U.S. State Privacy Notice (CA, CO, CT, VA, UT)

Effective Date: November 7, 2025
This Notice supplements the MZX AI Privacy Policy and applies to “consumers” residing in California, Colorado, Connecticut, Virginia, and Utah. Terms such as “personal information,” “sensitive personal information,” “sale,” and “share” are used as defined in applicable state laws.

A. Notice at Collection

Categories of Personal Information We Collect

• Identifiers: name, work email, phone, IP address, account credentials.
• Customer Records / Commercial Information: billing contacts, transaction history (payment details processed by our payment processors), plan tier.
• Internet/Network Activity: portal telemetry, device/browser data, pages viewed, time on page, referral URLs, email open/click data.
• Geolocation (approximate): inferred from IP (no precise geolocation).
• Professional/Employment Information: company, job title/role.
• Inferences: not created for profiling individuals.
• Sensitive Personal Information (SPI): account log-in and password for authentication. We do not collect government IDs, precise geolocation, health/biometric, or similar SPI.

Purposes for Collection/Use

• Provide, secure, and improve the Services; process client files and content and deliver documents and content; authenticate users; prevent fraud; analytics; communications; billing/compliance; (with consent where required) marketing to business contacts.

Retention
We retain personal information only as long as needed for the purposes above or as required by law. Default targets (subject to customer configuration and law):

• Uploaded client documents & attachments: auto-delete after 360 days
• Generated content and documents: retained for 360 days or per customer setting
• Operational logs/telemetry: 24 months
• Billing/transaction records: retained as required by law (7 years)
• De-identified/aggregated data may be kept longer.

Sources
Directly from you/your organization; your device/browser; enterprise administrators; service providers (e.g., payment, hosting, analytics); event and marketing partners; and lawful public/firmographic sources.

B. Disclosures for Business Purposes; Sale/Sharing

Disclosures for Business Purposes. We disclose personal information to service providers/contractors (hosting, storage, email delivery, support, analytics, payment processing, optional AI nfrastructure) under written contracts restricting use.

Sale. We do not sell personal information for monetary consideration.

Sharing for Targeted Advertising (state law definition). We do not “sell” or “share” personal information for targeted advertising.

Minors. We do not knowingly sell or share personal information of consumers under 18 years of age.

C. Your Privacy Rights

Subject to exceptions under applicable law, you may have the right to:

• Know/Access the categories and specific pieces of
  personal information we collected about you.
• Delete personal information we collected from you.
• Correct inaccurate personal information.
• Opt Out of the ‘sale’ or ‘sharing’ of your personal information. In some states, you also have the right to opt out of profiling for decisions that have a legal or similarly significant effect on you. We do not use your personal information for this type of profiling.
• Limit Use/Disclosure of Sensitive Personal Information (CA only) — we use SPI (account credentials) solely for authentication/security (a permitted purpose); if our use changes, you will have this right.
• Data Portability (receive a copy in a portable format).
• Appeal a rights request decision (CO/CT/VA).

How to Exercise Your Rights

• Email: privacy@mzx.ai
• Postal: Metrix Zenith X Artificial Intelligence; IFZA Business Park – Dubai Silicon Oasis – Dubai – United Arab Emirates
  We will verify your request (e.g., by email or account checks). Authorized agents may submit requests with proof of  authorization and, where required, your verification. We aim to respond within statutory timelines (e.g., 45 days, extendable as permitted).

Right to Appeal (CO/CT/VA). If we deny your request, you may appeal by replying to our decision. If your appeal is denied, you may contact your state Attorney General.

Non-Discrimination. We will not discriminate against you for exercising your rights (e.g., denying goods/services, charging different prices), though a different price/rate may apply if reasonably related to value provided by the data.

D. Category Disclosures (Past 12 Months)

E. Limit Use of Sensitive Personal Information (CA)

We use account credentials only for permitted security/authentication purposes. If we begin using sensitive personal information for additional purposes, we will provide you with the right to limit its use via the controls in Section G.

F. Financial Incentives

We currently do not offer programs that qualify as “financial incentives” under CA law. If we do, we will describe the material terms and how to opt in/out.

G. Your Privacy Choices & Controls

You can exercise your privacy choices and manage your data through the following dedicated links and mechanisms:

• Opt Out of Sale or Sharing: Not applicable. MZX AI does not sell or share personal information for targeted advertising. If this changes, we will update this Notice and provide an opt-out mechanism.
• Manage Cookies: To manage your cookie preferences, including for analytics and advertising, please visit our Cookie Preferences center: [PLACEHOLDER LINK]
• Limit Use of Sensitive Personal Information: If we begin using sensitive personal information for purposes that require this right, we will provide a control at the following link: [PLACEHOLDER LINK]
• Global Privacy Control (GPC): We honor GPC signals sent by your browser as a valid request to opt out of sharing for targeted advertising.

H. Contact Information

For questions or to submit a rights request about this Notice, please contact us at:

• Email: privacy@mzx.ai
• Postal Address: Metrix Zenith X Artificial Intelligence; IFZA Business Park – Dubai Silicon Oasis – Dubai – United Arab Emirates