Privacy Policy

This Privacy Policy explains how Systems Logic & Automation Group LLC collects, uses, discloses, and protects personal information when you use our websites, applications, APIs, and related services (collectively, the "Services"). References to SYSTALOG.ai, SYSTALOG, GemFit.ai, GemFit, IronFeed, K9Codex, we, us, and our mean Systems Logic & Automation Group LLC unless a separate signed agreement says otherwise.

This Privacy Policy should be read together with our Terms of Service.

What this policy covers. This policy applies to:

• SYSTALOG.ai, our studio services (websites, apps, and custom software we build for clients), the client portal, and our contact, quote, and assessment forms
• SYSTALOG Websites: the website builder, site hosting, domain registration, and the booking requests visitors send through websites our customers publish with it
• SYSTALOG business software: Vendor Manager, Proof of Work, Service Operations, Equipment Maintenance, Client Portal, Team Training, Talent Manager, GemFit for Coaches, and Service Inbox, including the team members, clients, vendors, and guests our customers invite
• K9Codex on the web and on iPhone
• GemFit.ai (also known as IronFeed) on the web and on iPhone, including Apple Health import, AI features, social features, coaching, the GemFit affiliate program, and GemFit connectors for AI assistants

What has its own policy.

• BlackBox has its own BlackBox Privacy Policy and BlackBox Terms of Use. This policy does not apply to BlackBox.
• The Jesus-Focused Youth Ministry app has its own privacy policy.
• A website that a customer publishes with SYSTALOG Websites belongs to that business. The business decides how it uses the booking requests you send it, and its own privacy notice applies to that use. Section 1 explains our role.

Privacy at a Glance

• We do not sell personal information for money, and our mobile apps contain no advertising or third-party analytics SDKs. On our marketing websites, Microsoft Advertising measurement loads only if you choose "Allow analytics" in the cookie banner (section 8).
• Records that a business keeps in our business software, in a K9Codex organization, or through a SYSTALOG website belong to that business. We store and process them to run the service for that business (section 1).
• AI features send the content needed for your request to our AI provider (section 7). AI output can be wrong, so review it before you rely on it.
• GemFit reads only the Apple Health data types you turn on, never writes to Apple Health, and does not use Health data for advertising or marketing.
• You can delete your account in the GemFit and K9Codex apps, in account settings on the web, or by emailing support@systalog.ai. Section 13 explains your rights and how to make a request.

GemFit.ai Mobile Privacy Summary

For GemFit.ai mobile users, the short version is:

• GemFit is private by default. Food logs, workouts, body metrics, goals, reports, and private progress logs are not public unless you choose to share something through a social feature.
• We do not sell personal information, run third-party advertising SDKs, or use GemFit mobile data for cross-app advertising tracking.
• Location is not required for ordinary food, workout, AI, billing, report, or private progress features. Approximate location is requested only if you choose adult social features that require state eligibility checks.
• Apple Health, device step import, camera, microphone, and photo access are permission-based. GemFit asks for those permissions only when you use a feature that needs them.
• From Apple Health, GemFit reads only the types you turn on (steps, water, active energy, workouts, body weight, and body fat percentage). GemFit does not write data to Apple Health.
• AI features may send the text, image, app context, or draft data needed for your request to third-party AI, nutrition, search-grounding, or moderation providers. Do not use AI features for medical, emergency, or regulated health decisions.
• You can use in-app account deletion or contact support@systalog.ai for access, correction, deletion, or privacy questions.

1. Scope and Roles

This Privacy Policy applies to personal information processed by Systems Logic & Automation Group LLC across our Services.

Depending on context, we may act as:

• A business/controller for account, billing, support, and platform operations
• A service provider/processor handling customer data on behalf of business users

When we act for a business customer. We are a service provider (processor) when we store and process information on behalf of a business that uses our Services, including:

• Booking requests and other information visitors send through a website published with SYSTALOG Websites
• Records a business keeps in our business software, such as its customers, job sites and photos, equipment, client files and approvals, support tickets, staff training, vendors, and job candidates
• K9Codex organization records, such as dogs, handlers, training logs, and certifications
• Files and information a studio client shares with us so we can build its website, app, or software

In those cases the business decides why and how the information is used, and its own privacy notice applies. If you are a website visitor, invited guest, vendor, job candidate, or member of a customer's organization and want to access, correct, or delete that information, contact the business first. If you contact us, we will forward your request to the business or help it respond, unless the law requires otherwise.

When we act for ourselves. We decide how information is used (we are the controller) for SYSTALOG.ai visitors and inquiries, account sign-in and security, billing, support, GemFit accounts and content, the GemFit affiliate program, and analytics about how our Services are used.

2. Service Categories Covered

This Policy applies to personal information processed across product areas, including:

• SYSTALOG.ai websites, studio services, quotes, assessments, and the client portal
• SYSTALOG Websites, published customer sites, domain registration, and booking requests
• SYSTALOG business software and the team members and guests our customers invite
• K9Codex training-record management on the web and on iPhone
• GemFit.ai and IronFeed fitness, nutrition, coaching, progress, reporting, social, and mobile/web app workflows
• AI features inside these products, and connectors that let you use your data with an AI assistant you choose
• Portals, dashboards, APIs, integrations, and related mobile/web apps
• Support, billing, account, and trust/safety operations

3. Information We Collect

Depending on use, we may collect the following categories.

3.1 Information You Provide

• Account and profile data (name, email, username, phone, organization, security preferences)
• User content (prompts, uploads, records, notes, documents, outputs, captions, and attachments)
• Contact, quote, and assessment form details, such as name, email, phone, company, business location, request type, message, and the project, budget, or feature details you choose to share
• Booking requests sent through a website published with SYSTALOG Websites: the service, your name, email or phone, the requested date and time, notes, and answers to any questions the business adds to its form
• Domain registration details collected at checkout (registrant name, email, phone, and mailing address), which domain registrars require
• Health, fitness, nutrition, and wellness-adjacent data you choose to provide, such as workouts, exercises, sets, reps, weights, workout duration, calorie-burn estimates, meals, food photos, nutrition logs, macro and micronutrient estimates, allergen/diet flags, supplements, custom nutrient trackers, goals, progress reports, body weight, body fat percentage, body measurements, step counts, and body-composition report imports
• Progress photos and other media you upload or share, including private body-progress photos, meal photos, social feed media, and profile images
• Social and messaging content (public/followers/private post settings, direct messages, and shared links/media)
• Coaching check-ins, and the categories of GemFit data you choose to share with a coach
• Management-system records you submit (for example personnel, vendor, training, and operational records)
• Business software records that customers and their invited users enter, such as customer and job-site contact details and access notes, before and after job photos, equipment and who holds it, client files, approvals, and messages, support tickets, training assignments and completion, vendor contact details, insurance and license dates, and W-9 status
• Job candidate information a business enters in Talent Manager, such as profiles, resumes, documents, interview notes, and scores
• K9Codex records, such as dog profiles, handler names, training logs, photos and videos, certifications, vaccinations, training aids, GPS training tracks, and training locations
• Billing/support information (subscription details, invoices, and support communications)

3.2 Information We Collect Automatically

• Device/browser/app metadata
• Usage and diagnostics logs
• Security and fraud signals (including IP-derived signals and abuse telemetry)
• Cookie/local storage identifiers and preference data
• Page views and interaction events on our websites and apps, such as pages visited, time on page, scroll depth, device type, browser, screen size, the site that referred you, campaign (UTM) tags, and approximate country derived from your IP address (see section 8)
• Interaction telemetry used for feed relevance and anti-abuse controls (for example likes, follows, and moderation signals)
• Device sensor data you authorize in-app, currently including reviewed device step imports where available
• Location you allow: approximate location for GemFit social eligibility (we keep your country and state or region, not coordinates), and precise location for K9Codex training logs, GPS tracks, and weather
• AI confidence, source, estimation, and parsing metadata generated when the Services analyze food, workouts, body metrics, reports, images, prompts, or other inputs
• Limited raw import and AI-review capture data you submit through logging, import, photo analysis, Health Sync preview, or coaching features, such as the original text or import context, parsed draft results, correction notes, source/confidence metadata, and troubleshooting metadata. We use size limits and may store photo-import metadata or AI results without storing the original image payload unless the feature itself requires image storage.

3.3 Information from Third Parties

• Payment confirmations and billing metadata from payment processors, including the billing name, email, phone, and address you give in Stripe Checkout
• App Store and RevenueCat subscription metadata, including product, entitlement, renewal, cancellation, and receipt-related status
• Apple Health data you choose to import into GemFit: steps, water, active energy, workouts, body weight, and body fat percentage, limited to the types you turn on
• Sign-in details from Apple or Google when you choose to sign in with them, such as your name, email address, and account identifier
• Information from the business, organization, or coach that invites you or keeps records about you in our Services
• Data from accounts a business customer connects to our software, such as Google or Microsoft email and calendar, or Slack, used only for the features the customer turns on
• Affiliate and referral program information, including application details, social handles and audience information, requested and assigned coach codes, referral attribution, qualifying subscription events, commission amounts, contact email, Stripe connected-account identifier, onboarding/readiness states, payout references and status, year-specific compensation totals, and tax-form filing/delivery status. Stripe, not GemFit, collects and stores full taxpayer identification numbers, identity documents, tax-form documents, and bank account details through its hosted experience.
• Authentication/session metadata from identity providers
• Provider metadata required to deliver infrastructure and AI operations
• Nutrition reference, web-grounding, moderation, app-store, and device-provider metadata used to operate requested features

4. How We Use Information

We use personal information to:

• Provide, maintain, secure, and improve Services
• Authenticate users and prevent unauthorized access
• Process subscriptions, billing, credits, and support requests
• Respond to contact, quote, and assessment requests and follow up about the work you asked about
• Deliver booking requests to the business that owns the website, send confirmation and status emails, and let the business and its team manage requests
• Register and renew domain names you buy through SYSTALOG Websites
• Send invitations, sign-in links, verification codes, reminders, receipts, and service notices
• Review affiliate applications; administer coach codes, discounts, referral attribution, commissions, tax-compliance status, and payouts; prevent self-referrals, duplicate claims, and program abuse
• Deliver user-requested AI features and workflows
• Estimate, parse, summarize, and organize user-requested fitness, nutrition, training, wellness, and progress information
• Import and reconcile user-authorized device step data while preserving manual entries where available
• Check age and state eligibility for GemFit social features
• Show weather and maps on K9Codex training logs when you allow location
• Deliver user-requested social sharing and private messaging features
• Detect/prevent abuse, fraud, and policy violations
• Operate ranking, personalization, and discovery features for feeds, plans, programs, playlists, reports, and recommendations
• Enforce contractual and legal obligations
• Conduct analytics and product performance measurement, subject to applicable law, and, if you allow it on our websites, measure our Microsoft Advertising campaigns
• Debug, evaluate, and improve food, workout, body-metric, supplement, device-import, and AI-routing accuracy using bounded import/review records

5. Legal Bases (EEA/UK)

Where required, we process personal data under one or more legal bases:

• Contract performance
• Legitimate interests (for security, product operations, fraud prevention, and service improvement)
• Consent (where required for non-essential cookies/marketing)
• Legal obligation

6. How We Disclose Information

As of the Effective Date, we do not sell personal information for monetary compensation.

We may disclose personal information to:

• Service providers/subprocessors for hosting, identity, payments, analytics, support, and operations (see 6.1)
• AI model/API providers when users invoke AI features
• The business that owns a website, workspace, or organization you interact with, and the team members it authorizes (for example, a booking request goes to the business and the staff it adds)
• Coaches you connect with in GemFit, limited to the categories you choose to share
• AI assistants you connect to GemFit (such as ChatGPT, Claude, or Codex), limited to the permissions you approve
• Domain registrars and registries when you buy a domain. Domain industry rules can require them to keep, and in some cases publish, registrant contact details.
• App Store, RevenueCat, Stripe, and similar purchase-management providers when needed to process purchases, verify entitlements, restore purchases, handle refunds/cancellations, and support billing questions
• Stripe and other payment, accounting, tax, and affiliate-program service providers when needed to host connected-account onboarding, verify identity and payout readiness, calculate and issue affiliate commissions, prepare/file/deliver tax forms, maintain required records, prevent fraud, and meet legal or tax obligations
• Nutrition, search-grounding, moderation, storage, app platform, and device/service providers when needed to provide requested features
• Other users and recipients you choose to share with, based on your selected visibility and messaging settings
• Professional advisors/auditors under confidentiality duties
• Courts, regulators, and law enforcement where legally required or necessary to protect rights/safety
• Successors in merger, acquisition, restructuring, or asset transfer transactions

We may also disclose aggregated or de-identified information that does not reasonably identify individuals.

6.1 Service Providers We Use

These providers help us run the Services and process personal information for us:

• Supabase: account sign-in, databases, and file storage for our products
• Vercel: website and API hosting, Vercel Web Analytics, and domain registration for SYSTALOG Websites
• Stripe: checkout, subscriptions, invoices, and payment methods for web purchases, and Stripe Connect onboarding and payouts for the GemFit affiliate program
• Apple and RevenueCat: App Store purchases, subscriptions, and restores in GemFit and K9Codex, and Sign in with Apple
• Google: Sign in with Google, and the Google Fonts web font service
• OpenRouter: routes AI requests to the model provider that answers them (see section 7)
• Resend: verification, booking, invitation, reminder, and service emails
• Vonage: phone verification codes
• fal.ai, Hive, and Sightengine: automated safety checks on photos and videos posted to GemFit social and profile features
• USDA FoodData Central, Open Food Facts, and DuckDuckGo: food and barcode lookups in GemFit. We send the food search or barcode, not your name or account details.
• OpenWeatherMap: weather for K9Codex training logs, based on the training location
• Mapbox and OpenStreetMap: maps for K9Codex GPS tracks
• Microsoft Advertising: ad measurement on our websites, only after you allow analytics (see section 8)
• Email and support tools: our support mailbox and email delivery providers

When a business customer connects its own Google, Microsoft, or Slack account to our software, information moves between our Services and that account at the customer's direction, under the customer's agreement with that provider.

7. AI Features and Third-Party Model Providers

When users invoke AI features, prompts, images, files, app context, fitness/nutrition/body-metric details, and output metadata may be sent to third-party AI providers, search-grounding providers, nutrition/reference services, and moderation providers as needed to perform the requested feature.

We send AI requests through OpenRouter, which passes each request to the model provider that answers it. Our AI features currently use OpenAI models through OpenRouter. Depending on the feature, a request can include:

• GemFit: what you type, food and progress photos you submit, and app context such as goals, logs, plans, and progress. In Pro coaching, that context can include body metrics and workouts you imported from Apple Health.
• K9Codex: notes you ask AI to clean up and photos of field notes you ask it to read
• Business software and website assistants: the records needed to answer the request, such as job, booking, or ticket details, status, and notes. The website follow-up assistant does not receive visitors' email addresses or phone numbers.
• Talent Manager: resumes and candidate and job details when a customer uses resume reading, matching, or drafting features. These features produce drafts and suggestions for the customer's staff, who make the decisions.
• Vendor Manager: documents a customer asks AI to read, such as insurance certificates

For the business software and website assistants, we turn on OpenRouter's setting that excludes model providers that may store request content. For other AI features, the model provider's own retention and training terms apply.

AI assistant connectors. If you connect GemFit to an AI assistant you choose (for example ChatGPT, Claude, or Codex), you approve which permissions it gets, such as reading your profile, goals, nutrition, workouts, body metrics, and trends, and creating drafts. Saving a draft to your log needs a separate permission, and goal changes and deletions need your approval in GemFit. The assistant's provider handles what it receives under its own terms. Access tokens expire after one hour and refresh tokens after 30 days, and you can disconnect an assistant at any time from Connected apps in GemFit.

Important:

• Third-party providers may apply their own retention/security/training practices.
• Their terms and privacy notices govern their processing.
• Users should not submit sensitive or regulated data unless they have legal authorization and appropriate controls.
• Food, workout, calorie-burn, body-composition, allergen, supplement, and health-related AI outputs are estimates for general wellness and organization only. They are not medical, dietetic, nutritional, psychological, emergency, injury, or professional advice.

AI outputs may be inaccurate, incomplete, biased, or infringing. Users are responsible for review before use.

8. Cookies, Analytics, and Advertising Technologies

We use cookies, browser storage, and similar technologies for:

• Authentication and session continuity
• Security and abuse prevention
• Preference storage and UX
• Analytics and campaign attribution

Always on. These run for every visitor because the site needs them or because they do not identify you:

• Sign-in sessions, your theme, and your cookie choice, saved in your browser's local storage
• Vercel Web Analytics, which counts page views and a few site events (such as which button was clicked) without cookies. Vercel processes your IP address and browser details to deliver the site and produce totals.
• Google Fonts and the cdnjs network, which deliver fonts and icons and receive your IP address and browser details when they load

Only after you choose "Allow analytics." If you allow analytics in our cookie banner:

• Our own analytics records page views, time on page, scroll depth, device type, browser, referrer, and campaign tags, using a session identifier in your browser's session storage. If you are signed in, it is linked to your account.
• Microsoft Advertising's Universal Event Tracking (UET) tag loads. It sets Microsoft cookies and tells Microsoft about your visit so we can measure our ads. Microsoft handles that information under the Microsoft Privacy Statement, which can include showing you ads.

If you choose "Essential only," neither of these loads. Your choice is saved in your browser. To change it, use the Privacy choices link at the bottom of any SYSTALOG or GemFit page.

In our apps. GemFit and K9Codex record first-party product events, such as screens opened and features used, linked to your account, so we can fix and improve the apps. GemFit product events do not include health data. Our apps contain no third-party advertising or analytics SDKs, and app events are not shared with advertising networks.

Websites our customers publish. Sites published with SYSTALOG Websites do not set cookies or load analytics or advertising tags. They load fonts from Google Fonts, which receives the visitor's IP address.

Browser signals. If your browser sends a Global Privacy Control signal, we treat it as "Essential only": our own visit analytics and Microsoft UET do not load. We do not respond to Do Not Track. Optional analytics and advertising measurement load only if you allow them in the cookie banner.

Where required, we obtain consent before enabling non-essential cookies or similar technologies.

9. Data Retention

We retain personal information for as long as reasonably necessary for:

• Service delivery and account management
• Security, fraud prevention, and reliability operations
• Legal, tax, accounting, and contractual obligations
• Dispute resolution and enforcement

Retention periods vary by data category and legal requirements.

For some mobile media features, we apply plan-based retention windows and storage limits. Expired or over-limit generated media may be archived, removed, or made unavailable in-app according to plan limits and operational constraints.

For raw import and AI-review capture records used for debugging and product improvement, we apply technical size limits, access controls, and a default operational retention target of up to 18 months unless deletion, legal, security, or account-support needs require a shorter or longer period.

Affiliate applications, referral attribution, subscription-event records, commission ledgers, payout records, and related tax-compliance status may be retained for the duration of the affiliate relationship and afterward for fraud prevention, dispute resolution, accounting, tax, audit, and other legal obligations. Removing a GemFit account does not require us to erase records we must retain by law or records reasonably needed to document prior payouts, reversals, or program abuse.

Booking requests stay with the website they were sent through, under the control of the business that owns it, until the business asks us to delete them or the website is deleted. Contact, quote, and assessment submissions are kept as business records while we may need them to follow up, quote, or document work, and for accounting and legal needs.

For direct messaging and social features:

• Message visibility can be affected by participant deletion actions.
• Public or followers-visible posts may remain visible until removed by the publisher, moderation systems, or legal process.
• Private progress photos are intended to be stored in non-public storage with owner-scoped access controls, but signed URLs, backups, provider logs, or legal/security retention may persist for limited periods.
• AI request payloads, provider responses, moderation logs, billing records, and security/audit logs may have different retention periods than ordinary user-entered app records.

When deletion is requested and legally permissible, we delete or anonymize data using operational processes.

Deleting your account.

• GemFit: Profile, then Settings, then Delete Account in the app deletes your GemFit account and the app records tied to it. Copies of uploaded media, backups, and provider logs can remain for a limited time before they are removed. Records we must keep, such as affiliate payout and tax records, are kept as described above, and connector security logs are kept with your account identifier removed.
• K9Codex and SYSTALOG web accounts: account deletion (in K9Codex under More, then Account & Security; on the web in your account settings) asks you to confirm with a code sent by email or text. It removes you from your organizations, clears your name, email, phone, and security settings from your profile, and disables sign-in. We keep a restricted record of the disabled sign-in, including the original email address, to prevent misuse and handle disputes. If your organization has an active subscription or you hold an active seat, cancel it or hand it off first.
• Records that belong to a business (website booking requests, business software records, and K9Codex organization records) stay with that business when one of its members deletes their own account. If you own a SYSTALOG website or business workspace and want it and its records deleted, email us. Deleting your sign-in alone does not remove them.

For account or data deletion requests, see Delete Account and Delete Data.

10. Data Security

We maintain administrative, technical, and organizational safeguards designed to protect personal information, including:

• Encryption in transit (HTTPS) for our websites, apps, and APIs
• Hosted databases and file storage with access rules that limit records to the accounts and organization members allowed to see them, and private storage for documents and photos
• Short-lived links for private files, and connector access tokens that expire
• Verification codes for sensitive actions such as account deletion
• Limited internal access: we access customer records only when needed to provide support, keep the Services secure, or meet legal obligations

If we learn of a security incident that affects your personal information, we will notify you and regulators as required by law.

No method of storage or transmission is perfectly secure, and we cannot guarantee absolute security.

11. Sensitive and Regulated Data

Unless you have a separate signed agreement with us that expressly allows a regulated use case, do not submit regulated categories of data where prohibited by law.

You are responsible for determining whether your use case requires additional contractual, legal, or regulatory controls.

GemFit.ai and IronFeed are wellness and fitness tools, not healthcare providers, medical devices, covered entities, business associates, or substitutes for licensed medical, nutrition, legal, or emergency professionals unless we have entered a separate signed agreement that expressly says otherwise. Do not use the Services to store protected health information, medical records, diagnosis/treatment information, or other regulated health data unless you have confirmed the required legal basis and signed controls with us.

Consumer health data. Some state laws, such as Washington's My Health My Data Act and Nevada's consumer health data law, treat information like GemFit food and nutrition logs, workouts, body weight and measurements, progress photos, step counts, and Apple Health imports as consumer health data. We collect it to provide the GemFit features you use. We share it only with the service providers in section 6.1 that help run those features, with people you choose (such as other users you post to, a coach, or an AI assistant you connect), and as required by law. We do not sell it, and we do not use Apple Health data for advertising or marketing. You can access or delete it as described in sections 9 and 13.

Sensitive information you choose to give us. Account passwords and verification codes, precise location in K9Codex, and health information in GemFit are used only to provide the features you request, keep your account secure, and meet legal obligations.

12. International Data Transfers

We are based in the United States. We and our providers may process information in countries other than your own, including the United States.

Where required, we use legally recognized transfer mechanisms.

13. Your Privacy Rights

Subject to local law, you may have rights to:

• Access personal information
• Correct inaccurate personal information
• Delete certain personal information
• Restrict/object to certain processing
• Request portability of applicable data
• Withdraw consent where processing is based on consent

To exercise rights, contact support@systalog.ai. We may verify identity before fulfilling requests.

13.1 How to Make a Request

• Email support@systalog.ai from the email address on your account, with "Privacy request" in the subject. Tell us which product you use and what you want: a copy of your data, a correction, or deletion.
• In GemFit you can also export your logs as CSV files from Reports and delete your account in the app.
• We may ask you to confirm your identity, usually by confirming control of your account email, before we act. We will not ask for more information than we need.
• You can use an authorized agent. We may ask for proof that you gave the agent permission and ask you to confirm your identity with us directly.
• We respond within the time the law requires, usually within 45 days, and we will tell you if we need more time.
• If we decline your request, we will explain why. You can appeal by replying to our decision with "Appeal" in the subject line, and we will answer within the time the law requires. If you are not satisfied, you can contact your state attorney general or your local data protection authority.
• We will not treat you differently for using your privacy rights.
• If your information is held for a business customer (see section 1), we will pass your request to that business or help it respond.

13.2 U.S. State Privacy Rights

Depending on where you live (for example California, Colorado, Connecticut, Oregon, Texas, Utah, Virginia, and other states with privacy laws), you may have the right to:

• Know what personal information we hold about you and get a copy in a portable format
• Correct inaccurate personal information
• Delete personal information
• Opt out of the sale of personal information, targeted advertising, and profiling that produces legal or similarly significant effects. We do not sell personal information for money, and we do not use personal information for that kind of profiling. To turn off Microsoft Advertising measurement on our websites, choose "Essential only" in the cookie banner.
• Appeal our decision on your request, as described in 13.1

14. California Privacy Notice

California residents may have rights under CCPA/CPRA, including rights to know, access, delete, correct, and limit use/disclosure of sensitive personal information, subject to legal exceptions.

Where required by law, we provide notice and applicable opt-out/limitation controls through available request channels.

Categories we collect. In the last 12 months we have collected these categories of personal information, from the sources and for the purposes described in sections 3 and 4:

• Identifiers, such as name, email, phone, account ID, and IP address
• Customer records and commercial information, such as billing details, purchases, and subscriptions
• Internet or network activity, such as pages viewed, interactions, and device and browser details
• Geolocation: approximate region for GemFit social eligibility, and precise location for K9Codex when you allow it
• Audio, electronic, and visual information, such as photos and videos you upload
• Professional or employment information, such as job candidate records that business customers keep in Talent Manager
• Inferences, such as AI estimates, match scores, and recommendations
• Sensitive personal information: account login credentials, precise geolocation in K9Codex, and health information you enter into GemFit

How we disclose it. We disclose each category to the service providers in section 6.1 and to the other recipients in section 6, for the business purposes in section 4. We do not sell personal information for money. If you allow analytics on our websites, Microsoft Advertising receives information about your visit (section 8). You can turn that off by choosing "Essential only" in the cookie banner.

Sensitive personal information. We use sensitive personal information only to provide the Services you request, keep accounts secure, and meet legal obligations.

Retention. Section 9 explains how long we keep information.

You may submit requests at support@systalog.ai. Section 13.1 explains verification, authorized agents, and appeals.

15. Children

GemFit.ai accounts are not available to users under 13. GemFit.ai social, direct messaging, public discovery, posting, media sharing, and progress-photo sharing features are intended for adults only and may require age, state, and eligibility checks. GemFit users aged 13 to 17 need permission from a parent or legal guardian and can use only private tracking features.

Other SYSTALOG services may have different age or account requirements depending on the product and customer agreement. K9Codex, SYSTALOG Websites, and our business software are intended for adults. We do not knowingly collect personal information directly from children under 13. If we learn we collected personal information from a child in violation of applicable law, we will take steps to delete it.

16. Third-Party Sites and Services

Our Services may contain links or integrations to third-party sites/services. Their privacy practices are governed by their own policies, not this Policy.

This includes websites our customers publish, and accounts or services you connect, such as Apple Health, an AI assistant, or a customer's Google, Microsoft, or Slack account.

17. Changes to This Policy

We may update this Privacy Policy from time to time. Updated versions are effective when posted unless otherwise stated.

We will update the Effective Date for material revisions. If a change is material, we will also update the dates at the top and, where the law requires, notify you by email or in the app before the change takes effect.

18. Contact

For privacy questions or requests:

• Email: support@systalog.ai (use "Privacy request" in the subject for requests under section 13)
• Website: https://www.systalog.ai
• Company: Systems Logic & Automation Group LLC, United States
• BlackBox questions: use the contact in the BlackBox Privacy Policy