Actionist — Privacy Policy

Effective date: 15 May 2026

Last updated: 15 May 2026

This Privacy Policy explains how ActionModel Ltd, a business company incorporated in the British Virgin Islands (company number 2195097) (“Actionist”, “we”, “us”, or “our”), collects, uses, shares, and protects information in connection with the Actionist desktop application, websites, APIs, integrations, marketplace, and related products and services (together, the “Service”).

This Policy forms part of and is incorporated into our Terms of Service. Capitalised terms not defined here have the meaning given in the Terms of Service. By accessing or using the Service, you acknowledge that you have read and understood this Policy. The Service is intended only for individuals aged 18 or over.

1. Scope & Roles

1.1 What this Policy covers. This Policy applies to information we process as a controller — that is, where we determine the purposes and means of processing — across the Service.

1.2 Business and enterprise use (controller/processor). Where you use the Service on behalf of, or as, an organisation, that organisation is the controller of personal data it submits to or processes through the Service (including data relating to its own customers, employees, or other individuals), and we act as a processor that processes such data on the organisation’s instructions, as further described in Section 13 and any applicable data processing agreement. The organisation is responsible for having all necessary rights, consents, notices, and lawful bases for that data.

1.3 Data from connected accounts. When you connect a third-party account or service (for example, an email, payment, CRM, or messaging platform) and instruct an agent to act on it, the Service accesses and processes data from that account at your direction and on your authorisation. You are responsible for ensuring you are permitted to grant that access and to automate that account.

2. Information We Collect

We collect the following categories of information:

2.1 Information you provide:

- Account and registration information — such as your name, email address, and authentication identifiers, handled through our third-party authentication provider.

- Workspace and configuration information — such as your organisation or company name, agent configurations, settings, and preferences.

- Content and files — documents, files, knowledge, memory entries, instructions, prompts, messages, and other content you upload to, create in, or provide to the Service.

- Communications — information you provide when you contact us for support or otherwise correspond with us.

- Payment information — where you purchase paid features, billing details are collected and processed by our third-party payment processor; we do not store full payment card numbers.

2.2 Information generated through your use of the Service:

- Activity and automation data — records of tasks, automations, workflow runs, schedules, and agent activity, including associated logs and outputs.

- Operational data from automated tasks — where you run tasks that control a computer or operate connected accounts, the Service processes the data necessary to perform those tasks, which may include screen contents, inputs, and the data the agent reads or writes in the course of carrying out your instructions.

- Usage information — features used, interactions, and similar information about how you use the Service.

2.3 Credentials. Where you provide credentials, tokens, or keys to connect a third-party service, we store and process them as needed to operate the connection you have authorised, using technical measures designed to protect them.

2.4 Device and technical information — such as IP address, device and operating-system information, application version, identifiers, and log, diagnostic, and crash data.

2.5 Cookies and similar technologies — on our websites, we and our providers use cookies and similar technologies (see Section 4).

2.6 Information from third parties — such as our authentication provider, services you connect, analytics providers, and, where permitted, other sources that help us operate, secure, and improve the Service.

2.7 Sensitive information; your responsibility. We do not seek to collect, and we ask that you do not input or provide, special categories of personal data or other sensitive information (such as health, biometric, genetic, racial or ethnic, political, religious, trade-union, sexual-orientation, precise-location, or government-identifier information) unless it is strictly necessary for a task you direct and you are permitted to provide it. Because the Service can capture screen contents and access the accounts and data you connect, it may incidentally process whatever information is present in those sources. You are responsible for ensuring you have the right to provide any such information and for not submitting sensitive information you are not authorised to disclose. We process any sensitive information only as needed to perform the task you request and as described in this Policy.

3. How We Use Information

We use information for the following purposes (and other purposes described to you or to which you consent):

• to provide, operate, maintain, and secure the Service;

• to authenticate you and manage your account;

• to perform the tasks, automations, and connected-account operations you request or authorise;

• to process transactions and manage billing;

• to personalise and improve your experience;

• to communicate with you, including service, security, and administrative messages and, where permitted, updates;

• to provide customer support;

• to analyse, develop, and improve our products, services, and technologies, including the algorithms and models that underlie them;

• to create and use aggregated, anonymised, and de-identified data and insights (which do not identify you) for any lawful purpose;

• to maintain the safety, integrity, and security of the Service, and to detect, prevent, and address fraud, abuse, and security incidents;

• to comply with legal obligations and enforce our Terms of Service and other agreements; and

• to establish, exercise, or defend legal claims.

4. Cookies & Similar Technologies

Our websites use cookies and similar technologies, including those that are strictly necessary for the site to function, and those used for preferences, performance, and analytics. You can manage non-essential cookies through your browser settings or any cookie controls we make available. Where required by law, we obtain consent for non-essential cookies. Disabling some cookies may affect site functionality.

5. Legal Bases for Processing (EEA/UK)

Where the EU or UK General Data Protection Regulation applies, we rely on the following legal bases:

- Performance of a contract — to provide the Service you have requested;

- Legitimate interests — to operate, secure, analyse, develop, and improve the Service and our business, where not overridden by your interests;

- Consent — where required (for example, certain cookies or communications), which you may withdraw at any time; and

- Legal obligation — to comply with applicable law.

6. How We Share Information

We do not sell your personal data. We share information only as described below:

6.1 Service providers and sub-processors. We share information with third parties that process it on our behalf to operate and support the Service. We engage providers in the following categories: cloud hosting and infrastructure; artificial-intelligence and inference providers; authentication; analytics; payment processing; and communications and messaging. These providers are permitted to use the information only to provide services to us.

6.2 At your direction. We share information as you direct — for example, with third-party services you connect, or when you publish content to the marketplace.

6.3 Affiliates. We share information with our affiliates and group entities to operate and improve the Service.

6.4 Business transfers and reorganisation. In connection with, or in preparation for, any merger, acquisition, financing, reorganisation, sale or transfer of assets, change of control, or transfer or migration of the Service or our business (including to a successor or to an entity in a different jurisdiction), we may transfer information as part of that transaction or arrangement, consistent with our Terms of Service.

6.5 Legal, safety, and compliance. We may disclose information where we believe it is necessary to comply with law or legal process, to enforce our agreements, or to protect the rights, property, safety, or security of Actionist, our users, or others.

6.6 With your consent. We share information for other purposes with your consent.

6.7 Aggregated and de-identified data. Aggregated, anonymised, and de-identified data does not identify you, is not personal data, and may be used and shared for any lawful purpose.

7. Artificial Intelligence & Automated Processing

The Service is powered by artificial-intelligence systems. To deliver and operate the Service, content and data you provide or generate may be processed by us and by third-party model and inference providers. We also use information to develop and improve our products, services, and technologies, including the models that underlie them, including in aggregated or de-identified form. As described in our Terms of Service, automated outputs and actions may be inaccurate or incomplete and should be reviewed before they are relied upon.

Automated decision-making. The Service performs tasks and takes actions through automated, AI-driven processing that you configure, instruct, and control. It is designed to operate under your direction and supervision, including the human-review and approval controls available to you, and we do not use it to make decisions producing legal or similarly significant effects about you without human involvement. You are responsible for the level of autonomy and oversight you choose to apply. Where automated decision-making within the meaning of applicable data-protection law applies to you, you may have the right to obtain human intervention, to express your point of view, and to contest the decision; to exercise these rights, contact us at privacy@actionist.ai.

8. Your Choices & Rights

8.1 Account controls. You can access and update certain information through your account settings and may close your account at any time.

8.2 Privacy rights. Depending on your location, you may have rights to access, correct, delete, or receive a copy of your personal data; to object to or restrict certain processing; to withdraw consent; and to be free from discrimination for exercising your rights. Regional details are in Sections 14 and 15.

8.3 How to exercise. To make a request, contact us at privacy@actionist.ai. We may need to verify your identity, and we will respond as required by applicable law. Some information may be retained as permitted or required by law, or where it is necessary for our legitimate interests (see Section 9).

8.4 Improvement preferences. If you would prefer that certain information not be used to help improve our products and services, you may contact us at privacy@actionist.ai, and we will honour such requests to the extent reasonably practicable and as required by applicable law.

8.5 Communications. You can opt out of non-essential communications using the unsubscribe mechanism provided or by contacting us; we may still send you service and administrative messages.

9. Data Retention

We retain personal data for as long as necessary to provide the Service, for the purposes described in this Policy, and as required for our legitimate business interests or to comply with legal obligations, after which we delete or de-identify it. For clarity, and consistent with our Terms of Service, the exercise of a deletion right or the closure of your account does not require us to delete aggregated, anonymised, or de-identified data, or any improvements, learnings, models, or know-how already derived from data, which are not personal data and which we may continue to retain and use.

10. International Transfers

We operate internationally, and information may be processed and stored in countries other than the one in which you are located, including countries that may have different data-protection laws. Where required, we use appropriate safeguards for such transfers. By using the Service, you understand that your information may be transferred to and processed in such countries.

11. Security

We use technical and organisational measures designed to protect information. However, no method of transmission or storage is completely secure, and we cannot and do not guarantee that information will be free from unauthorised access, loss, or alteration. You are responsible for safeguarding your account credentials and devices. Use of the Service is at your own risk, as further described in our Terms of Service.

12. Children

The Service is not directed to, and may not be used by, anyone under 18. We do not knowingly collect personal data from anyone under 18. If we learn that we have collected such data, we will take steps to delete it.

13. Business & Enterprise Customers

Where the Service is used by or on behalf of an organisation, the organisation is the controller of personal data it submits to or processes through the Service, and we process such data as a processor on the organisation’s instructions and, where applicable, under a separate data processing agreement. The organisation is solely responsible for providing any required notices to, and obtaining any required consents and lawful bases from, the individuals whose data it processes through the Service. This Policy describes our own processing as a controller.

14. Third-Party Services & Links

The Service integrates with, and may link to, third-party services that we do not control. Their collection and use of information is governed by their own privacy policies, and we are not responsible for their practices. We encourage you to review the privacy policies of any service you connect or visit.

15. Region-Specific Disclosures

15.1 European Economic Area & United Kingdom

If you are in the EEA or UK, you have the rights described in Section 8.2, including the right to lodge a complaint with your local supervisory authority. Our legal bases are described in Section 5, and international transfers in Section 10. The controller is ActionModel Ltd, and privacy queries may be sent to privacy@actionist.ai.

15.2 California

If you are a California resident, you have rights under the California Consumer Privacy Act (as amended), including the rights to know, access, correct, and delete your personal information, and to opt out of the “sale” or “sharing” of personal information. We do not sell or share your personal information for cross-context behavioural advertising. We do not discriminate against you for exercising your rights. The categories of personal information we collect, the purposes for which we use them, and the categories of recipients are described in Sections 2, 3, and 6. To exercise your rights, contact us at privacy@actionist.ai.

15.3 Other jurisdictions

Where other privacy laws apply, we provide the rights and protections those laws require.

16. Changes to This Policy

We may update this Policy at any time, in our sole discretion. Any changes become effective when we post the revised Policy (or on any later date we specify) and apply to all users, including those who registered before the change, without the need for individual notice and without any further action on your part. Making the revised Policy available within or in connection with the Service constitutes sufficient notice. The “Last updated” date indicates when it was last changed, and your continued use of the Service after a change takes effect constitutes your acceptance of the updated Policy.

17. Contact

Questions or requests regarding this Policy or your information may be directed to:

ActionModel Ltd (British Virgin Islands, company number 2195097)

Email: privacy@actionist.ai

© 2026 ActionModel Ltd. All rights reserved. This is a draft for internal review and is not legal advice.