This Privacy Policy explains how Redwane Studio LLC, doing business as Pegasy (“Pegasy,” “we,” “us,” or “our”), collects, uses, stores, protects, and shares personal information when you:

• visit pegasy.io;
• create or use an account on pegasy.app;
• connect a Google or Gmail account;
• create campaigns or generate creative content;
• use Pegasy’s discovery, asset, motion, messaging, or outreach features;
• contact our support team; or
• otherwise interact with our services.

Pegasy is a business-to-business platform intended for freelancers, studios, agencies, micro-businesses, and other professional users.

1. Who we are

The entity responsible for the personal information described in this Privacy Policy is:

Redwane Studio LLC
30 N Gould St, Ste R
Sheridan, WY 82801
United States

Email: support@pegasy.io

2. Scope of this Privacy Policy

This Privacy Policy applies to Pegasy’s:

• marketing website;
• web application;
• APIs;
• campaign and discovery tools;
• creative and motion-generation services;
• Google and Gmail integrations;
• billing and subscription services;
• support communications; and
• related services.

This Privacy Policy does not apply to third-party websites, applications, platforms, or services that operate independently from Pegasy and maintain their own privacy policies.

3. Our role when processing information

Pegasy may process personal information in different capacities depending on the circumstances.

We generally act as a controller when we process information to:

• create and manage Pegasy accounts;
• authenticate users;
• operate and secure the platform;
• manage subscriptions and payments;
• communicate with users;
• provide customer support;
• prevent fraud and abuse; and
• comply with legal obligations.

When a customer uses Pegasy to manage prospect information, campaign content, connected Gmail conversations, uploaded files, or outreach activity, Pegasy may process that information on the customer’s behalf as a service provider or processor.

Customers remain responsible for ensuring that their campaigns, prospect lists, outreach activity, and use of personal information comply with applicable privacy, electronic communications, direct marketing, and anti-spam laws.

4. Information we collect

4.1 Account and profile information

When you create or manage a Pegasy account, we may collect:

• your name;
• professional email address;
• password hash;
• Google account identifier;
• profile picture;
• preferred language;
• account role and permissions;
• workspace memberships;
• onboarding information;
• account and workspace preferences;
• account creation date;
• login timestamps; and
• account activity information.

Pegasy does not store passwords in plain text.

4.2 Workspace and team information

When you create, join, or manage a workspace, we may collect:

• workspace name;
• organization or business name;
• workspace logo;
• workspace owner;
• workspace members;
• member email addresses;
• roles and permissions;
• invitation details;
• connected services;
• usage and quota information;
• billing plan; and
• workspace configuration.

Workspace information is logically separated so users may only access workspaces for which they have been granted permission.

4.3 Campaign and creative information

When you use Pegasy, we may process:

• campaign names and descriptions;
• selected markets, industries, niches, and locations;
• targeting criteria;
• campaign briefs;
• discovery preferences;
• source preferences;
• selected templates;
• brand and creative directions;
• messaging angles;
• tone and positioning preferences;
• offers and campaign instructions;
• uploaded logos, images, files, and design references;
• user feedback and regeneration requests;
• generated hooks, messages, images, and videos;
• selected or rejected assets;
• asset source and quality information;
• approval and review decisions;
• campaign status;
• workflow history; and
• campaign usage information.

Campaign information may contain personal information when you or another user includes it in a campaign brief, message, file, or creative instruction.

4.4 Business and prospect information

Pegasy helps customers identify businesses and prepare personalized professional outreach.

We may collect or process publicly available or customer-provided information about businesses and professional contacts, including:

• business name;
• company website;
• publicly available web pages;
• business category or industry;
• business address and location;
• public business telephone number;
• public professional email address;
• social media profiles and handles;
• publicly listed professional contacts;
• names of business owners, founders, employees, or representatives;
• professional roles and job titles;
• logos;
• website images;
• product or portfolio images;
• public business descriptions;
• source URLs;
• public ratings or business information;
• inferred business category;
• campaign relevance;
• qualification scores;
• asset suitability;
• visual-readiness information; and
• other campaign-related classifications.

This information may be obtained from:

• public business websites;
• search engines and search providers;
• business directories;
• Google services;
• social platforms;
• public professional profiles;
• customer-provided lead lists; and
• other publicly accessible professional sources.

Pegasy is not designed to collect sensitive personal information about prospects, such as medical information, religious beliefs, political opinions, precise personal location, or other highly sensitive personal attributes.

4.5 Information imported by customers

Customers may upload or provide information to Pegasy, including:

• lead lists;
• business contact details;
• campaign instructions;
• custom templates;
• creative references;
• logos;
• images;
• videos;
• files;
• email content; and
• other campaign materials.

Customers are responsible for ensuring that they have the necessary rights and lawful basis to upload and use this information.

4.6 Google Sign-In information

When you use Continue with Google, Pegasy requests only the Google account information required to authenticate you and create or access your Pegasy account.

This may include:

• your Google OpenID identifier;
• email address;
• email verification status;
• basic profile information; and
• profile picture, where available.

Using Google Sign-In does not automatically connect your Gmail account.

Google Sign-In and Gmail authorization are separate actions.

4.7 Gmail information

Connecting Gmail is optional and requires separate authorization by the user.

When you explicitly connect Gmail, Pegasy may request the following Google OAuth permissions:

• gmail.compose; and
• gmail.readonly.

These permissions allow Pegasy to provide user-facing email features such as:

• creating Gmail drafts;
• sending messages that the user has reviewed or approved;
• associating Gmail messages with Pegasy campaigns;
• displaying the status of campaign messages;
• identifying replies to Pegasy-originated campaign threads;
• maintaining the relationship between a Pegasy campaign and its Gmail thread.

Depending on the feature used, Pegasy may access or store limited Gmail information such as:

• the connected Gmail address;
• OAuth scopes;
• connection status;
• encrypted access and refresh tokens;
• Gmail message identifiers;
• Gmail draft identifiers;
• Gmail thread identifiers;
• sender and recipient addresses;
• subject lines;
• message headers;
• timestamps;
• draft, sent, or reply status;
• content from Pegasy-originated campaign messages; and
• replies contained within the relevant Pegasy campaign thread.

Pegasy does not use Gmail access to index, mine, profile, or analyze the rest of your inbox.

Reply detection and conversation access are limited to email threads created through, associated with, or explicitly selected within a Pegasy campaign.

4.8 Billing and subscription information

Payments and subscriptions are processed through Stripe.

Stripe may collect payment information directly from you, including:

• payment card details;
• billing address;
• tax information;
• business identity information; and
• other information required to process payments.

Pegasy generally receives and stores only limited billing information, such as:

• Stripe customer identifier;
• subscription identifier;
• selected plan;
• billing interval;
• subscription status;
• invoice status;
• payment status;
• billing contact information;
• applicable tax information; and
• limited payment-method metadata made available by Stripe.

Pegasy does not store complete payment card numbers or card security codes.

4.9 Communications and support information

When you contact Pegasy, we may collect:

• your name;
• email address;
• company or workspace name;
• subject of your request;
• content of your message;
• attachments;
• technical information relevant to the issue; and
• previous communications with our support team.

4.10 Technical and usage information

When you use Pegasy, we may automatically collect limited technical information necessary to operate, secure, and maintain the Service, including:

• IP address;
• browser type;
• device information;
• operating system;
• pages and features accessed;
• login and session events;
• request timestamps;
• API usage;
• error information;
• diagnostic logs;
• security events;
• abuse-prevention events;
• campaign usage;
• quotas and usage limits; and
• identifiers stored through cookies, local storage, or similar technologies.

We use essential technologies to:

• authenticate users;
• maintain sessions;
• remember preferences;
• secure accounts;
• prevent abuse; and
• operate the Service.

Any non-essential analytics or similar technologies will be described in our Cookies Policy and, where required by law, used only after consent.

5. How we use information

We may use personal information to:

• provide and maintain Pegasy;
• create and authenticate user accounts;
• manage workspaces and permissions;
• connect authorized third-party services;
• process campaign briefs;
• identify and qualify relevant businesses;
• generate search and discovery strategies;
• find and evaluate creative assets;
• generate personalized hooks, messages, and videos;
• prepare user-requested Gmail drafts;
• send messages approved by the user;
• detect replies to Pegasy campaign threads;
• provide campaign and inbox functionality;
• provide notifications;
• manage subscriptions and billing;
• enforce usage limits;
• respond to support requests;
• monitor service performance;
• diagnose errors;
• prevent fraud and unauthorized access;
• enforce our Terms of Service;
• comply with legal obligations; and
• improve the reliability and usability of Pegasy.

Pegasy does not sell personal information.

Pegasy does not use personal information for third-party behavioral advertising.

6. Legal bases for processing

Where the General Data Protection Regulation, UK GDPR, or similar laws apply, we rely on one or more of the following legal bases.

6.1 Performance of a contract

We process information where necessary to:

• provide the Service;
• create and manage accounts;
• operate campaigns;
• process subscriptions;
• provide requested integrations; and
• perform our agreement with you.

6.2 Legitimate interests

We may process information where necessary for legitimate business interests, including:

• operating and securing Pegasy;
• preventing fraud and misuse;
• providing B2B campaign discovery;
• maintaining reliable business information;
• improving the platform;
• supporting customers; and
• protecting our legal rights.

When relying on legitimate interests, we consider the nature of the information, the context of the processing, and the rights and expectations of the individuals concerned.

6.3 Consent

We rely on consent where required, including for:

• optional Google or Gmail connections;
• OAuth permissions;
• certain cookies or analytics technologies; and
• other optional processing that requires consent.

You may withdraw consent at any time.

Withdrawal does not affect the lawfulness of processing that occurred before consent was withdrawn.

6.4 Legal obligations

We may process or retain information where necessary to comply with:

• tax obligations;
• accounting requirements;
• regulatory obligations;
• court orders;
• lawful government requests; and
• other legal requirements.

7. Artificial intelligence processing

Pegasy uses artificial intelligence service providers to deliver user-facing features such as:

• structuring campaign briefs;
• generating campaign strategies;
• qualifying professional prospects;
• evaluating asset suitability;
• analyzing selected images;
• generating creative copy;
• preparing personalized outreach;
• generating video text;

Depending on the feature requested, information sent to an AI provider may include:

• campaign instructions;
• market and location information;
• public business information;
• website text;
• selected image previews;
• campaign assets;
• generated content;
• user feedback; and

Pegasy limits AI inputs to information reasonably necessary to provide the requested functionality.

Pegasy does not use Customer Content or Google User Data to train generalized or non-personalized artificial intelligence models.

AI-generated outputs may be inaccurate, incomplete, or unsuitable.

Users are responsible for reviewing and approving generated messages, creative materials, and outreach content before they are used or sent.

Depending on the feature requested, information sent to an AI provider may include:

- campaign instructions;
- market and location information;
- public business information;
- website text;
- selected image previews;
- campaign assets;
- generated content; and
- user feedback.

Pegasy does not transmit Google User Data, Gmail message content, Gmail replies, or Gmail conversation threads to artificial intelligence providers.

Pegasy limits AI inputs to information reasonably necessary to provide the requested non-Gmail campaign and creative functionality.

Pegasy does not use Customer Content or Google User Data to train generalized or non-personalized artificial intelligence models.

‍

8. Google User Data and Limited Use

8.1 Separate authorization

Google Sign-In and Gmail access are separate.

Google Sign-In requests only the identity information necessary to authenticate the user.

Gmail access is requested only when an authenticated user explicitly chooses to connect a Gmail account.

8.2 How Google User Data is used

Information received from Google APIs is used only to provide and improve prominent, user-facing Pegasy features requested by the user, including:

• authenticating users;
• connecting an authorized Gmail account;
• creating Gmail drafts;
• sending user-approved messages;
• associating Gmail messages with Pegasy campaigns;
• displaying message and reply status;
• detecting replies to Pegasy-originated campaign threads; and

Pegasy does not transmit Google User Data or Gmail conversation content to artificial intelligence providers.

Information received from Google APIs is used only to provide prominent, user-facing Pegasy features requested by the user, including:

- authenticating users;
- connecting an authorized Gmail account;
- creating Gmail drafts;
- sending user-approved messages;
- associating Gmail messages with Pegasy campaigns;
- displaying message and reply status; and
- detecting replies to Pegasy-originated campaign threads.

Pegasy does not transmit Google User Data or Gmail conversation content to artificial intelligence providers.

‍

8.3 Google Limited Use compliance

Pegasy’s use and transfer of information received from Google APIs to any other application will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Pegasy does not:

• sell Google User Data;
• rent Google User Data;
• transfer Google User Data to advertising platforms;
• transfer Google User Data to data brokers or information resellers;
• use Google User Data for advertising;
• use Google User Data for retargeting;
• use Google User Data for personalized or interest-based advertising;
• use Google User Data to determine creditworthiness;
• use Google User Data for lending purposes;
• use Google User Data to train or improve generalized or non-personalized artificial intelligence models;
• use Google User Data for purposes unrelated to the user-facing Gmail features described in this Privacy Policy; or
• allow humans to read Google User Data except in the limited circumstances described below.

Google User Data is not used for general product analytics, lead enrichment, business discovery, advertising, or the development or improvement of Pegasy features unrelated to the Gmail functionality requested by the user.

Human access to Google User Data is permitted only where:

• the user has provided affirmative consent for specific data to be viewed;
• access is necessary to investigate a security incident;
• access is necessary to resolve a technical support issue;
• access is necessary to investigate fraud or abuse;
• access is required by applicable law; or
• the information has been aggregated and anonymized for legitimate internal operations.

Google User Data may be shared with service providers acting on our behalf only where necessary to provide a user-facing Pegasy feature requested by the user.

Such providers are subject to confidentiality, security, contractual, and data-use restrictions.

8.4 Gmail token security

Gmail OAuth access and refresh tokens are encrypted at rest using AES-256-GCM.

Google client secrets and unencrypted OAuth credentials are maintained on Pegasy’s backend systems and are not exposed through the public frontend.

Pegasy does not include Gmail access or refresh tokens in campaign payloads, user-facing responses, or application logs.

8.5 Disconnecting Gmail

Users may disconnect Gmail from Pegasy through their workspace or connection settings.

When Gmail is disconnected:

• Pegasy stops making new Gmail API requests through that connection;
• stored Gmail access and refresh tokens are removed from the active connection;
• Pegasy can no longer create Gmail drafts through that connection;
• Pegasy can no longer send messages through that connection; and
• Pegasy can no longer detect new replies through that connection.

Users may also revoke Pegasy’s access directly through their Google Account permissions.

Disconnecting Gmail does not automatically delete campaign records, message metadata, drafts previously created in Gmail, or records that must be retained for workspace history, security, legal compliance, dispute resolution, or billing.

Users may separately request deletion of eligible personal information.

9. How we share information

Pegasy does not sell personal information.

We may disclose information in the following limited circumstances.

9.1 Service providers

We use service providers to operate and deliver Pegasy.

Depending on the features used, these may include:

• Google for authentication, Gmail functionality, and certain discovery services;
• Supabase for database infrastructure;
• Render for application and API hosting;
• Cloudflare R2 for storing assets and generated files;
• OpenAI for artificial intelligence processing;
• Stripe for subscriptions and payment processing;
• Resend for transactional email delivery;
• rendering infrastructure providers for motion and video generation.

Artificial intelligence providers may process campaign instructions, public business information, selected assets, and user-provided creative content. They do not receive Google User Data or Gmail conversation content.

9.2 Workspace members

Information may be visible to other authorized members of the same workspace, depending on their assigned role and permissions.

Workspace owners and administrators may have access to account, campaign, billing, member, and connected-service information associated with their workspace.

9.3 Legal and safety disclosures

We may disclose information where reasonably necessary to:

• comply with applicable law;
• comply with regulation or legal process;
• respond to a lawful government request;
• protect the security or integrity of Pegasy;
• investigate fraud, abuse, or policy violations;
• protect the rights, property, or safety of Pegasy, our users, or others; or
• establish, exercise, or defend legal claims.

9.4 Business transactions

If Redwane Studio LLC is involved in a merger, acquisition, financing, corporate reorganization, bankruptcy, or sale of all or part of its business or assets, information may be transferred as part of that transaction.

Any such transfer will remain subject to applicable law and appropriate confidentiality protections.

Where Google User Data is involved, any transfer will also remain subject to Google’s Limited Use requirements, including obtaining user consent where required.

10. International data transfers

Redwane Studio LLC is established in the United States.

Pegasy and its service providers may process information in:

• the United States;
• the European Economic Area;
• the United Kingdom; and
• other countries in which our service providers operate.

These countries may have privacy and data protection laws that differ from those in your country.

Where required by applicable law, we use appropriate safeguards for international transfers, which may include:

• data processing agreements;
• contractual protections;
• standard contractual clauses; and
• other recognized transfer mechanisms.

11. Data retention

We retain personal information only for as long as reasonably necessary to:

• provide the Service;
• maintain accounts and workspaces;
• complete requested campaigns;
• provide connected integrations;
• maintain security;
• comply with tax and accounting obligations;
• resolve disputes;
• prevent fraud and abuse;
• maintain suppression records; and
• enforce our agreements.

When you submit a valid account-deletion request, we aim to delete or anonymize eligible personal information from active systems within 30 days, unless continued retention is required or permitted for:

• legal compliance;
• tax or accounting obligations;
• fraud prevention;
• security;
• billing;
• dispute resolution; or
• legal claims.

Residual copies may remain in secure backups for up to 90 days before being overwritten through normal backup rotation.

Certain information may be retained for longer where required by law, including:

• invoices;
• payment and tax records;
• security records;
• fraud-prevention records;
• records of consent;
• records of privacy requests;
• legal correspondence; and
• information necessary to establish or defend legal claims.

Aggregated or anonymized information that no longer identifies an individual may be retained for longer.

Google and Gmail access tokens are deleted from active systems when the relevant Gmail connection is disconnected or the associated account is deleted.

12. Data security

We use administrative, technical, and organizational measures designed to protect personal information.

Depending on the information and processing involved, these measures may include:

• TLS encryption in transit;
• encryption of Gmail OAuth tokens at rest;
• hashed passwords;
• hashed session tokens;
• account authentication;
• role-based permissions;
• workspace-level access isolation;
• restricted internal access;
• secret redaction from logs and stored payloads;
• rate limiting;
• abuse-prevention controls;
• provider access controls;
• backup and recovery processes; and
• security monitoring and incident-response procedures.

No method of storage or transmission is completely secure.

We cannot guarantee absolute security.

If a security incident affects personal information, we will investigate the incident and provide notifications where required by applicable law.

13. Your privacy choices and rights

Depending on your location and applicable law, you may have the right to:

• request access to personal information;
• request correction of inaccurate information;
• request deletion of personal information;
• request restriction of processing;
• object to certain processing;
• withdraw consent;
• receive a portable copy of certain information;
• opt out of the sale or sharing of personal information;
• limit certain uses of sensitive information;
• appeal a decision concerning a privacy request; and
• lodge a complaint with a competent data protection authority.

To submit a privacy request, contact:

support@pegasy.io

Please provide enough information for us to identify:

• your Pegasy account;
• your workspace;
• the relevant business contact record; or
• the data concerned.

We may request additional information to verify your identity and protect against fraudulent or unauthorized requests.

Authorized agents may submit requests where permitted by applicable law and subject to appropriate verification.

We will not discriminate against you for exercising applicable privacy rights.

14. European, UK, and Swiss users

If you are located in the European Economic Area, United Kingdom, or Switzerland, you may have rights under applicable data protection laws, including rights to:

• access;
• rectification;
• erasure;
• restriction;
• objection;
• data portability; and
• withdrawal of consent.

Where we rely on legitimate interests, you may object to that processing based on your particular circumstances.

You may also lodge a complaint with your local data protection authority.

Before filing a complaint, we encourage you to contact us at support@pegasy.io so we can attempt to resolve your concern.

15. United States state privacy rights

Residents of certain United States states may have additional rights under applicable state privacy laws.

Depending on the law, these rights may include the right to:

• know what personal information is collected;
• understand how personal information is used;
• access specific personal information;
• correct inaccurate information;
• request deletion;
• obtain a portable copy;
• opt out of certain sales or sharing;
• opt out of targeted advertising;
• limit certain uses of sensitive personal information; and
• appeal a denied privacy request.

Pegasy does not sell personal information.

Pegasy does not share personal information for cross-context behavioral advertising.

Where legally required, Pegasy will honor recognized browser-based opt-out preference signals.

16. Business contacts and prospects

Pegasy may process public professional information concerning individuals who have not created a Pegasy account.

These individuals may include:

• founders;
• business owners;
• employees;
• company representatives;
• freelancers; and
• other publicly listed professional contacts.

This information may be used to:

• identify potentially relevant businesses;
• verify professional contact information;
• evaluate campaign relevance;
• assess whether suitable creative assets are available;
• prepare personalized B2B creative concepts;
• enable customers to manage lawful professional outreach;
• prevent duplicate outreach; and
• suppress contacts who have objected to further processing or communication.

If you are listed as a business contact and would like to access, correct, object to, or request deletion of your information, contact:

support@pegasy.io

Please identify the business, website, email address, or professional profile concerned so we can locate the relevant record.

After an objection or deletion request, we may retain limited suppression information to prevent the contact details from being re-added or contacted again.

17. Automated analysis

Pegasy may use automated systems to:

• classify businesses;
• determine business categories;
• assess campaign relevance;
• score lead quality;
• evaluate digital and visual readiness;
• assess template suitability;
• select creative assets;
• identify creative opportunities; and
• generate campaign content.

These processes support creative and campaign workflows.

Pegasy does not use automated analysis to make decisions that produce legal or similarly significant effects concerning individuals.

Users retain responsibility for reviewing campaign leads, messages, assets, and generated outputs before using them.

18. Children

Pegasy is intended only for professional users who are at least 18 years old.

We do not knowingly collect personal information from children.

If you believe that a person under 18 has provided personal information to Pegasy, contact support@pegasy.io so we can investigate and delete the information where appropriate.

19. Third-party services and links

Pegasy may contain links to third-party websites or integrations.

Those services operate under their own terms and privacy policies.

Pegasy is not responsible for the privacy practices of third parties that operate independently from us.

We encourage users to review the privacy policies of third-party services before using them.

20. Changes to this Privacy Policy

We may update this Privacy Policy to reflect changes to:

• Pegasy’s features;
• our data practices;
• our service providers;
• legal requirements;
• security practices; or
• Google API permissions.

When we update this Privacy Policy, we will revise the “Last updated” date at the top of the page.

If a change materially affects how we use Google User Data or other personal information, we will provide additional notice and request renewed consent where required.

21. Contact us

For questions, privacy requests, Gmail data requests, deletion requests, or complaints, contact:

Redwane Studio LLC
30 N Gould St, Ste R
Sheridan, WY 82801
United States

Email: support@pegasy.io

‍