Privacy Policy

Introduction

Mica AI Inc. (“Mica,” “we,” “us”) operates https://www.usemica.com and related pages and services (collectively, the “Service”). This policy describes how we collect, use, share, and protect personal information through the Service, marketing, and waitlist/demo requests.

We are headquartered in California, United States, and have no establishment in the European Economic Area (EEA) or the United Kingdom (UK). The section Notice to European users applies to you if you are in the EEA, UK, or Switzerland. The section State privacy rights notice applies to you if you are in a U.S. state with a comprehensive privacy law.

Controller: Mica AI Inc., our mailing address (enable JavaScript to view), contact: our support email (enable JavaScript to view). You can exercise rights at that address. At the current scale of the landing page we have no EU/UK representative and no Data Protection Officer. We will appoint them before we start large-scale systematic monitoring in the future app (for example PostHog session recordings and extensive custom events) if the law requires it.

Personal information we collect

Information you provide to us

• Contact and request data: name, work email, company, role, and message content when you request a demo, join the waitlist, or contact us.
• Communications data: records of exchanges with us by email, form, or social media.
• User content: any text or files you choose to submit to the demo form.

We do not ask you to provide sensitive information (for example government IDs, health, or biometric data). Do not send such information through the Service.

Automatic data collection

We, our service providers, and our advertising partners automatically log:

• Device data: browser type and version, OS, device type, screen and viewport size, language, IP address, and identifiers for advertising.
• Online activity data: pages viewed, time on page, navigation paths, referrer, and whether you opened our emails (via pixel tags where used).
• Approximate location: country and, where applicable, state/province derived from the geolocation lookup described below. We do not collect precise geolocation.
• Communication interaction data: interactions with our emails or site (for example link clicks).

Geolocation lookup via ipapi.co

The current landing page is a static site with no application server or database. To apply the correct consent law (opt-in in the EEA/UK, opt-out in California, etc.), your browser makes one request to ipapi.co (https://ipapi.co/json/) before consent is given. ipapi.co sees your IP address as part of that network request. We keep only the country and region codes from the response. We do not store or log your IP address, city, or coordinates. The result is cached in your browser localStorage under mica:geo for up to 30 days and reused to keep consent stable. If the lookup fails, is rate-limited, or times out, we apply the strictest (opt-in) rules and retry on the next visit.

Information from other sources

• Public sources, data providers, marketing partners, and event co-sponsors.
• Service providers that help us operate the Service (hosting, analytics, email delivery).
• Business transaction partners in connection with a financing, acquisition, or merger.

Tracking technologies and advertising

See our Cookie Notice for full details on cookies, localStorage, web beacons, and SDKs. We store your consent choices with our consent manager (c15t) in a cookie and in localStorage key mica-consent. We run Google Consent Mode v2 with defaults set to denied and update it only after you give consent.

Google Tag Manager and Google Analytics 4

Google Tag Manager (GTM-KCGNPSXS) loads on the landing page with Consent Mode defaults denied. GA4 and other tags inside the container remain blocked until you accept the relevant category. Region and country-level metadata is collected by default for all traffic to support regional privacy settings.

Advertising Features we have implemented: Google signals and Google Analytics Advertising Features that use advertising cookies and identifiers in addition to the standard GA implementation. When Google signals is on, Google Analytics collects visitation information and may associate it with Google information from signed-in users who have consented to that association. That Google information may include end-user location, search history, YouTube history, and data from sites that partner with Google. Such data may be accessed and deleted by end users via My Activity. By keeping Google signals on, we confirm we adhere to the Google Advertising Features Policy, including rules on sensitive categories, and that we have the required disclosures and rights for this association.

Google and we use first-party cookies (such as the Google Analytics cookie) and third-party cookies (such as Google advertising cookies) or other identifiers together. We do not merge personally identifiable information with Google advertising data unless we have your prior opt-in consent and use a feature that expressly supports it, and we do not attempt to re-identify aggregated data.

You can opt out of the Google Analytics Advertising Features at:

• Google Ads Settings: myadcenter.google.com and Ad Settings for mobile apps;
• Network Advertising Initiative: optout.networkadvertising.org;
• Digital Advertising Alliance: optout.aboutads.info;
• Google Analytics opt-out browser add-on: tools.google.com/dlpage/gaoptout.

In EEA/UK regions, Google Analytics Advertising Features run only after you give consent. Where required under Google's EU User Consent Policy, we obtain consent before storing or accessing cookies for advertising. Learn more at the GA4 Advertising Features policy and the EU User Consent Policy.

RB2B (visitor identification)

RB2B (Retention.com) is loaded through GTM for visitor identification. It may associate page visits and interactions with company information and, where available, with a person or LinkedIn profile, for sales outreach. In regions where consent is required (EEA, UK, Quebec, Switzerland, Brazil, Japan, South Korea), RB2B stays off until you accept marketing. You can also opt out directly at app.retention.com/optout and via our GPC and consent controls below.

PostHog analytics

We use PostHog (US region, host us.posthog.com) to measure page views and interactions on the landing page. PostHog may collect: browser and OS details, device type, screen dimensions, current and referrer URL, UTM parameters, advertising click IDs (for example gclid, fbclid), timestamp, and event types. PostHog respects your browser's Do Not Track signal and then sends no events. In the future app we plan to use PostHog session recordings and additional custom events to understand feature use. Session recordings can capture clicks, scrolls, and page content you see. Where the law requires consent (EEA, UK, and similar regions), we will run session recordings only after you consent.

• Cookieless mode before consent: in opt-in regions, before you accept analytics, PostHog runs with cookieless_mode: "on_reject". No cookies or localStorage are written. Visitors are counted with a rotating, server-generated hash. IP is stripped before GeoIP enrichment in this mode.
• After consent: when you accept analytics, PostHog enables first-party persistence and fuller interaction capture (autocapture, history-based pageviews, exception capture). Feature flags and surveys are disabled.
• If you reject or withdraw consent: PostHog stays in cookieless mode. GTM/GA4 remain off.

How we use your personal information

• Provide, secure, and maintain the Service and your requests (demo, waitlist, support).
• Personalize content and remember your choices and consent.
• Measure and improve the Service, develop new products, and understand page performance and navigation. In EEA/UK this relies on consent where cookies are used; otherwise on our legitimate interest in improving the Service.
• Send you information about Mica where permitted and personalize direct marketing. You can opt out at any time.
• Interest-based advertising via RB2B and Google signals where you have consented (EEA/UK) or have not opted out where opt-out applies.
• Comply with law, enforce terms, protect rights and safety, and prevent fraud.
• Create aggregated, de-identified, or anonymized data for lawful business purposes. We do not attempt to re-identify such data.

How we share your personal information

• Service providers: hosting and infrastructure, consent management (c15t), analytics (PostHog, Google), visitor identification (RB2B/Retention.com), geolocation lookup (ipapi.co, receives IP as network data but we do not provide additional personal data), and email/form delivery.
• Advertising partners: for interest-based advertising as described above.
• Partners we designate: event co-sponsors or integrations where you instruct us to share.
• Professional advisors: lawyers, auditors, insurers.
• Authorities: law enforcement or government where required for legal compliance or protection.
• Business transferees: in connection with a financing, merger, acquisition, sale of assets, or insolvency.
• Other users/public: only if you make content public. Our landing page does not currently publish user content.

We do not sell personal information for money. We may “sell” or “share” as defined by California law when we use interest-based advertising and visitor identification. See your opt-out choices below.

Your choices and controls

• Consent banner and dashboard:change choices at any time via the banner or “Cookie settings” link in our Cookie Notice. Necessary storage is always on. If you reject analytics or marketing, GTM/GA4 and RB2B stay off, and PostHog stays cookieless.
• Browser controls: block or delete cookies in browser settings. Some site features may not work.
• Do Not Track: PostHog respects DNT and sends no events when DNT is on. We do not otherwise respond to DNT outside PostHog.
• Global Privacy Control (GPC): we honor GPC as an opt-out of sale/share for targeted advertising where required by law. In California and other opt-out regions, GPC is treated as a valid opt-out request.
• Email marketing: use the unsubscribe link or contact us at our support email (enable JavaScript to view).
• RB2B / Retention.com: opt out at app.retention.com/optout.
• Google Analytics: use the add-on at tools.google.com/dlpage/gaoptout and the Ads Settings links above.

Retention

We retain analytics data as follows, then it is deleted or anonymized automatically, unless you ask us to delete sooner:

• PostHog (us.posthog.com): event data for 12 months.
• Google Analytics 4: event data for 2 months and user-level data (including explorations and segments) for 14 months. This matches our current GA4 data-retention settings.
• Consent records (c15t): up to 365 days.

We retain contact and request data (demo, waitlist, support) for as long as needed to handle your request and for our legitimate business records. We decide retention by the amount and sensitivity of data, the purpose, risk of harm, and legal duties. When we no longer need personal information, we delete it, anonymize it, or isolate it from further processing (for example in backups).

Security

We use technical, organizational, and physical safeguards to protect personal information. No system is fully secure. Do not send us sensitive personal information through the Service.

International data transfer

We are headquartered in the United States. Your personal information may be transferred to and processed in the United States or other countries where laws may not be as protective as in your home country.

If you are in the EEA, UK, or Switzerland, the United States is not subject to an adequacy decision. Where we transfer personal information outside Europe, we use safeguards such as Standard Contractual Clauses approved by the European Commission and the UK Addendum, and we require our providers (Google, PostHog, c15t, ipapi.co, RB2B) to protect the data. See also the European notice below.

Children

The Service is for users at least 18 years old. We do not knowingly collect personal information from children. If you believe a child has provided personal information, contact us at our support email (enable JavaScript to view) and we will delete it as required by law.

Changes to this policy

We may update this policy at any time. We will post the updated version on the Service and update the effective date. If we make material changes, we will give additional notice as required by law. Your continued use after the effective date means you accept the updated policy.

How to contact us

For privacy questions or to exercise rights, contact:

Mica AI Inc.
our mailing address (enable JavaScript to view)
Email: our support email (enable JavaScript to view)
Website: https://www.usemica.com

This policy is for general information and does not constitute legal advice. We recommend you seek independent legal counsel to confirm coverage for your use case.