MAGNAVIS Privacy Policy

Version 1.2 — Effective September 15, 2026

This Policy explains how MAGNAVIS, offering MAGNAVIS under its current product name (the Provider), handles personal information. A signed customer agreement controls where it expressly differs.

1. Information handled

Depending on use and configuration, we may handle account and business-contact data; candidate and recruiting records; employment history; notes, messages, and imported content; service activity; device, browser, IP, authentication, and diagnostic data; support communications; and inferences or scores generated from submitted data. Customers determine much of the content placed in their tenant.

2. Roles

For customer-controlled candidate, prospect, and business records, Provider generally acts as a processor or service provider under customer instructions. Provider acts as an independent controller for its own account administration, security, billing, legal compliance, and direct business relationships. Actual roles depend on the activity and contract.

3. Purposes and legal bases

We use information to provide and secure the Service; authenticate users; maintain tenant permissions; respond to support; meter authorized functionality; prevent abuse; meet contractual and legal obligations; and communicate about the relationship, only where an applicable lawful basis permits the activity. Where EU or UK law applies, the customer is responsible for identifying the lawful basis for customer-directed processing.

4. Disclosures and external AI

Information may be disclosed to authorized customer users, providers separately approved for the applicable environment, professional advisers under duties of confidentiality, authorities when legally required, and a successor in a permitted transaction. External AI processing depends on the configured provider, access controls and request. Administrator configuration shows which providers are enabled; prompt history records the provider used for each request. Do not assume a provider is disabled from this policy alone. Activation requires verified commercial terms, data-protection terms where applicable, and environment configuration. We do not authorize Customer Data for a provider's general model training without separate express authorization.

5. Security

We maintain technical and organizational measures designed to protect personal information against unauthorized access, use, alteration, and disclosure. Measures vary by service, environment, account configuration, and risk and may include access controls, authentication safeguards, encryption provided by configured hosting and communications services, logging, backup, and incident-response procedures. No method is completely secure. Contract customers should rely on their Order Form and signed Security Addendum for specific promised controls.

6. Retention

Retention depends on customer instructions, account term, record type, backup cycle, dispute or legal hold, and configured services. Deletion or de-identification must follow those instructions and constraints through the configured or documented manual procedure; this Policy does not claim that an automated deletion process runs for every record. Customer administrators should use the applicable verified export and deletion procedure before termination.

7. Locations and transfers

Processing locations depend on hosting region, enabled features, support access, and approved subprocessors. Restricted international transfers use mechanisms required by applicable law when in scope. No public statement that data remains in one region overrides a signed, environment-specific transfer schedule.

8. Choices and rights

Depending on applicable law, a person may request access, correction, deletion, portability, restriction, or objection. If a customer controls the relevant data, we may route the request to that customer. We may verify identity and retain the request record. Submit requests to info@middletonadvisorygroup.com.

9. Children and sensitive data

The Service is not directed to children. Do not submit sensitive or special-category data, criminal records, government identifiers, payment-card data, health information, or protected-trait data unless the applicable Order Form and DPA expressly authorize it and required safeguards are in place.

10. Updates

We will identify material revisions by version and effective date and use the contractual or in-product notice and acceptance process that applies.