Privacy Policy

Introduction

Penomic ("we," "our" or "us") provides agentic AI platform configuration, deployment, licensing, integrations and managed knowledge operations. This Policy explains how we handle personal information when you visit our website, communicate with us or use services provided to your organization.

A customer's commercial agreement may include additional privacy, security, retention, data-location and processing terms. Where Penomic processes data on a customer's instructions, that customer controls the purposes of processing and its agreement governs.

Information we collect

Business and account information

• Name, business contact details, role and organization
• Account, authentication and authorized-user identifiers
• Commercial, billing and order information, with payment data handled by an approved payment provider when enabled
• Communications, meeting notes, support requests and security-review information

Customer content

• Documents, spreadsheets, models, policies, definitions and other material supplied for an engagement
• Interview notes and domain knowledge captured during platform configuration
• Prompts, conversations, approved workflow inputs and generated outputs
• Firm-specific configured knowledge, evaluation cases, provenance and governance records

Technical and usage data

• IP address, browser, device, access time and diagnostic logs
• Feature, API, workflow and integration activity
• Security events, permissions, approvals and administrative actions

Decision Brief information

• The public website address a visitor asks Penomic to analyze and the public pages reviewed from that site
• The generated decision hypothesis, questions, answers and resulting executive brief
• A business email address when a visitor chooses to save, resume or receive the resulting brief
• Separate marketing consent, if given; requesting a brief does not by itself subscribe a visitor to marketing

How we use information

• Provide platform configuration, deployment, licensing, integration and managed-operation services
• Process approved financial-intelligence workflows and generate requested artifacts
• Administer contracts, authorized users, support, billing and service capacity
• Secure, monitor, troubleshoot and improve the reliability of the services
• Evaluate quality in aggregate without training general-purpose models on customer content
• Analyze public website information to create, deliver or resume a visitor-requested Decision Brief
• Meet legal obligations, enforce agreements and communicate material service changes

AI, infrastructure and deployment providers

Penomic does not use customer conversations, uploaded documents, firm-specific ontology content or generated outputs to train general-purpose AI models. Where a model provider processes customer content, Penomic uses business or enterprise arrangements intended to prevent provider training on that content.

Depending on the approved deployment, Penomic may use Microsoft Azure and Azure AI services, OpenAI, Anthropic or Groq, together with identity, storage, monitoring and communication providers needed to operate the service. Not every provider is used in every deployment.

The provider set, processing location, retention controls and permitted subprocessors are deployment-specific. Penomic documents them during security review or in the applicable agreement and will not knowingly move restricted customer workloads to an unapproved provider or region.

The website Decision Brief currently uses direct public-page retrieval and may use Jina AI as a fallback reader, Groq to structure available public material into a working hypothesis, Resend to deliver requested emails and Attio to record the business inquiry. If public material cannot be retrieved, Penomic produces a clearly labeled baseline without inferring claims about the institution. The public scan is not connected to the visitor's private systems and is not treated as a substitute for human-led discovery.

Disclosure of information

We may disclose information:

• To approved service providers acting under contract and only as needed to provide the services
• To a customer's authorized users, administrators, advisors or delivery partners
• When required by law or reasonably necessary to protect rights, safety or service integrity
• In connection with a financing, merger, acquisition or sale, subject to appropriate confidentiality protections

Penomic does not sell personal information and does not share it for cross-context behavioral advertising.

Retention and deletion

Penomic retains personal information and customer content for as long as needed to provide the services, meet contractual and legal obligations, resolve disputes and maintain security records. Customer-specific retention, return, deletion and backup periods may be set in the applicable agreement.

When an engagement or account ends, Penomic deletes or returns customer content in accordance with that agreement and then removes residual copies through its backup lifecycle, except where retention is legally required.

Security

Penomic uses administrative, technical and organizational controls designed to protect customer information. Controls may include encryption in transit and at rest, managed secrets, role-based access, environment separation, logging, dependency monitoring and deployment-specific identity controls.

No system is risk-free. Security scope and assurance commitments for an institutional deployment are documented through security review and the applicable agreement. Current program status is described on the Security page.

Cookies and website analytics

Penomic may use essential cookies for authentication, session security and preferences, and limited analytics to understand website and product use. Penomic does not use third-party advertising cookies. The website also keeps a short first-party record of the pages a visitor views, stored only in that visitor's browser; it is sent to Penomic only if the visitor submits a form, so that a request can be answered in context, and it is not recorded when the browser sends a Global Privacy Control signal. After a visitor has given their details in a form, a signed cookie remembers them so they are not asked again; while it is present, views of research papers and of the briefing, contact, pricing and assessment pages are added to that visitor's record so the Penomic team can follow up on their interests. Clearing cookies or sending a Global Privacy Control signal stops this. Visitors who tick the research box or subscribe receive Definitions Matter each week and a short welcome series of four or five emails over about three weeks; every email has a one-click unsubscribe link, and unsubscribing stops all of it. Browser settings can control cookies, although disabling essential cookies may prevent sign-in.

Your rights

Depending on your location, you may have rights to access, correct, delete, export, object to or restrict processing of your personal information, and to withdraw consent where consent is the legal basis. You may also have the right to appeal a decision or complain to a data-protection authority.

Email contact@penomic.ai to submit a request. Penomic may need to verify your identity and, where the data is controlled by a customer, may direct the request to that customer.

International transfers

When personal information is transferred across borders, Penomic uses safeguards appropriate to the transfer, which may include contractual protections such as Standard Contractual Clauses. Deployment-specific data-location commitments are governed by the applicable agreement.

Children

Penomic's services are intended for organizations and authorized professional users, not children. We do not knowingly collect personal information from children under 16.

Changes to this Policy

Penomic may update this Policy as its services and legal obligations change. Material changes will be communicated through the website and, where appropriate, by email or in-product notice. An update to this Policy does not override a customer's executed agreement.