LOYD / ENTERTAINMENT INTELLIGENCE GROUP, INC.

At loyd, we take your privacy seriously. This Privacy Policy explains how Entertainment Intelligence Group, Inc. D.B.A. loyd, collects, uses, and discloses information when you use our website, applications, AI assistant, and related services (collectively, the "Services").

By accessing or using the Services in any way, you agree to the practices described in this Privacy Policy and you consent to our collection, use, and disclosure of your information as set out here.

Your use of the Services is always subject to our Terms of Use, which incorporates this Privacy Policy. Any capitalized terms that are not defined here have the meaning given to them in the Terms of Use.

We may update this Privacy Policy from time to time as our Services evolve or as laws change. If we make material changes, we will notify you by posting the updated policy on our website at https://www.loyd.ai and may also contact you by email or other channels. If you continue to use the Services after an updated Privacy Policy becomes effective, you agree to the updated policy.

1. The short version

Loyd is an assistant that works inside your existing tools. To be useful it needs to see the things it works on: your calendar, the mailboxes you connect, the conversations you have with it, and the records you keep in it. The commitments below govern all of that.

• We do not sell your personal data, and we do not share it for advertising or cross-context behavioral advertising.
• We do not use your content to train AI models, and the AI providers we use are contractually prohibited from training on it.
• We send AI providers only what is needed to answer the request in front of loyd, never your whole mailbox or account.
• You can disconnect a connected account, delete a conversation, or close your account at any time.
• Every provider we rely on is listed on our subprocessors page.

The rest of this policy is the detail behind those five points.

2. Scope of this Privacy Policy

This Privacy Policy covers how we treat information that relates to an identified or identifiable individual, which we call "Personal Data," when you use or access the Services.

This policy does not apply to:

• Information collected by third parties that we do not own or control
• Services or content provided by other companies that may integrate with or link to loyd
• Information collected by your employer, studio, agency, or other organization that may give you access to loyd

If an organization (for example, your employer or a talent agency) provides you access to the Services, that organization may act as the controller of your Personal Data for certain purposes and its own privacy policy may also apply. See Section 8.

3. Personal Data We Collect

The categories of Personal Data we collect depend on how you use loyd and which features you enable. Below are the main types and examples of each.

A. Account and profile data

• Name, email address, and account identifier
• Phone number, if you choose to use loyd over text message
• Time zone, working hours, and the preferences you set for how loyd should behave
• Role, title, company, or affiliation
• Which connected account you mark as your primary one

We collect this when you request access, create an account, join an organization, or communicate with us.

B. Payment data

If you purchase paid Services, our payment processor collects billing details such as payment card type and last digits, billing address, and billing contact details. We do not store full payment card numbers. Payments are processed by Stripe, which uses your information according to its own terms and privacy policy.

C. Device and network data

• Internet Protocol (IP) address and device identifiers
• Browser type and version, operating system, and platform
• Time zone, language settings, and similar technical data

D. Usage, diagnostic, and analytics data

• Pages or screens you view and features you interact with
• Session duration, timestamps, and referring source
• Application logs and error traces, which may incidentally include identifiers relating to the request that failed
• Records of what loyd did on your behalf, and diagnostic traces of the AI steps behind a response, which we keep so a result can be explained and debugged
• Counts of how much of the Services you use, for billing and internal product metrics

E. Identity data from accounts you connect

When you sign in or connect through a third-party provider such as Google or Microsoft, we receive identifiers and basic profile data from that provider, typically your email address, name, and avatar. The specific information depends on the permissions you grant.

F. Mailbox, calendar, and contacts data from accounts you connect

Email, calendar, and contacts are granted as one connection: loyd cannot schedule well without the thread the request came in on, or coordinate without knowing who you work with. When you connect a Google or Microsoft account, we may access and process:

• Calendar events and their metadata, including titles, times, locations, descriptions, and attendees, and we create and update events at your direction
• Message metadata, including subject, sender, recipients, and timestamps
• Message content, where it is needed to understand or act on the request in front of loyd
• Your contacts — the people in your Google Contacts and the "other contacts" you have corresponded with, including their names, email addresses, phone numbers, and organization details — used to build your People directory so you can find and reference the people you work with. Like your mailbox and calendar data, this is subject to the additional restrictions in the disclosure at the top of this page.

We request read-only access to mail. We do not request permission to delete your mail or to empty your mailbox. The exact permissions we ask for, and what each one is for, are itemized on our permissions page.

Google API data specifically: data received from Google APIs is subject to the additional restrictions in the disclosure at the top of this page. It is never used for advertising, never used to train or improve AI models, and never transferred to third parties for their independent use.

G. Your conversations with loyd, and files you upload

loyd is a conversation, and the conversation is data. Depending on the surface you use, we process:

• The messages you send loyd and the replies it sends you, in a browser, by email, or by text message
• Documents, spreadsheets, presentations, and images you upload to a conversation, and the text extracted from them
• The state of work in progress, such as which times are on the table for a meeting and what loyd is waiting on
• Your decisions on the actions loyd proposes, including what you approved or declined and when

H. Records you create or import

If you use loyd to track work, we process the records you put in it, such as pipelines and their deals, stages, values, notes, comments, and custom fields, along with the people and companies you associate with them. If you import a spreadsheet, we process the file and the rows and columns in it, including any Personal Data they contain.

I. Information about other people

Because loyd coordinates with other people, we receive Personal Data about individuals who are not loyd users, such as meeting attendees, counterparties, contacts in a record you keep, and anyone included on a thread loyd is working in. We process that information to provide the Services to the user acting on it, and we do not use it to build independent profiles or to market to those individuals. If you provide us Personal Data about another person, you are responsible for having the right to do so.

J. Inferences and derived data

We may generate inferences to make loyd more useful, such as your likely working hours and meeting preferences, who you work with most often, and which features you rely on.

K. What we do not ask for

We do not ask for and do not want government identifiers, payment card numbers outside the payment flow, health information, biometric data, precise geolocation, or the other categories that privacy laws treat as sensitive. The Services are not designed for them, and our Terms of Use ask you not to put them in. If such information happens to sit in a mailbox you connect, we process it only incidentally, as part of the message it appears in, and never as a category we sort, target, or act on.

4. How We Use Personal Data

A. Providing the Services

• Creating and managing accounts, organizations, and profiles
• Authenticating access and maintaining session security
• Processing transactions and subscription payments
• Understanding what you asked for and answering it
• Taking the actions you approve, such as proposing times, sending a message you agreed to, booking an event, or updating a record
• Integrating with the email, calendar, and other tools you connect
• Providing customer support and responding to requests

B. Improving, securing, and maintaining the Services

• Analyzing usage, performance, and reliability
• Debugging failures, including by reviewing the traces of a request that went wrong
• Measuring and improving the quality of loyd's answers and the prompts behind them
• Detecting and preventing abuse, fraud, and security incidents
• Developing new features and workflows

Improving the Services means improving our software, prompts, and product. It does not mean training AI models on your content. See Section 5.

C. Communications

• Administrative messages such as security alerts, billing notices, and service updates
• Responses to your inquiries
• Information about new features, events, or promotions, where permitted by law or your preferences

You can opt out of non-essential marketing communications at any time by following the unsubscribe instructions in them. If you use loyd by text message, replying STOP ends those messages.

D. Legal, safety, and compliance

• Complying with laws, regulations, legal process, or government requests
• Enforcing our Terms of Use and other agreements
• Protecting the rights, property, or safety of loyd, our users, or others

E. What we do not do

• We do not sell Personal Data, and we do not share it for cross-context behavioral advertising.
• We do not use your content, your mail, your calendar, or your conversations to train, fine-tune, or improve AI or machine learning models.
• We do not use Personal Data to make decisions about you that produce legal or similarly significant effects without human involvement.
• We do not use your content for advertising of any kind.

We will not use Personal Data for materially different, unrelated, or incompatible purposes without updating this Privacy Policy or obtaining any additional consent required by law.

5. AI Providers and Your Content

This section is the one most people want, so it is stated plainly.

Loyd does not build or operate its own AI models. AI features run on the commercial APIs of third-party model providers, currently OpenAI and Anthropic. Which provider answers a given request depends on what is being asked; both are listed on our subprocessors page.

• No training, by contract. We do not permit these providers to use our customers' data to train or improve their models, and their commercial API terms do not allow it. We do not train models on your content either.
• Only what the request needs. For each request, we send the provider the conversation and the specific context relevant to it, for example the thread being scheduled, the availability window being checked, or the record being asked about. We do not hand a provider your mailbox, your calendar, or your account as a whole.
• Google data is excluded outright. Data received from Google APIs is never used for model training or development by us or by any provider, directly or indirectly.
• Uploaded and retrieved content is treated as untrusted. Content we did not author, such as an uploaded document or a web page, is passed to the model as data rather than as instructions, and actions it appears to request are still subject to your approval.

Web search. When answering a question needs current public information, loyd can search the web. The search runs on the model provider's infrastructure: your search terms go to that provider, and public page content comes back and is used to answer you. Search terms are derived from your request, so do not ask loyd to look something up if you would not want the query itself leaving our systems.

Diagnostic traces. We keep traces of the AI steps behind a response, including the prompts and outputs involved, so that an answer can be explained, graded, and debugged. That tracing runs on our own infrastructure in our own cloud project, not on a third-party observability vendor.

AI output is not always right. loyd can be wrong, incomplete, or out of date. Actions that commit you to something are shown to you for approval first, and you remain responsible for what you approve. Section 8 of our Terms of Use covers this.

6. Sources of Personal Data

Directly from you

When you request access, create an account, complete a form, connect an integration, converse with loyd, upload a file, request support, or otherwise provide information.

Automatically through your use of the Services

Through cookies, log files, and similar technologies that record device and usage information.

From accounts you connect

From your email, calendar, and identity providers when you connect those accounts, limited to the permissions you grant.

From other people

If somebody replies to a message loyd sent, includes you on a thread loyd is working in, or invites you to an organization, we receive Personal Data through them. We use it only as described in this policy.

From public sources

When loyd searches the web to answer a question, the pages it retrieves may contain Personal Data. That content is used to answer the request and is not compiled into profiles.

7. How We Disclose Personal Data

A. Service providers and subprocessors

We rely on third parties to run the Services, including cloud hosting and databases, file storage, AI model inference, authentication, email and text message delivery, payment processing, and analytics. Each is bound to process Personal Data only as necessary to provide services to us, under appropriate contractual safeguards. The current list, and what each one does, is published at loyd.ai/subprocessors.

B. AI model providers

As described in Section 5, and subject to the restrictions there.

C. Parties you authorize

When you use loyd to interact with others, the relevant information goes to the people you chose. In practice that means:

• People on an email thread loyd is working in, and attendees of an event loyd manages for you
• A venue or booking provider, when you ask loyd to make a reservation on your behalf
• Members of your organization who share a workspace or a pipeline with you

Actions that send something in your name are shown to you before they happen, so what leaves is what you approved.

D. Legal and compliance recipients

We may disclose Personal Data to courts, law enforcement, government authorities, or other parties when required by law or when we believe disclosure is necessary to protect rights, investigate or prevent wrongdoing, or enforce our Terms of Use.

E. Business transfers

If we are involved in a merger, acquisition, financing, restructuring, bankruptcy, or sale of all or part of our business or assets, Personal Data may be transferred as part of that transaction, subject to continued protections consistent with this Privacy Policy and, for Google user data, with advance notice as the Google API Services User Data Policy requires.

F. Aggregated and de-identified data

We may create aggregated, anonymized, or de-identified data and use or disclose it for any lawful purpose, provided it does not identify you.

8. Organizations and Workspaces

loyd can be used by an individual or by an organization such as a company, agency, or production.

When you use loyd through an organization, that organization decides who has access and what is shared, and it is generally the controller of the data in its workspace. We process that data on the organization's instructions, and we act as its processor or service provider. Data you mark as organization-level, such as a shared pipeline, is visible to the members the organization allows; data you keep at the individual level is not shared with the organization by loyd.

An organization administrator may be able to see records in shared workspaces, manage membership, and receive information about how the workspace is used. If you use loyd through your employer, direct requests about your data to them first, and we will support them in responding.

For our own account, billing, and website data, we act as the controller. Business customers who need a data processing agreement can request one at privacy@loyd.ai.

9. Cookies and Similar Technologies

We use cookies and similar technologies to operate and improve the Services. We use:

• Essential cookies and local storage, which are necessary for core features such as secure login, session management, and remembering your cookie choices.
• Analytics cookies, which help us understand how the Services are used. On our website these load only after you consent, and you can change your choice at any time from the Cookie Settings link in the footer.

We do not use advertising cookies and we do not allow third parties to use cookies on our Services for their own advertising.

If your browser or extension sends a Global Privacy Control signal, we treat it as an opt-out and do not enable analytics unless you later choose to. Most browsers also let you block or delete cookies through their settings; if you disable cookies, some features may not work. Beyond Global Privacy Control, the Services do not currently respond to other browser "Do Not Track" signals.

10. Data Security

We use technical, organizational, and administrative measures designed to protect Personal Data against unauthorized access, loss, misuse, or alteration, taking into account the nature of the data and the risks involved. These include:

• Encryption of data in transit and at rest
• Hosting on managed cloud infrastructure in the United States, with internal-only network paths between our own components
• Credentials and access tokens held in a managed secrets service, with access limited to the systems that need them
• Access controls and least-privilege practices for team members, and separation between our development and production environments
• Application-level checks so that a request, including one made by loyd on your behalf, can only reach data you are permitted to see
• An internal control that lets us stop loyd from sending anything on your behalf if we detect a problem

No system is completely secure, and we cannot guarantee the absolute security of your information. You are responsible for keeping your account credentials confidential and for limiting access to your devices. If you believe your account or information has been compromised, contact us immediately at support@loyd.ai.

11. Data Retention

We retain Personal Data for as long as reasonably necessary to provide the Services, comply with legal, accounting, and reporting obligations, resolve disputes, and enforce agreements. Retention varies by type of data. The main rules:

• Conversations and uploads. When you delete a conversation, the conversation and anything uploaded in it are permanently removed within 30 days.
• Work in progress. The internal state loyd keeps so a task can be paused and resumed is deleted on a rolling schedule and, in any case, within 60 days of last use.
• Account and records data. Your profile, records, and the history of what loyd did for you are kept while your account is active, and are deleted or anonymized within 30 days of your request or of account closure.
• Connected account data. Access tokens are revoked and deleted when you disconnect an account. Content derived from that account is removed on the schedules above.
• Logs and diagnostic traces. Kept for a limited period for security, debugging, and quality purposes, then deleted.
• Billing records. Kept as long as required by tax and accounting law, even after account closure.

Backups are kept for a limited period and expire on their own schedule, so deleted data may persist in a backup briefly after it is removed from the live system.

We do not keep copies of your data outside the systems described above. loyd does not carry information from one conversation into an unrelated one.

12. Your Choices and Controls

• Disconnect an account. Remove a connected Google or Microsoft account at any time from your loyd settings, which revokes our access. You can also revoke access from your Google or Microsoft account security settings.
• Delete a conversation. Deleting a conversation removes it and anything you uploaded in it, on the schedule in Section 11.
• Decline an action. Anything loyd is about to do in your name is shown to you first, and declining it means it does not happen.
• Stop text messages. Reply STOP to any text from loyd.
• Marketing. Unsubscribe from any marketing email.
• Cookies. Change your analytics choice from Cookie Settings in the footer.
• Close your account. Email us and we will close it and delete your data as described above.

13. U.S. State Privacy Rights

A growing number of U.S. states give their residents privacy rights. Depending on where you live, and subject to applicable law, you may have the right to:

• Know what Personal Data we collect, use, and disclose, and the categories of recipients
• Access a copy of your Personal Data, in a portable format where required
• Correct inaccurate Personal Data
• Delete Personal Data, subject to legal exceptions
• Opt out of the sale or sharing of Personal Data, of targeted advertising, and of certain profiling
• Limit the use of sensitive personal information
• Not be discriminated against for exercising these rights
• Appeal a decision we make on your request

We do not sell Personal Data and we do not share it for targeted or cross-context behavioral advertising, so there is nothing to opt out of on that front. We also do not use Personal Data for profiling in furtherance of decisions that produce legal or similarly significant effects about you.

We do not seek out sensitive personal information, and we do not use or disclose it beyond what is needed to provide the Services you asked for. Nevada residents: we do not sell covered information as Nevada law defines it. California residents may also request information about disclosures of Personal Data to third parties for their direct marketing purposes.

To exercise these rights, email privacy@loyd.ai. We may need to verify your identity first, and an authorized agent may submit a request on your behalf with proof of authority. If we decline a request, you may appeal by replying to our response.

14. Rights of Individuals in the European Economic Area, United Kingdom, and Switzerland

If you are located in the EEA, the UK, Switzerland, or another region with similar laws, you may have the following rights regarding your Personal Data:

• Access: information about the Personal Data we hold about you and a copy of it.
• Rectification: correction of inaccurate or incomplete Personal Data.
• Erasure: deletion of certain Personal Data, subject to legal exceptions.
• Restriction: limitation of processing in certain circumstances.
• Portability: a copy in a structured, commonly used, machine-readable format, and transfer to another controller where technically feasible.
• Objection: objection to certain processing, including direct marketing.
• Withdraw consent: where processing is based on consent, at any time, without affecting the lawfulness of processing before withdrawal.

Where we act as a controller, we rely on the following legal bases: performance of a contract with you, our legitimate interests in operating, securing, and improving the Services, your consent where we ask for it, and compliance with legal obligations. Where we act as a processor for an organization, direct your request to that organization and we will assist them.

To exercise these rights, contact privacy@loyd.ai. We may need to verify your identity, and we may not be able to comply with every request, for example where we have overriding legal obligations. You also have the right to lodge a complaint with your local supervisory authority.

15. International Data Transfers

The Services are operated in the United States, and our infrastructure and service providers are located there. If you access the Services from outside the United States, your Personal Data will be transferred to, stored in, and processed in the United States and possibly other countries where our providers operate. Those countries may have data protection laws that differ from the ones where you live.

Where required, we use appropriate safeguards such as the European Commission's standard contractual clauses, and the UK addendum to them, to protect Personal Data transferred from the EEA, the UK, or Switzerland.

16. Personal Data of Children

The Services are not directed to children under 16 years of age, and we do not knowingly collect Personal Data from children under 16. If you are under 16, please do not use the Services or send any Personal Data to us. If we learn that we have collected Personal Data from a child under 16, we will delete it as soon as reasonably practicable. If you believe a child under 16 may have provided us Personal Data, contact us at privacy@loyd.ai.

17. Deletion Requests

You may request deletion of your Personal Data, including any Google API data we hold, at any time. Email privacy@loyd.ai with the subject "Data Deletion Request." We will process requests within 30 days and confirm by email.

To revoke loyd's access to a connected account without deleting your loyd account, disconnect it in your loyd settings, or revoke access from that provider's own security settings.

18. Contact Information

Questions about this Privacy Policy, our data practices, or your rights:

Privacy: privacy@loyd.ai
General support: support@loyd.ai

Address:
Entertainment Intelligence Group, Inc.
401 Stoner Ave
Los Angeles, CA 90025

Website: https://www.loyd.ai