Contents
About this policy
Who we are
Iconic Agentic, Inc. (“Iconic,” “we,” “us” or “our”) is located at 156 2nd St, Suite 606, San Francisco, CA 94105. Contact us about privacy at privacy@withiconic.ai.
What this covers
This policy covers our website, app and services. We are the controller, or “business,” for personal information we use to manage our own users, teams, billing, support and marketing.
When customers use Iconic to operate their sites, we act as their processor, or “service provider,” for information about their visitors, form respondents, contacts, email recipients, buyers and site users. Customers decide why that information is collected and how it is used. We process it on their instructions, subject to our agreements and applicable law. A Data Processing Addendum (DPA) is available to customers on request at legal@withiconic.ai.
If you interact with a customer-built site, contact its operator about its privacy practices or a request concerning your data. You can also contact us, and we will help route your request and assist the customer as required.
Children
Iconic is for people who are at least 18, or the age of majority where they live if higher. It is not directed at children. If you believe a child has provided personal information directly to Iconic, contact privacy@withiconic.ai.
Customers are responsible for the audiences and privacy practices of their own sites, including laws protecting children and any required parental consent.
What we collect and why
Information we collect
We receive information from you, your team members, services you connect and your use of Iconic.
| Category | Examples |
|---|---|
| Account and team information | Email address, name, profile photo, sign-in information, team name, invitations, membership and roles. |
| Connected services | With Sign in with Google, your email, name, photo and sign-in confirmation. With a connected code repository, your repository identity, source files and contribution information. |
| Content and project information | Websites, apps, source code, text, images, uploaded files, saved versions, domain names and settings you provide. |
| AI information | Prompts, instructions, content provided to AI features, outputs and information about AI usage. |
| Billing and sales information | Team plan, billing contact, payment status, transaction records and AI balance. Payment processors collect payment details and seller identity and bank information. |
| Support and communications | Messages, feedback, support requests and information you include in them. |
| Usage and device information | Pages and features used, dates and times, browser and device information, referring pages, general location, network information such as IP addresses, and error or performance information. |
| Cookies and similar technologies | Sign-in state, preferences, referral information and advertising interactions, as explained below. |
We process network information, including IP addresses, to deliver and protect the service. Our built-in visitor analytics does not store IP addresses, as described below, but other parts of the service and our providers may.
When you provide personal data in connection with Iconic Pay, Stripe receives that personal data and processes it in accordance with Stripe’s Privacy Policy. Payment details entered into Stripe’s payment forms are handled by Stripe. Iconic receives the billing and transaction information needed to provide the service.
Data we process for customers’ sites
The information depends on the features a customer uses and the content they collect:
- Visitor analytics: Pages viewed, referral sources, time on pages, events, browser and device types, general location, live visitor counts and page performance. Iconic’s basic built-in visitor analytics does not use cookies or store IP addresses. Advanced Analytics, which a site’s owner on the Pro plan can turn on, stores a cookie on that site’s visitors’ computers, and the owner is told they may need a cookie notice or consent mechanism. It briefly processes network information to produce visit counts and uses temporary browser storage for navigation and live visitor reporting. Customer sites may use other cookies and storage for sign-in, purchases or features the customer adds.
- Forms and contacts: Form answers, names, email addresses, contact sources and interaction history. Form answers may also appear in notification emails.
- Email: Recipient addresses, message content, delivery status, replies, unsubscribe preferences and engagement information. Open and click tracking is on by default for emails customers send through Iconic. It uses tracking pixels and tracked links to report opens and clicks, including their time, clicked links, general location and device information. Customers can turn tracking off. They must tell recipients about it and obtain any consent their law requires.
- Site sign-ins and accounts: Email addresses, profile information, sign-in records and information stored in the customer’s app.
- Sales: Buyer contact details, orders, products, payment status, subscriptions, refunds and transaction records.
- Other site content: Files and other information visitors submit or customers choose to store.
How we use information
We use information to:
- Create accounts, manage teams and provide websites, apps and connected features.
- Process billing, measure usage and support customer sales.
- Respond to requests and send service, security and account notices.
- Detect fraud, prevent abuse, enforce our terms and protect people and the service.
- Understand performance, troubleshoot problems and improve Iconic.
- Use content and usage data to improve our service, as described in the next section.
- Understand referrals, measure and improve our advertising, and send marketing where permitted.
- Meet legal obligations, keep required records and resolve disputes.
Information you publish on a site or make public is available to others. Team members can access shared information according to their roles. Consider what you include before publishing or sharing it.
Improving our service
For customers on plans other than Enterprise, including Free and Pro, we may use customer content and usage data, including prompts and outputs, to improve our service unless the customer opts out. That information may contain personal information.
Unless you opt out, we may use your content and usage data to train and improve models. Enterprise customers and private database data are never used.
Anyone can opt out at any time, on any plan and at no cost, by emailing privacy@withiconic.ai. The opt-out applies prospectively. It does not remove content already used or undo improvements already made.
We never use Enterprise customers’ content or usage data to improve our service. We never use private database data, meaning the data stored in customers’ own app databases, to improve our service, on any plan. We also exclude customers whose written agreement with us prohibits this use. These exclusions do not depend on an opt-out request.
This use does not override our obligations for data we process on a customer’s instructions or an applicable DPA. Opting out does not stop the processing needed to provide an AI feature you use.
For people in the EEA and UK, our legal basis for using data to improve our service is our legitimate interest in improving it. The opt-out is a way to exercise your right to object.
The AI assistant you choose to connect to Iconic is your chosen tool. It is governed by that provider’s terms and privacy policy and is not an Iconic subprocessor. Connecting it lets it receive information within the access you authorize. Its own data practices are separate from ours.
Legal bases for the EEA and UK
When we act as controller, we rely on these bases as applicable:
| Basis | What it covers |
|---|---|
| Contract | Providing the service you request, managing your account and processing billing. |
| Legitimate interests | Keeping Iconic secure, preventing fraud, supporting team users, responding to inquiries, and improving the service, subject to the opt-out above. We consider your rights when relying on these interests. |
| Consent | Advertising cookies, email marketing and other processing where consent is required. You can withdraw consent at any time without affecting processing that was lawful before withdrawal. |
| Legal obligation | Required financial records, legal requests and other duties imposed by law. |
If information is needed to provide a feature or meet a legal obligation, we may be unable to provide that feature without it. For data processed on a customer’s behalf, the customer is responsible for identifying its lawful basis.
Your rights and choices
Your choices and rights
Regardless of where you live, you can ask to:
- Access your personal information and learn how we use and disclose it.
- Correct inaccurate information.
- Delete personal information.
- Receive an export in a portable format.
- Object to processing, including use of your data to improve our service and direct marketing.
- Restrict processing.
- Opt out of sale, sharing and targeted advertising.
- Withdraw consent where processing relies on it.
Send requests to privacy@withiconic.ai. We will not discriminate against you for exercising these rights. Some requests are subject to legal exceptions, including records we must keep or information affecting another person’s rights. We will explain any limitation.
We may need information reasonably necessary to verify your identity or an authorized agent’s authority for access, correction or deletion requests. You do not need an Iconic account to opt out of sale or sharing. We respond within the periods required by applicable law. If we deny a request, you can ask us to review that decision by replying or emailing privacy@withiconic.ai with “Privacy appeal” in the subject.
You can delete sites and teams using the app. Full account deletion is available by emailing privacy@withiconic.ai. There is no self-service account erasure control yet. Deleting a site or team is separate from deleting your personal account. Sites with active buyer subscriptions cannot be deleted, archived or unpublished until those subscriptions have ended.
You can unsubscribe from marketing emails using the link in the message. We may still send necessary service notices. For a customer’s email, use its unsubscribe link or contact that sender. For customer-site data, we assist the responsible customer with your request.
You have the right to complain to a supervisory authority, including the authority where you live or work in the EEA or the UK Information Commissioner’s Office, as applicable.
Do Not Sell or Share My Personal Information
To opt out, email privacy@withiconic.ai with “Do Not Sell or Share” in the subject, or enable GPC in a supported browser. Browser choices generally apply to the browser used. If you use other browsers or devices, set your preferences there too. Contact us to apply your request to information associated with your account.
California and other US state notices
The following categories describe information we collect and disclose for the purposes in this policy. Sources include you, team members, connected services, customers acting as controllers, and interactions with our services. Retention is described in the next section.
| Category | Examples | Recipients for business purposes | Sale or sharing for advertising |
|---|---|---|---|
| Identifiers and account information | Name, email, account identifiers and online identifiers | Relevant service providers, authorized team members and connected services | Online identifiers used on our own website may be disclosed to advertising partners. |
| Commercial information | Plans, billing records, transactions and subscription status | Payment processors and relevant service providers | Website conversion events may be disclosed to advertising partners. |
| Internet activity and general location | Pages visited, device information, ad interactions and approximate location | Relevant service providers | Website activity, device information and general location may be disclosed to advertising partners. |
| Content and communications | Project files, images, prompts, outputs, support messages and feedback | Relevant service providers and recipients you authorize | We do not disclose this category to advertising partners. |
| Customer-site data | Forms, contacts, messages, sign-ins and sales records | The customer and providers needed to operate its site | We do not use this data for our own advertising. |
The rights and opt-out methods above are available to everyone, including California and other US state residents. We do not knowingly sell or share the personal information of anyone under 16.
Do not include sensitive information in prompts, public pages or ordinary forms unless the feature is appropriate for that information and you have the required legal basis. This includes government identifiers, account credentials, health information and financial details. Necessary seller verification and payment information should be provided through the designated payment forms.
Security, retention and transfers
Retention and deletion
We keep information for as long as reasonably needed to provide the service, maintain accounts, honor preferences, resolve disputes, protect against fraud and meet legal obligations. The period depends on the information’s purpose, sensitivity, your instructions and applicable law.
Email send and engagement history is kept for up to 24 months. Contact records, replies and unsubscribe records may have different retention periods based on their purpose. We may retain unsubscribe records to avoid sending unwanted email.
After deletion, data is removed from active systems within a reasonable period, typically about 30 days, and from backups as they rotate out. Some records, including billing, fraud prevention and legal records, are kept as the law requires. Copies you or others keep outside Iconic are subject to their own controls. The opt-out from improving our service has the prospective effect described above and does not limit rights that cannot be waived by law.
Security
We use technical and organizational safeguards designed to protect information, including access controls and protections for data in transit and stored credentials. No service or transmission is completely secure. Keep your account secure and only grant access to people and tools you trust.
International transfers
Data is stored and processed in the United States. Its laws may differ from those where you live. For transfers requiring safeguards under EEA or UK law, we rely on Standard Contractual Clauses and the UK Addendum, as applicable. Contact privacy@withiconic.ai for information about these safeguards or a copy, subject to appropriate redactions. Customers can request our DPA at legal@withiconic.ai.
Contact and changes
Changes
We may update this policy. We will post changes here and email team owners, or notify them through the app, about material changes at least 30 days before they take effect. Continued use after the effective date means acceptance of the updated policy. Where the law requires consent or another notice, we will obtain that consent or provide that notice.
Contact
Iconic Agentic, Inc.
156 2nd St, Suite 606
San Francisco, CA 94105
privacy@withiconic.ai