Effective date: September 12, 2026 | Last updated: September 15, 2026

Legit Privacy Policy

Legit is a personal networking assistant operated by Cedar AI Agents, Inc. ("Cedar," "we," "us," or "our"), a corporation incorporated in British Columbia, Canada. You talk to it in a chat at app.getcedar.ai/legit and, once text messaging is available, over text messages; it can connect to accounts you choose so it can find the people you know and make introductions on your behalf. This policy describes how Legit collects, uses, stores and shares information. It applies to Legit only; Cedar's platform for organizations has its own Privacy Policy.

1. Information Legit Collects

• Your sign-in details: the email address, and the phone number if you use one, that you sign in with. If you use Legit over text messages, your phone number is taken from the first text message you send; Legit does not create an account for a number that has never messaged it.
• Your messages to Legit and its replies, which are how you use the product.
• Contacts and connections you import. Legit stores what you choose to share so it can show you the people you know and let you pick who to share with:
  • your LinkedIn connections export, once importing the full connections list is available (name, employer, title, the date you connected, and email where the connection allowed it)
  • your Google or Microsoft contacts, including Google's "other contacts" (names, email addresses, phone numbers, organisations)
  • contacts from your phone, if you choose to share them once texting is available (names, phone numbers, email addresses)
• Data from accounts you connect, such as Gmail and Google Calendar, as described in Section 3.
• Public professional data about the people you import: Legit looks them up in licensed public professional data to add their current role, employer and profile photo, used to show you who they are.
• Service data: which features you use and when, usage logs, system performance data and error reports needed to run and secure the service; session replay data (a recording of the pages and interactions in the Legit web account, where enabled), used to diagnose errors and support you; and aggregated, anonymized statistics about how the service is used. Aggregated statistics are never derived from Google user data.

2. How Legit Uses Information

• To show you the people you know and let you choose who to share your network with
• To order the people you know by how recently and how often you have been in touch, using email headers and calendar attendance where you connected them
• To make the introductions you ask for, and only those, after the other side has agreed
• To reply to you and to follow up on things you asked Legit to do
• To keep the service secure and to prevent abuse

Information about other people that you import is held as your data: it is used only inside your own Legit network and for introductions you ask for, it is never sold, never used for advertising, and never shown to other users unless you share a specific person with them. Legit does not use your data to train general-purpose AI or machine learning models, to build profiles for advertising, or for any purpose other than delivering Legit to you.

AI and machine learning. Legit uses AI to understand your messages, find people you know and compose introductions. Our AI processes your data as follows:

• Inference only: your data is used to generate results for your benefit, not to train or improve Cedar's models for other users
• No general model training: Cedar does not use your data to train, fine-tune, or update any general-purpose AI or machine learning model
• Google (Gemini): Cedar uses Google's Gemini models for AI inference under the applicable Google service terms, which prohibit Google from using your data to train its models
• OpenAI and Anthropic: Cedar also uses OpenAI and Anthropic for AI inference; under their API terms, your data is not used to train their models
• Voice providers: AI-led voice conversations are delivered through third-party voice providers, which process call audio and transcripts on Cedar's behalf
• You own outputs: all AI-generated content relating to your use of Legit belongs to you

3. Google User Data

When you connect a Google account, Legit asks in one screen for all the permissions it may use, and you can leave any of them unchecked; a feature that needs a permission you did not grant stays off. Depending on what you grant, Legit will:

• Gmail (send and drafts): send an introduction email from your address after both sides agree, or place it in your Drafts for you to send
• Gmail (read): read replies on the specific email threads you asked Legit to watch, so it can tell you when the other person answered and what times they proposed, and, if you import your LinkedIn connections, find the one email LinkedIn sends when your connections export is ready
• Gmail (labels and read status): create a "Legit" label, apply it to the threads Legit is watching for you, and mark a reply as read once Legit has handled it
• Gmail (headers): read email headers (sender, recipient, date, subject), not message bodies, to understand who you have recently been in touch with
• Google Contacts: read your contacts and "other contacts" to show you people you already know and to find an introduction's email address, and add a person you were introduced to as a contact if you ask
• Google Calendar: read your calendar and free/busy times to recognise people you have met with and to find a free time, and create the meeting once both sides agree

What Legit keeps from a connected Google account. From a connected mailbox Legit keeps three things: who you have emailed, when and how often, derived from message headers; for the introduction threads Legit started on your behalf, the thread itself and what Legit pulled out of the reply (that the other person answered, and the times they proposed), not the message content, which is deleted within 30 days; and, for the LinkedIn import, the one email LinkedIn sends when your export is ready. It does not keep the rest of your mailbox. From a connected calendar it keeps who attended your past meetings and when, not event descriptions or attachments.

How Google user data is stored and shared. Google user data is stored encrypted and kept only as described in Section 6: the items Legit keeps (the summary of who you have been in touch with, the introduction threads Legit started and the facts it pulled out of the replies, the LinkedIn export email, and who attended your past meetings and when) and the contacts you import are kept while your account exists; anything else Legit reads to perform a feature, such as email message content (including the content of introduction threads and their replies), raw email headers, Gmail labels and read status, calendar event details and free/busy times, is deleted within 30 days; and connected account tokens are removed when you disconnect that account, or within 30 days of deleting your Legit account (Section 7). It is shared only with the service providers listed in Section 5, and only as needed to provide the features above. It is shared with other Legit users only when you choose to: the introduction email you asked Legit to send, and, for the people you choose to share from your network, their name, role, employer and public profile (the profile photo from licensed public professional data). Email addresses and phone numbers from your Google account are never shown to other users.

AI and machine learning. Google Workspace APIs are not used to develop, improve, or train non-personalized AI and/or ML models. Google user data is not used to train or improve foundational AI models. Legit may send Google user data to AI model providers only to perform the features you asked for, such as reading a reply to tell you which times were proposed, under terms that prohibit those providers from training on it.

Legit's use and transfer to any other app of information received from Google APIs will adhere to Google API Services User Data Policy, including the Limited Use requirements. The policy is at developers.google.com/terms/api-services-user-data-policy. In plain terms: Google user data is used only to provide the Legit features you turned on, it is never used for advertising, never sold, never transferred to data brokers, and no person at Cedar reads it except with your permission, to investigate abuse or a security problem, or where the law requires it.

4. Text Messages

Text messaging is not yet available in Legit. When it is: by texting Legit you agree to receive replies and follow-ups from Legit about the things you asked it to do. Message frequency depends on your use. Legit does not send marketing messages. Message and data rates may apply. Reply STOP at any time to stop all messages, or HELP for help. You can also tell Legit in your own words.

5. Sharing and Sub-Processors

Legit does not sell personal information. Cedar shares information only as necessary to deliver Legit, with sub-processors bound to use it only to provide their service to us. Legit's sub-processors are:

• Google Cloud Platform — infrastructure, hosting, data storage, and AI inference (United States)
• OpenAI — AI inference; no training on your data (United States)
• Anthropic — AI inference; no training on your data (United States)
• Slack Technologies — primary user interface (United States)
• Clerk — authentication and session management for the Cedar web application, and secure storage of the Google account connections you approve for Legit (United States)
• Neo4j, Inc. (AuraDB) — managed graph database storing relationship data (United States)
• Vapi.ai — voice call handling and transcription; call recordings are retained by Vapi under Cedar's account configuration and accessed by Cedar on demand (United States)
• ElevenLabs — conversational voice agent for AI-led meetings (United States)
• Bland AI — outbound voice calling (United States)
• Granola — meeting notes and transcript capture (United States)
• SendGrid (Twilio) — transactional email delivery (United States)
• Linq — iMessage and SMS messaging between you and Legit, once texting is available (United States)

Cedar does not sell, rent, or share your information with third parties for their own purposes. Information is disclosed to others only when you ask for an introduction (the person being introduced sees what you asked Legit to send), when you share part of your network with someone, or where the law requires it. When you share part of your network with someone, they see the name, role, employer and public profile (the profile photo from licensed public professional data) of the people you chose, and nothing else. Your contacts' phone numbers and email addresses are never shown to other users; they are used only when you ask Legit to make an introduction.

6. Retention

• Email content Legit reads, including the content of introduction threads and their replies, is kept for no more than 30 days, encrypted, then deleted. The LinkedIn export email is kept while your account exists, and for introduction threads Legit keeps only the thread and the facts it pulled out of the reply (that the other person answered, and the times they proposed)
• The summary of who you have emailed, when and how often (derived from headers), and who attended your past meetings and when, are kept while your account exists; raw email headers, Gmail labels and read status, calendar event details and free/busy times are kept for no more than 30 days, encrypted, then deleted
• Imported contacts and connections are kept while your account exists
• Introduction requests and the messages Legit sent on your behalf are kept while your account exists so you can see your history
• Public professional data about the people you import is kept while your account exists and the person remains in your network
• Session replay data is deleted automatically within 30 days of capture; other service data is kept only as long as needed to operate, secure and support the service

When you delete your account. Within 30 days Cedar deletes everything listed above that relates to you from its own systems: your account, messages, imported contacts and connections, the public professional data retrieved for your network, email and other Google data, connected account tokens, introduction history, and session replay data. The only exceptions are aggregated, anonymized statistics that no longer identify you, and technical and security logs, which are kept only as long as needed to secure the service or as required by law and are then deleted. Cedar provides written confirmation of deletion on request and instructs its service providers to delete data they hold on Cedar's behalf. Some service providers delete or expire content on shorter schedules of their own, so content may be removed sooner than the periods above.

7. Your Account and Deletion

Everything Legit holds about you is visible when you sign in at app.getcedar.ai/legit, where you can disconnect accounts, export your data, and delete your account. To delete your account and everything it holds, use that page, or email legit@getcedar.ai; Cedar deletes your account, your imported contacts and connections, your introduction history and any connected account tokens within 30 days. If you are not a Legit user and someone you know imported your contact details, email legit@getcedar.ai and Cedar will remove them from every Legit account and block them from being re-imported.

8. Security

Cedar protects Legit data using industry-standard security measures, including:

• AES-256 encryption at rest and TLS 1.2+ encryption in transit
• Private VPC network isolation on Google Cloud Platform
• Role-based access controls and IAM authentication; access inside Cedar is limited to the people who operate the service and is logged
• Connected Google account tokens are held by Clerk, Cedar's authentication provider (see Section 5), and requested by Legit's backend only when a feature you turned on needs them; they are never stored in Legit's application code, database or logs
• Infrastructure is managed as code and deployed through a CI/CD pipeline that requires manual approval for production changes
• SOC 2 Type II audit in progress (target completion Q4 2026)

In the event of a security incident affecting your data, Cedar will notify affected users within 72 hours of confirmed discovery.

9. Your Rights

Depending on where you live you may have the right to access the personal information Cedar holds about you, correct it, request its deletion, object to or restrict certain processing, and receive it in a portable format. Contact legit@getcedar.ai and Cedar will respond within 30 days.

10. International Data Transfers

Cedar is incorporated in Canada, which the European Commission recognizes as providing an adequate level of data protection for commercial organizations. Your information may be processed in the United States by the service providers described in Section 5. For those transfers, Cedar relies on the transfer mechanisms in its agreements with those providers, including Standard Contractual Clauses or equivalent frameworks, as required under applicable data protection law.

11. Cookies and Tracking

Legit does not use cookies or tracking technologies for advertising. The Legit web app at app.getcedar.ai/legit uses cookies to keep you signed in, set by our sign-in provider Clerk, and first-party product analytics to understand which features are used and to diagnose errors; getcedar.ai may use minimal analytics to understand visitor behavior. Where session replay is enabled on the web app, it is used to diagnose errors and support you, not for advertising or profiling. No personal data is sold or shared with advertising networks.

12. Age

Legit is for adults. You must be at least 18 to use it, and Cedar does not knowingly collect information from anyone under 18.

13. Changes

Cedar may update this policy. Material changes will be announced to active users by email or a notice in the app, and by text where you use Legit over text messages, at least 30 days before they take effect. The current version is always available at getcedar.ai/legit-privacy.

14. Contact

legit@getcedar.ai

Cedar AI Agents, Inc., Suite 2700, The Stack, 1133 Melville St, Vancouver, BC V6E 4E5, Canada