Privacy Policy

Innex is an AI influencer marketing workspace operated by W2Z AI Inc., a California corporation ("Innex", "we", "us"). This policy covers the Innex websites, the Innex application and its APIs, and related communications (together, the "Service").

We play different roles for different data:

• Account, billing, website and usage data. We are the controller.
• Content customers put into their workspace. This includes campaign material, creator lists a customer uploads, connected-mailbox correspondence, uploaded files and conversations with the AI assistant. We process it on the customer's behalf, and the customer is the controller. The customer's instructions consist of its use and configuration of the Service and its agreement with us. They include the processing needed to operate, maintain, secure, support and improve the Service for that customer, as described below.
• Innex's creator database. We compile this from public sources and make it searchable to customers. We are the controller (Section 6).

This policy does not cover third-party sites or platforms we link to. Where a customer has signed a data processing agreement with us, that agreement governs our processing of its workspace content.

What you give us

• Account information: work email, name, avatar, organization name, account role (brand or agency), the social platforms and target markets you care about, interface language, and invite code. We sign you in with one-time codes, so we never store a password for you.
• Preferences and settings: time zone (read from your browser and saved to your account, used for scheduling and send times), the AI assistant's default approval mode, and interface preferences.
• Workspace content: campaign plans, KPIs and budgets, schedules and milestones, creator lists and notes, email drafts and threads, files uploaded to the campaign library, and your conversations with the AI assistant.
• Demo request form: name, work email, company name, preferred meeting time, and time zone, plus the page language and a source tag recorded at submission. We use these to log the booking, send you a confirmation email, and notify our team.
• What you send us directly: the content and attachments of support emails.

What you authorize us to access on your behalf

• Email accounts: you can connect a mailbox by OAuth with a provider we currently support, or by entering SMTP credentials. Once connected, Innex works as a full mail client: we draft and send on your behalf, and we read that account's inbox and sent mail — bodies, attachments, threads, and read state — and let you search, reply, forward, and mark messages read inside Innex. That is what lets creator replies and your campaigns be tracked in one place. Tokens and SMTP credentials are stored encrypted, and you can disconnect at any time in settings.

What we collect automatically

• Log and device data: IP address, browser and operating system, access times, the pages or endpoints requested, and error details.
• Usage and billing data: your subscription tier, per-period feature usage, and your quota and account balance state.
• Cookies and local storage: see Section 9.

What we get from third parties

• Public creator profiles: see Section 6.
• Payment information: subscriptions are processed by Stripe. Full card numbers and payment credentials never reach our servers; what we receive from Stripe is subscription and billing status, used to enable the corresponding entitlements.

• Providing the service: creator discovery and matching, campaign management, drafting and sending outreach, analytics dashboards.
• Running AI features: see Section 4.
• Accounts and billing: provisioning, subscriptions, credit and quota accounting, invoices.
• Security and abuse prevention: detecting unusual sign-ins, rate limiting, and preventing spam and fraud.
• Support and service notices: verification codes, status updates, and material changes.
• Product improvement: analyzing aggregated or de-identified usage. We do not use one customer's workspace content to improve features for other customers.
• Marketing communications: only where you have consented or the law otherwise permits, and always with an unsubscribe link.
• Legal obligations, and establishing or defending legal claims where necessary.

We process information only for the purposes listed above. Some of that is needed to provide and secure the Service, bill you, or meet legal obligations; other processing — such as marketing communications — happens only with your consent or where otherwise permitted.

The Innex assistant calls third-party large language models to interpret your instructions, draft emails, and summarize creator and campaign data. To do that we send the model provider the context needed for the task — typically your instruction, the current conversation, the relevant campaign and creator fields, and any files you explicitly selected.

• We do not train our own models on your workspace content, and for external models we use only API tiers whose provider terms do not permit customer inputs to be used to train general-purpose models.
• Model providers may process this data only to provide the service to you — as our sub-processors for workspace content, and as our processors for other data.
• Actions with outside effects require human approval. Actions such as sending email, syncing an email draft, adding or removing creators from a campaign, changing creator status, and editing pipeline targets, KPIs, budgets, or milestones all pause for your approval — unless you change the default approval mode in settings, or switch an individual conversation to full-autonomy mode.
• Model output can be wrong. Review it yourself before it goes out, especially email to creators and any external commitment.

When you connect Gmail through Google OAuth, we request a single scope: gmail.modify (full identifier: https://www.googleapis.com/auth/gmail.modify). This restricted scope lets Innex read messages and attachments in the connected mailbox; create, update, delete, and send drafts; send, reply to, and forward messages; and change message state, such as marking messages read. We obtain the connected Gmail address through the Gmail users.getProfile method under this same scope; this flow does not request separate Google identity or profile scopes. Note that this grant covers the whole connected mailbox, not only campaign-related correspondence. Innex's built-in mail workspace reads your inbox and sent mail so you can view, search, reply to, and track messages inside Innex. If you would rather Innex not touch the rest of your work mail, connect a mailbox dedicated to outreach.

Innex's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Concretely:

• mailbox data is used only to provide Innex's outreach and reply-tracking features to you;
• it is never used for advertising, sold, or transferred to data brokers;
• it is never used to train generalized AI or machine learning models; and
• our staff do not read your email content except with your explicit consent, for a security investigation, where required by law, or when the data has been aggregated and de-identified.

You can disconnect a mailbox at any time in Innex settings, and revoke access from your Google account's third-party access page. On disconnect we delete the stored credentials and also attempt to revoke the token with Google programmatically; if we cannot confirm that revocation with Google, the app asks you to remove Innex from your Google account's third-party access page yourself.

Innex helps businesses find and work with creators, so we process information about creators.

Innex's creator database. We compile publicly available information from social platforms and the public web. This includes display names, handles, profile images, bios, public post and audience metrics, and contact details that creators publish for business enquiries. We do not bypass logins, paywalls or technical access restrictions, and we do not intentionally collect special categories of personal data.

What stays separate. Creator lists a customer uploads, and a customer's correspondence with creators, are that customer's workspace content. Innex may link such information to matching profiles within that customer's workspace. We do not use workspace or mailbox content to build or enrich the shared creator database.

Legal basis and transparency (EEA/UK and similar laws). We process creator database information on the basis of our and our customers' legitimate interests in discovering and evaluating creators for business collaborations. We consider this processing limited to information creators have made public for professional purposes, and we offer an easy way to object. Because we do not have direct contact details for most creators, this policy is how we provide the information required by Article 14 GDPR.

Your choices as a creator. You can ask us to access, correct or delete your profile, or object to our processing of it, by writing to support@w2z.ai. If you object, we will stop processing your profile unless the law allows otherwise. Where we can, we will also suppress it so it is not re-collected. Requests about information a customer uploaded, or about correspondence with a customer, are passed to that customer, and we help as needed.

Outreach you receive. Outreach sent through Innex comes from the brand or agency using Innex, which is responsible for it. Replying to them is the fastest way to stop contact. You can also write to us.

Authorized Innex personnel may access customer accounts and data, including by signing in to an account with the user's permissions for a limited time, as needed to:

• provide and support the Service, for example when responding to a support request;
• troubleshoot, maintain and fix it;
• keep it secure and prevent abuse; or
• comply with law.

Personnel are bound by confidentiality obligations, and account access sessions are recorded. For data received from Google APIs, Section 5 applies and prevails over this section.

We do not sell workspace content or connected-mailbox data, and we do not share personal information for cross-context behavioral advertising.

We share information:

• Within the customer's organization. Users in a workspace may see its content according to the workspace's roles and settings. Customers' workspaces are separated from one another.
• With service providers that help us run the Service, such as hosting and storage, payments, authentication, email delivery, AI model inference, web content retrieval, analytics, and support and communications tools. They process data on our instructions under contract. Customers can request our current sub-processor list and a data processing agreement at support@w2z.ai.
• With referrers and affiliates, limited to whether and when a referral or promotion code was used, and aggregated program statistics. We do not tell referrers or affiliates who you are.
• For legal reasons: to comply with law or legal process, and to protect the rights, safety and property of Innex, our users or others.
• In a business transaction, such as a merger, acquisition, financing or sale of assets, subject to standard confidentiality protections. Where required by law or by Google's policies, we will give notice or obtain consent first.

We use:

• Essential cookies and storage to keep you signed in, secure the Service, and remember settings and preferences. These are needed for the Service to work.
• Analytics (currently Google Analytics) to understand traffic and sign-ups. Inside the application we limit what we send and do not send workspace content.

We do not use advertising cookies. Where the law requires consent, for example in the EEA, UK and Switzerland, we do not set non-essential cookies without it. You can also block cookies in your browser.

Some content, such as creator images hosted by social platforms or front-end libraries, may be loaded by your browser directly from third parties, which then receive your IP address and browser details.

We are based in the United States, and we and our providers may process information in the United States and other countries. Where required, we use recognized transfer safeguards, such as the European Commission's Standard Contractual Clauses.

We use administrative, technical and organizational measures appropriate to the nature of the data. These include encryption in transit, encryption of stored credentials, access controls, and separation between customer workspaces. No system is perfectly secure. If a security incident affects your personal information, we will notify you and others as required by law.

We keep information for as long as needed for the purposes in this policy. That includes providing the Service, meeting legal, tax and accounting obligations, resolving disputes, preventing abuse, and enforcing agreements. We then delete or anonymize it. When we set retention periods we consider the type of data, our relationship with you, and legal requirements.

In particular:

• You can delete your account in Settings. We then delete or anonymize your personal information, except records we keep for billing, legal, security and audit purposes, and subject to backups.
• Workspace content is kept while the customer's workspace exists. An authorized administrator can ask us to export or delete a workspace's content by contacting support@w2z.ai.
• Mailbox credentials are deleted when you disconnect the mailbox or revoke access.
• Creator profiles are kept while they remain useful to the Service, subject to objection and deletion requests.

Depending on where you live, you may have the right to:

• access, correct or delete your personal information, or receive a copy of it;
• object to or restrict certain processing;
• withdraw consent; and
• complain to a data protection authority.

You can update your profile in Settings. For anything else, email support@w2z.ai. We may need to verify your identity, and we will respond within the time required by applicable law. If your information is held as a customer's workspace content, we may refer your request to that customer and help them respond.

EEA and UK. We rely on:

• performance of a contract, for providing the Service to account holders;
• legitimate interests, for operating, securing and improving the Service, for the creator database, and for business-to-business communications;
• consent, where required, for example for non-essential cookies and some marketing; and
• legal obligations.

California. California residents may have rights under the California Consumer Privacy Act:

• to know the categories and specific pieces of personal information we collect, the sources, the purposes, and the categories of recipients (all described in this policy);
• to delete and correct their information;
• to opt out of any sale or sharing; and
• not to be discriminated against for exercising these rights.

You or an authorized agent can make a request at support@w2z.ai. We do not use or disclose sensitive personal information for purposes that would require a right to limit.

Innex is a business service for users aged 18 and over. Public creator information may occasionally relate to minors, because public profiles rarely state an age. If you are a minor or a guardian, write to support@w2z.ai and we will delete the relevant records.

This policy describes Innex as it works today. We will keep changing the product, and how it handles data will change with it — this policy is updated to match. We'll update the date at the top, and for material changes — a new purpose for data, or a new category of sub-processor — we'll give you at least 30 days' notice by email or in-app. Continuing to use Innex after a change takes effect means you accept the updated policy.

W2Z AI Inc., a California corporation. Email: support@w2z.ai