer it to data brokers or information resellers; we do not use it to determine creditworthiness or for lending purposes; and we do not use it to train generalized AI or machine learning models. Customer Google data is used at inference time only to generate outputs for that customer's own workspace.

Access and safeguards. Human access to Google user data is limited to what is necessary to operate and maintain the Services, investigate security or abuse issues, or comply with applicable law, and otherwise occurs only with your consent. Google user data is encrypted in transit and at rest, and is shared only with sub-processors that process it on our behalf to deliver the platform in a manner consistent with this Notice and the Google API Services User Data Policy. You can revoke our access at any time from your Google security settings at myaccount.google.com/permissions.

11INTERNATIONAL TRANSFERS

Our servers are located in the United States, and the Services are operated from the United States. If you access the Services from outside the United States, your information will be transferred to, stored, and processed in the United States and in other countries where we or our service providers maintain facilities - countries whose data protection laws may differ from those of your jurisdiction. By using the Services, you acknowledge and, where consent is a valid basis, consent to such transfers.

Where personal information originating in the European Economic Area, United Kingdom, or Switzerland is transferred to a country not recognized as providing an adequate level of protection, we implement appropriate safeguards, such as the European Commission's Standard Contractual Clauses (and the UK Addendum or International Data Transfer Agreement, where applicable), together with additional measures where necessary. You may contact us for more information about our transfer mechanisms.

12DATA RETENTION

We retain information for as long as necessary to fulfill the purposes described in this Notice, unless a longer period is required or permitted by law. As a general matter, we retain personal information for as long as you maintain an account with us, and for a reasonable period thereafter as necessary to comply with legal, tax, accounting, anti-money-laundering, and record-keeping obligations, resolve disputes, enforce our agreements, collect amounts owed, prevent fraud and abuse, and protect our legal rights. Records relating to payments, verification, and financial compliance may be retained for longer periods where required by law or by our banking and processing partners.

When we have no ongoing legitimate business need to retain information, we will delete or anonymize it or, if that is not immediately possible (for example, because it is stored in backup archives), securely store and isolate it from further processing until deletion is possible. De-identified and aggregated data may be retained without restriction. Upon termination of your account, your content may be deleted in our discretion as described in the Legal Terms; we are not obligated to retain or export data after termination.

13SECURITY

We have implemented commercially reasonable technical and organizational measures designed to protect the information we process, including encryption in transit and at rest where appropriate, access controls, and monitoring.

You are responsible for choosing a strong password, keeping your credentials confidential, securing your own systems, devices, and connected accounts, and all activity under your account. As set out in the Legal Terms, you are responsible for adequate security, protection, and backup of your content and for your own end users' data, and you must notify us immediately at [email protected] of any suspected unauthorized use or security breach relating to the Services. Where we are legally required to notify you or a regulator of a data breach, we will do so in accordance with applicable law.

14MINORS

The Services are intended for business users who are at least 18 years old. We do not knowingly solicit data from, market to, or collect personal information from anyone under 18. By using the Services, you represent that you are at least 18. If we learn that we have collected personal information from an individual under 18, we will deactivate the related account and take reasonable measures to promptly delete that data. If you become aware of any data we may have collected from anyone under 18, contact us at [email protected].

15YOUR RIGHTS AND CHOICES

Depending on where you are located, applicable law may give you rights regarding your personal information, which may include the right to: request access to and obtain a copy of your personal information; request correction of inaccurate information; request deletion; request restriction of processing; object to processing (including for direct marketing); data portability; withdraw consent (without affecting processing already performed); and not be subject to certain automated decision-making. These rights are not absolute and are subject to conditions and exceptions under applicable law.

How to exercise. Submit requests to [email protected] with "Privacy Request" in the subject line. To protect you and others, we must verify your identity - and, for agents, written proof of authority - before acting on a request, and we may request additional information to do so. We will respond within the time required by applicable law. We may deny or limit requests where permitted - for example, where retention is required for legal compliance, fraud and abuse prevention, security, collections, enforcing our agreements, or establishing or defending legal claims - and we may charge a reasonable fee or decline to act on requests that are manifestly unfounded, excessive, or repetitive, as permitted by law.

Requests relating to customer or recipient data. Where information is processed by Myuser as a processor on behalf of a customer (Section 3), the customer is responsible for responding, and we will direct your request to the relevant customer and/or assist them to the extent required by applicable law (Section 18).

Marketing opt-out. You can unsubscribe from our marketing emails at any time using the unsubscribe link in the email or by contacting us. We may still send you non-promotional, service-related messages necessary for the administration of your account, which you cannot opt out of while you maintain an account.

Account information and deactivation. You may review and update your account information in your dashboard. Account deactivation and termination are governed by the Legal Terms; upon a verified deletion request or termination, we will delete or de-identify personal information from active systems, except information we retain as described in Section 12.

Non-discrimination. We will not discriminate against you for exercising your privacy rights.

Complaints. If you have concerns about our processing, contact us first at [email protected] and we will investigate. If you are located in the EEA, UK, or Switzerland, you also have the right to lodge a complaint with your data protection authority, the UK Information Commissioner's Office, or the Swiss Federal Data Protection and Information Commissioner, respectively.

16DO-NOT-TRACK AND OPT-OUT PREFERENCE SIGNALS

Some browsers include a Do-Not-Track ("DNT") feature. Because no uniform technology standard for recognizing and implementing DNT signals has been finalized, we do not currently respond to DNT browser signals.

Where required by applicable law, we treat recognized opt-out preference signals - such as the Global Privacy Control (GPC) - as a valid request to opt out of the "sale" or "sharing" of personal information for targeted advertising for that specific browser and device. You can learn more at globalprivacycontrol.org. Because signals are browser- and device-specific, you would need to enable them on each browser and device you use.

17US STATE PRIVACY DISCLOSURES

This section applies to residents of California and other US states with comprehensive consumer privacy laws (including Colorado, Connecticut, Delaware, Iowa, Indiana, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, and Virginia), to the extent those laws apply to us. Note that because the Services are provided to businesses, much of the information we process is business contact data processed in a commercial (business-to-business) context, to which certain state law obligations may apply differently or not at all.

Categories of personal information collected (past 12 months)

We retain each category as described in Section 12 - generally for as long as you maintain an account with us, plus a reasonable period thereafter. Sources, purposes, and disclosures are described in Sections 2, 4, and 7. We use and disclose sensitive personal information only for purposes permitted by applicable law (such as providing the Services, verification, security, and fraud prevention), and not to infer characteristics; we therefore do not offer a separate "limit use" control.

"Sale" and "sharing"

We do not sell personal information for money. Our use of advertising and analytics cookies may constitute "sharing" (or a "sale") of identifiers and internet activity data under some state laws. You can opt out via the cookie and advertising controls in Section 8, an opt-out preference signal such as GPC (Section 16), or by emailing [email protected] with the subject "Do Not Sell or Share." We do not knowingly sell or share the personal information of consumers under 16, and we do not use the Services to knowingly collect data from anyone under 18 (Section 14).

Your state rights

Depending on your state, you may have the right to: know whether we process your personal information; access it and obtain a copy in a portable format; correct inaccuracies; delete it; opt out of targeted advertising, sale/sharing, and certain profiling; and not receive discriminatory treatment for exercising rights. Submit requests as described in Section 15; we will verify your identity and respond within the period required by the applicable statute. Authorized agents may submit requests with proof of valid authorization, which we may require to be notarized or accompanied by direct confirmation from you. If we decline your request, you may appeal by replying to our decision email with "Appeal" in the subject line; if your appeal is denied, you may contact your state Attorney General or data protection authority.

California-specific disclosures

Shine the Light. California Civil Code § 1798.83 permits California residents to request, once per calendar year and free of charge, information about categories of personal information (if any) we disclosed to third parties for their own direct marketing purposes and the identities of those third parties. Send requests to [email protected] with "California Privacy Rights Request" in the subject line, including your name and address.

Content removal (under-18 users). California residents under 18 with a registered account may request removal of content they publicly posted by contacting us with the email address associated with the account and a statement of California residency; note that removal may not be complete or comprehensive where the law permits retention.

18NOTICE TO OUTREACH RECIPIENTS (THIRD-PARTY CONTACT DATA SUBJECTS)

This section applies to individuals - including residents of the EEA, UK, and Switzerland, for whom it serves as notice under GDPR Article 14 - who have received communications sent through the platform but are not themselves users of the Services.

What we process and why. Myuser provides outbound communication and automation tools to business customers. In providing those tools, Myuser may process, as a data processor on the customer's behalf, categories of professional contact data relating to you: name, professional email address, business phone number, job title, employer name, and related professional information. This data may have been provided to the customer directly or sourced from third-party data providers. The customer, as controller, is responsible for identifying a lawful basis under applicable law (commonly legitimate interests or, where required, consent) for processing your data and contacting you; Myuser does not independently assess or verify the legal basis, consent status, or contact preferences relied upon by any customer.

Your rights. To exercise rights of access, rectification, erasure, restriction, or objection, contact the business that sent you the communication, as they are the controller. If you cannot identify or reach that business, you may contact us at [email protected]; we will forward your request to the relevant customer where feasible and assist to the extent required by applicable law. Myuser's role and responsibility with respect to your data are limited to those of a processor acting on documented instructions.

19BUSINESS TRANSFERS; THIRD-PARTY SITES; CHANGES TO THIS NOTICE

Business transfers. If we or our assets are acquired, or in the event of a merger, financing, reorganization, bankruptcy, receivership, or sale or transfer of all or a portion of our business or assets, information we hold - including personal information - may be disclosed to and transferred among the parties involved and their advisors, and will be among the assets transferred. You acknowledge that any acquirer or successor may continue to use your information as set out in this Notice or as otherwise permitted by applicable law.

Third-party sites and services. The Site and Services may contain links to, or interoperate with, websites, content, and services not operated by us. We do not control and are not responsible for their content, policies, or practices, and this Notice does not apply to them. Any access is at your own risk, and you should review the applicable third party's privacy policy.

Changes. We may update this Notice at any time in our discretion to reflect changes to our practices, technologies, legal requirements, or business. The updated version is effective as soon as it is posted, as indicated by the "Last updated" date. For material changes, we will make reasonable efforts to provide notice (for example, by email or a notice on the Site or in your dashboard), and where required by law we will obtain your consent. Your continued use of the Services after any update constitutes acceptance of the revised Notice.

Limits of this Notice. This Notice is a description of our practices; except as required by applicable law, it does not create or confer rights, obligations, or warranties beyond those set out in the Legal Terms, and does not create rights enforceable by any third party.

20CONTACT US

For questions, concerns, or requests regarding this Notice or your information - including requests to review, update, or delete personal information (Section 15) - contact our privacy team (which serves as our data protection contact) using the details below. Please include "Privacy" in the subject line.