Equanimo Privacy Policy

1. Introduction and Scope

Equanimo ("Equanimo," "we," "us," or "our") provides an enterprise AI governance, knowledge-security, and sovereignty platform, including the Equanimo AI Cockpit, Policy Engine, prompt and AI-usage monitoring capabilities, Tacit Knowledge Protection, browser-based tools and extensions (including the AI Prompt Collector), desktop tools, APIs, connectors, and related services (collectively, the "Services").

This Privacy Policy explains how we collect, use, disclose, retain, transfer, and protect personal data in connection with the Services, our website, and our business operations. It applies to:

• Visitors to our website and people who contact us.
• Prospective and current customers and their authorized representatives.
• Authorized end users within customer organizations whose use of AI tools is governed, monitored, or logged through the Services at the direction of their organization.
• Vendors, partners, contractors, job applicants, and our workforce, to the extent applicable.

Customer-controlled data. When Equanimo processes personal data on behalf of an enterprise customer—for example, to monitor, evaluate, redact, block, route, or log AI interactions under that customer's instructions—the customer generally determines the purposes and means of that processing and Equanimo acts as a processor, service provider, or contractor as applicable. The customer's agreement and Data Processing Addendum (DPA) govern that processing. Individuals should ordinarily direct requests concerning customer-controlled data to the organization that provided their access to the Services.

This Policy also describes Equanimo's practices when we act as a controller or business for personal data we collect for our own purposes, such as website, sales, account-administration, recruiting, security, and business operations.

2. Who We Are and How to Contact Us

Equanimo is based in Cambridge, Massachusetts, USA.

For privacy questions or requests, contact:

Email: privacy@equanimo.ai

Grievance Officer (India, Digital Personal Data Protection Act, 2023): Narayanan Palissery, privacy@equanimo.ai, is designated as the Grievance Officer responsible for addressing grievances raised by data principals under the DPDP Act.

If Equanimo formally appoints a Data Protection Officer under applicable law, the contact information for that role will be published here. References in this Policy to our Privacy Officer or Grievance Officer do not by themselves represent that appointment of a statutory Data Protection Officer is required.

3. Personal Data We Collect

The personal data we collect depends on the relationship, deployment, customer configuration, and features used. Categories may include:

• Website and communications data: name, business email, company, job title, information submitted through forms or correspondence, IP address, browser/device information, pages viewed, timestamps, and cookie or similar-technology data where used.
• Account and identity data: name, business email, organization or tenant identifier, role, user principal identifier, authentication identifiers or tokens, and access-control information.
• AI interaction and governance data: prompts, instructions, AI-generated outputs, policy decisions, risk classifications, redaction or enforcement events, AI tool or model identifiers, URLs or application context, timestamps, and related audit evidence where configured by a customer.
• Browser extension data: prompt or interaction content submitted to supported AI tools, relevant page or application context, tenant information, pseudonymous or hashed device/browser identifiers, user identifiers, and operational telemetry, as described in the applicable extension notice and customer configuration.
• Desktop and endpoint telemetry: activity and usage logs associated with governed AI tools on a monitored device, where deployed by a customer organization.
• Customer and prospect data: business contact details, account information, support communications, onboarding information, and commercial relationship records.
• Security and diagnostic data: authentication events, audit logs, IP addresses, device or session information, system events, error logs, and security telemetry.
• Workforce and applicant data: identity and contact details, resumes and application information, employment records, payroll and tax information, and other information needed for workforce administration.

Sensitive information. Equanimo does not design the Services for the intentional collection of health information, biometric identifiers, financial account credentials, cardholder data, children's data, or other highly sensitive personal data unless a customer has expressly configured an authorized use case. Because enterprise users may enter sensitive or special-category information into AI systems, such information can incidentally appear in monitored prompts, outputs, or contextual data. Where that occurs, Equanimo processes it subject to customer instructions, contractual restrictions, access controls, and applicable law.

Sources. We may obtain personal data directly from you; from the organization that provides you access to the Services; from your browser, device, or configured enterprise applications; from service providers acting on our behalf; and from business partners or publicly available professional sources in connection with legitimate business development activities.

4. How We Use Personal Data

Depending on our role and the applicable deployment, we use personal data to:

• Provide, operate, maintain, configure, support, and secure the Services.
• Apply customer-defined AI governance and knowledge-security policies, including inspection, classification, redaction, blocking, routing, logging, escalation, and creation of audit evidence.
• Authenticate users, administer accounts, enforce permissions, and prevent unauthorized access or abuse.
• Respond to inquiries, provide support, conduct onboarding, and manage customer and partner relationships.
• Monitor performance, troubleshoot, maintain reliability, and improve the safety and functionality of the Services.
• Maintain security logs, investigate incidents, detect fraud or misuse, and protect Equanimo, our customers, users, and others.
• Manage recruiting, workforce administration, payroll, and legal obligations.
• Comply with law, enforce agreements, establish or defend legal claims, and support corporate transactions.

Customer content and model training. Equanimo will process customer-controlled prompt and output content only as permitted by the applicable customer agreement, DPA, product configuration, and documented customer instructions. Any use of customer-controlled content for product improvement, model training, or similar secondary purposes must be consistent with those governing terms and applicable law. Customers should review their agreement and deployment documentation for the controls applicable to their environment.

5. Legal Bases for Processing

Where a law requires a legal basis for processing, the basis depends on the context and our role. It may include:

• Performance of a contract or steps requested before entering into a contract.
• Legitimate interests, such as operating and securing our business and Services, improving reliability, responding to business inquiries, and protecting against misuse, where those interests are not overridden by individual rights.
• Consent, where consent is required and appropriate.
• Compliance with legal obligations.
• Other lawful bases or permitted uses available under applicable privacy law.

For personal data subject to the EU GDPR or UK GDPR, we apply the legal bases required by those laws. For personal data subject to India's Digital Personal Data Protection Act, 2023 and implementing rules as they become applicable, we process personal data based on consent or another lawful or permitted use recognized by that framework, as applicable.

6. Enterprise Monitoring and Automated Processing

The Services are designed to help enterprise customers govern the use of AI systems. Depending on customer configuration, the Services may automatically inspect AI prompts, outputs, contextual signals, and policy rules to generate risk indicators or to allow, block, redact, route, log, or escalate an AI interaction.

Equanimo provides the technology and executes customer-configured policies; the customer is responsible for determining whether and how monitoring is deployed to its workforce, providing notices required by employment or privacy law, establishing an appropriate legal basis, and configuring policies consistent with applicable law.

The Services are not intended, by themselves, to make hiring, termination, compensation, promotion, credit, insurance, housing, or other legally significant decisions about individuals. If a customer uses outputs from the Services in a process that may have legal or similarly significant effects, that customer is responsible for evaluating and satisfying any additional transparency, human-review, risk-assessment, opt-out, or other requirements that apply. Equanimo will support contractual obligations applicable to its role.

7. How We Disclose Personal Data

We do not sell personal data for monetary consideration. We disclose personal data only as reasonably necessary for the purposes described in this Policy, including to service providers and subprocessors that support our operations and customer deployments.

The specific subprocessors used for a customer may depend on deployment architecture, region, contract, and enabled features. Where required, subprocessors are subject to contractual confidentiality, security, and data-protection obligations. A current customer-facing subprocessor list is maintained and made available through Equanimo's website, trust center, customer documentation, or on request.

We may also disclose personal data to professional advisers; regulators, courts, or law-enforcement authorities where legally required; to protect rights, safety, and security; or in connection with a merger, financing, acquisition, reorganization, or sale of assets, subject to appropriate protections.

8. International Data Transfers

Equanimo is based in the United States and may use personnel and service providers located in other countries. Personal data therefore may be transferred to or processed in jurisdictions different from the jurisdiction in which it was collected, subject to customer configuration and contractual requirements.

Where applicable law restricts an international transfer, Equanimo will use an appropriate transfer mechanism and supplementary safeguards as required. For transfers subject to the EU GDPR or UK GDPR, these may include an adequacy decision, the European Commission's Standard Contractual Clauses, the UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses, as applicable. Customer-specific data residency and transfer commitments are governed by the applicable customer agreement and DPA.

9. Data Retention

We retain personal data only for as long as reasonably necessary for the purposes described in this Policy, to meet contractual commitments, and to satisfy legal, accounting, security, and compliance obligations. Retention periods vary by data type and context.

• Customer-controlled AI interaction, monitoring, and audit data is retained according to the applicable customer agreement, DPA, product configuration, and customer instructions.
• Security and audit logs are retained according to documented security and compliance requirements; where Equanimo commits to a specific minimum period in a customer contract or control framework, that commitment governs.
• Business, tax, payroll, workforce, and applicant records are retained for periods required or permitted by applicable law and legitimate business needs.
• When retention is no longer required, we delete, de-identify, or anonymize personal data, subject to technical limitations, backup cycles, legal holds, and applicable law.

10. Your Privacy Rights

Depending on where you live and the law that applies, you may have rights concerning your personal data, such as access, correction, deletion, portability, restriction, objection, withdrawal of consent, or rights relating to certain automated processing. Rights are subject to legal conditions and exceptions.

If Equanimo processes your data on behalf of an enterprise customer, please submit your request to that customer where practicable. We will assist the customer as required by our DPA and applicable law. For data for which Equanimo acts as controller or business, contact privacy@equanimo.ai.

EU/UK. Where the GDPR or UK GDPR applies, you may have rights to access, rectify, erase, restrict processing, receive portable data, object to certain processing, withdraw consent where processing is based on consent, and complain to the competent supervisory authority.

India. Where India's Digital Personal Data Protection framework applies, you may have rights provided under that framework, including access to prescribed information, correction and erasure, grievance redressal, and nomination, subject to the Act, implementing rules, commencement provisions, and applicable exceptions. Grievances may be directed to our Grievance Officer identified in Section 2.

California and other U.S. states. Where a U.S. state privacy law applies to Equanimo and to the relevant personal information, residents may have rights such as access/knowledge, correction, deletion, portability, and rights to opt out of certain sales, sharing, targeted advertising, profiling, or uses of sensitive personal information, depending on the state and processing involved.

California applicability. The CCPA applies only when statutory applicability requirements are met. If Equanimo is subject to the CCPA for a particular activity, we will provide the disclosures, request methods, opt-out mechanisms, and other protections required by then-current California law. Equanimo does not currently describe ordinary customer disclosures to contracted service providers or processors as a "sale" merely because data is processed to provide contracted services; legal classification depends on the actual arrangement and applicable law.

We will verify and respond to requests within the period required by applicable law. Authorized agents may submit requests where permitted. We will not unlawfully discriminate against an individual for exercising applicable privacy rights.

11. Cookies and Similar Technologies

Our website (equanimo.ai) uses cookies and similar technologies to distinguish you from other visitors, support core site functionality, and help us understand how the site is used. By continuing to browse the site, you are agreeing to our use of strictly necessary cookies as described below; any non-essential cookie will only be set with your consent.

A cookie is a small file of letters and numbers that we store on your browser or device. We categorize the cookies and similar technologies used on equanimo.ai as follows:

• Strictly necessary cookies: required for the website to function (e.g., basic session and security cookies set by our website platform). These do not require consent and cannot be disabled without affecting core site functionality.
• Analytics cookies: used, where enabled, to understand site traffic and visitor behavior so we can improve the website. As of the effective date of this Policy, equanimo.ai does not have an analytics or tag-management service (e.g., Google Analytics, Google Tag Manager) implemented. If one is added in the future, this section will be updated to name the specific tool(s) used, and a cookie consent mechanism will be implemented before any such non-essential cookies are set.
• Marketing/advertising cookies: used, where enabled, to measure advertising performance or personalize ads (e.g., via services such as Google Ads, LinkedIn Ads, or similar platforms). As of the effective date of this Policy, equanimo.ai does not use any advertising or marketing tracking technologies. If this changes, we will name the specific platforms used and provide a cookie consent banner with the ability to accept, decline, or manage preferences for non-essential cookies before they are set.

A current, specific list of cookies and similar technologies in use on equanimo.ai, if any beyond strictly necessary cookies, is available on request from privacy@equanimo.ai and will be reflected in an updated version of this section once implemented.

12. Children's Data

The Services are intended for enterprise and business use and are not directed to children. We do not knowingly collect personal data from children through our own website or direct business operations. If we learn that we collected children's personal data in circumstances requiring deletion or parental authorization, we will take appropriate action.

Customers are responsible for determining whether their use of the Services involves children or minors and for ensuring that any such deployment is lawful and contractually authorized.

13. Security

We maintain administrative, technical, and organizational safeguards designed to protect personal data against unauthorized access, use, alteration, disclosure, or destruction. Depending on the environment and deployment, safeguards may include role-based access controls, authentication, encryption in transit and at rest, vulnerability management, security logging and monitoring, incident-response procedures, tenant isolation, least-privilege access, and restricted access to monitored AI content.

Our security program is informed by recognized security and assurance practices, including controls relevant to SOC 2. References to a framework do not constitute a representation of certification unless Equanimo has obtained and is maintaining that certification.

No method of transmission, processing, or storage is completely secure, and we cannot guarantee absolute security.

14. Personal Data Breaches

We maintain incident-response procedures for identifying, assessing, containing, investigating, and remediating security incidents. If a personal data breach occurs, we will notify affected customers, individuals, regulators, or other parties when and within the timeframes required by applicable law and our contractual commitments.

Where Equanimo acts as a processor or service provider, breach notification to individuals or regulators may be handled by the customer as controller/business, with Equanimo providing required information and cooperation under the applicable DPA.

15. Third-Party Services and Links

Our website and Services may link to or interoperate with third-party websites, AI tools, applications, or services. Their privacy practices are governed by their own notices and agreements. Equanimo is not responsible for a third party's independent privacy practices except to the extent applicable law or a contract assigns Equanimo responsibility.

16. Changes to This Policy

We may update this Privacy Policy to reflect changes in our Services, data practices, legal requirements, or business operations. We will post the revised version with an updated effective date. Where required by law or contract, we will provide additional notice of material changes.

Effective date / last updated: September 19, 2026

17. Contact Us

Questions, requests, or complaints concerning this Privacy Policy or Equanimo's privacy practices may be sent to:

Equanimo One Broadway, Cambridge, Massachusetts, USA

Email: privacy@equanimo.ai

The Equanimo browser extension (AI Prompt Collector) is presented with its own extension-specific notice at installation, consistent with Chrome Web Store requirements. That notice identifies the exact data and permissions used by the current extension version and should be read alongside this Policy; where the two conflict, the extension-specific notice governs collection through the extension.