Legal

Privacy Notice

Last updated: 13 October 2026

1. Who we are

1.1 This notice explains how the MEGA.AI group uses personal data when you visit mega.ai and its subdomains (the “Website”), contact us, attend our events, apply for a job with us, invest or consider investing in us, or deal with us as a client, partner or supplier. Section 3 explains our different role when our voice agents handle calls for our clients.

1.2 MEGA.AI Limited, registered in England and Wales (company number 16280311), 71-75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom, and registered with the Information Commissioner’s Office under reference ZB875576, is the controller of personal data collected through the Website and used for our marketing. Where you or your organisation deal with MEGA.AI ApS (CVR 44911957, Sankt Gertruds Stræde 5, 1., 1129 Copenhagen K, Denmark) or MEGA.AI Inc. (8 The Green, #15967, Dover, DE 19901, United States), that company is also a controller of the personal data it uses for that relationship.

1.3 Our Data Protection Officer is Peter Hauge Jensen. You can contact him at contact@mega.ai, marked “Data protection”, or by post to MEGA.AI Limited at the address above.

2. The personal data we use and why

2.1 Website visits. We collect your IP address, device and browser information, the pages you visit and how you interact with them, and cookie identifiers. We use this to run and secure the Website and, if you consent, to understand how the Website is used and to measure our advertising. Our lawful basis is our legitimate interests for strictly necessary cookies and security, and your consent for analytics and advertising cookies (see section 6).

2.2 Enquiries, briefing requests and chat. We collect your name, job title, organisation, business email address and telephone number, and the content of your message. We use this to respond to you, arrange meetings and manage our relationship with you. Our lawful basis is our legitimate interests in responding to business enquiries and developing our business.

2.3 Marketing and events. We use your business contact details to send newsletters and invitations to events, LinkedIn Live sessions, podcasts and webinars, and to record your attendance. Our lawful basis is our legitimate interests, or your consent where the law requires it. You can unsubscribe at any time using the link in each email or by contacting us.

2.4 Clients, partners and suppliers. We use the contact details of your organisation’s personnel, our communications, contract and billing information, and, for users of our platform, account details and the security and audit logs we keep to protect the platform. We use this to perform and manage our contracts, provide support, invoice, secure our services and keep records. Our lawful basis is the performance of a contract where you are the contracting party, our legitimate interests in managing our business relationships and securing our services, and our legal obligations, for example for accounting and tax.

2.5 Investors and prospective investors. We collect your name, contact details, organisation, investor status and the answers you give to our qualification questions, including through invest.mega.ai, our communications with you and, where the law requires, identity verification information. We use this to assess eligibility, provide information about investing in MEGA.AI, manage your investment and meet our obligations under company and securities law. Our lawful basis is our legitimate interests, the performance of a contract and our legal obligations.

2.6 Job applicants. We collect your CV and contact details, employment history, interview notes, references and, where relevant to the role, right-to-work and screening information. We use this to assess your application and meet our legal obligations. Our lawful basis is taking steps at your request before entering into a contract, our legitimate interests in recruiting, and our legal obligations.

2.7 Sources. We collect personal data from you, from your organisation, from public professional sources such as LinkedIn and company websites, from event organisers and partners, and through the Website.

2.8 No automated decisions. We do not make decisions about you based solely on automated processing that have legal or similarly significant effects for any of the purposes in this section.

3. Calls handled by our voice agents for our clients

3.1 Our clients, such as lenders, banks, collection agencies and utilities, use our AI voice agents to make and receive calls. For those calls, the client is the controller and decides why and how your personal data is used. MEGA.AI acts as the client’s processor under a written contract and uses your personal data only on the client’s instructions.

3.2 The client’s privacy notice explains how it uses your personal data, including call recordings and transcripts, and how to exercise your rights. If you contact us about such a call, we will pass your request to the client and help it respond.

3.3 Call data of our clients in the United Kingdom and the European Economic Area is hosted in the United Kingdom. We do not use call data to train our AI system or any third-party or foundation model.

4. Who we share personal data with

4.1 We share personal data with:

  • other MEGA.AI group companies, for the purposes in this notice;
  • service providers who act on our instructions, for website hosting and content delivery (Webflow and Cloudflare, including Cloudflare Stream for video), website analytics (Google Analytics and Microsoft Clarity), advertising measurement (LinkedIn), customer relationship management, forms, chat and email (HubSpot), email and office tools (Google Workspace), cookie consent (CookieYes) and cloud hosting for our platform (Microsoft Azure);
  • our professional advisers, auditors, certification bodies, insurers and banks;
  • authorities, regulators and courts where the law requires it, or where needed to establish, exercise or defend legal claims; and
  • a buyer, investor or successor in connection with a sale, merger, financing or reorganisation of our business, under confidentiality obligations.

4.2 Some providers, such as LinkedIn, also use data they collect through their technology for their own purposes as controllers, as explained in their own privacy policies. We do not sell personal data.

5. International transfers

5.1 We are based in the United Kingdom and Denmark. Transfers between the United Kingdom and the European Economic Area are covered by adequacy decisions in both directions.

5.2 Some of our service providers are located in, or access data from, the United States and other countries. Where personal data is transferred to a country without an adequacy decision, we rely on the UK Extension to the EU-US Data Privacy Framework where the recipient is certified, or on the UK International Data Transfer Agreement or the EU Standard Contractual Clauses with the UK Addendum, with supplementary measures where needed. You can contact us for more information.

6. Cookies

6.1 We use cookies and similar technologies on the Website. Strictly necessary cookies are needed for the Website to work and to keep it secure, and are set without consent. Analytics, functional and advertising cookies, including those from Google Analytics, Microsoft Clarity, HubSpot and LinkedIn, are set only if you accept them in our cookie banner.

6.2 You can change your choice at any time through the cookie settings on the Website, and you can block or delete cookies in your browser. Our cookie banner lists the cookies we use and how long they last.

7. How long we keep personal data

7.1 We keep personal data only for as long as we need it for the purposes in this notice, and then delete or anonymise it:

  • website analytics data: no longer than 14 months;
  • enquiries and prospective client contacts with no ongoing relationship: up to 2 years after our last contact;
  • marketing: until you unsubscribe or object, after which we keep a suppression record so that we do not contact you again;
  • clients, partners and suppliers: for the duration of the relationship and up to 6 years afterwards, to deal with any claims and meet our legal obligations, with accounting records kept for the periods required by UK and Danish law;
  • job applicants: up to 6 months after the recruitment process ends, unless you agree to a longer period or join us; and
  • investors: while you hold an investment and afterwards for as long as company and tax law require; prospective investors: up to 2 years after our last contact.

8. Your rights

8.1 Under UK and EU data protection law you have the right to access your personal data, to have it corrected or erased, to restrict its use, to object to its use (including, at any time, to direct marketing and to processing based on our legitimate interests), to receive it in a portable format, and to withdraw any consent you have given at any time.

8.2 To exercise your rights, contact us at contact@mega.ai. We respond within one month, which can be extended where the law allows, and may need to verify your identity first.

8.3 If you have a complaint about how we use your personal data, please tell us first so we can put it right. We acknowledge complaints within 30 days. You can also complain to the Information Commissioner’s Office in the United Kingdom (ico.org.uk), to Datatilsynet in Denmark (datatilsynet.dk), or to the data protection authority where you live or work.

9. Security

9.1 We protect personal data with technical and organisational measures operated under our certified information security and privacy management systems. More information is available at trust.mega.ai.

10. Children

10.1 The Website and our services are intended for businesses and are not directed at children. We do not knowingly collect personal data from anyone under 18.

11. Changes to this notice

11.1 We may update this notice. The date at the top shows when it was last changed. This notice replaces the Privacy Policy previously published on the Website.