Pansophy AI Inc. is committed to protecting the privacy of data processed by Second Opinion for Sales. This Policy explains what we collect, how we use it, who we share it with, and the controls you have over it. Most processing happens within Microsoft Azure in the United States. Three things can involve providers outside that boundary: payment processing by Stripe for read packs, email delivery by Twilio SendGrid, and the AI agent you connect over MCP, such as Anthropic's Claude. We identify all three plainly below.
You reach Second Opinion for Sales through Microsoft, and you sign in with your Microsoft work or school account (Microsoft Entra ID). The behavioral analysis pipeline is the same however you use it; what differs is how your content reaches us and how you pay.
You can use the Software inside Microsoft Teams, where you submit content by uploading a file or sharing a meeting transcript, or you can connect it to your own AI agent through the Model Context Protocol (MCP), including an agent you build in Microsoft Copilot Studio, and submit content as text through that agent. Your agent may be Anthropic's Claude, Microsoft Copilot, or any other MCP-capable agent you choose.
Every individual starts on the free tier, which requires no payment method, so we collect no billing data for it. Team subscriptions are purchased through the Microsoft commercial marketplace (AppSource), where Microsoft handles billing as the merchant of record. Read packs are one-time top-ups purchased from us and processed by our payment provider, Stripe; Stripe handles your card information and we do not store your full card details.
On the Microsoft Teams plan, we receive your Microsoft Entra ID identity, including your name, email address, and tenant identifier, used solely to authenticate your session and operate the Software.
When you connect your own AI agent over MCP, we hold a seat record and a unique connector token (stored only as a cryptographic hash) that maps the connection to your seat. If you started free with the Microsoft door, the seat is keyed to your Microsoft identity (above). If you started free with the email door, the seat is keyed to a one-way code derived from your email; our seat records do not store the email address itself. We use the address to send your connector link through our email delivery provider, Twilio SendGrid (see Section 8). We collect no billing data for a free seat. If you buy a read pack, your name, email, and card details are collected and held by our payment processor, Stripe (see Section 8); we receive only a record that the pack was paid and do not store your full card number.
You submit content to the Software for behavioral analysis. In Microsoft Teams this may be an uploaded file (PDF, DOCX, or TXT). Through a connected AI agent it is text your agent submits. In both cases, submitted content is held in session state during the active session and discarded when the session ends. It is not written to persistent storage at any point. Before analysis, submitted text is processed through Microsoft Azure AI Language to detect and remove personally identifiable information, including names, email addresses, and phone numbers.
The Software produces behavioral trait scores and a written read from the PII-redacted text. We retain only a limited, anonymized analytical record as described in Section 7. This record describes language patterns and does not contain the source text, the written read, or your identity.
We collect session metadata used for support and operations, such as session identifiers, timestamps, and word counts measured after PII scrubbing. This metadata contains no submitted content.
If you contact us for support, we collect the information you provide in that communication.
Content submitted to the Software passes through a deterministic pipeline inside the Microsoft Azure tenant:
When you connect your own AI agent, for example Anthropic's Claude, that agent is operated by a third party and sits between you and us. Your text passes through it before it reaches our pipeline, and the read we return passes back through it to you. That agent's provider handles your data under its own privacy terms, which we do not control. See Section 8.
Where the General Data Protection Regulation (GDPR) applies, we rely on the following lawful bases. We process account, subscription, connector, and usage data as necessary to perform our contract with you and to provide the Software. We process the anonymized analytical record described in Section 7 on the basis of our legitimate interests in maintaining and improving the reliability and quality of the Software, an interest weighed against the privacy impact on data subjects, which is minimal because the record contains no identity, no account or tenant identifier, and no source content. Where content you submit contains the personal data of other individuals, you are responsible for establishing the lawful basis and obtaining any required consent for that content, as described in Section 11.
Pansophy AI does not collect, process, or infer any demographic information about the subjects of submitted content. This is an affirmative architectural design principle, not a policy limitation.
The behavioral analysis engine receives only anonymized word patterns after PII removal. It has no access to and makes no inference about:
The analysis methodology counts and categorizes word usage patterns using a validated psycholinguistic lexicon. It does not know who wrote or spoke those words. No demographic inference is performed at any stage of processing, not during PII scrubbing, not during scoring, and not during read generation.
This architecture means Pansophy AI cannot build demographic profiles, cannot use proxy variables to infer protected characteristics, and cannot produce outputs that vary based on the identity of a speaker rather than the content of their language.
Pansophy AI processes and stores data within Microsoft Azure's United States data centers, in the East US 2 region. Three exceptions apply: payment data for a read-pack purchase is collected and stored by Stripe on its own infrastructure (see Section 8); the email address you use to activate or to buy a read pack is handled by our email delivery provider, Twilio SendGrid, when it sends your connector link (see Section 8); and content submitted through a connected AI agent passes through that agent provider's systems before it reaches our Azure pipeline. Apart from these, no submitted content is transmitted outside Microsoft Azure. Specifically:
We apply a split retention model. Content that you submitted, and anything derived from it that could reconstruct the source, is discarded at session close. The limited anonymized record we produce as our own work product is retained.
A session ends when you explicitly close it, when you submit new content for analysis, or after thirty (30) minutes of inactivity. You may request deletion of data associated with your account by contacting privacy@pansophyai.com. Submitted content and extracted text are not subject to deletion requests because they are already discarded at session close and never stored.
We do not sell, rent, or share your personal data with third parties for marketing or commercial purposes. We share data only in the following limited circumstances.
When you connect the Software to your own MCP-capable AI agent, such as Anthropic's Claude or Microsoft Copilot, your submitted text passes through that agent and the returned read passes back through it. The provider of that agent processes your data under its own terms and privacy policy. Pansophy AI does not control, and is not responsible for, your agent provider's data practices; review the privacy terms of the agent you connect.
Pansophy AI implements the following technical and organizational security measures:
While we implement industry-standard security measures, no system can guarantee absolute security. In the event of a data breach that affects your personal data, we will notify you and applicable regulatory authorities as required by law.
Automated processing: the Software produces behavioral trait scores and a written read as decision-support intended to inform human judgment. It does not make decisions that produce legal or similarly significant effects about any individual without human involvement, and it performs no demographic profiling (see Section 5 and our Responsible AI page).
Depending on your jurisdiction, you may have the following rights with respect to your personal data:
To exercise any of these rights, contact us at privacy@pansophyai.com. We will respond to valid requests within thirty (30) days and may require verification of your identity. Where your data is held by a subprocessor, such as billing data held by Stripe or email delivery records held by Twilio SendGrid, we will direct or assist your request as appropriate.
Your rights apply to personal data about you. The anonymized analytical record described in Section 7 is Pansophy AI proprietary work product, contains no identity, and is not subject to these rights.
Important: You are solely responsible for obtaining any required consent from individuals whose words are contained in content you submit to the Software for analysis. Pansophy AI does not obtain consent directly from the subjects of submitted content. By submitting content, you represent and warrant that you have obtained all necessary consents under applicable law.
The Software is designed for professional and enterprise use. It is not directed at individuals under the age of 18. We do not knowingly collect personal data from individuals under 18. If you believe we have inadvertently collected such data, please contact us immediately at privacy@pansophyai.com.
The Software is operated from the United States, and all processing by Pansophy AI occurs in the Azure East US 2 region. Through Microsoft (Teams or a Microsoft sign-in), the Software is offered to Microsoft 365 tenants in the countries supported on its Microsoft AppSource listing, and eligibility is enforced at the listing level. The email door and read packs are currently offered to customers in the United States.
If you access the Software from a supported location, your data will be processed in the United States, subject to United States law. If you believe personal data of an individual outside a supported location has been submitted to the Software, please contact us at privacy@pansophyai.com.
International data transfers: Pansophy AI processes personal data in the United States. The email door and read packs are offered only to customers in the United States, and the Microsoft path is offered only in the countries supported by its Microsoft AppSource listing, with eligibility enforced at the listing level. We do not offer the Software in the European Economic Area, the United Kingdom, or Switzerland. If personal data originating from those regions is nonetheless submitted to the Software, it will be processed in the United States; where a cross-border transfer mechanism is required by applicable law, we will rely on an approved mechanism such as the applicable Standard Contractual Clauses.
We may update this Privacy Policy from time to time. We will post the updated Policy at this URL with an updated effective date. For material changes, we will provide notice through the Software or by email. Your continued use of the Software after the effective date of any update constitutes your acceptance of the revised Policy.
July 2, 2026 update: we added a Lawful Basis for Processing section, a right to lodge a complaint with a supervisory authority, an international data transfer statement, and an automated-processing disclosure. These additions clarify existing practices and do not change how the Software processes your content.
20 October 2026 update: retired the direct Stripe subscription; described the two free doors (Microsoft sign-in and email activation) and the connected-agent flow; disclosed that a free email-door seat is identified by a one-way code derived from your email, not the email itself; clarified that Stripe processes read-pack payments only; and named Twilio SendGrid as the email delivery provider for connector links.
For privacy inquiries, data subject requests, or to report a privacy concern: