Effective date: March 25, 2026 | Last updated: October 30, 2026

Privacy Policy

This Privacy Policy describes how Cedar AI Agents, Inc. ("Legit," "we," "us," or "our") collects, uses, and protects information in connection with the Legit platform (the "Service"). Legit is incorporated in British Columbia, Canada.

1. Information We Process

Legit processes three categories of data:

Customer Data — data you and your organization provide through the Service. This includes:

Network Data — professional and company data Legit obtains from sources other than you, used to build and enrich the professional network graph that powers referral matching. This includes:

Service Data — data Legit collects automatically to operate and improve the Service:

2. How We Use Information

Legit uses Customer Data solely to provide the Service to you. Specifically:

Legit does not use Customer Data to train general-purpose AI or machine learning models, to build profiles for advertising, or for any purpose other than delivering the Service to you.

Legit uses Network Data to build and maintain the professional network graph that identifies possible referral paths between an employee and a candidate. Network Data is not used to train general-purpose AI or machine learning models, is not used for advertising, and is not used for any purpose other than operating the Service.

3. AI and Machine Learning

Legit's Service uses AI to generate recommendations. Our AI processes your data as follows:

4. Sharing and Sub-Processors

Legit shares data only as necessary to deliver the Service. Our key sub-processors are:

Network Data is processed by the same sub-processors listed above where necessary to operate the Service. Legit does not sell, rent, or share Customer Data or Network Data with third parties for their own purposes.

5. Data Retention and Deletion

Legit retains Customer Data for the duration of your active subscription or evaluation period. Upon termination:

Some sub-processors delete or expire content on their own retention schedules; where that schedule is shorter, content may be removed before the periods described above.

Service Data. Session replay data is deleted automatically within 30 days of capture under a storage lifecycle rule, whether or not your subscription has ended. Other Service Data is retained only as long as needed to operate, secure, and support the Service.

Network Data. Legit retains Network Data for as long as it remains relevant to the professional network graph. Individuals whose information appears in Network Data may contact Legit about that information as described in Section 8.

6. Security

Legit protects Customer Data using industry-standard security measures, including:

In the event of a security incident affecting Customer Data, Legit will notify affected customers within 72 hours of confirmed discovery.

7. International Data Transfers

Legit is incorporated in Canada, which the European Commission recognizes as providing an adequate level of data protection for commercial organizations. Customer Data may be processed in the United States by the sub-processors listed in Section 4. For those onward transfers, Legit relies on the transfer mechanisms in its agreements with those sub-processors, including Standard Contractual Clauses or equivalent frameworks, as required under applicable data protection law.

8. Your Rights

Depending on their location, customers, their employees, and individuals whose professional information Legit holds as Network Data may have rights with respect to personal data, including:

To exercise these rights, contact support@getcedar.ai. Legit will respond within 30 days. Individuals whose professional information Legit holds as Network Data may contact Legit at the same address regarding that information, and Legit will respond to such requests as required under applicable data protection law. Where Legit processes personal data on behalf of a customer, Legit will refer the request to that customer and assist in responding to it.

9. Cookies and Tracking

Legit's Service operates primarily within Slack and does not use cookies or tracking technologies for advertising purposes. Our website (legit.io) may use minimal analytics to understand visitor behavior. Legit's web application records session replay data as described in Section 1, which Legit uses to diagnose errors and support users, not for advertising or profiling. No personal data is sold or shared with advertising networks.

10. Changes to This Policy

Legit may update this Privacy Policy from time to time. Material changes will be communicated to active customers with at least 30 days notice. The current version is always available at legit.io/privacy.

11. Contact

For questions about this Privacy Policy, contact Legit at: support@getcedar.ai

Cedar AI Agents, Inc., Suite 2700, The Stack, 1133 Melville St, Vancouver, BC V6E 4E5, Canada