Privacy Policy

Effective October 14, 2026

Overview

Midlevel (“Midlevel,” “we,” “us”) provides a web-based workspace that helps corporate development and investment teams source, evaluate and execute acquisitions. This policy explains what information we collect when you use Midlevel at www.midlevel.ai, how we use it, who we share it with, and the choices you have.

Midlevel is used by organizations (“Customers”) and the people they invite (“Users”). Content a Customer’s team puts into its workspace is controlled by that Customer; we process it to provide the service on the Customer’s behalf.

Information we collect

Account information — your name, email address, password (stored hashed by our authentication provider), and the organizations and roles you belong to.
Workspace content — documents you upload or import, deal folders, reports, notes, pipeline and contact records, chat messages, and other material your team adds. This may include information about companies and people involved in transactions.
Configuration — organization settings such as firm profile, tool training materials, AI provider settings and outreach email settings. API keys and email passwords you provide are stored encrypted.
Usage information — records of AI usage (for example token counts, the tool used and timestamps) for billing, limits and reliability, plus standard server logs such as IP address, browser type and request times.
Google user data — only if your organization connects a Google account; see “Google user data” below.

How we use information

To provide, operate and secure the service, including generating the analyses and drafts you request.
To index your workspace content so it can be searched and cited within your organization’s workspace.
To send account emails (such as invitations and sign-in links) and, when your organization configures it, outreach emails on its behalf.
To meter usage, enforce limits and bill Customers.
To troubleshoot, prevent abuse and comply with legal obligations.

We do not sell personal information, and we do not use workspace content for advertising. We do not use workspace content to train AI models.

AI processing

When you run an AI feature, the relevant content is sent to an AI model provider to generate the result. By default this is Anthropic; a Customer may instead configure its own account with another provider (such as OpenAI or Google). We use these providers’ commercial API services, which under their terms do not use API inputs to train their models by default. AI output is a draft for your review and may be inaccurate.

Google user data

Midlevel can connect to Google services when an organization chooses to. When connected:

Google Drive (read-only) — we list the files and folders the connected account can access so a User can choose files to import. Only files a User selects are copied into that organization’s workspace. We never modify or delete anything in Google Drive.
Gmail — we send outreach emails that your organization’s users compose or schedule, read the connected account’s email signature to append it, and read messages in threads we sent in order to detect replies and stop follow-ups.

Google user data is used only to provide these user-facing features. We do not sell it, use it for advertising, or transfer it to others except as needed to provide these features (for example, sending an imported document to an AI provider when you ask for an analysis of it), to comply with law, or as part of a merger or acquisition with notice. People at Midlevel do not read it except with your permission, for security purposes, to comply with law, or when it has been aggregated and anonymized for internal operations.

Midlevel’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google Workspace API data to develop, improve or train generalized AI or machine-learning models.

An organization can disconnect Google at any time, and you can revoke access from your Google account’s security settings.

Who we share information with

We share information only with service providers that help us run Midlevel, under contracts that limit their use of it:

Supabase — database, authentication and file storage
Vercel — application hosting
Anthropic, and any AI provider a Customer configures — AI model processing
Voyage AI — creating search indexes of workspace content
Tavily — web search for certain research features
Clay — company and contact enrichment, when used
Stripe — billing and payments
Resend — delivery of account emails
Cloudflare — encrypted backup storage
Google — Drive and Gmail, when an organization connects them

We may also disclose information to comply with law or legal process, to protect the rights and safety of our users or others, or in connection with a merger, acquisition or sale of assets.

Security and isolation

Each organization’s data is isolated from every other organization’s at the database and file-storage level. Data is encrypted in transit, and credentials such as API keys and email passwords are encrypted at rest. No method of storage or transmission is completely secure, but we work to protect your information and to limit access to those who need it.

Retention and deletion

We keep workspace content for as long as the Customer’s account is active or until it is deleted. When a Customer deletes content or its organization, we delete it from our active systems; copies in backups expire on a rolling schedule. Usage records may be kept longer where needed for billing, legal or security purposes.

Cookies

We use only the cookies and browser storage needed to run the service — to keep you signed in, remember which organization you are working in, and keep interface preferences. We do not use advertising or cross-site tracking cookies.

Your choices and rights

You can access and update your account information in the app. To request access to, correction of, or deletion of your personal information, contact us at info@midlevel.ai. If your information is held in a Customer’s workspace, we may refer your request to that Customer. Depending on where you live, you may have additional rights under local law.

Children

Midlevel is a business service and is not directed to children under 16. We do not knowingly collect their information.

International users

Our service providers process information in the United States and other countries where they operate.

Changes to this policy

We may update this policy. We will post the new version here with its effective date, and will notify Customers of material changes.

Contact

Questions about this policy or your information: info@midlevel.ai.