Privacy Notice

Effective 3 September 2026. Supersedes the notice dated 30 July 2026.

This Privacy Notice describes how SANSPNASH, a California sole proprietorship doing business as The Origination Engine ("the Operator", "we", "us"), collects, uses, discloses and retains personal information in connection with the website at pipe.mvat.ai (the "Site"), the subscription email brief and related services (the "Service"), and the telephone line at (775) 252-8333 (the "Line"). Capitalized terms not defined here have the meanings given in the Terms of Service.

In one paragraph. We collect what you give us (name, firm, email, calibration answers, call audio and transcripts), what Stripe needs to bill you (we never see your full card number), and the minimum server data needed to operate the Site. We use it to deliver the brief, answer your questions, bill the subscription and comply with law. We do not sell it, we do not run advertising or tracking on the Site, and we do not use it to train any general-purpose model. You can ask for it, correct it, or have it deleted at any time.

1. Scope and roles

We are the business (as that term is used in the California Consumer Privacy Act, as amended by the California Privacy Rights Act, together the "CCPA") and the controller of the personal information described in this Notice. Where you subscribe on behalf of a firm, your firm may separately be a controller of information it provides to us; this Notice addresses our processing only.

This Notice does not cover the issuer data that the Service processes. Issuer names, tickers, financial figures, filing dates and officer names are drawn from public filings on the U.S. Securities and Exchange Commission's EDGAR system and public exchange disclosures. Named officers of public companies appear in the brief only as they appear in those public filings.

2. Information we collect

2.1 Information you provide

Request and calibration forms: name, firm, email address, how you participate in financings, typical check size, sectors, exchanges, float band, colleagues' email addresses you ask us to copy, and free-text notes.
Subscription: the email address and name you give at checkout, and any billing address you provide to Stripe.
Correspondence: the content of emails, replies and messages you send us.
The Line: if you call (775) 252-8333, the calling number, the audio of the call, a machine transcript, the details you state on the call (which may include your name, firm, role, email address and preferences), and the outcome of the call. The Line is answered by an automated system that identifies itself as such at the start of every call.

2.2 Information collected automatically

Server and security data: IP address, user agent, referring page, timestamps and request paths, used to operate the Site, rate-limit abuse and investigate incidents.
Email delivery data: whether a brief bounced or was rejected. We do not embed open-tracking pixels or click-tracking redirects in the brief.
Cookies: the Site sets no cookies of its own and uses no analytics, advertising, session-recording or tag-management services. Stripe's hosted checkout page sets its own cookies under Stripe's policies. The Site uses browser session storage only to carry a checkout reference between two pages.

2.3 Information from third parties

Stripe: payment status, the last four digits and brand of the card, subscription status and dispute information. We never receive or store the full card number, expiry or security code.
Public and professional sources: for prospective subscribers at firms named in public filings as placement agents or underwriters, we may obtain a business name, title, firm and work email address from the firm's own public website, from public filings, and from commercial verification services, solely to determine whether a work email address is deliverable and to send a limited number of business-to-business communications as described in Section 4.

3. How we use information

To deliver the Service: build and send the brief, calibrate the rubric, copy the colleagues you designate, and respond to questions.
To bill and manage the subscription through Stripe, including trial reminders, renewal, payment failure and cancellation notices.
To operate the Line: answer calls, take details, send a checkout link you request, confirm your signup and record the outcome so a human can follow up.
To secure the Site and Service: rate limiting, abuse prevention, fraud detection and incident investigation.
To send business-to-business marketing to professionals at firms active in the financings the Service covers, in compliance with the CAN-SPAM Act, always with a one-click unsubscribe.
To comply with law, respond to lawful requests, enforce our Terms and protect our rights.
To improve the Service using aggregated or de-identified information that cannot reasonably be linked to you.

We do not use your personal information, call audio or transcripts to train any general-purpose artificial intelligence model. Call transcripts are processed by AI models solely to conduct and summarize the individual call.

4. Marketing communications and your choices

If we email you an unsolicited business communication, it will identify the sender, include a valid physical postal address, and carry a one-click unsubscribe link and header that work without a login. We honor an opt-out within ten business days, and in practice immediately, and we maintain a suppression list so an address that opts out is not contacted again. We contact professionals at their work addresses about a service relevant to their profession; we do not purchase consumer lists.

We do not place unsolicited outbound telephone calls and do not use automated or prerecorded voice calls for marketing. The Line places an outbound call only when you have asked, on a call or in writing, to be called back at a specific number and time.

5. Disclosure of information

We do not sell personal information and have not sold it in the preceding twelve months. We do not share personal information for cross-context behavioral advertising. We disclose personal information only to:

Service providers acting on our instructions under written terms: Netlify (hosting, serverless functions and data storage), Stripe (payments and subscription management), Google (email transmission over Gmail SMTP and IMAP), Twilio (telephony), xAI (real-time speech recognition and synthesis for the Line), Anthropic (call summarization and text generation), and commercial email-verification services (deliverability checks on work addresses only).
Colleagues you designate to be copied on the brief.
Professional advisers such as counsel and accountants, bound by confidentiality.
Authorities and courts where required by law, subpoena or court order, or where necessary to protect the rights, property or safety of the Operator, subscribers or the public.
A successor in a merger, acquisition or sale of assets, subject to this Notice.

6. Retention

Request-form records: twelve months from the last contact, or until you ask us to delete them.
Subscriber account and billing records: for the life of the subscription and seven years thereafter, as required for tax and accounting purposes.
Call audio: not retained after the call ends. Call transcripts and summaries: twelve months, or until you ask us to delete them.
Server logs: ninety days.
Suppression (opt-out) records: indefinitely, because we need them to honor your opt-out.

7. Security

We use industry-standard technical and organizational measures appropriate to the sensitivity of the information, including encryption in transit, encrypted storage of credentials, access limited to the Operator, signature verification on payment and telephony webhooks, and rate limiting on public endpoints. No method of transmission or storage is perfectly secure, and we cannot guarantee absolute security. We will notify affected persons and authorities of a breach of unencrypted personal information as required by California Civil Code section 1798.82 and other applicable law.

8. Your rights

Subject to applicable law, you have the right to know what personal information we hold about you and how we use it, to obtain a copy, to correct inaccuracies, to delete it, to opt out of any sale or sharing (we do neither), to limit the use of sensitive personal information (we collect none as defined by the CCPA), and not to be discriminated against for exercising these rights. Persons in the European Economic Area, the United Kingdom and other jurisdictions with comparable laws have the corresponding rights under those laws, including the right to object to processing and to lodge a complaint with a supervisory authority.

To exercise any right, email privacy@mvat.ai with the subject line "Privacy request". We will verify the request by confirming control of the email address on file and respond within forty-five days, extendable once by a further forty-five days where reasonably necessary. You may designate an authorized agent to make a request on your behalf; we may require proof of the agent's authority. We do not charge a fee for requests unless they are manifestly unfounded or excessive.

9. Children

The Service is offered to businesses and professionals. It is not directed to, and we do not knowingly collect personal information from, anyone under eighteen years of age.

10. International transfers

We are located in the United States and the service providers listed in Section 5 process information in the United States. If you access the Service from outside the United States, your information will be transferred to and processed in the United States, where data protection laws may differ from those of your jurisdiction.

11. Do Not Track and Global Privacy Control

Because the Site performs no tracking, sale or sharing, browser Do Not Track and Global Privacy Control signals have no effect on it; there is nothing to opt out of. We treat a Global Privacy Control signal as a valid request to opt out of sale or sharing in any event.

12. Changes to this Notice

We may revise this Notice from time to time. The effective date at the top will change, and material changes will be announced in the brief or by email to subscribers at least fourteen days before they take effect.

13. Contact

SANSPNASH d/b/a The Origination Engine
15839 Woodvale Rd., Encino, CA 91436
hello@mvat.ai

This Notice is written to satisfy the disclosure requirements of the CCPA (Cal. Civ. Code section 1798.100 et seq.), the California Online Privacy Protection Act (Cal. Bus. and Prof. Code section 22575), and the CAN-SPAM Act (15 U.S.C. section 7701 et seq.). It is not legal advice to you.