Privacy Policy

Effective: December 11, 2024 · External-assistant disclosure updated September 25, 2026

We at Linnet Legacies (together with our affiliates, "Linnet Legacies", "we", "our" or "us") respect your privacy and are strongly committed to keeping secure any information we obtain from you or about you. This Privacy Policy describes our practices with respect to Personal Data that we collect from or about you when you use our website, applications, and services (collectively, "Services").

1. Personal Data We Collect

We collect personal data relating to you ("Personal Data") as follows:

Personal Data You Provide

We collect Personal Data if you create an account to use our Services or communicate with us as follows:

• Account Information: When you create an account with us, we will collect information associated with your account, including your name, contact information, account credentials, payment information, and transaction history (collectively, "Account Information").
• Financial and Business Data: We collect financial information and business data that you provide through our Services, including profit and loss statements, cash flow data, company information, OKRs, and other business metrics ("Financial Data").
• Communication Information: If you communicate with us, such as via email or our support channels, we may collect Personal Data like your name, contact information, and the contents of messages you send ("Communication Information").
• Other Information You Provide: We collect other information that you may provide to us, such as when you participate in our events or surveys (collectively, "Other Information You Provide").

Personal Data We Receive from Your Use of the Services

When you visit, use, or interact with the Services, we receive the following information ("Technical Information"):

• Log Data: We collect information that your browser or device automatically sends when you use our Services. Log data includes your Internet Protocol address, browser type and settings, the date and time of your request, and how you interact with our Services.
• Usage Data: We collect information about your use of the Services, such as the types of content that you view or engage with, the features you use and the actions you take, as well as your time zone, country, the dates and times of access, and user agent.
• Device Information: We collect information about the device you use to access the Services, such as the name of the device, operating system, device identifiers, and browser you are using.
• Location Information: We may determine the general area from which your device accesses our Services based on information like its IP address for security reasons and to improve your experience.
• Cookies and Similar Technologies: We use cookies and similar technologies to operate and administer our Services and improve your experience.

Information We Receive from Other Sources

We receive information from trusted partners, such as security partners, to protect against fraud, abuse, and other security threats to our Services, and from payment processors to facilitate transactions.

2. How We Use Personal Data

We may use Personal Data for the following purposes:

• To provide, analyze, and maintain our Services, including processing and displaying your financial data
• To improve and develop our Services and conduct research, for example to develop new features
• To communicate with you, including to send you information about our Services and events
• To prevent fraud, illegal activity, or misuses of our Services, and to protect the security of our systems
• To comply with legal obligations and to protect the rights, privacy, safety, or property of our users, Linnet Legacies, or third parties
• To provide customer support and respond to your inquiries

We may also aggregate or de-identify Personal Data so that it no longer identifies you and use this information for analytics, research, and service improvement purposes. We will maintain and use de-identified information in de-identified form and not attempt to reidentify the information, unless required by law.

3. Connected Services and Store Data

FreedomOS connects to third-party services you choose to authorize — such as your online store, accounting system, email, or advertising accounts — so that the Services can act on your behalf inside them. You authorize each connection yourself, you choose the level of access when you connect, and you can revoke it at any time.

External AI assistants you connect

When you authorize an external AI assistant to connect to FreedomOS, it can request information and actions through the permissions available to your account. Responses may include your identity, company information, goals, knowledge, notes, and deal records, including Personal Data contained in those records. The connection does not give the assistant access to businesses you do not have permission to access.

The assistant provider receives the information returned to it and handles that information under its own terms, privacy policy, and your settings with that provider. It may act as an independent controller rather than a vendor acting only for FreedomOS. Depending on the provider and your settings, its purposes may include operating, personalizing, or improving its services. Review those policies before connecting. Connecting an assistant does not override restrictions on data obtained from other services or grant rights you do not have to disclose someone else's information.

You can request revocation of an assistant's authorization without deleting your FreedomOS business or the original records you keep here. We handle connector-specific data under applicable deletion requirements and the retention purposes in section 5. Revocation does not itself erase information already received by the assistant provider; requests concerning its copies are governed by that provider's deletion process. To request help revoking access or deleting data held by FreedomOS, contact us using the details below.

Shopify store data

If you connect a Shopify store, we access store data through Shopify's official API using the permissions you grant at the time of connection. Depending on the permission level you choose, this may include:

• Store and catalog data: shop details, products, variants, prices, inventory levels and locations, discounts, files, pages, navigation, and themes.
• Order data: orders, their totals, and their financial and fulfillment status.
• Customer data: aggregate customer statistics, where you have granted the customer permission. We do not use Shopify customer Personal Data for advertising, we do not sell or share it, and we do not use it to train machine-learning models.
• Staff data: the identity of the person who installed the app, used solely to confirm that the installer administers the FreedomOS company the store is being connected to.

We use this data only to operate the Services for you: answering your questions about your own store, preparing drafts for your approval, and making the changes you approve. Changes that a customer would see are held for your approval before they are published.

Access credentials for connected services are stored encrypted and are never exposed to you or to other users. When you disconnect a store — from FreedomOS or by removing the app in your Shopify admin — we delete the access credentials we hold for it. We honor Shopify's data request, customer redaction, and shop redaction notifications: on a redaction request we delete the corresponding data we hold, and on shop redaction we delete the store's data from our systems. To make a request directly, contact us at the address in the "How to Contact Us" section below.

4. Disclosure of Personal Data

We may disclose your Personal Data in the following circumstances:

• Vendors and Service Providers: To assist us in meeting business operations needs, we may disclose Personal Data to vendors and service providers, including providers of hosting services, cloud services, payment processors, email communication software, web analytics services, and other information technology providers. These parties will access, process, or store Personal Data only in the course of performing their duties to us.
• Assistants You Authorize: We disclose requested information to external AI assistants you connect, as described in section 3. These independent providers are distinct from vendors performing duties solely for us.
• Business Transfers: If we are involved in strategic transactions, reorganization, bankruptcy, receivership, or transition of service to another provider, your Personal Data may be disclosed in the diligence process and transferred as part of that transaction.
• Government Authorities or Other Third Parties: We may share your Personal Data with government authorities, industry peers, or other third parties in compliance with the law, to protect and defend our rights or property, to detect or prevent fraud, or to protect the safety and security of our Services and users.
• Affiliates: We may disclose Personal Data to our affiliates, who may use it in a manner consistent with this Privacy Policy.
• Business Account Administrators: When you join a business account, the administrators of that account may access and control your account, including accessing your Financial Data.

5. Data Retention

We'll retain your Personal Data for only as long as we need in order to provide our Services to you, or for other legitimate business purposes such as resolving disputes, safety and security reasons, or complying with our legal obligations. How long we retain Personal Data will depend on factors such as:

• Our purpose for processing the data
• The amount, nature, and sensitivity of the information
• The potential risk of harm from unauthorized use or disclosure
• Any legal requirements that we are subject to

Financial Data may be retained for longer periods to comply with tax, accounting, and regulatory requirements.

6. Your Rights

Depending on where you live, you may have certain statutory rights in relation to your Personal Data. For example, you may have the right to:

• Access your Personal Data and information relating to how it is processed
• Delete your Personal Data from our records
• Update or correct your Personal Data
• Transfer your Personal Data to a third party (right to data portability)
• Restrict how we process your Personal Data
• Withdraw your consent—where we rely on consent as the legal basis for processing at any time
• Object to how we process your Personal Data
• Lodge a complaint with your local data protection authority

You can exercise some of these rights through your account settings. If you are unable to exercise your rights through your account, please contact us at [email protected].

Linnet Legacies processes your Personal Data for the purposes described in this Privacy Policy on servers located in various jurisdictions, including processing and storing your Personal Data in our facilities and servers in the United States. We apply the protections described in this policy to your Personal Data regardless of where it is processed.

7. Children

Our Services are not directed to, or intended for, children under 18. We do not knowingly collect Personal Data from children under 18. If you have reason to believe that a child under 18 has provided Personal Data to Linnet Legacies through the Services, please contact us. We will investigate any notification and, if appropriate, delete the Personal Data from our systems.

8. Security

We implement commercially reasonable technical, administrative, and organizational measures designed to protect Personal Data, particularly sensitive Financial Data, from loss, misuse, and unauthorized access, disclosure, alteration, or destruction. This includes:

• Encryption of data in transit and at rest
• Regular security assessments and audits
• Access controls and authentication mechanisms
• Employee training on data security practices

However, no Internet or email transmission is ever fully secure or error free. Therefore, you should take special care in deciding what information you provide to the Services. We are not responsible for circumvention of any privacy settings or security measures contained on the Service, or third-party websites.

9. Additional U.S. State Disclosures

Some U.S. state privacy laws require specific disclosures. The following provides additional information about the categories of Personal Data we collect and how we use and disclose that information.

Categories of Personal Data We Collect:

• Identifiers (name, contact details, IP address, device identifiers)
• Commercial information (transaction history, payment information)
• Financial information (P&L statements, cash flow data, business metrics)
• Network activity information (how you interact with our Services)
• Communication information (contact information when you send us messages)
• Geolocation data (general area from which you access our Services)
• Account credentials and payment information

Your California Privacy Rights

Depending on where you live and subject to applicable exceptions, you may have the following privacy rights:

• The right to know information about our processing of your Personal Data, including the right to access your Personal Data
• The right to request deletion of your Personal Data
• The right to correct your Personal Data
• The right to be free from discrimination relating to the exercise of any of your privacy rights

We don't "sell" Personal Data or "share" Personal Data for cross-contextual behavioral advertising, and we do not process Personal Data for "targeted advertising" purposes (as those terms are defined under state privacy laws). We also don't process sensitive Personal Data for the purposes of inferring characteristics about a consumer.

Exercising Your Rights

You can exercise privacy rights by submitting a request through your account settings or by contacting us at [email protected].

Verification

In order to protect your Personal Data from unauthorized access, change, or deletion, we may require you to verify your credentials before you can submit a request. If we cannot verify your identity, we will not be able to honor your request.

Authorized Agents

You may also submit a rights request through an authorized agent. If you do so, the agent must present signed written permission to act on your behalf and you may also be required to independently verify your identity with us.

10. International Data Transfers

Your information may be transferred to, and maintained on, computers located outside of your state, province, country, or other governmental jurisdiction where the data protection laws may differ from those in your jurisdiction. We will take all steps reasonably necessary to ensure that your data is treated securely and in accordance with this Privacy Policy.

11. Changes to the Privacy Policy

We may update this Privacy Policy from time to time. When we do, we will publish an updated version and effective date on this page, unless another type of notice is required by applicable law. We encourage you to review this Privacy Policy periodically to stay informed about our information practices.

12. How to Contact Us

If you have any questions or concerns not already addressed in this Privacy Policy, please contact us through our support channels or email us at [email protected].