Terms, privacy, and security.

Terms of service

These terms govern your access to and use of the SmixAI platform and related professional services ("Services"). The Services are operated by N.G.A SOFTWARE SOLUTIONS LTD ("SmixAI," "we," "us," or "our"), the company behind SmixAI. By using the Services, you agree to these terms.

1. The service

SmixAI connects to enterprise systems you authorize, analyzes configuration and metadata to produce grounded findings, and provides tooling to plan and operate AI-driven transformation.

2. Accounts & access

You are responsible for the accuracy of account information and for safeguarding credentials and connection authorizations. You must promptly notify us of any unauthorized use.

3. Acceptable use

You agree not to misuse the Services, including attempting to access another tenant's data, reverse-engineer the platform, or use outputs to violate applicable law or third-party rights.

4. Customer data & connected systems

You retain all rights to your data. You grant us a limited license to process connection metadata and findings solely to provide the Services. Record-level data remains in the source system and is accessed under the permissions you configure.

5. Fees

Paid plans and professional-services engagements are billed per the applicable order or statement of work. Fees are non-refundable except as required by law or expressly stated.

6. Intellectual property

The platform, including its software and methodology, is owned by N.G.A SOFTWARE SOLUTIONS LTD. These terms grant no rights other than the limited right to use the Services.

7. Disclaimers

Findings and ROI estimates are provided for informational purposes and depend on the data available in connected systems. The Services are provided "as is" without warranties of any kind to the extent permitted by law.

8. Limitation of liability

To the maximum extent permitted by law, SmixAI is not liable for indirect, incidental, or consequential damages, and total liability is limited to the amounts paid for the Services in the preceding twelve months.

9. Termination

Either party may terminate per the applicable order. On termination, we will disconnect integrations and delete or return access metadata in line with the privacy policy.

10. Governing law

These terms are governed by the laws of the jurisdiction stated in your order. Where no order states a jurisdiction, these terms are governed by the laws of the State of Israel, and disputes are subject to the competent courts of Tel Aviv-Jaffa, Israel.

11. Contracting entity

The Services are provided by N.G.A SOFTWARE SOLUTIONS LTD (company no. 515594521), לויתן 4, Netanya, Israel. For legal notices, contact legal@smixai.com; for privacy notices, contact privacy@smixai.com.

Privacy policy

Effective date: July 9, 2026 · Last updated: October 1, 2026

This Privacy Policy describes how N.G.A SOFTWARE SOLUTIONS LTD ("SmixAI," "we," "us," or "our"), the company operating SmixAI, collects, uses, stores, and shares information in connection with the SmixAI platform, available at smixai.com (the "Service"). N.G.A SOFTWARE SOLUTIONS LTD is the data controller for personal data processed about visitors to our website and about authorized users of the Service.

SmixAI is a multi-tenant B2B AI transformation platform that connects to a customer organization's enterprise systems to identify inefficiencies, generate recommendations, and deploy AI agents that act on those recommendations. This policy applies to visitors to our website, to authorized users of the Service acting on behalf of a customer organization ("Customer"), and to any third-party data (including Google user data) that SmixAI processes through connected systems.

If you are an end user of a Customer that uses SmixAI, your organization's own privacy policy and internal agreements also govern how your data is handled. Contact your organization's administrator with questions about your organization's specific configuration.

1. Information we collect

Account and authentication information. When you or your organization sign up for SmixAI, we collect information necessary to create and secure an account, including name, work email address, organization name, and authentication data processed through our third-party identity provider. If you sign in using a third-party account (such as signing in with Google), we receive basic profile information (name, email address) from that provider as authorized by you during sign-in.

Connected system data. With explicit authorization from a Customer administrator, SmixAI connects to a Customer's enterprise systems through OAuth or API credentials the Customer provides. Depending on which connectors a Customer enables, this may include data from third-party enterprise systems the Customer chooses to connect — such as CRM, source-control, email, integration, ERP, project-management and API tools. This data may include metadata about system configuration, workflows, records, and usage patterns needed to generate findings and recommendations. SmixAI does not initiate connections to any system without a Customer's explicit configuration and consent. Record-level data remains in the source system; we minimize what we store to the access metadata and findings needed to operate the Service.

Usage and technical data. We automatically collect certain technical information when you use the Service, including IP address, browser type, device information, log data, and usage patterns, through third-party error-tracking and logging tools. We may aggregate or de-identify this usage data so that it no longer identifies any individual, and use it as described in "Analytics and product improvement" in Section 3.

Meetings. If your organisation uses the SmixAI desktop recorder, we process meeting transcripts and participant names to produce summaries and follow-ups. Audio stays on the user's computer.

Gmail. If you connect Gmail, email content is processed by AI and may be stored as comments on requests. We follow Google's Limited Use rules.

AI processing. SmixAI is an AI product, so producing findings, summaries and recommendations means your data is processed by AI — this includes SmixAI's own AI, not only an external AI client. If your organisation connects an external AI client, masked data is shared with that client under your settings. Data sent for AI processing is used only to provide the Service.

2. Signing in with Google

SmixAI offers "Sign in with Google" as an authentication option, provided through our third-party identity provider. When you choose to sign in or sign up using Google, we receive only basic profile information from Google: your name, your email address, and your Google account profile picture (if available).

We use this information solely to create and authenticate your SmixAI account. We do not request or receive access to your Gmail messages, Google Drive files, calendar, or any other Google service through this sign-in method. SmixAI does not use this information for advertising, does not sell it, and does not share it with third parties except as described in Section 4 (service providers necessary to operate the Service).

Separately, SmixAI offers an optional Google Workspace connector that, when a Customer administrator explicitly enables and authorizes it for their own organization's use, may access additional Google Workspace data (such as Gmail) for that Customer's specific business purposes. That connector requests its own distinct authorization and is covered by a separate disclosure at the time it is enabled; it is not part of, and is not required for, signing in to SmixAI.

Limited Use. SmixAI's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Google user data is never used for advertising, never sold, and never used to train generalized AI or machine-learning models.

3. How we use information

• Provide, maintain, and improve the Service.
• Analytics and product improvement. Analyze aggregated and de-identified usage data — such as feature usage, interaction events, and error rates — to understand how the Service is used, to improve, secure and develop the Service, and to produce internal and aggregate reporting. This data does not identify any individual. We do not use customer content (such as connected-system records, meeting transcripts, or message content) or Google user data for these analytics or for product improvement; that data is processed only to deliver the Service to the Customer that provided it.
• Authenticate users and secure accounts.
• Generate discovery findings, ROI-scored recommendations, and AI agent actions on behalf of an authorizing Customer.
• Route requests to our AI processing pipeline (see how we share information in Section 4) to analyze connected-system data and produce findings and recommendations.
• Monitor system health, detect and prevent abuse, and debug errors.
• Communicate with Customers about their account, the Service, and support requests.
• Comply with legal obligations.

4. How we share information

We do not sell personal information or Google user data. We share information only in the following circumstances.

Service providers (subprocessors). We use third-party infrastructure and service providers to operate SmixAI. The current list — what each one processes, and where — is maintained on our sub-processor page, which is the single, authoritative source. We give at least 30 days' notice before a new sub-processor begins processing customer personal data.

These providers process data solely to provide their contracted service to SmixAI and are bound by confidentiality and data protection obligations.

Within a Customer's own organization. Data connected to SmixAI on behalf of a Customer is visible only to authorized users within that Customer's organization (enforced through per-tenant isolation and role-based access controls), unless the Customer configures otherwise.

Legal requirements. We may disclose information if required to do so by law, or in the good-faith belief that such action is necessary to comply with legal process, protect our rights, or protect the safety of users or the public.

Business transfers. If SmixAI is involved in a merger, acquisition, or sale of assets, information may be transferred as part of that transaction, subject to the confidentiality commitments in this policy and, for Google user data, subject to the user's affirmative consent where required.

5. Data storage, security, and residency

• Connector credentials are encrypted (AES-256-GCM) at rest and never stored in plaintext.
• Your data is stored in the EU (Ireland). Application processing, background jobs and AI processing run in the United States. See our sub-processor list. Per-tenant isolation is enforced at the application and database layer.
• Where data is transferred across regions, we apply appropriate safeguards.
• Access to production systems is restricted to authorized personnel and logged.

No method of transmission or storage is 100% secure. While we implement industry-standard safeguards, we cannot guarantee absolute security.

SmixAI is not currently offered to organisations based in the European Union.

6. Data retention

We retain information for as long as necessary to provide the Service to the Customer, or as required by contractual or legal obligations. Customers may request deletion of their organization's data by contacting us (Section 8). Google user data is retained only as long as necessary to provide the authorized feature, and is deleted or de-identified when no longer needed, or upon revocation of authorization, whichever comes first.

7. Your rights and choices

Depending on your location and applicable law (including GDPR for EU/EEA individuals), you may have rights to access, correct, delete, restrict, or port your personal information, and to withdraw consent at any time. To exercise any of these rights, contact us using the details in Section 8, or use the "Privacy or data request (access, correction, deletion)" category on our contact form.

Revoking Google access. You can revoke SmixAI's access to your Google account at any time via your Google Account permissions page. Revoking access will stop SmixAI from accessing your Google data going forward but does not automatically delete data already processed; contact us to request deletion.

8. Contact us

For privacy questions, data deletion requests, or to exercise your rights under this policy, email our privacy contact at privacy@smixai.com or contact us. The data controller is N.G.A SOFTWARE SOLUTIONS LTD (company no. 515594521).

9. Changes to this policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify Customers via the Service or by email, and update the "Last updated" date above. Continued use of the Service after changes take effect constitutes acceptance of the revised policy.

This policy is intended to be read together with SmixAI's Terms of Service and any separate Data Processing Agreement (DPA) entered into with Enterprise Customers.

Cookie policy

We use only essential cookies that sign you in and keep the service secure. We do not use analytics or advertising cookies. If that changes, we will ask for your consent first.

Open-source licences

Our software builds on open-source components, and we honour their licences. The desktop recorder and the agent bundles you download each ship a THIRD-PARTY-NOTICESfile that lists the open-source components they include and reproduces the licences that require it.

In particular, the desktop recorder includes the FFmpeg libraries (via the PyAV package), which are licensed under the GNU Lesser General Public License (LGPL). ItsTHIRD-PARTY-NOTICES file contains the full LGPL text and tells you where to obtain the corresponding source code. You can also request that source by emailing legal@smixai.com.

We do not ship components under the GPL, AGPL, SSPL or BUSL inside our products; our release checks fail if such a dependency is introduced.

Security overview

Security is built into the platform, not bolted on.

• Tenant isolation — each customer's data is kept separate from every other customer's, and we test that separation.
• Least privilege — connections use scoped credentials; record data is read under your permissions.
• Encryption — data encrypted in transit and at rest.
• Auditability — access decisions are logged with their reason for audit and chargeback.
• Credential encryption — credentials for your connected systems are encrypted at rest (AES-256-GCM).

For a detailed security questionnaire, contact us. To report a vulnerability, see our security disclosure policy below.

Vulnerability disclosure policy

We welcome reports from security researchers and treat them as a priority. This policy explains how to report an issue, what is in scope, and what you can expect from us. It is the human-readable companion to our machine-readable security.txt.

Reporting a vulnerability

Email security@smixai.com with enough detail to reproduce the issue: the affected URL or component, the steps, and the impact you observed. Please report in English or Hebrew, and give us a reasonable time to investigate and remediate before any public disclosure. Do not open a public GitHub issue for a security vulnerability.

Scope

In scope: the SmixAI web application at smixai.com, its API, and the customer portals we host. Out of scope: findings that require a compromised device or account, social-engineering of our staff or customers, physical attacks, volumetric denial-of-service, and reports from automated scanners with no demonstrated impact. Vulnerabilities in third-party services we integrate with should be reported to those vendors.

Rules of engagement

• Only test against your own account and organization. Never access, modify, or delete another tenant's data.
• Do not run tests that degrade service for others (load or stress testing, resource exhaustion).
• Stop as soon as you have demonstrated a vulnerability, and do not exfiltrate more data than is necessary to prove it.
• Keep the details of any vulnerability confidential until we confirm it is resolved.

Safe harbour

If you make a good-faith effort to comply with this policy during your research, we will consider your activity authorized, will not pursue or support legal action against you for it, and will work with you to understand and resolve the issue quickly. If legal action is initiated by a third party against you for activity that complied with this policy, we will make this authorization known.

What to expect

We aim to acknowledge a report within three business days, keep you informed as we investigate, and let you know when the issue is resolved. We do not currently operate a paid bug-bounty program, but we are glad to credit reporters who wish to be acknowledged once a fix has shipped.