Privacy Policy — Pre1 Software

1. Overview

Pre1 Software (“Pre1,” “we,” “us,” or “our”) operates websites including pre1.com and smartpublisher.com and provides SmartPublisher software, hosted services, APIs, Model Context Protocol (“MCP”) servers, authentication services, and third-party integrations (collectively, the “Services”).

This Privacy Policy explains how Pre1 collects, uses, stores, discloses, and protects personal information when you visit our websites, use the Services, connect a third-party account, communicate with us, or authorize an integration.

Some Services are provided to newspapers, publishers, and other organizations that control the information stored in their SmartPublisher systems. When we process information for those customers, the customer generally determines why and how the information is used, and Pre1 acts as a service provider or processor under our agreement with that customer. Questions about information submitted directly to one of our customers may need to be directed to that customer.

This Policy does not govern the independent privacy practices of Google, Microsoft, OpenAI, our customers, or other third-party services.

2. Information We Collect

2.1 Account and identity information

When you create an account or sign in, we may receive or maintain:

• Your name, email address, profile image, and provider-specific account identifier.
• Your organization, tenant assignments, roles, permissions, and account status.
• Authentication-session information, sign-in timestamps, security events, and related audit records.
• Information included in identity-provider claims needed to identify your account or determine authorized access.

When you use Google or Microsoft to sign in, Pre1 does not receive your Google or Microsoft password or multifactor-authentication code.

2.2 OAuth tokens and connected-account information

When you choose to connect an external service, Pre1 may receive and store:

• OAuth access tokens and refresh tokens issued by the provider.
• The scopes or permissions granted.
• Token expiration and connection timestamps.
• The email address or account identifier associated with the connection.
• Connection status and provider error information.

OAuth tokens are security credentials. We use them only to provide the connected feature authorized by the user, protect them using access controls and encryption appropriate to our systems, and delete them when the connection is removed or the associated account is deleted, subject to backup retention and legal requirements.

Pre1 does not ask users to provide their Google or Microsoft passwords, API keys, or multifactor-authentication codes in place of a provider authorization flow.

2.3 Email content processed through connected accounts

When an authorized user sends an email through a connected Google or Microsoft account, we may process the information needed to create and transmit that message, including:

• Sender and recipient addresses.
• Subject, body, formatting, and attachments.
• Related SmartPublisher record identifiers and delivery status.
• Provider responses and error information needed to complete or troubleshoot delivery.

Under the currently implemented send-only permissions described in Appendix A, Pre1 does not receive general permission to read the user's existing Gmail or Microsoft mailbox.

2.4 Customer-controlled SmartPublisher data

The Services process data entered into or stored by a Pre1 customer, such as advertiser, subscriber, contact, publication, order, billing, document, communication, or operational information. The categories of data depend on the customer's configuration and the feature being used.

Pre1 processes customer-controlled data to host, maintain, support, secure, and provide the Services and as otherwise directed by the customer or an authorized user. We do not use one customer's private business data to compete with that customer or disclose it to unrelated customers.

2.5 MCP and API information

When you use a Pre1 MCP server or API, we may process:

• Tool names, request parameters, and authorization context.
• The minimum customer data needed to perform the requested operation.
• Results returned to the requesting user or platform.
• Security, rate-limit, error, and diagnostic records.

Pre1 MCP tools are designed to request and return information relevant only to the tool's stated function. Pre1 does not collect a user's complete chat history merely because an MCP tool is invoked. The platform through which the user invokes a tool may separately process conversations under its own privacy policy.

2.6 Website, device, and usage information

We may automatically collect:

• IP address, browser type, operating system, device characteristics, and referring page.
• Pages or features accessed, approximate timestamps, and interaction events.
• Session, security, and authentication cookies.
• Application logs, performance measurements, and error reports.

We use this information to operate, secure, diagnose, and improve the Services. We do not use OAuth-derived Google or Microsoft data for unrelated website analytics.

2.7 Communications and support information

When you contact us, we may collect your contact details and the content of support requests, emails, bug reports, screenshots, attachments, feature requests, and other communications.

2.8 Information the Services are not designed to collect

The Services are not designed to request consumer payment-card numbers, government identification numbers, health records, provider passwords, or multifactor-authentication codes through general support forms, MCP tools, or OAuth setup screens. Do not submit this information unless a specific Pre1 feature and customer agreement expressly require it.

3. How We Use Information

We use information to:

• Create and administer accounts and authenticate users.
• Determine organization, tenant, role, and feature access.
• Provide, operate, maintain, and improve the Services.
• Carry out MCP, API, email, and other actions requested by authorized users.
• Connect, refresh, and disconnect authorized third-party integrations.
• Respond to support requests and communicate about the Services.
• Detect, investigate, and prevent fraud, abuse, security incidents, and unauthorized access.
• Monitor reliability, diagnose errors, and maintain audit records.
• Enforce agreements and protect the rights, safety, and property of Pre1, our customers, users, and others.
• Comply with applicable law, legal process, and regulatory obligations.

We do not sell personal information. We do not use Google- or Microsoft-derived OAuth data for advertising, cross-context behavioral advertising, data-broker activity, credit or lending decisions, or general-purpose artificial-intelligence or machine-learning model training.

4. Third-Party Sign-In and OAuth Integrations

4.1 Sign-in is separate from optional integrations

Using Google or Microsoft to sign in gives Pre1 only the identity information and permissions shown in the provider's sign-in consent flow. Signing in does not, by itself, authorize Pre1 to read Gmail or Outlook messages, access calendars or contacts, send mail, or access organization-wide data.

When a feature needs additional provider permissions, Pre1 presents a separate connection or consent flow. The provider's consent screen identifies the requested permissions before the user authorizes them.

4.2 Google Sign-In

For identity-only Google Sign-In, Pre1 requests standard OpenID Connect identity scopes (openid email profile) to receive an account identifier and basic profile information such as name, email address, and profile image.

We use Google Sign-In information only to authenticate the user, establish the Pre1 account, display basic account information, and enforce authorized access.

4.3 Microsoft Entra ID Sign-In

For Microsoft Entra ID Sign-In, Pre1 requests OpenID Connect scopes and delegated User.Read (openid profile email User.Read) to authenticate the user, resolve tenant and role assignments, and display user profile details.

4.4 Connected Google email sending

When a user separately connects a Google account for email sending, Pre1 requests the Gmail https://www.googleapis.com/auth/gmail.send permission and the minimum identity scope email. This permission allows the Service to send messages on the user's behalf and identify the connected sender address. It does not grant general access to read the user's existing mailbox.

Pre1 uses this permission only to send messages that the user initiates or that an authorized SmartPublisher workflow instructs the Service to send. Pre1 does not use the permission to inspect, profile, or analyze the user's mailbox.

4.5 Connected Microsoft email sending

When a user separately connects a Microsoft account for email sending, Pre1 requests delegated Mail.Send, User.Read, and offline_access permissions:

• Mail.Send allows the Service to send mail as the connected user.
• User.Read allows the Service to identify the connected user and display their email profile.
• offline_access allows the provider to issue a refresh token so the connection persists without requiring the user to sign in for each send.

These permissions do not grant Pre1 general access to read the user's existing Microsoft mailbox.

4.6 Disconnecting an integration

A user or authorized administrator may disconnect a Google or Microsoft email connection through available account settings or by contacting Pre1. When disconnected, Pre1 deletes the active stored OAuth tokens for that connection and attempts provider-side revocation where supported.

5. Google API Limited Use Disclosure

Pre1's use and transfer of information received from Google APIs complies with the Google API Services User Data Policy, including its Limited Use requirements.

Pre1 limits Google user data to providing or improving the user-facing feature for which the user granted access. We do not:

• Sell or transfer Google user data to advertising platforms, data brokers, or information resellers.
• Use Google user data for targeted, personalized, interest-based, or retargeted advertising.
• Use Google user data to determine creditworthiness or make lending decisions.
• Use Google user data for general-purpose AI or machine-learning model training.
• Combine Google user data with unrelated information for an undisclosed purpose.
• Permit personnel to read Google user data except when the user affirmatively requests support, access is necessary for security investigation, access is required by law, or appropriately aggregated information is used for internal operations.

6. How We Disclose Information

We disclose information only as follows:

• Service providers and subprocessors: Cloud hosting, database, security, and infrastructure providers operating under confidentiality obligations.
• Customer organizations: Authorized administrators and users of the customer that controls the account.
• User-directed integrations: Transmitting messages and data to Google, Microsoft, or designated third parties at the user's instruction.
• Legal and safety obligations: When required by valid legal process, regulation, or to protect the safety and property of Pre1, our customers, and the public.
• Business transactions: In connection with a corporate reorganization, merger, or asset sale, subject to customary confidentiality protections.

We do not sell personal information or share personal information for cross-context behavioral advertising.

7. Data Retention and Deletion

We retain information only for as long as reasonably necessary to provide the Services, fulfill contractual commitments, resolve disputes, maintain security audit trails, and comply with law.

8. Security

Pre1 maintains technical and organizational measures to safeguard personal information, including TLS encryption in transit, encryption at rest for sensitive credentials, least-privilege role-based access controls, tenant isolation, and continuous observability and error monitoring.

9. Cookies and Similar Technologies

We use strictly necessary cookies and session storage for authentication, security, tenant routing, and session continuity. We do not use third-party advertising cookies or cross-site tracking trackers.

10. Your Privacy Rights and Choices

Depending on your jurisdiction, you may have rights to access, correct, delete, or receive a portable copy of personal information held by Pre1, or to object to certain processing.

To exercise any privacy rights, contact support@pre1.com. For requests regarding data controlled by a publisher customer, we will coordinate with that customer to process the request.

11. Contact Information

Questions or requests regarding this Privacy Policy may be directed to: