Privacy Policy

Medici & Company ("Medici," "we," "us," or "our") is a Delaware C-Corporation. This Privacy Policy describes how we collect, use, and protect information when you use our websites at cosimo.work and medici.ai and our Cosimo platform (collectively, the "Services").

1. Information We Collect

Information You Provide

• Contact information (name, email address, phone number) when you request a discovery call or contact us
• Company information provided during onboarding
• Documents and data you upload to the Cosimo platform

Information Collected Automatically

• Device and browser information (browser type, operating system)
• IP address and approximate location
• Pages requested and technical request information processed by our hosting providers; platform activity associated with your account

Website Storage and Third-Party Requests

The marketing Website stores your light or dark theme preference under “medici-theme” and your animation pause preference under “cosimo-motion” in your browser’s local storage. You can remove these preferences through your browser’s site-data settings. The automatic theme uses your browser’s time zone locally; it does not request your precise location.

The marketing Website does not include advertising pixels or cross-site behavioral analytics. It does not change its behavior in response to a browser Do Not Track signal because it does not perform that tracking. This describes the marketing Website, not signed-in platform features or third-party sites you visit through a link.

The marketing Website serves its fonts locally and does not contact an external font service to display them. Contact links open your email application or an external email service; information you choose to send is also processed by that service under its own privacy terms.

2. How We Use Your Information

We use the information we collect to:

• Provide, operate, and maintain the Services
• Prepare and deliver financial operations reports and related work
• Respond to your inquiries and schedule discovery calls
• Improve and develop the Services
• Send administrative communications related to your account
• Comply with legal obligations

3. Data Segregation and Security

Client data is isolated by customer tenancy and access is restricted to that customer’s authorized users and the processing needed to provide the Services. Documents and data may be processed by our service providers as necessary to carry out your workflows, subject to the protections described below. Client data is encrypted and excluded from model training; it is not made accessible to other clients.

We implement industry-standard technical and organizational security measures, including encryption in transit and at rest and access controls. No method of storage or transmission can guarantee absolute security.

4. Data Retention

Retention and deletion of client platform data are governed by the applicable service agreement, documented client instructions, and applicable law.

We retain website inquiry and technical request information for the period needed to respond to inquiries, operate and secure the Website, and meet applicable legal obligations. We determine that period based on the purpose and nature of the information and any applicable recordkeeping requirements. Your rights under applicable privacy law remain as described below.

5. Connected Accounts and Google User Data

Cosimo lets you connect third-party accounts, such as Google Calendar and, where enabled for your deployment, Gmail or Google Drive, to provide features within the platform. Cosimo's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

• What we access. Each Google connection requires your explicit consent through Google’s OAuth consent screen. Calendar requests permission to read events and availability ("calendar.readonly") and manage events ("calendar.events"). Separate Gmail and Drive connections, where enabled, request permissions to read and modify messages and send email ("gmail.modify" and "gmail.send"), or to work with Drive files ("drive"). These connections also request basic account identity information ("openid" and "email"). Connecting one service does not itself connect the others.
• How we use it. Google user data is used to provide the connected features and workflows you invoke or authorize, such as scheduling, calendar actions, working with business files, and preparing or sending communications. The actions allowed depend on your connection permissions and workflow approval settings. Google user data is never used for advertising, never sold, never used to train models, and never shared across clients.
• Storage and retention. Connection credentials are stored encrypted at rest. Data retrieved or produced through connected features may be retained in your workspace’s records, workflow outputs, or history, subject to the retention provisions above.
• Disconnecting. You can disconnect a Google connection from your account settings. Cosimo deletes the stored connection credential and attempts to revoke access with Google. You can also revoke access directly through your Google Account permissions.
• Sharing. We do not transfer Google user data to third parties except with your consent as necessary to provide or improve appropriate, visible user-facing features, for security purposes, to comply with applicable law, or as part of a merger, acquisition, or sale of assets after obtaining your explicit prior consent.
• Human access. Humans do not read your Google user data except with your explicit permission (for example, a support request), where required for security or legal compliance, or when the data is aggregated and used for internal operations in accordance with applicable privacy law.

6. Third-Party Services

We may use third-party service providers to assist in operating the Services, including hosting, communications, document processing, and model inference. These providers are contractually obligated to protect your information and may only use it to perform services on our behalf.

We do not sell, rent, or share your personal information with third parties for their marketing purposes.

7. Your Rights

Depending on your jurisdiction, you may have the right to:

• Access the personal information we hold about you
• Request correction of inaccurate information
• Request deletion of your information
• Object to or restrict processing of your information
• Request portability of your data
• Opt out of sale, sharing for cross-context behavioral advertising, or other processing where applicable law provides that right
• Limit certain uses of sensitive personal information where applicable law provides that right

Send a request to info@medici.ai with the subject “Privacy request.” Tell us the right you want to exercise and the email address associated with your inquiry or account. Do not send passwords, identification documents, or sensitive business records in your initial email. We may request information reasonably necessary to verify your identity and authority before releasing or changing personal information.

An authorized agent may submit a request on your behalf where permitted by applicable law; we may ask for proof of authorization and, where allowed, confirmation from you. We will respond within the period required by applicable law and explain any applicable exception. We do not discriminate against you for exercising your privacy rights.

If we decline a request, you may ask us to review that decision by emailing info@medici.ai with the subject “Privacy appeal,” identifying the original request and the reason you disagree. Where an applicable law gives you an appeal right, we will process the appeal and provide information about any further complaint options it requires.

We do not sell personal information or share it for cross-context behavioral advertising. The marketing Website does not perform those activities, including when you enable Global Privacy Control. For data we process on behalf of your organization, we may refer a request to that organization so it can respond as the responsible controller or business.

8. Children's Privacy

The Services are not directed to individuals under the age of 18. We do not knowingly collect personal information from children.

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page with a revised effective date.

10. Contact Us

If you have questions about this Privacy Policy or our data practices, contact us at:

Medici & Company
Email: info@medici.ai