Privacy Policy

When we change this policy we publish a new numbered version and update the effective date. A change to what we collect, why we collect it, or who we share it with increments the whole number (2.0, 3.0); a clarification that does not increments the decimal (1.1, 1.2). Section 13 explains how we notify you.

1. The short version

• We hold your email address, your uploaded presentations, what we generate from them, and a record of what you paid for.
• Your presentation is read by an AI model running on AWS, called from our own AWS account. AWS does not store what we send the model or what it returns, and Anthropic, who make the model, never receive your presentation. The paid full package may also read public web pages to check facts your deck states (§3.2).
• Your presentation and everything we generate from it are deleted automatically, currently 30 days after your analysis finishes, and we email you three days before.
• You can delete your data yourself at any time from your account.
• We keep billing and audit records after a deletion, because they are financial and legal records.
• Card details never reach us. Paddle handles payment as our authorised reseller and merchant of record.
• In the portal we set one cookie, and it exists to keep you signed in. Our public website, pmoc.ai, uses analytics that sets one more — asking first where the law requires it — so we can see which pages lead people to sign up, and when you create an account we join those visits to it. There is no advertising, no tracking across other websites, and nothing is sold.

The rest of this document is the detail behind those sentences.

2. Who is responsible for your data

The Psychology of Mafia Offer service is operated by Ogenics Ltd., a private limited company registered in Israel under company number 516909900. For data-protection purposes that company is the controller of the personal data described here — meaning we decide why and how it is processed. In this document, “we”, “us” and “our” mean that company.

Questions, requests and complaints: support@pmoc.ai. We answer in English and in Hebrew, and we aim to respond within five working days.

3. What we collect, and why

3.1 Account data

3.2 Your presentations and what we make from them

This is the heart of it, and it is the most sensitive material we hold.

Web access (full package only). To check facts your deck states, such as a market size or a competitor’s claim, the full package may read public web pages. The page addresses are chosen by the model and can include words and figures from your deck. Pages are fetched by our servers from the public sites concerned, which receive our server’s address and the page requested, and nothing else from your deck. The free scorecard does not use the web.

We hold this in order to produce your analysis and to let you come back to it later — that is, to perform our contract with you. A deck may contain personal data about other people (a team slide, a customer quote, a named reference). We process that only as part of analysing the deck, and §4.3 of the Terms asks you not to upload material you have no right to share.

3.3 Payment data

Payment is taken by Paddle, which is our authorised reseller and merchant of record: Paddle is the seller of the transaction, charges any sales tax or VAT due, issues your receipt and invoice, and is the party your card is charged by. Your card details go from your browser to Paddle inside Paddle’s own payment window and never pass through our servers. Paddle also collects billing information (including your email address and the country it needs for tax) directly from you, under Paddle’s own privacy notice. We send Paddle your email address before the payment, so the receipt reaches the right person.

The amount we record against your account is the price of the package, not the tax Paddle adds: the tax is Paddle’s to collect and remit, and we never hold it.

3.4 How you use the portal, and our public website

The portal. We record a fixed set of product events so we can see where the service works and where it does not: signing in, viewing a page, leaving a page, clicking a control, starting an upload, an upload succeeding or failing, opening an analysis, downloading a deliverable, reaching a paywall, starting a checkout, signing up (started, completed or failed), confirming your email address, and a session ending. That list is the whole list: our servers reject any event type that is not on it.

Each event carries its type, the time, a one-way hash of a random identifier that ties one browsing session together, and — when you are signed in — which account and user it belonged to. An event may also carry which page you were on, how long you spent on it, how far down it you scrolled, the name of the control you clicked (a short internal label such as download-file, chosen by us, not text you typed or a file you named), the identifier of the analysis in view, and any campaign parameters in the link you arrived from.

It does not carry your IP address or your browser’s user-agent string, and it never carries anything you typed or uploaded: no file names, no deck titles, no email addresses, no page text. Our server drops any value that is not on the published list before the event is stored.

We do this on the basis of our legitimate interest in understanding and improving the service. In the portal there is no advertising network involved, no third-party analytics provider, no cross-site tracking, and no profile is built about you as an individual from these events. Our public website is different in one respect, and the rest of this section says exactly how.

Our public website, pmoc.ai. The website — the pages that describe the service, not the portal you sign in to — uses PostHog, an analytics service we run on its servers in the EU, to count visits and to see which pages and buttons lead people to sign up. It records the pages you view and the buttons you click, the site that referred you, any campaign parameters in the link you followed, your screen size, and your browser and operating system. Your IP address is used to work out a country and is then discarded. No page text, no form contents and no file names are ever recorded, and the website’s requests go to our own domain, not to a third-party host.

If you are in the EU, the UK, Iceland, Liechtenstein, Norway or Switzerland, the website asks before it sets a cookie, and PostHog records nothing until you answer. If you allow it, a cookie holding a random identifier is set for up to twelve months so that a return visit is recognised. If you decline, nothing is stored in your browser; at most the visit is counted through a value that changes daily and cannot recognise you tomorrow. Elsewhere the cookie is set without asking, because the law there allows it. Wherever you are, the “Privacy choices” link in the website’s footer lets you decline, or change an earlier answer.

When you create an account, we join the two. The identifier from the website cookie is sent with your signup, stored on your user record, and we tell PostHog that the visits it recorded under that identifier belong to your user. PostHog never receives your email address or your name — only that identifier and the random id of your user record. This is the one place we link website browsing to a person, and it exists so we can see which pages and campaigns actually lead to accounts, not just to clicks. You can object at any time (§8); we will unlink the identifier from your record and ask PostHog to delete what it holds under it.

The legal basis for the website is our legitimate interest in understanding what brings people to the service, and, for the cookie where the law requires it, your consent.

3.5 Server logs

Our web servers write a standard access log for every request: the IP address, the date and time, the request line, the response status and size, the referring page and the browser’s user-agent string. Values in a URL that look like a credential are stripped before anything is written.

These logs exist to keep the service running and secure — diagnosing faults, investigating abuse — which is our legitimate interest. They are rotated automatically as they grow, so old entries are overwritten; we do not archive them long-term.

3.6 Support correspondence

If you email us, we have your email and whatever you put in it, for as long as we need it to deal with your request and to keep a record of what was agreed.

3.7 Records of what our own staff did

Administrative actions on an account — changing a setting, granting a package, issuing an invitation — are written to an append-only audit log with a before-and-after record. It exists so that “who changed this?” is answerable, and it is deliberately outside the deletion path.

3.8 What we never collect

We do not ask for and do not want: government identity documents, health data, biometric data, racial or ethnic origin, political opinions, religious beliefs, trade-union membership, sex life or sexual orientation, or criminal-offence data. We do not buy personal data from anyone, we do not enrich your record from third-party data brokers, and we do not build advertising profiles.

4. Who else sees your data

We use a small number of providers to run the service. Each processes data only on our instructions and for the purpose in the table.

4.1 Sub-processors

Anthropic is not on this list, and that is deliberate. Anthropic makes the Claude models that analyse your deck, but on Amazon Bedrock they do not run them for us. AWS deploys a copy of the model into an account Anthropic cannot access, so Anthropic receives neither your presentation, nor the prompts, nor the results, nor the logs. They are not a processor of your content, because none of your content reaches them. See §9 of the Terms.

The public websites that the full package reads (§3.2) are not sub-processors: they receive our server’s address and a page request, not your deck.

We do not sell personal data, we do not share it with advertisers, and we do not disclose it to anyone else except where §4.3 applies.

4.2 Notice of changes

If we add or replace a sub-processor in a way that materially changes how your data is handled, we will update this page and note the change here.

Version 6.0, effective 8 October 2026: a free scorecard, a paid full package, and web access. The free analysis is now a scorecard, and what was sold as two separate unlocks is now one full package. The full package may read public web pages to check facts in your deck; the page addresses can include words and figures from your deck, and the public sites concerned receive our server’s address and the page requested (§3.2). The service now accepts .pptx and .pdf files for new analyses. A paid package that was never delivered is kept until it is delivered or refunded (§6). The AI model still runs on Amazon Bedrock, and no new company receives your presentation. Nothing else changed about what we collect or how long we keep it.

Version 5.0, effective 4 September 2026: analytics on our public website, and a link from it to your account. Our public website, pmoc.ai, now uses PostHog, on its EU cloud, to count visits and see which pages lead people to sign up; PostHog is a new sub-processor and §3.4 describes what it receives. Two things are genuinely new. The website sets an analytics cookie — asking first in the EU, the UK, the EEA and Switzerland, and without asking elsewhere — which is the first cookie we set that is not strictly necessary, and §9 now says so. And when you create an account, the website’s anonymous identifier is stored on your user record and reported to PostHog, so the visits before your signup are joined to your user; §3.4 explains why and how to object. Nothing changed about the portal’s own event capture, and PostHog receives nothing from inside the portal.

Version 4.0, effective 3 September 2026: more detail in the product events we already collect. The events described in §3.4 may now also record which page you were on, how long you spent on it, how far you scrolled, and the internal name of the control you clicked. The list of event types they can carry is still fixed and is enforced by our servers, and the values they can carry are now checked against a published list before anything is stored. No new company sees your data, no cookie was added, no browser storage was added, and we still do not record your IP address or your browser’s user-agent string with these events. The random session identifier is now stored as a one-way hash. We also began deleting these events automatically at 24 months, which is the retention period this policy has always stated, and the account-level “delete all of my data” control now removes them too. We have additionally listed the pmo_first_touch browser-storage key in §9, which was in use but not previously named there.

Version 3.0, effective 30 August 2026: occasional email about your results and our services. We may now send account holders occasional email about their results and our services, through Postmark, on a separate sending stream from the account email above. Every such message carries an unsubscribe link; opting out is immediate, is recorded both at Postmark and in our own records, and never affects verification, password-reset, expiry-warning or deletion-confirmation email. Nothing else changed about what we collect or how long we keep it.

Version 2.0, effective 11 August 2026: transactional email moved from Amazon SES to Postmark. Postmark now receives your email address and the contents of the messages we send you; Amazon Web Services no longer handles that mail. AWS remains our host and still holds your email address in the database. Nothing else changed about what we collect, why we collect it, or how long we keep it, and no part of your presentation or its analysis reaches Postmark.

4.3 Legal disclosure

We may disclose data where we are legally required to — a valid court order or a lawful demand from an authority — or where it is necessary to establish, exercise or defend a legal claim, or to prevent fraud or a serious threat to someone’s safety. Where we are allowed to tell you, we will.

If the business is sold or merged, account and billing records may pass to the buyer, who would be bound by this policy or one no less protective. We would tell you before that happened.

5. Sending data outside your country

We are an Israeli company, and the providers in §4.1 operate in the United States and elsewhere. Your data will therefore be processed outside your own country, including in the United States. We do not offer a choice of storage region.

For personal data coming from the EEA or the UK, the transfer mechanisms we rely on are:

• Israel benefits from a European Commission adequacy decision, so transfers to us do not need additional safeguards.
• Transfers onward to our US providers rely on those providers’ standard contractual clauses and, where applicable, their certification under the EU-US and UK-US Data Privacy Frameworks.

6. How long we keep things

6.1 What “deleted” means here

When something is deleted, the file is removed from our object storage, the worker’s working copy is removed, and the queue record is removed. It is not hidden behind a flag; it is gone, and it cannot be restored for you.

Two honest qualifications:

1. Backups lag deletion. A backup taken before you deleted something still contains it until that backup ages out of rotation.
2. Very old analyses. Files written before the current storage layout are stored under an older naming scheme that the per-analysis deletion does not yet reach. We are fixing that; until we have, the statement above is fully true of recent analyses and not yet fully true of the oldest ones.

7. Deleting your data yourself

Two controls, both in your account, both immediate:

Delete one analysis. Removes the presentation and everything generated from it. Your scores stay in your history. Your billing records stay.

Delete all of my data. Does the same for every analysis on the account, also removes the scores, and removes the account’s product-usage events (§3.4).

Both require you to type a confirmation phrase, both are recorded in our audit log, and both send you a confirmation email listing what was removed and what was kept.

What neither of them does:

• Neither closes your account. Your sign-in still works. Closing an account is a request to support@pmoc.ai.
• Neither removes billing records, which we keep as financial records.
• Neither restores a used free analysis. The confirmation screen says so before you commit.
• Neither can interrupt an analysis that is mid-processing; wait for it to finish, then delete.

8. Your rights

Depending on where you live, you have some or all of the following rights. We apply them to everyone, wherever you are, because running two standards is harder than running one.

We will answer within one month. If a request is genuinely complex we may take longer and will tell you why. We will not charge you, and we will not retaliate. We may need to confirm it is really you before we act on a request about an account.

Automated decision-making. The Service analyses documents automatically, but it does not make automated decisions about people that produce legal or similarly significant effects. Nobody is accepted, rejected, priced or profiled by our software.

8.1 If the GDPR applies to you

You are dealing with a controller established outside the EEA. The legal bases we rely on are in the tables in §3: mostly performance of our contract with you, plus legitimate interests for security, abuse prevention and product analytics, plus legal obligation for financial records. Where we rely on legitimate interests, we have weighed them against your rights, and you can object.

8.2 If you are in Israel

The Privacy Protection Law, 5741-1981 gives you the right to inspect the information we hold about you and to ask for it to be corrected or deleted, and a right of complaint to the Privacy Protection Authority. Use the same address as everyone else: support@pmoc.ai.

9. Cookies and browser storage

In the portal, we set one cookie for customers.

There is one more cookie, pmo_admin_session, which does the same job for our own staff. It is never set on a customer’s browser.

In the portal, that is the complete list. No advertising cookies. No analytics cookies. No third-party cookies. No tracking pixels. Nothing that follows you to another website. Because everything the portal sets is strictly necessary to deliver a service you asked for, the portal shows no cookie banner — there is nothing to consent to or refuse.

Our public website, pmoc.ai, sets one more cookie, and it is the one exception to the paragraph above:

The website shows a consent bar where consent is required, and the “Privacy choices” link in its footer reopens it wherever you are. The website also keeps two small values in your browser’s storage — pmoc_consent, your answer, and __ph_opt_in_out_<key>, PostHog’s own record of the same answer — so that you are not asked twice.

The portal also uses your browser’s own storage. None of it is a cookie, and none of it is sent with every request the way a cookie is:

Clearing your cookies signs you out. Clearing the browser storage above resets your language choice and nothing else; your analyses and your account are held on our servers, not in your browser.

Note the font point in §4.1: portal pages currently load their typeface from Google’s font service, which means Google’s servers see your IP address when a page loads, even though we set no Google cookie.

10. What we cannot delete, and why

If you ask us to erase everything, some records will still stand:

• Financial records — payments, receipts and what was purchased. Tax and company law require them.
• The audit log of administrative actions on your account. It is append-only by design; that is what makes it worth having.
• Backups, until they age out of rotation (§6.1).
• Anything we must keep to comply with a legal obligation or to defend a legal claim.

We keep the minimum, we keep it no longer than we have to, and we do not use it for anything else.

11. How we protect it

The honest summary — and the things we deliberately do not claim — are in our public security policy. The short version:

• Passwords are argon2 hashes. API keys and emailed one-time links are stored as hashes, are single-use and expire.
• Traffic between you and us is encrypted with TLS. Download links are short-lived and generated per request.
• Every query for your data is scoped to your account in the database itself, not in the page.
• The full package, until you buy it, is not generated, so there is nothing to send to your browser.
• Card details never reach us; payment events from Paddle are signature-verified and replay-protected.
• Our staff’s actions on your account are logged.
• Your files are held in a private bucket that is encrypted at rest and cannot be made public. The database and the cache are encrypted at rest too, and neither is reachable from the internet.
• What we send the AI model, and what it returns, is not stored by AWS and is never received by the company that makes the model. §9 of the Terms sets this out in full.

And what is not true today, stated here so nobody has to infer it: we hold no SOC 2, ISO 27001 or PCI certification of our own; we have not had a third-party penetration test; our backups are not separately encrypted by us before they are stored, beyond the storage’s own encryption; there is no uptime commitment, no multi-factor authentication for customers, and no single sign-on.

No service is perfectly secure. If you find a problem, our security policy explains how to tell us.

11.1 If something goes wrong

If a breach affects your personal data and is likely to put you at risk, we will notify you and the relevant authority within the time the law requires.

12. Children

The Service is for business use by adults. We do not aim it at children, we do not knowingly collect data from anyone under 18, and if we discover we have, we will delete it. If you believe a child has given us data, tell us at support@pmoc.ai.

13. Changes to this policy

We may update this policy. The version and date at the top always say which version is current. If a change materially affects how we handle your personal data, we will tell you by email or in the portal before it takes effect.

This policy is published in English. The portal itself is available in English and Hebrew, and we may publish a translation of this policy for convenience; if a translation and the English version disagree, the English version governs.

14. Contact us

If you are in the EEA or the UK and you think we have handled your personal data wrongly, you may also complain to your local supervisory authority. We would rather you came to us first so we can put it right.