This Privacy Policy describes how MySoc AI, Inc., a Delaware corporation ("mysoc.ai", "we", "us", or "our") collects, uses, discloses, and protects information in connection with our AI-powered security operations center (SOC) platform, our website at mysoc.ai, and our mobile and web applications (collectively, the "Services"). By using the Services, you agree to the practices described in this policy.

1. Information We Collect

We collect the following categories of information:

Account information. Name, work email address, organization, role, and authentication credentials used to create and secure your account.
Customer security data. Security telemetry, alerts, tickets, investigation notes, chat messages, and related operational data that your organization processes through the Services. This data is controlled by your organization (our customer); we process it on their behalf.
Usage and device data. Log data, IP address, device and browser type, app version, and interactions with the Services, collected to operate, secure, and improve the product.
Communications. Information you provide when you contact us for support or sales, including the contents of your messages.

2. How We Use Information

Provide, maintain, secure, and improve the Services.
Authenticate users and prevent fraud, abuse, and unauthorized access.
Detect, investigate, and respond to security events on behalf of our customers.
Respond to support requests and communicate about the Services.
Comply with legal obligations and enforce our agreements.

We do not sell your personal information, and we do not use customer security data for advertising.

3. How We Share Information

We share information only as needed to operate the Services:

Service providers (sub-processors). Cloud hosting, email delivery, and infrastructure providers that process data under contract and on our instructions.
AI model providers (sub-processors). Third-party large language model providers that power the platform's AI analysis, as described in Section 4.
Your organization. Administrators of your organization may access data associated with your account.
Legal and safety. When required by law, legal process, or to protect the rights, safety, and security of our users and the public.
Business transfers. In connection with a merger, acquisition, or sale of assets, subject to this policy.

4. AI Processing

The Services use AI to triage alerts, investigate incidents, extract indicators, map activity to MITRE ATT&CK, communicate with customers, and write reports. To do this, relevant portions of customer security data (for example alert details, log excerpts, and investigation context) may be sent to the AI model provider configured for your deployment:

Cloud model providers. Anthropic, OpenAI, Google (Gemini), and OpenRouter. We use these providers under their commercial API terms, and we do not authorize them to use customer data to train their models. Providers may retain inputs and outputs for a limited period to detect abuse and misuse of their services, under their own retention policies.
Local models. For on-premises deployments, the AI layer can run on a locally hosted model so that customer security data does not leave your environment.

The AI is used only for defensive security operations on behalf of our customers. Contact us for the current list of AI sub-processors or to discuss which providers are enabled for your organization.

5. Data Retention

We retain personal and customer data for as long as your account is active or as needed to provide the Services, comply with legal obligations, resolve disputes, and enforce our agreements. Customer security data is retained according to the configuration and contract with your organization, and is deleted or returned upon termination as provided in that agreement.

6. Data Security

We use technical and organizational measures designed to protect information, including encryption in transit and at rest, access controls, least-privilege practices, and monitoring. No method of transmission or storage is completely secure, but we work to protect your data and continually improve our safeguards. See our Security page for more detail.

7. Your Rights and Choices

Depending on your location, you may have rights to access, correct, delete, or restrict processing of your personal information, and to object to certain processing. Because much of the data in the Services is controlled by your organization, please direct such requests to your organization administrator or contact us and we will assist as required by applicable law.

8. Children's Privacy

The Services are intended for business use and are not directed to children under 13 (or the equivalent minimum age in your jurisdiction). We do not knowingly collect personal information from children.

9. International Data Transfers

We may process and store information in countries other than where you are located. Where required, we use appropriate safeguards for cross-border transfers of personal data.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will post the updated version on this page and revise the "Last updated" date above. Material changes will be communicated as required by law.

11. Contact Us

If you have questions about this Privacy Policy or our data practices, contact us at privacy@mysoc.ai or visit our Support page.