CommsRx Privacy Notice

Effective 16 October 2026 (version 1.3.0). Issued by Signal Fidelity Group LLC. This version replaces version 1.2.0 of 15 October 2026, which replaced version 1.1.0 of 15 October 2026, which replaced version 1.0.0 of 4 October 2026.

1. Who we are and what this notice covers

Signal Fidelity Group LLC, a Massachusetts limited liability company ("SFG", "we"), provides CommsRx and Ally, its AI communications counsellor. Contact us about privacy, support or this notice at help@signalfidelitygroup.com, or by post at Signal Fidelity Group, 14 Aegean Lane, Lowell, MA 01854.

This notice covers one deployment: the CommsRx Azure private pilot, which is the CommsRx web application hosted by SFG on Microsoft Azure, and the CommsRx with Ally app for Microsoft Teams that connects to it. It does not cover other SFG websites, the separate Render-hosted CommsRx environment, the single-operator Azure evaluation application, or the earlier Copilot Studio demonstration. Your invitation identifies the environment available to you.

Your employer or other subscribing organization (the "Customer") decides what business material enters CommsRx and who may use its workspace. For personal information inside that material, we process it on the Customer's instructions under our agreement with the Customer. We decide how account, security and support information is used to run the service.

2. What the pilot is for, and what you may put in it

The pilot is for evaluating CommsRx on communications work. During the initial pilot:

• Permitted: fictional or synthetic material, and public, non-sensitive material that you are authorized to use.
• Only after specific review: de-identified material. Removing names does not by itself make health information de-identified, and anonymized trial or business material can still be confidential or market-sensitive.
• Not permitted unless separately authorized under an appropriate agreement, in a deployment verified for those data classes: confidential or embargoed material, material non-public information, protected health information, payment card data, credentials, and other legally restricted data.

If restricted material is submitted by mistake, email help@signalfidelitygroup.com. We will remove the assignment from view, record the request, and tell you what we can and cannot erase (see section 7). The service does not automatically detect or block every such upload.

This boundary concerns assignment content. The service still collects the account and operational information described below.

3. Information we receive

• Account and organization information: name, business email, organization, membership and role, assignment access, and sign-in events. Our authentication provider handles credentials; the application sees signed tokens, never your password. Invitation, sign-in and password-reset emails are sent through Resend (section 5).
• Microsoft Teams information: your Microsoft organization and user identifiers, the conversation identifier, the messages you send to the app, and what is needed to authenticate Microsoft's channel and deliver replies. The app supports personal conversations. Installing it does not give CommsRx access to your mailbox, files, Teams history, SharePoint or OneDrive, and the app holds no Microsoft Graph permissions.
• Work you provide: prompts and messages, assignment briefs, source material and uploaded files, instructions, and corrections you ask Ally to remember. These may describe colleagues, stakeholders or other people.
• Work the service creates for your organization: strategies, key messages, drafts, readiness findings, saved conversations, and the records that connect each piece of work to its sources, requests and revisions. Some of this is derived: the meaning vectors of your confirmed messages and the phrasings they must not drift into, and a profile of how your leader decides, built only from decisions that carry stated reasons. All of it is specific to your organization.
• Operational information: request identifiers, timestamps, error codes and classes, timings, service revision names, and the network information our hosting providers receive, such as IP addresses and browser type. Application logs are written to carry identifiers and codes rather than message text.
• Support communications: what you send us when you ask for help or make a privacy request.

4. Why we use information

To authenticate you and enforce workspace permissions; to provide AI-assisted communications work and keep it retrievable; to deliver replies in Teams and in the web application; to support you; to find and fix failures; to secure the service and prevent abuse; to manage capacity and usage; and to meet legal obligations or resolve disputes.

SFG personnel may look at relevant content when needed for a support request you make, a security or service problem, or an agreed service. Today that is one person. We do not claim that every access is automated.

5. AI processing, and the providers that receive information

CommsRx sends the instructions and context for each request to Google's Gemini models. Ally's conversations, drafts, research and reviews, and the answers a meeting kit's persona gives, go through Google Cloud's Vertex AI. Meeting kits are written, and the pictures, video clips and voice narration CommsRx produces are made, through Google's Gemini API. SFG's application supplies the instructions and the workflow; Google supplies the models. AI output can be wrong, and a response can repeat or infer personal information from the conversation. Review it before relying on it or sharing it.

Our commitment on model training: SFG does not use Customer Content to train or fine-tune general-purpose or cross-customer AI models. Customer-specific storage, retrieval and contextual adaptation used to provide the pilot are described in section 3 and in your agreed pilot scope. Processing a prompt to answer it, and keeping your saved work so you can return to it, are different from training a model.

What Google says about Vertex AI. Google says it does not use the data sent to Vertex AI to train or fine-tune any AI or machine-learning model without the customer's prior permission or instruction, including for preview models. By default it caches requests and responses to answer faster: the cache is scoped to SFG's project, never used for training, and deleted no later than 24 hours after it is written. Google may log a prompt that its automated classifiers flag, solely to examine whether its acceptable use or prohibited use policies were violated, and keeps such a prompt for up to 90 days; authorized Google employees may review it. SFG has no zero data retention arrangement and no master agreement with Google Cloud that would exempt the pilot from that logging. We therefore do not promise zero retention or that no human review can occur.

What Google says about the Gemini API. Under Google's Gemini API terms for paid services, Google does not use prompts or responses to improve its products, and it logs them for a limited period solely to detect and prevent violations of its prohibited use policy and for legally required disclosures. Google's usage policies say it keeps prompts, the context supplied with them and the outputs for 55 days for that purpose, and that authorized Google employees may review that data. SFG has no zero data retention arrangement with Google. We therefore do not promise zero retention or that no human review can occur.

Web search. Ally can run web searches to check facts. When she does, the request goes to Google Search through Vertex AI. Google stores the queries it derives from the request and the context supplied with it, not associated with you or your organization, for up to three days, and may use them to debug the systems behind that feature. Your documents are not sent as search queries.

The engine check. When you ask CommsRx which sources AI answer engines cite, it sends the check's questions, which may name a condition, a medicine or your company, to Google (through the Gemini API, which keeps the prompt, the context supplied with it and the result for 30 days to produce the search results), OpenAI and Perplexity. Each answers with its own web search, and CommsRx records the answers and the sources they cite. Only the questions are sent; your documents and saved work are not. OpenAI says data sent to its API is not used to train its models by default and that its abuse-monitoring logs are kept for up to 30 days; CommsRx asks it not to store the response. Perplexity says it does not use Customer Content sent to its API to train generative AI models; it states no retention period. SFG has no zero data retention arrangement with either.

What Supabase does. Supabase processes the pilot's data as our processor, on our instructions, under its data processing addendum, which is part of its terms of service. Its notice says nothing about training models on project data, and we attribute no such statement to it.

What Resend does. Resend sends the invitation, sign-in and password-reset emails that our authentication provider composes, from no-reply@commsrx.com, and so receives your email address and the content of those emails, which carry a one-time link and no assignment content. It processes them as our processor under its data processing addendum, which says its primary processing operations take place in the United States.

Microsoft Teams. Microsoft processes your Teams messages under its arrangements with your organization. Copies in Microsoft 365 are your organization's records and follow its retention policies; CommsRx cannot delete them.

Other providers or data sources are added to a pilot only by agreement, and this notice is updated first.

6. Sharing

We disclose information to the providers above as needed to run the service, to authorized people in your organization's workspace according to its permissions, and to recipients or connected services when you direct an available feature to share it. We may also disclose information when the law requires it, to protect rights or security, or in connection with a merger, financing, acquisition or transfer of our business, with appropriate confidentiality. We do not sell personal information or use Customer Content for advertising, and we do not authorize a provider to use Customer Content for unrelated purposes.

7. Retention and deletion

During the pilot. We keep your saved work for the pilot term so that conversations reopen exactly as they were. Removing an assignment hides it from everyone and frees its name; it does not erase the underlying records. Closing a source stops its words being served; what was already imported remains stored.

Provider clocks. Operational logs are kept for 30 days. Our database provider keeps daily backups for 7 days; uploaded files are not part of those backups. Through Vertex AI, Google caches requests for no later than 24 hours, keeps a prompt its classifiers flag for up to 90 days, and keeps web-search queries for up to three days; through the Gemini API, it keeps prompts and outputs for 55 days to detect misuse, and requests that use web search for 30 days (section 5). OpenAI keeps abuse-monitoring logs for up to 30 days; Perplexity states no retention period (section 5). Resend processes the sign-in emails it sends under its own data processing terms. Requests made before version 1.3.0 took effect (16 October 2026) went to Google through the Gemini API and remain subject to the handling described there. Requests made before version 1.1.0 took effect (15 October 2026) went to the model provider named in version 1.0.0, Microsoft, and remain subject to the handling described there until they age out of Microsoft's own retention. Copies in Microsoft 365 follow your organization's policies.

Deletion. After the pilot ends, or earlier on a verified request from your organization's representative, SFG erases your organization's pilot data from its application records and files through an operator-run procedure, and confirms in writing what was erased. We do not yet publish a fixed deadline for that erasure; the schedule for an external pilot is agreed in the pilot order. Backups age out within 7 days of an erasure. Exports you took and copies in Teams are outside our control.

Exceptions. If we must preserve specific records because of a legal demand or obligation, we suspend their erasure for that period and tell the requester that an exception applies.

To request access, correction, export or deletion, email help@signalfidelitygroup.com. We verify the requester's authority and coordinate with your organization where its content is concerned.

8. Security

We use safeguards appropriate to a private pilot: encrypted connections throughout, including certificate-verified connections to the database; per-row access rules in the database; separate least-privilege database roles for each process; credentials kept in the hosting platform's secret store; and encryption at rest by our providers. No system is completely secure, and this notice is not a certification. Do not submit credentials, payment card data or protected health information; the pilot is not offered under a business associate agreement.

9. Browser storage

The web application uses browser storage to keep you signed in and to remember preferences and unsent drafts. Clearing it signs you out. Microsoft and other providers use their own cookies under their notices.

10. Your choices and rights

You choose what you submit, you can ask your administrator about access, you can stop using the app, and you can contact us about your information. Depending on where you live, you may have rights to access, correct, delete, export, restrict or object to processing of personal information, and to complain to a privacy authority. We may need to verify identity and authority, and requests about your organization's content may need to go through your organization. We will not retaliate against anyone for exercising a right. The pilot is for adult business users and is not directed to children.

11. Changes and contact

When this notice changes we update its date and give notice of material changes where appropriate. Questions and requests: help@signalfidelitygroup.com, or by post to Signal Fidelity Group, 14 Aegean Lane, Lowell, MA 01854.

This notice is not a data processing agreement. Where the pilot processes personal information on a business's behalf, the data processing terms are agreed separately in the pilot agreement.