Privacy Policy

⚠ Held back from publication

EU and UK Article 27 representatives not yet appointed (Prighter in progress), and the consent management platform is not yet live. This document asserts both.

This page is noindex and excluded from the sitemap until that is resolved. Fields still to complete: [NAME] [ADDRESS IN EEA MEMBER STATE] [EMAIL] [UK ADDRESS] [NAME AND CONTACT]

Last Updated: August 17, 2026 | Effective Date: August 17, 2026

At a Glance

This summary is for convenience only. The full policy below governs.

Who we are. AtmosAI, Inc., a Wyoming company, operating Marketing Titan.

We wear two hats. For data you put into the platform — your CRM, your campaigns, your creative — you're in charge and we only act on your instructions. For our business contact database, we're in charge. Section 2 explains the difference, and it determines who you contact about what.

If you're in our contact database and never signed up with us, Section 6 is written for you. You can have your record deleted, free, without creating an account: marketingtitan.ai/opt-out.

We don't train AI models on your data. We don't build our own models, and we configure our AI providers to disable training on customer data where that setting exists.

We do sell business contact data. That's the product. Under California law that makes us a data broker, and we say so plainly rather than hiding behind a technicality. You can opt out.

What we won't do. We don't use your CRM data to build our database. We don't share your data with other customers. We don't run advertising trackers inside the platform itself — only on our public marketing pages, where you can turn them off.

Reaching us. privacy@marketingtitan.ai for anything privacy-related.

1. Introduction and Governing Entity

Marketing Titan (the "Service") is owned and operated by AtmosAI, Inc., doing business as Marketing Titan ("we," "us," or "our"). We are the parent entity responsible for Marketing Titan and its related products, including Lead Titan AI and IT Titan.

Marketing Titan is an AI-native marketing and sales operating system. It combines B2B contact data, a customer relationship management (CRM) system, AI-assisted campaign strategy, generative content and visual creation, multi-channel campaign delivery across email, SMS, voice, social, and paid advertising, and analytics and data optimization tooling.

This Privacy Policy explains how we collect, use, store, disclose, and protect information in connection with the Service, including through integrations with third-party platforms such as CRM systems, calendar tools, email delivery providers, advertising platforms, and telecommunications providers.

By creating an account or using the Service, you acknowledge that you have read and agree to this Privacy Policy. If you do not agree, discontinue use immediately.

If you are not a Marketing Titan customer and are reading this because your business contact information appears in our database, Section 6 is written for you.

Contact address AtmosAI, Inc. 30 N Gould St, Ste. R Sheridan, WY 82801, United States

1.1 Regulatory Framework

We are committed to compliance with applicable data protection, privacy, and consumer protection laws, including:

United States — federal

Telephone Consumer Protection Act (TCPA), 47 U.S.C. § 227
CAN-SPAM Act, 15 U.S.C. § 7701 et seq.
Federal Trade Commission Act, 15 U.S.C. § 45
Health Insurance Portability and Accountability Act (HIPAA), where applicable
Fair Debt Collection Practices Act, where applicable

United States — state

California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA)
California Delete Act, Cal. Civ. Code § 1798.99.80 et seq.
Comprehensive privacy statutes in Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Florida, Delaware, Iowa, Nebraska, New Hampshire, New Jersey, Tennessee, Minnesota, Maryland, Indiana, Kentucky, and Rhode Island
Washington My Health My Data Act and Nevada SB 370
Data broker registration statutes in California, Texas, Oregon, and Vermont
Florida Telephone Solicitation Act and applicable state telemarketing statutes
Applicable state wiretapping and call recording statutes

European Economic Area and United Kingdom

General Data Protection Regulation (EU) 2016/679
UK GDPR and Data Protection Act 2018
Privacy and Electronic Communications Regulations and national ePrivacy implementations

Canada

Personal Information Protection and Electronic Documents Act (PIPEDA)
Canada's Anti-Spam Legislation (CASL)
Quebec Law 25
Alberta and British Columbia PIPA, as applicable

2. Our Role: Controller and Processor

We occupy two distinct legal roles depending on the data at issue.

2.1 Where We Act as a Controller

We are the controller — or, under US state law, the business — and determine the purposes and means of processing for:

Customer account data: your name, business email, company, billing details, and account activity
The Marketing Titan contact database: business contact records we compile, verify, and make available to customers, including records relating to individuals who are not our customers
Service usage and telemetry: logs, analytics, and security data generated by use of the Service
Our own marketing communications to you

2.2 Where We Act as a Processor

We are a processor — or, under US state law, a service provider — acting only on your documented instructions for:

CRM records you create, upload, import, or sync
Campaign audience lists and recipient data you upload or select
Email, SMS, voice, and social message content you create and send
Creative assets and brand materials you upload
Calendar, meeting, and scheduling data accessed through your authorized integrations
Analytics and engagement data generated by your campaigns

For all processor-role data, you are the controller. You are responsible for establishing a lawful basis, providing notice to the individuals concerned, and responding to their rights requests. Our obligations to you in this role are set out in our Data Processing Addendum.

2.3 Where the Roles Meet

When you select contacts from our database and import them into a campaign, the same record may be held by us as controller and processed by us as processor. Deleting a record from your campaign does not delete it from the database, and a database deletion request does not automatically remove copies you have already exported. Section 6.5 explains how deletion requests are handled across both.

3. Information We Collect

3.1 Account and Identity Information

Full legal name, business email, company name, job title, and password (hashed and salted)
Legal entity name, jurisdiction of incorporation, and business identifier, for compliance and fraud prevention
Billing contact information and payment details, processed by our payment processor; we do not store full card numbers
Phone number for account verification and support
Time-stamped consent attestations captured at signup and at activation of regulated features

3.2 Usage and Platform Activity Data

Pages visited, features accessed, search queries, exports, and interaction patterns
AI agent session data, prompts submitted, and generated outputs
Campaign configuration, send activity, and performance results
AI Caller session metadata, call logs, recordings, and transcripts where enabled and legally permissible
Browser type, operating system, IP address, device identifiers, and referring URLs

3.3 CRM Data

Marketing Titan includes a native CRM. Data you enter, import, or sync may include contact and company records, deal and pipeline data, activity and communication history, notes, attachments, custom fields, and lifecycle status.

We process CRM data solely as a processor, on your instruction. We do not use CRM data to expand, enrich, or validate our contact database, and we do not disclose it to other customers.

Prohibited categories. The Service may not be used to process special category personal data under GDPR Art. 9, sensitive personal information as defined under applicable US state law, Protected Health Information, payment card data, or government identification numbers, unless you have executed a written agreement with us expressly permitting it. Uploading such data without that agreement is a breach of our Terms of Use.

3.4 Campaign, Creative, and Generative Content Data

When you use campaign strategy, content generation, or visual creation features, we process:

Prompts and inputs you submit, including briefs, brand guidelines, product information, and audience descriptions
Uploaded creative assets, including images, video, logos, and brand materials
Generated outputs, including copy, images, video, and campaign structures
Voice inputs and outputs where AI Voice features are used, including uploaded knowledge bases
Screen recordings where that feature is used, which may incidentally capture whatever is visible on your screen

You are responsible for ensuring you hold the necessary rights to material you upload and that uploads do not contain personal data of individuals who have not been given appropriate notice. Screen recording in particular can capture third-party personal data inadvertently; review recordings before sharing.

3.5 Advertising Platform Data

When you use paid social, search, or display advertising features, we may transmit audience data to advertising platforms on your behalf. This can include hashed email addresses, hashed phone numbers, and other matching identifiers used to build custom or matched audiences, along with campaign performance and conversion data returned by those platforms.

Where you instruct us to upload audience data to an advertising platform, you are the controller of that disclosure and are responsible for having a lawful basis and for making the disclosures the platform's terms require. Where this activity constitutes sharing under the CPRA or an equivalent term under other state law, see Section 16.4.

3.6 Business Contact Database

We compile and maintain a database of business contact information for B2B sales and marketing. Section 6 describes the sources, purposes, legal bases, and rights that apply.

3.7 Integration and Connected Platform Data

CRM platforms. Contact records, account data, activity logs, deal and pipeline data, and custom fields, as authorized by your configuration. Processor role only.

Calendar and scheduling platforms. Availability, meeting data, event details, and attendee information, limited to what the scheduling features you enable require.

Email accounts and inbox platforms. Sending, receiving, and logging email on your behalf, including delivery status, open and click data, bounce data, and reply detection. We do not read or store inbound email content beyond what is necessary to detect replies and manage sequences.

Transactional email delivery providers. Email content, recipient addresses, and delivery metadata, processed on our behalf under data processing agreements.

Telecommunications providers. Voice calls, SMS, and phone number provisioning through third-party infrastructure providers. Call metadata, recordings where enabled, SMS content, and telephony logs may be transmitted through and stored by these providers.

Advertising platforms. As described in Section 3.5.

Social and professional networks. Outreach and publishing executed on your behalf using your authenticated credentials or authorized API access.

Analytics and data warehouse platforms. Where you connect a warehouse or BI tool, we read and write only the datasets you authorize.

3.8 Google and Microsoft API Data

Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

We use Google user data only to provide and improve user-facing features that are prominent in the Service interface
We do not transfer Google user data except as necessary to provide those features, to comply with applicable law, or as part of a merger or acquisition following consent
We do not use Google user data, raw or derived, to develop, improve, or train generalized artificial intelligence or machine learning models
We do not allow humans to read Google user data except with your affirmative consent, for security purposes, to comply with applicable law, or where the data has been aggregated and de-identified

Equivalent commitments apply to data accessed through Microsoft Graph and other inbox providers.

4. Legal Bases for Processing (EEA and UK)

Processing activity	Legal basis
Providing the Service under your subscription	Contract — Art. 6(1)(b)
Billing, invoicing, and collections	Contract — Art. 6(1)(b); Legal obligation — Art. 6(1)(c)
Compiling and maintaining the business contact database	Legitimate interests — Art. 6(1)(f). Our interest: enabling lawful B2B commerce and business development. See Section 6.3.
Verifying and enriching contact records for accuracy	Legitimate interests — Art. 6(1)(f). Our interest: data accuracy and reducing misdirected contact.
Security, fraud prevention, and abuse detection	Legitimate interests — Art. 6(1)(f); Legal obligation — Art. 6(1)(c)
Product analytics and Service improvement	Legitimate interests — Art. 6(1)(f)
Marketing communications about our products	Consent — Art. 6(1)(a), or legitimate interests where the soft opt-in applies
Non-essential cookies and similar technologies	Consent — Art. 6(1)(a) and ePrivacy/PECR
Call recording	Consent — Art. 6(1)(a), obtained by you as controller
Retaining consent and opt-out records	Legal obligation — Art. 6(1)(c); Legitimate interests — Art. 6(1)(f)
Responding to legal process and regulatory demands	Legal obligation — Art. 6(1)(c)

Where we rely on legitimate interests, you have the right to object under Art. 21. For direct marketing purposes that objection is absolute, and we will stop the processing without requiring you to justify the request.

5. How We Use Information

To provision, operate, maintain, secure, and improve the Service
To provide CRM, campaign management, and analytics functionality
To generate marketing content, creative assets, campaign strategy, and audience recommendations using AI
To provision telecommunications infrastructure on your behalf
To facilitate CRM sync, calendar scheduling, email delivery, and advertising platform connections
To compile, verify, enrich, and maintain the accuracy of the business contact database
To process subscription payments and manage billing
To send product updates and, with your consent, marketing communications
To detect, investigate, and prevent fraud, abuse, policy violations, and security incidents
To enforce our Terms of Use and Acceptable Use Policy
To maintain records required for TCPA, CAN-SPAM, CASL, GDPR, CCPA, and other regulatory compliance
To respond to legal process, court orders, regulatory requests, and law enforcement demands
To operate the opt-out and do-not-contact processes described in Section 6.5

6. Information About Business Contacts

This section is for you if you are not a Marketing Titan customer but your business contact information appears in our database.

We may hold information about you even though you have never interacted with us. This section explains what we hold, where it came from, why, and how to have it removed.

6.1 What We Hold

Your name; business email address; business phone number, which in some cases is a mobile number; job title and seniority; employer name; employer location, industry, and size; professional profile URLs; and derived attributes such as an inferred role category or an engagement score generated by our systems.

We do not knowingly collect or maintain, for this database, special category data under GDPR Art. 9, sensitive personal information under US state law, government identification numbers, financial account details, health information, or precise geolocation.

6.2 Where It Came From

Records are compiled from publicly accessible business sources including company websites, public filings and registries, professional and business networking profiles, published directories, press and news sources, and event and conference materials, together with records licensed from third-party data suppliers. We also verify email deliverability and phone validity through specialist verification providers.

6.3 Why We Process It, and Our Legal Basis

We process this information to enable business-to-business commerce: helping companies identify potential business contacts, verifying that contact details are accurate so that outreach reaches the right person, and making this information available to our customers for lawful B2B sales and marketing.

For individuals in the EEA and UK, our legal basis is legitimate interests under Art. 6(1)(f). Our interest is the operation of a lawful B2B data service. In relying on this basis we weigh our interests against your rights and freedoms, taking into account the professional rather than private nature of the data, your reasonable expectations, and the availability of an unconditional opt-out.

You have the right to object to this processing at any time. Where you object for direct marketing purposes, we will stop without requiring a reason.

Contact records are made available to Marketing Titan customers — businesses that have subscribed to the Service — for B2B sales and marketing. We also share with the sub-processors listed at marketingtitan.ai/subprocessors.

We are a data broker as that term is defined under California, Texas, Oregon, and Vermont law, and we make personal information available to third parties for consideration.

6.5 Your Rights and How to Exercise Them

You may, at any time and free of charge:

Access the information we hold about you
Correct information that is inaccurate or incomplete
Delete your record from our database
Object to our processing, including for direct marketing
Opt out of the sale or sharing of your information
Restrict processing or request portability, where applicable law provides these rights

To exercise any of these rights: email privacy@marketingtitan.ai or use the form at marketingtitan.ai/opt-out. You do not need an account and will not be asked to create one. There is no fee.

We will respond within the period required by applicable law: 45 days under CCPA and most US state statutes, extendable once by a further 45 days; one month under GDPR and UK GDPR, extendable by up to two further months for complex requests; and 30 days under PIPEDA.

Deletion is permanent. When you ask us to delete your record, we remove it and retain no copy. Because our database is compiled on an ongoing basis from public and licensed sources, information about you may be collected again from those sources in future. If that happens, you may submit a further request and we will delete it again.

Records already exported by customers. Customers who exported your record before your request hold their own copies, for which they are the controller. We will notify customers known to hold your record and instruct them to delete it, and we will identify them to you on request so you can approach them directly.

6.6 California DROP Platform

California residents may submit a single deletion request to all registered data brokers through the state's Delete Request and Opt-Out Platform (DROP) at privacy.ca.gov. We process deletion requests received through DROP in accordance with the timelines the Delete Act requires. You may also contact us directly using the details in Section 6.5.

6.7 When We Provide This Notice

Where we obtain your information from a source other than you, Art. 14(3) requires that we inform you within a reasonable period and at the latest within one month, or — if the information is used to communicate with you — at the latest when that first communication takes place.

Because we do not ourselves contact individuals in the database, we make this notice permanently and publicly available on this page and on our GDPR page, and we require our customers to identify themselves and provide an opt-out in every communication they send. Where providing individual notice would involve disproportionate effort within the meaning of Art. 14(5)(b), we rely on this public notice, which sets out all of the information Art. 14 requires.

6.8 Retention

We retain contact records for as long as they remain accurate and relevant for B2B purposes, and we review them on a 24-month cycle. Records that fail verification or that we can no longer confirm are removed.

7. Artificial Intelligence, Automated Decision-Making, and Model Training

A plain-language overview is available in our AI Transparency Notice.

7.1 AI Features

The Service uses artificial intelligence for campaign strategy, content and creative generation, audience segmentation, lead and engagement scoring, voice calling, and analytics. These features are delivered using a combination of our own models and third-party foundation models operated by the providers listed at marketingtitan.ai/subprocessors.

7.2 Model Training

We do not train artificial intelligence or machine learning models on your data. We do not develop our own models. Our AI features are powered by third-party providers, and we configure those providers to disable training on customer data where that option is available.

We use aggregated and de-identified data derived from Service usage to operate, maintain, and improve the Service and our AI agents. De-identified data is not re-identified and is not used to build profiles of any individual.

7.3 Profiling and Automated Scoring

The Service generates scores and derived attributes about contacts, including lead scores, ideal-customer-profile match indicators, and engagement predictions. These are profiling within the meaning of GDPR Art. 4(4).

These scores inform human decisions about who to contact; they do not by themselves produce legal or similarly significant effects on individuals within the meaning of GDPR Art. 22. Individuals may request the logic involved, request human review, and object to the profiling under Section 6.5.

7.4 Generated Content

AI-generated copy, images, and video may be inaccurate, may resemble existing works, and are not warranted as original or free of third-party rights. You are responsible for reviewing generated content before publication.

7.5 EU AI Act Transparency

Where the Service is used with individuals in the European Union, Article 50 of Regulation (EU) 2024/1689 (the EU AI Act) imposes transparency obligations that apply from 2 August 2026.

Interaction with AI systems. Individuals who interact with our AI Caller or other conversational AI features are informed that they are interacting with an AI system, unless this is obvious from the circumstances.

Synthetic content marking. Audio, image, video, and text generated by the Service are marked in a machine-readable format and detectable as artificially generated, as required by Art. 50(2). The marking obligation applies to systems placed on the market before 2 August 2026 from 2 December 2026.

Deepfake disclosure. Where generated image, audio, or video content depicts a real person, that content must be disclosed as artificially generated or manipulated.

Allocation of responsibility. We act as the provider of these AI systems. Customers act as deployers and are responsible for the deployer-side disclosures in Art. 50, including informing individuals they contact through AI features and disclosing AI-generated text published to inform the public on matters of public interest. Section 8.6 of the Terms of Use sets out what this requires of you.

8.1 Sub-Processor List

A current list of our sub-processors, including each entity's name, function, and processing location, is maintained at marketingtitan.ai/subprocessors.

We give at least 30 days' notice before adding or replacing a sub-processor. Customers may subscribe to change notifications and may object to a new sub-processor on reasonable data protection grounds, as set out in the Data Processing Addendum.

Sub-processor categories include cloud infrastructure and hosting; payment processing; telecommunications infrastructure; transactional email delivery; AI and machine learning model providers; email verification and data enrichment; analytics, monitoring, and error tracking; customer support tooling; and identity and authentication.

8.2 Integration Partners

CRM platforms, calendar systems, inbox providers, advertising platforms, and social networks are connected by you, through OAuth or API credentials. These are not our sub-processors; they are independent controllers or your own processors, and your relationship with them is governed by their terms. Our access is limited to the scopes you authorize and may be revoked by you at any time.

8.3 Other Disclosures

We disclose personal information:

To sub-processors under written data processing agreements
To affiliated entities, including Lead Titan AI and IT Titan, for operational, billing, and security purposes
In response to valid legal process, subpoenas, court orders, or regulatory demands
In connection with a merger, acquisition, reorganization, or asset sale, subject to the acquirer honoring this policy
With your explicit consent

Government and law enforcement requests. We review each request for validity and scope, and we object to requests that are overbroad or legally deficient. Where we are legally permitted to notify you, we will.

8.4 Third-Party Platform Responsibility

We are not responsible for the privacy practices, data handling, security, or terms of any third-party platform you connect. Review their policies before connecting.

9. Outreach Compliance and Customer Obligations

9.1 Allocation of Responsibility

You are solely responsible for ensuring that your outreach — across email, SMS, voice, social, and advertising — complies with applicable law. We do not obtain consent on your behalf, do not perform do-not-call scrubbing unless expressly offered as a feature of your plan, and do not warrant the legal suitability of any data for any specific purpose.

9.2 TCPA and AI Voice Calls

Business phone numbers, including mobile numbers, may be subject to TCPA protection regardless of business-use context. You must independently verify prior express written consent before placing any automated or AI-generated voice call or text message. Statutory damages range from $500 to $1,500 per violation.

9.3 CAN-SPAM

Commercial email must include a functioning opt-out, a valid physical postal address, accurate headers and subject lines, and identification as an advertisement where required. Opt-outs must be honored within 10 business days.

9.4 CASL (Canada)

CASL requires express or valid implied consent before sending a commercial electronic message to a Canadian recipient. Implied consent is narrow and time-limited. Every message must identify the sender, provide contact information valid for at least 60 days, and include an unsubscribe mechanism honored within 10 business days.

CASL penalties reach CAD $10 million per violation for organizations, and directors and officers may be personally liable. CASL's amendments to PIPEDA also prohibit the collection of electronic addresses through address-harvesting software.

9.5 EEA and UK Electronic Marketing

Under PECR and national ePrivacy rules, electronic marketing to individuals generally requires prior consent. Rules for corporate subscribers vary by member state; several treat individually-addressed corporate email as requiring consent. Every message must offer a free opt-out.

9.6 Advertising Platform Compliance

When uploading audience data to advertising platforms, you are responsible for holding a lawful basis, making the disclosures those platforms require of advertisers, and honoring opt-outs.

10. Telecommunications, Call Recording, and AI Disclosure

10.1 Telecommunications Infrastructure

Voice and SMS are transmitted through third-party infrastructure providers. Call and SMS data, including metadata, recordings where enabled, and logs, may be processed and stored by those providers subject to their own terms.

10.2 Call Recording

If you enable call recording, you are solely responsible for compliance with federal and state wiretapping, electronic surveillance, and call recording law. All-party consent is required in numerous states, including California, Florida, Illinois, Maryland, Massachusetts, Michigan, Montana, Nevada, New Hampshire, Oregon, Pennsylvania, and Washington. Canada requires notification, and EEA/UK recording generally requires a lawful basis and clear notice to all parties. Configure appropriate disclosures and obtain required consents before recording.

10.3 AI Identity Disclosure

State and federal rules increasingly require AI-driven or automated callers to identify themselves as such at the outset of a communication. You are responsible for configuring AI features to comply in every jurisdiction where you operate. We recommend AI identification at the start of every AI-initiated call and in every AI-generated message, regardless of jurisdiction.

10.4 Voice Cloning and Synthetic Voice

Where the Service permits custom voice creation, you represent that you hold documented consent from the individual whose voice is used. Several jurisdictions regulate synthetic voice and digital replicas, and the FCC has held that AI-generated voices in unsolicited calls fall within the TCPA's artificial-voice prohibition.

11. International Data Transfers

AtmosAI, Inc. is established in the United States. Personal data may be transferred to and processed in the United States and other jurisdictions where our sub-processors operate.

EEA and UK transfers are made under the European Commission's Standard Contractual Clauses, the UK International Data Transfer Agreement, or the UK Addendum to the EU SCCs, together with supplementary measures where required. We conduct transfer impact assessments where applicable.

Canadian transfers are subject to PIPEDA's accountability principle. We remain accountable for personal information transferred to third parties for processing and require comparable protection by contract. For Quebec residents, we conduct privacy impact assessments before communicating personal information outside Quebec, as required by Law 25.

Copies of the transfer mechanisms are available on request at privacy@marketingtitan.ai.

11.1 EU and UK Representatives

EU Representative (GDPR Art. 27) [NAME] [ADDRESS IN EEA MEMBER STATE] [EMAIL]

UK Representative (UK GDPR Art. 27) [NAME] [UK ADDRESS] [EMAIL]

Quebec Privacy Officer (Law 25) [NAME] [EMAIL]

12. HIPAA and Regulated Data

Marketing Titan is not a HIPAA-covered entity or business associate, and the Service is not designed for and may not be used with Protected Health Information. We do not enter Business Associate Agreements. If you are a covered entity or business associate, do not submit PHI to the Service.

Similar restrictions apply to data regulated under GLBA, FERPA, and PCI-DSS. The Service is not certified for cardholder data beyond the tokenized processing performed by our payment processor.

Consumer health data. Washington's My Health My Data Act and Nevada SB 370 define consumer health data broadly enough to capture inferences drawn from marketing activity, including audience segments implying a health condition. Do not build, upload, or target audiences on the basis of health status or inferred health conditions without separate written authorization from us and valid consent from each individual. The Washington statute carries a private right of action.

13. Data Security

TLS 1.2 or higher for data in transit
Encryption at rest using AES-256 or equivalent
Encrypted, audited cloud infrastructure
Role-based access controls and least privilege
Multi-factor authentication for administrative access
Regular security audits, vulnerability assessments, and penetration testing
Formal incident response procedures with defined escalation paths

Breach notification. In the event of a personal data breach we will:

Notify the relevant supervisory authority within 72 hours of becoming aware, where GDPR Art. 33 or UK GDPR requires it
Notify affected customers without undue delay
Report to the Privacy Commissioner of Canada and notify affected individuals where a breach of security safeguards creates a real risk of significant harm, and maintain a record of all such breaches for 24 months, as PIPEDA requires
Notify the Commission d'accès à l'information du Québec and affected individuals where a confidentiality incident presents a risk of serious injury, and maintain a confidentiality incident register, as Law 25 requires
Notify the Alberta Information and Privacy Commissioner where a real risk of significant harm exists
Comply with all applicable US state breach notification statutes

No method of electronic transmission or storage is completely secure. We cannot guarantee the security of data transmitted through third-party integrations, which are subject to those providers' own practices.

14. API Access and Data

API keys are account credentials, subject to the same security and confidentiality obligations as login credentials
Data accessed via API is subject to the same use restrictions, compliance obligations, and retention schedules as data accessed through the interface
API activity logs, including timestamps, endpoints, and data retrieved, are retained for 12 months for security and audit purposes
API keys are stored hashed and may be revoked at any time in response to suspected abuse
Data retrieved via API may not be resold, redistributed, or used in violation of this policy or applicable law

15. Data Retention

Data category	Retention period
Account data	Active account plus 30 days after deletion
CRM data	Active account plus 30 days, or per your configured settings
Integration access tokens	Only while the integration is active; revoked tokens deleted promptly
Campaign content and creative assets	Active account plus 30 days
AI prompts and generated outputs	90 days
Call recordings and transcripts	12 months, unless otherwise required by law or configured by you
Email, SMS, and outreach activity logs	12 months
Calendar booking records	12 months
CRM sync and activity logs	12 months
API activity logs	12 months
Business contact database records	Reviewed on a 24-month cycle; removed when no longer verifiable
Consent records and opt-out logs	Minimum 5 years, or as required by applicable law
Billing and financial records	7 years
Backups	Rolling 90-day window; deletion requests propagate on the next backup cycle

16. Your Privacy Rights

If you are a business contact in our database rather than a customer, see Section 6.5.

16.1 All Individuals

Access the personal data we hold about you
Correct inaccurate or incomplete data
Request deletion, subject to legal retention obligations
Withdraw consent at any time, without affecting the lawfulness of prior processing
Receive a copy of your data in a portable format
Lodge a complaint with a supervisory authority

16.2 EEA and UK Residents

In addition to the above: the right to object to processing based on legitimate interests, including an absolute right to object to direct marketing; the right to restrict processing; the right to data portability; and the right not to be subject to a decision based solely on automated processing producing legal or similarly significant effects.

You may complain to your national supervisory authority. In the UK, that is the Information Commissioner's Office. In the EEA, contact your member state's authority; a list is maintained by the European Data Protection Board.

16.3 Canadian Residents

Under PIPEDA, you have the right to access the personal information we hold about you, to challenge its accuracy and have it corrected, to know how it is used and disclosed, and to withdraw consent subject to legal and contractual restrictions. We respond within 30 days.

PIPEDA's business contact information exemption is narrow: it applies only where information is collected, used, or disclosed solely to communicate with an individual in relation to their employment or profession. We do not rely on that exemption for our contact database, and treat the records as personal information subject to PIPEDA in full.

Quebec residents (Law 25) additionally have:

The right to data portability — a copy of your computerised personal information in a structured, commonly used technological format
The right to de-indexing — to have a hyperlink to your personal information de-indexed where dissemination causes serious injury to your reputation or privacy
The right to information about automated decision-making, including the personal information used, the principal factors and parameters that led to the decision, and the right to submit observations to a member of our personnel able to review it
The right to cease dissemination of personal information where it is being disseminated in contravention of law

Our Privacy Officer for the purposes of Law 25 is identified in Section 21.

Alberta and British Columbia residents have rights of access and correction under their respective Personal Information Protection Acts.

Language. French-language versions of this policy and our Terms of Use are available at marketingtitan.ai/fr.

Complaints may be directed to the Office of the Privacy Commissioner of Canada, to the Commission d'accès à l'information du Québec, or to the applicable provincial commissioner.

16.4 US State Residents

Residents of California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Florida, Delaware, Iowa, Nebraska, New Hampshire, New Jersey, Tennessee, Minnesota, Maryland, Indiana, Kentucky, and Rhode Island have rights that vary by state but generally include the right to know, access, correct, delete, obtain a portable copy, opt out of sale or sharing, opt out of targeted advertising, opt out of profiling with significant effects, limit use of sensitive personal information, and be free from discrimination for exercising these rights.

Categories collected, sold, and disclosed in the preceding 12 months. As required by CCPA § 1798.130(a)(5):

Category (Cal. Civ. Code § 1798.140(v))	Collected	Sold or shared	Disclosed for a business purpose
Identifiers (name, email, phone, IP address, account ID)	Yes	Yes — contact database records	Yes — to sub-processors
Customer records (billing contact, payment information)	Yes	No	Yes — to payment processor
Commercial information (subscription, transaction history)	Yes	No	Yes — to sub-processors
Internet activity (usage, interaction with the Service)	Yes	No	Yes — to analytics providers
Geolocation (approximate, from IP; city or region level)	Yes	No	Yes — to sub-processors
Audio and electronic information (call recordings, message content)	Yes	No	Yes — to telecom and email providers
Professional or employment information (job title, employer, seniority)	Yes	Yes — contact database records	Yes — to sub-processors
Inferences (lead scores, ICP match, engagement predictions)	Yes	Yes — contact database records	Yes — to sub-processors
Sensitive personal information	No	No	No

We do not collect education information or biometric information. We do not sell or share the personal information of individuals we know to be under 16.

Sale and sharing. We make business contact information available to our customers for consideration, which constitutes a sale under the CCPA and comparable state statutes. We may also share hashed identifiers with advertising platforms at a customer's instruction, which may constitute sharing for cross-context behavioral advertising. You may opt out at marketingtitan.ai/your-privacy-choices or by emailing privacy@marketingtitan.ai.

Authorized agents may submit requests with proof of authorization. Appeals: if we decline a request, you may appeal to privacy@marketingtitan.ai; we will respond within the period your state's law requires.

16.5 How to Exercise Rights

Email privacy@marketingtitan.ai or use marketingtitan.ai/privacy-request. We verify identity proportionately to the sensitivity of the request. Response times: 45 days under US state laws, extendable once; one month under GDPR and UK GDPR, extendable by two months for complex requests; 30 days under PIPEDA.

17. Cookies and Tracking Technologies

Essential cookies are required for authentication, session management, security, and core functionality, and are set without consent as permitted by law.

Analytics cookies help us understand usage patterns and improve the Service.

Marketing and advertising cookies support campaign measurement and remarketing. These operate only on our public marketing website, not within the Marketing Titan platform.

Integration session tokens maintain authenticated connections to platforms you connect.

For visitors in the EEA and UK, non-essential cookies are set only after you give consent through our cookie banner, with category-level granularity. You may withdraw or change your choices at any time at marketingtitan.ai/cookie-preferences. Withdrawing consent is as easy as giving it.

For visitors in the US, you may manage preferences at the same link.

18. Children's Privacy

The Service is not directed to individuals under 18. We do not knowingly collect personal information from minors, and our contact database is not intended to contain records of individuals under 18. If we learn that a minor has created an account or that a minor's information is in our database, we will delete it promptly and, where applicable, close the account.

19. Export Controls and Sanctions

The Service may not be used by individuals or entities subject to US economic sanctions administered by OFAC. By using the Service you represent that you are not located in, organized under the laws of, or subject to the jurisdiction of any sanctioned country or region, and that you are not listed on any US government prohibited parties list.

20. Changes to This Policy

We may update this Privacy Policy to reflect changes in our practices, integrations, technology, legal requirements, or business operations. We will notify you of material changes by email and by prominent notice on the Service no fewer than 14 days before the change takes effect. Continued use after the effective date constitutes acceptance.

Prior versions are archived at marketingtitan.ai/privacy/archive.

21. Contact

AtmosAI, Inc. dba Marketing Titan 30 N Gould St, Ste. R Sheridan, WY 82801, United States

Privacy inquiries: privacy@marketingtitan.ai Legal inquiries: legal@marketingtitan.ai Data Protection Officer: dpo@marketingtitan.ai Security disclosures: security@marketingtitan.ai

EU Representative: [NAME AND CONTACT] UK Representative: [NAME AND CONTACT] Quebec Privacy Officer: [NAME AND CONTACT]