What we collect, and what we do with it

Who we are

Magnolia Systems Technologies, Inc. (“Magnolia Systems”, “we”). Privacy enquiries: privacy@magnoliasystems.ai.

This policy covers Magnolia IRIS, Magnolia Synergy, Magnolia FieldSense, Magnolia Haven, and this website. Each product collects different things for different reasons, so where that matters this policy says which product it is talking about rather than averaging them together.

Magnolia Haven is treated differently throughout, and the difference is not editorial. What people write in Magnolia Haven is health information about their own minds. Several states classify that as sensitive data by statute, which changes what we are permitted to do with it — not what we have chosen to do with it. The section Magnolia Haven, and why it is separate below sets out the rules that apply only to it. Where that section conflicts with anything else here, it governs.

We hold two different roles, and they matter

For IRIS we are the controller: it is our product, and we decide why information is processed. This policy governs it.

For Synergy we are a processor. Synergy holds employee records — names, identifiers, email addresses, roles, wages and tips — belonging to the business that uses it. That business decides what is collected and why; we act on its instructions. If you are an employee of a business that uses Synergy, your employer is the controller of your data, not us, and a request about it should go to them. The terms governing that relationship are in a Data Processing Addendum signed with the business.

For Magnolia FieldSense we are a processor as well. The organisation — a club, school or team — decides which players are enrolled and what is captured. Requests from a player or a parent should go to that organisation first; we will help them answer.

For Magnolia Haven we are the controller, and the account belongs to the person, not to any organisation that told them about it. If your workplace or your clinician introduced you to Magnolia Haven, they did not thereby get an account, a report, or a way to ask us what you wrote. This is the arrangement whether or not anyone else paid.

What IRIS collects

We do not ask for, and IRIS is not built to hold, payment card numbers, government identifiers, or health information. Please do not put them into a planning conversation.

What this website collects

Nothing. There are no analytics, no cookies, no tracking pixels, no advertising tags and no third-party scripts on these pages. We are not describing an intention — there are none present, and our own engineering rules block them from being added without review. If that changes, this section changes first.

Where it is stored

In Microsoft Azure, in the East US 2 region, in the United States. If you are outside the United States, using IRIS means your information is transferred there.

Since 6 September 2026 the storage account holding IRIS content has public network access disabled. It is reachable only over a private network path inside our own Azure network. That is a deliberate architectural decision, recorded and enforced, not a setting we intend to apply later.

Artificial intelligence, and what it does not do

IRIS sends what you write to Azure OpenAI, running in East US 2 under our Microsoft agreement, to produce its replies.

Your content is not used to train foundation models. Microsoft does not use Azure OpenAI customer data for that purpose, and neither do we. We do not sell your information, and we do not use one customer’s planning content to serve another.

One thing you should know because it is not ours to change: Microsoft may retain prompts and responses for up to 30 days for abuse monitoring, unless a zero-retention exemption applies. That is Microsoft’s retention operating on their systems, separate from ours below.

If you pay us

Payment is handled by Stripe. Your card details go from your browser to Stripe directly and never reach a Magnolia system — we could not see your card number if we wanted to.

What we send Stripe is the billing email, the organisation name and the number of seats. Never a planning conversation, a brief or a specification.

Who else processes it

Only the providers listed on our sub-processor page. We publish that list rather than describing it in the abstract, and it changes when they do.

How long we keep it

Magnolia Haven, and why it is separate

Magnolia Haven is a private place to write things down. Entries, moods, anything you log about medication or sleep, what you search for inside it, and anything the product infers from those — including an inferred mood — are sensitive data under the laws of several states, which name mental health condition, treatment and diagnosis expressly. An inference we draw is sensitive for the same reason the entry is: it says something about your health whether you typed it or not.

Four rules follow, and none of them has an exception:

• We do not sell it, and we will not. Not to a data broker, not to an advertiser, not to a research buyer, not as part of a dataset, and not in a form we have relabelled as something other than a sale. This is the one promise in this document written without qualification, because the alternative is unlawful and we could not undo the promise even if we wanted to.
• It is never used for advertising — not to target adverts anywhere, not to build audiences or segments, and not to decide whether you should be approached about anything.
• It stays out of the aggregate and derived work described below. It is excluded at the point the data is stored, not by a rule someone has to remember to apply.
• We do not train models on it without asking you first, specifically and separately, in a way you can refuse without losing the product and withdraw later. As of the effective date above we do not train any model on Magnolia Haven content at all, and no such consent has been requested from anyone.

Because this information is sensitive, we ask before processing it rather than treating your signing up as agreement. That request is made on its own, not bundled into these terms or a tick-box at registration — bundling it would not be consent, and in several states would not be lawful consent either.

What we collect is bounded by what the feature needs. We collect sensitive information only where it is necessary to provide something you actually asked for. If you use a mood log, we hold what you log. If you do not, we do not collect it and hold it in case a use appears later. This is a deliberate limit and not only a legal one: under Maryland law it is the rule, and consent does not lift it — which we think is the right rule, because information gathered on the chance it becomes useful is information nobody can tell you the purpose of.

What we do not collect

A list of what we collect is only half a disclosure. Here is the other half. Nothing below is gathered by any Magnolia Systems product, and where a reason is given, it is the real one.

This list will change as the products do, and when it changes it will shrink or grow visibly rather than quietly. If something moves off it, that is a material change and you get told before it takes effect.

Aggregate and derived information

Across IRIS, Synergy and Magnolia FieldSense — and not Magnolia Haven — we produce aggregate and statistical information from how the products are used: benchmarks, patterns, model improvements and industry insight. We keep the right to do this, and to build products from it.

What that means concretely. The information is aggregated or de-identified first, so what comes out describes a pattern, not a person. We do not attempt to re-identify it, and we do not permit anyone we give it to to attempt that either.

The permitted uses are these, and this list is exhaustive:

• operating, securing, debugging and improving the products;
• building benchmarks and industry insight, including products we sell to the businesses whose use produced them;
• training and evaluating our own models for product features — never on Magnolia Haven content, and for Synergy and Magnolia FieldSense only where the customer organisation has agreed;
• research and reporting we publish or share, in aggregate form.

It is a closed list on purpose. An open list ending in “and other business purposes” would let this paragraph mean anything later without us having to tell you, which is the specific drafting move that has gone badly for other companies. If we want a use that is not on this list, we add it here, say so, and it applies from then on.

One thing we do not do with it: we do not use it to make or influence a decision about an individual — hiring, staffing, promotion, eligibility, pricing for a person, or anything else about one identified human being. Aggregate work answers questions about groups. Using it to answer a question about a person would defeat the aggregation that makes it acceptable in the first place.

Deleting your information

You can delete a workspace yourself, in the product, at any time. That works today.

You can delete a conversation and its transcript yourself as well. That also works today.

Deleting a conversation removes the transcript and the record of the model runs behind it together. It cannot be undone, and we do not keep a shadow copy. If a transcript was included in something you sent us earlier, deleting it here does not reach that copy — email us and we will remove that too.

Your rights

Depending on where you live, you may have the right to see what we hold, correct it, delete it, obtain a copy, or object to how it is used. Residents of California, and people in the United Kingdom and European Economic Area, have specific statutory rights. Email us and we will respond within 30 days. We will not charge you, and we will not treat you differently for asking.

We do not sell personal information, as “sale” is defined under applicable United States state privacy laws, and we do not share it for cross-context behavioural advertising as those laws define that term. We are bounding this to the statutory definitions deliberately rather than leaving it absolute: those definitions are broad enough to catch ordinary arrangements with service providers, and a promise we could breach by hiring a hosting company would not be worth making. The plain-English version is that nobody pays us for your information and we are not in that business.

For Magnolia Haven the statement is unqualified and appears above: we do not sell that information in any sense of the word, and no definition of “sale” changes it.

Universal opt-out signals. If your browser or an extension sends a Global Privacy Control signal, we treat it as an opt-out for that browser without asking you to do anything else. Several states require this; we apply it to every visitor rather than determining where you live first, because working out who is entitled to the protection costs more than just giving it to everybody.

How to exercise a right. Email privacy@magnoliasystems.ai. We will acknowledge within 10 business days and respond within 45 calendar days, and will tell you if we need longer and why. If we refuse a request we will say which exemption we are relying on rather than simply declining. You may appeal a refusal by replying to that decision; an appeal goes to someone who did not make the original call.

We will not charge you for any of this, and we will not degrade the product because you asked. Any discount or programme that does depend on data use will say so at the point we offer it.

Security

Sign-in is handled by Microsoft Entra; we never see or store a password. Content is encrypted in transit and at rest. The IRIS data store is reachable only over a private network path. Access by our staff is limited to those who need it to review a request or support you.

No system is perfectly secure, and anyone who tells you otherwise is selling something. If we discover a breach affecting your information, we will tell you and the relevant regulator as the law requires.

Young people

IRIS and Synergy are business tools and are not intended for anyone under 18. Magnolia FieldSense is used by organisations that enrol young athletes; where it is, the organisation obtains parental consent and we act on its instructions.

Where we know or reasonably should know that someone is under 18, we do not use their information for targeted advertising, we do not sell it, and we do not profile them for decisions with a legal or similarly significant effect. Several states set that standard with no lower age bound and no way to consent around it, so we apply it as a flat rule rather than working out which state a person is in.

If you believe a child has given us information, email us and we will delete it.

If the company is sold

If Magnolia Systems is acquired, merges, reorganises, or sells a business line, information may move with it. Two commitments attach to that, and they are the point of this section:

• Your information stays subject to the promises made in the policy you signed up under, not merely whichever version is current on the day of the sale. A buyer takes it with those commitments attached. We are wording it this way on purpose: the alternative — binding a buyer only to the current policy — lets a company amend its way into a sale it could not otherwise make, and that has happened.
• Magnolia Haven information is not transferable to a buyer who will not adopt these same commitments, and never to one who intends to sell it.

We will tell account holders by email before such a transfer completes, with enough notice to export or delete first.

Changes to this policy

We will change this document as the products change. When we do:

• Changes apply going forward, not backwards. Information we already collected stays governed by the policy in force when we collected it. If we want a genuinely new use for information already held, we ask — a revised policy is not how we would do that, and in several states it could not be.
• We notify before a material change takes effect, by email to account holders, at least 30 days ahead, rather than relying on you to re-read this page. You are not expected to check it periodically.
• The effective date at the top always changes when the text does, and previous versions are in our source history, which is public.