Privacy Policy

This Privacy Policy explains how NORTH 28 STUDIO LLC ("NORTH 28," "Mencey," "we," "us," or "our") collects, uses, discloses, and protects personal information when you visit mencey.co, use the Mencey platform, communicate with us, or otherwise interact with our services (collectively, the "Services").

For account, billing, website, and direct business relationship information, NORTH 28 generally acts as the controller or business. When a customer uploads, imports, connects, or otherwise submits information to a Mencey workspace ("Customer Content"), the customer generally determines the purposes and means of processing and NORTH 28 acts as its processor or service provider. Questions about Customer Content should first be directed to the customer that controls the relevant workspace.

Depending on how you use the Services, we may collect:

• Account and profile information, such as your name, work email, organization, role, avatar, authentication identifiers, and workspace membership.
• Customer Content, including contacts, companies, leads, projects, tasks, messages, calendar entries, documents, signatures, invoices, notes, files, prompts, AI outputs, and workflow data.
• Business and public-record information, such as company filings, principals, business addresses, domains, and other information obtained from public registries, public websites, our customers, or their authorized sources.
• Communications, including support requests, demo inquiries, feedback, and messages sent through connected inboxes or support channels.
• Billing and transaction information, such as plan, subscription, invoice, payment status, and limited payment metadata. Payment providers process full payment-card details on our behalf; we do not need to store full card numbers.
• Integration information, including account identifiers, authorization tokens or encrypted credentials, settings, and data exchanged with services you choose to connect. Bring-your-own-key features may process credentials you provide solely to enable the selected integration.
• Usage and device information, such as IP address, browser and device type, timestamps, pages or features used, diagnostic events, security logs, and cookie or similar-technology data.

We collect information directly from you and your organization, automatically from your use of the Services, from integrations you authorize, and from public or commercially available sources used to provide company intelligence.

We use personal information to:

• provide, maintain, personalize, and improve the Services;
• authenticate users and administer accounts, workspaces, roles, and permissions;
• operate discovery, CRM, communications, workflow, document, AI, and billing features;
• process transactions and provide subscription and service notices;
• respond to inquiries, support requests, and feedback;
• monitor reliability, debug problems, prevent fraud, and protect the Services;
• comply with law, enforce our agreements, and establish or defend legal claims;
• send product or marketing communications where permitted by law; and
• create aggregated or de-identified information that cannot reasonably identify you.

We do not use Customer Content to train general-purpose AI models unless the relevant customer has expressly enabled or requested that use.

Where the laws of the European Economic Area, United Kingdom, or Switzerland apply, we process personal information when necessary to perform a contract with you; pursue legitimate interests such as operating, securing, and improving the Services; comply with legal obligations; protect vital interests; or based on consent. Where we rely on consent, you may withdraw it at any time without affecting earlier processing.

We may disclose information to:

• Your organization and workspace users according to configured roles, permissions, sharing settings, and public links.
• Service providers that support hosting, databases, authentication, storage, email delivery, subscription billing, AI processing, security, and support.
• Connected services when you or your organization enables an integration or directs us to exchange information with a third party.
• Professional advisers and authorities when reasonably necessary to comply with law, protect rights and safety, prevent abuse, or resolve disputes.
• Transaction participants in connection with a merger, financing, acquisition, reorganization, or sale of all or part of our business, subject to appropriate confidentiality protections.

We do not sell personal information for money. We also do not share personal information for cross-context behavioral advertising as those terms are defined by applicable U.S. state privacy laws.

Mencey may send prompts, Customer Content, website content, or other inputs to an AI provider selected by us or configured by your organization. Outputs may be inaccurate and should be reviewed by a person before use. Mencey is designed to assist business workflows and does not make decisions that produce legal or similarly significant effects about individuals on our own behalf. Customers are responsible for evaluating their own uses of AI, profiling, and automated decision-making.

We retain personal information for as long as needed to provide the Services, maintain the business relationship, meet legal and accounting requirements, resolve disputes, enforce agreements, and protect the Services. Retention varies by the type of data, workspace settings, contract terms, and applicable law. After deletion or account closure, information may remain for a limited period in backups or where retention is required or permitted by law. Aggregated or de-identified information may be retained without time limit where lawful.

Mencey is not currently offered as a HIPAA-ready service and NORTH 28 does not currently represent that Mencey may be used to create, receive, maintain, or transmit protected health information ("PHI"). Do not submit PHI unless we have expressly approved the use in writing and entered into any required business associate agreement.

A general reference to security practices or a private assessment is not an HHS certification of HIPAA compliance. Any future support for regulated health data will be described in the applicable contract and security documentation.

NORTH 28 is based in the United States, and we and our service providers may process information in the United States and other countries. Where required, we use recognized transfer mechanisms and safeguards, such as standard contractual clauses, or rely on another lawful transfer basis.

We use administrative, technical, and organizational measures designed to protect personal information, including access controls and tenant-scoped data handling. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. You are responsible for safeguarding account credentials, configuring access appropriately, and notifying us promptly of suspected unauthorized use.

We use cookies and similar technologies that are necessary to authenticate users, maintain sessions, remember preferences, secure the Services, and understand basic service operation. If we introduce non-essential advertising or analytics technologies, we will provide any choices or consent mechanisms required by law.

You can unsubscribe from marketing email using the link in the message or by contacting us. We may still send transactional, security, billing, and other service-related notices.

Depending on where you live, you may have rights to access, know, correct, delete, restrict, or obtain a portable copy of personal information; object to or opt out of certain processing; withdraw consent; appeal a denied request; and receive equal service without unlawful discrimination. You may also have the right to lodge a complaint with a data protection authority.

To exercise a right, email hello@mencey.co and describe your request. We may verify your identity and authority before acting. An authorized agent may submit a request where permitted by law. If information belongs to a customer-controlled workspace, we may direct the request to that customer or assist it in responding.

In the preceding 12 months, we may have collected the categories described in Section 2: identifiers; customer records; commercial information; internet or network activity; approximate location inferred from IP address; professional information; and inferences generated to provide company intelligence or workspace features. We collect, use, retain, and disclose these categories for the business purposes described in this Policy.

We do not knowingly sell or share personal information for cross-context behavioral advertising, and we do not knowingly sell or share personal information of anyone under 16. If our practices change, we will update this Policy and provide required opt-out methods, including recognition of applicable universal opt-out preference signals.

The Services are intended for business users and are not directed to children under 18. We do not knowingly collect personal information directly from children through account registration. If you believe a child has provided personal information to us, contact us so we can review and take appropriate action.

We may update this Policy from time to time. We will post the revised version with a new "Last updated" date and provide additional notice when required by law. Material changes apply prospectively unless otherwise stated or agreed.

Questions, requests, and appeals may be sent to: