theNeedle Privacy Notice

theNeedle is an email-intelligence and attention-management product operated by Crescentic LLC ("Crescentic," "we," "our," or "us").

This theNeedle Privacy Notice explains how Crescentic collects, uses, discloses, retains, and protects Personal Information specifically in connection with theNeedle.

This Notice supplements the Crescentic LLC Privacy Statement, which describes Crescentic's general privacy practices and also applies to theNeedle. Where this Notice differs from the Crescentic Privacy Statement concerning a practice specific to theNeedle, this Notice controls for that practice.

Questions about this Notice or the privacy of information processed by theNeedle may be directed to privacy@crescentic.ai.

theNeedle connects to email accounts that a user voluntarily authorizes and uses automated technology to help identify, organize, summarize, and monitor communications that may deserve attention.

• Identify communications that may be urgent, important, or time-sensitive
• Classify and prioritize messages
• Generate message or thread summaries
• Identify communications that may require a response
• Monitor sent communications for which no response has been detected
• Surface email-account connection or synchronization issues
• Identify recurring, bulk, subscription, or lower-priority communications
• Generate alerts, reminders, and periodic summaries
• Help users review activity across multiple connected inboxes

theNeedle is an attention and decision-support tool. It does not replace the user's underlying email account, inbox, records, professional judgment, or responsibility to review and respond to communications.

This Notice applies when a person:

• Creates or uses a theNeedle account
• Connects an email account
• Authorizes Crescentic to access email information
• Uses theNeedle's classification, summarization, monitoring, or alerting features
• Enables email, push, or SMS notifications
• Purchases or manages a subscription
• Contacts Crescentic for support
• Visits a theNeedle website or application that links to this Notice
• Otherwise interacts with theNeedle

This Notice does not govern the independent privacy practices of an email provider, telecommunications carrier, application store, mobile operating system, website, or other third-party service.

When a user creates or maintains a theNeedle account, Crescentic may collect:

• Name
• Email address
• Mobile telephone number, when voluntarily provided
• Account identifier
• Authentication and session information
• Subscription and billing status
• Notification preferences
• Time zone and application settings
• Support requests and communications
• Records of acceptance of applicable terms and notices
• Security, access, and account-recovery information

theNeedle may use passwordless authentication or an external identity provider.

Crescentic does not store passwords in plain text. When an external provider uses OAuth or a similar authorization process, Crescentic generally does not receive the password used for the connected email account.

A user may choose to connect one or more supported email accounts to theNeedle.

Crescentic may use an email-connectivity provider, including Nylas, to establish and maintain connections with supported email providers.

The information available to theNeedle depends on the email provider, the permissions requested by theNeedle, the permissions approved by the user or account administrator, the features enabled by the user, and the technical capabilities of the provider and connectivity service.

Depending on those permissions and features, theNeedle may access or process:

• Email account identifiers
• Sender and recipient information
• Email addresses
• Subject lines
• Message bodies
• Attachments or attachment metadata
• Message dates and times
• Thread and conversation information
• Message identifiers
• Folder, label, read, unread, sent, draft, archive, or similar status information
• Reply and response activity
• Delivery and synchronization information
• Links and telephone numbers appearing in messages
• Dates, deadlines, meetings, or events appearing in message content
• Contact information associated with communications
• Other metadata made available through the authorized connection

theNeedle accesses connected email information only within the permissions granted by the user or applicable account administrator.

Unless a feature is clearly presented and separately authorized, theNeedle does not send, delete, archive, move, or modify messages in the underlying email account.

Where a user connects a Google or Gmail account, theNeedle's use and transfer of information received through Google APIs will comply with the Google API Services User Data Policy and applicable Google Workspace Limited Use requirements.

Crescentic uses Google user data only to provide or improve prominent, user-facing theNeedle functionality, maintain security, comply with law, and perform other uses permitted under applicable Google policies.

Crescentic does not use Google user data:

• For advertising
• To create advertising profiles
• To sell or broker user information
• To determine creditworthiness or lending eligibility
• To train generalized artificial-intelligence or machine-learning models for unrelated products or customers
• For purposes unrelated to the user-facing functionality of theNeedle

Human access to Google user data is restricted and may occur only when the user provides affirmative permission for support or troubleshooting, access is reasonably necessary to investigate abuse, fraud, a bug, or a security incident, access is required to comply with applicable law, or the information has been aggregated or de-identified and is used for permitted internal operations.

Crescentic may use connected email information to:

• Synchronize authorized inbox information
• Analyze email content and metadata
• Identify urgency, priority, relevance, and potential deadlines
• Detect communications that may require attention or a response
• Generate summaries, classifications, and alerts
• Identify sent communications without a detected response
• Identify recurring, subscription, bulk, or lower-priority communications
• Generate user-configured reports and digests
• Improve the accuracy and usefulness of the user's theNeedle experience
• Diagnose account-connection and synchronization issues
• Provide customer support
• Detect misuse, fraud, unauthorized access, and security threats
• Maintain service reliability
• Comply with legal obligations
• Enforce applicable terms

theNeedle does not guarantee that every important communication, deadline, request, risk, opportunity, or response will be identified. Users remain responsible for reviewing their underlying email accounts and acting on their communications.

theNeedle uses artificial intelligence, machine learning, rules, classifiers, and other automated methods to analyze connected email information and produce user-facing results.

These processes may be used to:

• Classify messages
• Estimate urgency or importance
• Extract dates, names, requests, or other details
• Generate summaries
• Identify potential action items
• Detect unanswered or unresolved communications
• Group related communications
• Identify patterns in subscription or bulk-email activity
• Generate alerts, digests, and recommendations

To perform these functions, Crescentic may transmit limited portions of email content or metadata to contracted artificial-intelligence and technology providers. Crescentic limits these disclosures to information reasonably necessary to perform the applicable function and requires providers to process information for Crescentic's authorized purposes.

Crescentic does not authorize its providers to use connected email content for their own advertising or to train generalized models for unrelated customers.

Automated outputs may be incomplete, inaccurate, delayed, outdated, or based on an incorrect interpretation. A classification, summary, alert, or recommendation is not an authoritative statement regarding the meaning, importance, legal effect, or required response to an email.

theNeedle may create information derived from connected communications, including:

• Priority and urgency classifications
• Summaries
• Extracted dates or deadlines
• Sender or relationship classifications
• Response-status indicators
• Alert history
• User feedback on classifications
• Recurring-sender or subscription classifications
• Usage patterns and product preferences
• Confidence scores or similar analytical indicators

Derived information may remain associated with the user's account where needed to provide the product, preserve user settings, improve the user's individual experience, maintain security and audit records, or support troubleshooting.

Derived information may not accurately reflect the intent of a sender or the legal, financial, professional, social, or personal significance of a communication.

Where theNeedle offers paid subscriptions, Crescentic may collect subscription-plan information, billing status, transaction identifiers, and limited payment-related records.

Payment-card information may be processed by Stripe, Apple, Google, or another disclosed payment provider.

Crescentic does not ordinarily store complete payment-card numbers in its application databases. Purchases made through an application store are also governed by that store's independent payment and privacy practices.

SMS messaging from theNeedle is optional.

When a user voluntarily enrolls in theNeedle SMS messaging, Crescentic may collect and process:

• Mobile telephone number
• Date and time of enrollment
• Consent-language version
• Notification preferences
• Verification information
• Message-delivery information
• HELP, STOP, and related messaging requests
• Records needed to administer and document the messaging program

theNeedle SMS messages may include account-security and verification messages, user-enabled priority alerts, email-account connection notices, sent-message follow-up reminders, and service-related notifications.

Message frequency varies based on the user's account activity, connected inbox activity, and notification settings. Message and data rates may apply.

Users may reply STOP to opt out or HELP for assistance. Consent to receive SMS messages is not a condition of purchasing, subscribing to, or using theNeedle.

Crescentic may provide mobile information to telecommunications carriers, messaging providers, and other service providers solely to verify, operate, deliver, secure, and support the theNeedle messaging program. Those providers may use the information only to perform services for Crescentic and may not use it for their own marketing or promotional purposes.

Opting out of SMS does not automatically disable email, in-app, push, security, legal, or other communications that the user has separately authorized or that Crescentic must send to operate the account.

Additional information is available in the theNeedle SMS Messaging Terms.

Crescentic may disclose information processed through theNeedle to the following categories of recipients.

Crescentic does not:

• Sell connected email content
• Rent connected email content
• Use connected email content for behavioral advertising
• Share connected email content with data brokers
• Use connected email content to determine creditworthiness
• Use connected email content to make lending or insurance decisions
• Publicly disclose connected email content
• Allow unrelated Crescentic products to access connected email content merely because the user has a Crescentic account
• Use connected email content to train generalized models for unrelated products or customers

Crescentic may use service telemetry and aggregated or de-identified information to understand product reliability, feature performance, and general usage trends, provided that such use complies with applicable provider policies and the information cannot reasonably be used to identify a user or reconstruct a communication.

theNeedle is operated by Crescentic LLC, but connecting an inbox to theNeedle does not automatically authorize another Crescentic product to access the connected email information.

Information may be made available to another Crescentic product only when the user expressly requests or enables the connection, the transfer is necessary to provide a clearly disclosed integrated feature, Crescentic has another lawful and disclosed basis, or the information has been properly aggregated or de-identified.

Product branding, shared ownership, or common authentication does not, by itself, authorize unrestricted data sharing among Crescentic products.

Crescentic retains information for the period reasonably necessary to:

• Provide theNeedle
• Maintain user-selected functionality and historical results
• Process alerts and reports
• Maintain synchronization
• Provide support
• Protect security
• Prevent fraud and misuse
• Resolve disputes
• Maintain billing and transaction records
• Comply with contractual and legal obligations

Retention may vary by information type. Raw message content may be retained differently from message metadata, generated summaries, classifications, extracted deadlines, notification records, account activity, and security or audit logs.

Crescentic seeks to minimize retention of raw message content where theNeedle can operate using derived information, references, or metadata. Information may remain temporarily in backups, security logs, or protected archival systems after deletion from active systems.

A user may disconnect a connected email account through available application settings or through the applicable email provider. Disconnecting an account:

• Stops or restricts future access through that authorization
• May stop synchronization and monitoring
• May disable related alerts and reports
• Does not necessarily delete information previously processed by theNeedle
• Does not cancel a paid subscription
• Does not delete the user's theNeedle account

Previously processed information may remain until the user deletes the relevant data or account, the applicable retention period expires, or Crescentic completes scheduled deletion processes.

Users may request deletion of a theNeedle account through available account controls or by contacting privacy@crescentic.ai.

Following a valid deletion request, Crescentic will delete or de-identify Personal Information associated with the account, subject to legal and regulatory obligations, fraud-prevention and security requirements, billing and transaction records, dispute-resolution needs, backup and archival cycles, information Crescentic is required or permitted to retain, information already de-identified, and information independently held by an email provider or other third party.

Deleting a theNeedle account does not delete messages or information held by the underlying email provider.

Depending on available functionality, users may be able to:

• Connect or disconnect email accounts
• Select notification methods
• Adjust priority, alerting, and follow-up settings
• Manage subscription and billing information
• Manage mobile-number and SMS enrollment
• Submit privacy requests
• Request account deletion

Crescentic maintains administrative, technical, and organizational safeguards intended to protect information processed by theNeedle, including:

• Encryption in transit and at rest
• Authentication and session controls
• Restricted administrative access
• Role-based and database access controls
• Logging and monitoring
• Service-provider controls
• Backup and recovery procedures
• Incident-response processes
• Security testing
• Access reviews

No system, service, storage environment, or transmission method can guarantee absolute security. Users are responsible for securing their devices, email accounts, authentication methods, and account-recovery channels. Suspected vulnerabilities may be reported to security@crescentic.ai.

Depending on the user's location, applicable rights may include the right to:

• Request access to Personal Information
• Request correction
• Request deletion
• Obtain a portable copy
• Restrict or object to certain processing
• Withdraw consent where processing relies on consent
• Opt out of certain sharing or targeted advertising
• Appeal the denial of a privacy request

Requests may be submitted to privacy@crescentic.ai. Crescentic may take reasonable steps to verify the requester's identity and authority. Crescentic will not discriminate against a person for exercising an applicable privacy right.

theNeedle is not directed to children under 13, and Crescentic does not knowingly allow a child under 13 to create a theNeedle account.

If Crescentic learns that it collected Personal Information directly from a child under 13 without appropriate authorization, Crescentic will take reasonable steps to delete it.

Crescentic is based in the United States and may use service providers located in the United States or other jurisdictions.

Information may therefore be processed in countries whose privacy laws differ from those of the user's location. Where required, Crescentic uses contractual terms or other recognized mechanisms intended to protect transferred Personal Information.

Crescentic may update this Notice to reflect changes in theNeedle functionality, connected providers, artificial-intelligence processing, notification methods, data practices, legal requirements, service providers, or retention practices.

The version number and revision date will be updated when changes are published. Where required, Crescentic will provide additional notice or obtain consent before applying a material change to previously collected Personal Information.

theNeedle — a Crescentic LLC product

• Privacy questions and privacy-rights requests: privacy@crescentic.ai
• Account, billing, and product support: support@crescentic.ai
• Security inquiries and vulnerability reports: security@crescentic.ai

Formal legal notices must be delivered according to the notice provisions in the applicable Crescentic or theNeedle terms. Crescentic's registered-agent information is reserved for service of process and official legal notices and is not a product-support or privacy-request channel.