Privacy Policy.

• We collect what we need to run the Service: your account details, the content of your workspace, and the credentials for accounts you choose to connect.
• Your content is processed by third-party AI model providers to generate and evaluate marketing work. We use providers whose API terms state that customer API data is not used to train their models.
• We act on your instructions. Campaigns, posts, and messages go out only after your approval, under your connected accounts, on your authority.
• We do not sell personal data. We are not an ad network.
• Waitlist details are used to reach you about access, nothing else.
• We count visits to see what reaches people, which sets one cookie. Other analytics stay off unless you allow them (section 8).

Account data. Name, email address, and sign-in credentials when you create an account. Billing runs through our payment processor; we do not store card numbers.

Waitlist data. While access is invite-only, the name, email address, and (optionally) company you submit through the waitlist form on this website, together with the page that referred you, your IP address, and the time of submission. Submitting the form also runs a Cloudflare anti-bot check, which receives your IP address and basic browser signals to tell a person from a script; it sets no tracking cookies and is not used to profile you. We use waitlist details to contact you about access and for nothing else, and you can have the entry deleted at any time by writing to privacy@multiply.sh.

Workspace content. The prompts, briefs, and voice notes you give the Service; the drafts, campaigns, and plans it produces; the contact lists, documents, and brand material you upload; and the settings and approvals you record.

Connected account data. When you connect a third-party account (for example a mailbox, a messaging account, a social or publishing account, an analytics property, or a payment account in read-only mode), we store the tokens or credentials needed to act on your instructions, encrypted, and we access that account's data only to provide the features you use.

Usage and log data. Standard technical records: IP address, browser and device information, pages viewed, actions taken, and timestamps. We use these for security, debugging, and capacity planning.

• To provide, operate, and secure the Service.
• To execute the work you approve: drafting, scheduling, sending, publishing, and replying across the channels you connect.
• To bill for subscriptions and prevent abuse.
• To provide support and communicate about the Service.
• To comply with law and enforce our terms.

Where the GDPR or a similar law applies, our legal bases are performance of a contract (running the Service you signed up for), legitimate interests (security, improvement, support), consent (where we ask for it, such as optional analytics), and legal obligations.

Multiply is an AI product. To generate and evaluate content, your prompts and the relevant parts of your workspace are sent to third-party large language model providers. We use commercial API agreements under which the provider does not use customer API data to train its models, and we send only what the task needs.

AI output is generated on your instructions and is reviewed by you before it is published or sent. You remain responsible for what you approve.

We do not use your data to develop, improve, or train generalized artificial intelligence or machine learning models, and we do not transfer it to anyone else for that purpose. This applies to everything in your workspace and to data from the accounts you connect, including data obtained through Google APIs (section 5).

The Service works by orchestrating third-party platforms on your behalf: email providers, messaging services, social networks, publishing systems, search and analytics tools, and payment processors. You choose which to connect, and you can disconnect them at any time in the product.

• Each connected platform processes your data under its own terms and privacy policy. We encourage you to review them.
• We access connected accounts only as needed to carry out the actions you have configured or approved.
• Multiply is an independent product. We are not affiliated with, sponsored by, or endorsed by any of the platforms the Service connects to. Their names, logos, and brands belong to their respective owners and appear in the product for identification only.

Google APIs.Multiply's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not use data obtained through Google APIs, including Google Workspace APIs such as Google Calendar, to develop, improve, or train generalized artificial intelligence or machine learning models, and we do not transfer it to anyone else for that purpose. We request the narrowest permissions each feature needs, all of them read-only: aggregate website traffic and search performance figures, and calendar event times and attendee addresses, which are used to record that a meeting was booked with someone already in your workspace. We do not retain event titles, descriptions, locations, or attachments. You can disconnect Google at any time in the product, which deletes the stored credentials.

The contact lists you upload and the people your campaigns reach are your data: for that data you are the controller and Multiply processes it on your documented instructions. You are responsible for having a lawful basis to contact those people, including any consent a channel requires (for example, messaging consent on chat platforms), and for honoring their choices.

The Service maintains suppression lists and honors unsubscribe and opt-out signals across channels. If a person asks us directly to stop processing their data in your workspace, we will inform you and assist you in responding.

We share data only with service providers that help us run the Service, and only what they need:

• Cloud hosting and storage providers.
• Cloudflare, which runs the anti-bot check on the waitlist form (Turnstile).
• AI model providers (section 4).
• Email and messaging infrastructure providers.
• Payment processing (subscription billing).
• Error monitoring and observability tooling.

Each is bound by contract to protect your data and use it only to provide services to us. We may also disclose data if required by law, to protect the rights and safety of Multiply or others, or as part of a corporate transaction, in which case this policy continues to apply to your data.

This website counts visits. Our analytics provider sets a first-party cookie holding a random identifier, which lets us see how many people arrive and which pages they read, and lets us connect a purchase back to the visit that led to it. This runs for every visitor, because measuring our own audience is part of running the site. It is not advertising, we do not sell it, and it is never combined with data from other companies to build a profile of you.

Two more things are stored on your device by the site itself: your theme preference and your cookie choice, both in local storage. The choice is also written to an mx-analytics cookie on multiply.sh, so the product on app.multiply.sh can honour it. That cookie holds the word "on" or "off" and nothing about you, and lasts a year.

Optional analytics are separate and stay off unless you choose "Allow all". Today that means Google Analytics, which sets its own identifiers to measure how the site is used. Choose "Essentials only" and it never loads.

The product sets strictly necessary cookies when you sign in: a session cookie that keeps you signed in and security cookies that protect your account. These are required for the Service to function and cannot be switched off while you use it. The product also runs the same analytics as this website: the visit and purchase measurement above, plus the optional tier, which honours the choice you make here — choose "Essentials only" and the optional tier stays off in the product too.

You can change your choice at any time via the "Cookie preferences" link in the page footer.

We keep your data while your account is active. When you delete content, it is removed from the live Service promptly and from backups on their rotation schedule. When you close your account, we delete or anonymize your workspace data within 30 days, except records we must keep for legal, billing, or security reasons, which we keep no longer than required.

Data is encrypted in transit and at rest. Credentials for connected accounts are stored in an encrypted vault with per-workspace keys. Access to production systems is restricted and logged. No system is perfectly secure; if we learn of a breach affecting your data, we will notify you without undue delay and as the law requires.

We are based in the United Arab Emirates and use service providers in other countries, including the United States and the European Union. Where data protection law requires safeguards for a transfer, we use recognized mechanisms such as contractual protections with our providers.

Subject to the law that applies to you (including the UAE Personal Data Protection Law, the GDPR, and similar laws), you can ask us to access, correct, export, restrict, or delete your personal data, and you can object to certain processing. Write to privacy@multiply.sh and we will respond within the time the law allows. If you are unsatisfied, you may complain to your local data protection authority.

The Service is for business use and for adults. It is not directed to anyone under 18, and we do not knowingly collect data from children.

We will update this policy as the Service evolves. If a change is material, we will notify account holders by email or in the product before it takes effect. The date at the top reflects the latest revision.

Multiply AI INC, Ras Al Khaimah free zone, United Arab Emirates.
Privacy requests: privacy@multiply.sh
Everything else: legal@multiply.sh