Privacy Policy

1. Overview

This Privacy Policy describes how The Product Operator, operated by MLX Advisory LLC ("we," "us," or "our"), collects, uses, stores, and protects information when you use theproductoperator.ai and app.theproductoperator.ai (collectively, the "Services").

By using the Services, you agree to the practices described in this policy. If you do not agree, please do not use the Services.

2. Information We Collect

2.1 Information you provide directly

• Contact inquiries — name, email address, organization, and the nature of your inquiry submitted via our contact form
• Account registration — name, email address, organization, and access code when registering for Platform access
• Engagement information — business context, company data, financial information, product details, and other materials shared in connection with advisory engagements
• Communications — emails, messages, and other correspondence you send to us

2.2 API Keys

When using the Platform, you provide an API key from a supported AI provider (such as Anthropic, OpenAI, or Google). Your API key is:

• Encrypted at rest using AES-256 or equivalent industry-standard encryption
• Never stored in plaintext at any point
• Used exclusively to execute Platform workflows at your direction
• Never accessed, shared, or transferred to any third party for any purpose
• Deleted promptly upon account closure or on your request

2.3 Platform usage data

• Which skills and workflows you run
• Session activity and usage frequency
• Inputs and outputs associated with your Platform sessions

We do not use your Platform inputs or outputs to train or improve AI models. Your data is used solely to deliver the Services to you.

2.4 Automatically collected technical data

• IP address and approximate geographic location
• Browser type, version, and device information
• Pages visited, time on page, and navigation patterns
• Referring URLs

This data is collected via standard server logs to maintain and improve the Services.

3. How We Use Your Information

3.1 We use your information to:

• Respond to inquiries and evaluate potential engagements
• Deliver advisory, consulting, and due diligence services
• Provision, maintain, and improve Platform access
• Execute Platform workflows on your behalf using your API key
• Send service-related communications (account notices, updates, security alerts)
• Detect, investigate, and prevent fraud, abuse, and security incidents
• Comply with applicable legal obligations

3.2 We do not use your information to:

• Train, fine-tune, or improve AI models
• Sell, rent, or trade your data to third parties
• Send unsolicited marketing or promotional communications
• Build advertising profiles or target you with ads
• Share client-specific information with other clients

4. Information Sharing and Disclosure

We do not sell, rent, or trade your personal information. We may share information only in the following limited circumstances:

4.1 Service providers

We engage trusted infrastructure providers who may process your information solely to operate the Services. These providers are contractually prohibited from using your information for any other purpose. Our current sub-processors include:

• Railway — application hosting and database
• Cloudflare — content delivery, security, and DDoS protection
• Stripe — payment processing for Platform subscriptions
• Sentry — error monitoring and diagnostics

4.2 AI providers

When you use the Platform, your inputs are transmitted to the AI provider associated with your API key (such as Anthropic, OpenAI, or Google) in accordance with that provider's terms of service and privacy policy. We are not responsible for how AI providers process data transmitted via their APIs. We recommend reviewing the privacy policy of any AI provider you choose to use with the Platform.

4.3 Legal requirements

We may disclose information if required by applicable law, valid court order, subpoena, or government request. Where permitted, we will attempt to notify you before disclosing.

4.4 Protection of rights

We may disclose information to protect the rights, property, or safety of The Product Operator, our users, or the public where permitted by law.

4.5 Business transfers

In the event of a merger, acquisition, reorganization, or sale of assets, your information may be transferred. We will provide notice before your information becomes subject to a materially different privacy policy.

5. Data Retention

We retain your information only for as long as necessary to deliver the Services, comply with our legal obligations, resolve disputes, and enforce our agreements.

In general:

• Contact inquiries are retained for as long as needed to respond to your inquiry and for a reasonable period thereafter for follow-up and recordkeeping.
• Advisory engagement records are retained for the duration of the engagement and for a reasonable period afterward to meet legal, professional, and tax obligations.
• Platform account data is retained for the duration of your account and for a reasonable period following account closure.
• API keys are deleted promptly upon account closure or upon written request.
• Technical logs are retained only as long as needed for security, debugging, and operational purposes, and are routinely overwritten.

You may request deletion of your information at any time, subject to applicable legal retention requirements, by contacting marc@theproductoperator.ai.

6. Security

We implement commercially reasonable technical and organizational security measures including:

• AES-256 encryption of API keys at rest
• TLS encryption for all data in transit
• Access controls limiting who can access client data
• Regular review of security practices and access permissions
• Cloudflare protection including bot mitigation and DDoS protection

No method of electronic transmission or storage is 100% secure. In the event of a data breach that affects your personal information, we will notify you within 72 hours of becoming aware of the breach, consistent with applicable law.

7. Local Storage and Tracking

The Services use your browser's local storage and session storage to maintain your login session, remember preferences, and provide core functionality. We do not set advertising cookies, cross-site tracking cookies, or third-party marketing pixels.

Our infrastructure provider (Cloudflare) may set strictly necessary cookies for security and bot mitigation purposes. These cookies do not track you across sites and are governed by Cloudflare's privacy policy.

8. Your Privacy Rights

8.1 General rights

Depending on your location, you may have the following rights:

• Access — Request a copy of the personal information we hold about you
• Correction — Request correction of inaccurate or incomplete information
• Deletion — Request deletion of your personal information, subject to legal retention requirements
• Portability — Request your data in a structured, machine-readable format
• Objection — Object to certain processing of your information
• Restriction — Request that we restrict processing of your information in certain circumstances

8.2 California residents (CCPA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act:

• The right to know what personal information we collect, use, disclose, and sell
• The right to delete personal information we have collected
• The right to opt out of the sale of personal information — We do not sell personal information
• The right to non-discrimination for exercising your CCPA rights

To exercise your CCPA rights, contact us at marc@theproductoperator.ai. We will respond within 45 days.

8.3 EU/EEA and UK residents (GDPR)

If you are located in the EU, EEA, or UK, we process your personal data on the following legal bases:

• Contract performance — Processing necessary to deliver Services you have engaged
• Legitimate interests — Operating and improving the Services, security, fraud prevention
• Legal compliance — Processing required by applicable law
• Consent — Where you have provided explicit consent

You have the right to lodge a complaint with your local data protection authority. To exercise your GDPR rights, contact marc@theproductoperator.ai.

8.4 Exercising your rights

To exercise any privacy right, contact us at marc@theproductoperator.ai with the subject line "Privacy Request." We will verify your identity and respond within 30 days (or 45 days for CCPA requests).

9. Children's Privacy

The Services are not directed to or intended for use by individuals under the age of 18. We do not knowingly collect personal information from minors. If we become aware that we have collected personal information from a minor, we will delete it promptly. Contact us at marc@theproductoperator.ai if you believe we have inadvertently collected such information.

10. International Data Transfers

The Services are operated from the United States. If you access the Services from outside the United States, your personal information may be transferred to and processed in the United States. For transfers from the EU/EEA or UK, we implement appropriate safeguards including standard contractual clauses where required by applicable law.

11. Third-Party Services and Links

The Services may contain links to third-party websites or integrate with third-party services (such as AI providers). This Privacy Policy does not apply to those third parties. We encourage you to review the privacy policies of any third-party services you use in connection with the Platform.

12. Changes to This Policy

We may update this Privacy Policy from time to time. For material changes, we will provide at least 14 days' advance notice by posting the updated policy on this page and, where appropriate, notifying you by email. The "Last updated" date at the top of this page reflects the most recent revision. Continued use of the Services after the effective date of changes constitutes acceptance of the updated policy.

13. Contact

For questions, requests, or concerns about this Privacy Policy or our privacy practices, contact us at: