Privacy Policy

Last updated: October 14, 2026

AI Matrx is a technology product owned and operated by ALL GREEN ELECTRONICS RECYCLING, LLC ("we", "us"). We provide an AI-agent platform that you access through our website at https://www.aimatrx.com and through our Chrome extension "Matrx Extend" (the "Extension"). This Privacy Policy explains what information we collect, how we use it, where it goes, and how long we keep it. We do not sell your data, we do not run advertising, and we do not share your data with data brokers.

Questions, deletion requests, or anything else: email support@aimatrx.com.

1. Scope

This policy covers:

The AI Matrx web application at aimatrx.com.
The Matrx Extend Chrome extension, which runs an AI agent inside your browser and can read and act on the pages you choose to give it.
The optional Matrx Local desktop companion, when you install it and connect it to the Extension.

It does not cover third-party websites you visit or third-party services we link to. Each of those has its own policy.

2. Information we collect

2.1 Account information

When you sign up we collect the information you provide: email address, name (if you set one), profile information, and a password (which is stored, hashed, by our authentication provider Supabase — we never see your plain-text password).

The Extension stores your session locally on your device using Chrome’s built-in extension storage (chrome.storage.local). Refresh tokens are encrypted at rest with AES-GCM before being stored.

2.2 Content and prompts you send to agents

When you use the Extension or the web app to chat with an agent, the following is transmitted to our agent backend so the agent can reason over it:

The text of your messages and any files you attach.
For Extension chats, page context derived from the active browser tab: URL, page title, language, viewport dimensions, the visible text or rendered HTML/markdown, the accessibility tree, headings, links, page metadata (Open Graph, Twitter, canonical, JSON-LD, schema.org blocks), any text you have selected, and an inventory of forms / images / videos / audio elements present.
Prior messages in the same conversation, so the agent has continuity.
Limited orchestration metadata: the current tab id, window id, open-tab count, your admin status, your selected permission mode, which optional permissions you have granted, and your extension version.
Domain-scoped notes ("guidance") you have authored for the current site, which the Extension auto-attaches when you are on that site.

The agent backend then routes your request to a third-party large language model provider (see Section 3). Page content is processed solely to generate the agent’s response.

2.3 Browser data the agent can access on your behalf

The Extension declares Chrome permissions that let the agent perform browser-level actions when you ask it to. On a fresh install, page content is read only for a feature you invoke. You may separately enable automatic capture in Settings; it is off by default and can be disabled at any time.

Tabs and tab groups: list, open, close, group, switch to, reload, and read URL/title of tabs in your current Chrome profile.
Browsing history: search and list your Chrome history when an agent tool such as "search history" is invoked.
Bookmarks: read your bookmark tree when invoked.
Downloads: list, cancel, or initiate downloads when invoked.
Recently closed tabs (sessions): list and restore.
Web navigation events: detect when a page finishes loading so the agent can read it.
Clipboard write: write to your clipboard (for example, copying an audit receipt). The Extension does not read your clipboard unless you grant the optional clipboardRead permission.
Notifications: shown when scheduled agent tasks become due.
Native messaging: used only if you have installed the optional Matrx Local desktop companion, to bridge between the Extension and the desktop engine.
Debugger (Chrome DevTools Protocol): used by admin-only diagnostic tools (CDP). When attached, Chrome shows a visible "is being debugged" banner. CDP-derived data (console messages, network metadata, accessibility tree) is treated the same as any other page content described in Section 2.2.
All-sites access (<all_urls> host permission): required because users choose which web pages they want to capture, audit, or work with. A lightweight content-script bridge is present on normal web pages, but it does not transmit page content until you invoke a feature or explicitly enable automatic capture.

2.4 Optional permissions you may grant at runtime

These are not requested at install time. The Extension asks for them only when you toggle them on in Settings → Advanced agent capabilities, and you can revoke them at any time from the same screen or from Chrome’s extension settings.

Cookies: read, set, or delete cookies on the current origin.
Page capture: save the current page as an MHTML archive.
Clipboard read: read clipboard contents on demand.
Tab capture: record video of the active tab when you start a recording.

2.5 Microphone audio (optional voice input)

If you press the microphone button in the Extension, your microphone captures audio locally. Audio chunks are sent to our backend at aimatrx.com, which proxies the audio to Groq for speech-to-text transcription, and (when you ask an agent to speak) proxies generated text to Cartesia for text-to-speech synthesis. Audio is processed for the request only; we do not retain the raw audio.

2.6 Data stored locally on your device

The Extension keeps the following on your machine, inchrome.storage.local, and never uploads it unless you explicitly choose to:

Settings, voice preferences, theme preference.
Cached recent conversations (the authoritative copy lives on our server — see Section 3.2).
"Demos" you record — sequences of your own browser actions you save for the agent to replay.
Per-domain "guidance" notes, screenshots, and recordings you create.
A local audit log of cryptographic run receipts: the Extension generates a device-bound Ed25519 keypair and signs a record of each tool call (call id, hashes of inputs and outputs, timestamps) so you can later verify what the agent did. The audit log is local-only; nothing is uploaded.
A debug log ring buffer (last several hundred events). This is for your own troubleshooting and can be exported or cleared from the Debug tab.
A short log of which tabs recently produced sound, used by the "recently audible" agent tool.

2.7 What we do not collect

No analytics, telemetry, or third-party trackers in the Extension.
No advertising identifiers, fingerprinting, or precise location data.
No selling of personal information; no data brokers.
No page-content capture except for a feature you invoke or automatic capture you explicitly enable.

2.8 SMS and mobile information

If you choose to enroll in AI Matrx SMS notifications, we collect the mobile number you provide, your consent status and timestamp, the verification result, messaging preferences, and the messages needed to operate and support the program. Message frequency varies and message and data rates may apply. You can reply STOP to opt out or HELP for help.

2.9 Google Workspace data (optional)

If you choose to connect Google Workspace, AI Matrx requests access at the point of use for the feature you are using. Connecting Docs and Sheets uses Google’s drive.file permission. This lets you select individual Google Docs or Sheets through Google Picker; it does not let AI Matrx browse your entire Google Drive. For a selected file, we may process its file id, name, type, link, and the content needed to perform the read or update action you request.

Google Drive browsing is a separate, optional feature in internal testing. If you grant drive.readonly, Google technically permits AI Matrx to view and download all files that account can access, including shared files. The Files browser lists file details and searches that account; it downloads an ordinary file or exports a supported Google file only when you explicitly choose to copy it into Matrx Files. That copy remains in Matrx Files until you delete it. Browsing or copying a file does not automatically send its contents to an AI model. If you later attach the saved copy to a chat or make another explicit agent request, Section 3.1 applies.

Gmail sending uses gmail.send to send the recipients, subject, and message body visible to you after you confirm the send. Gmail reading is a separate, optional feature in internal testing. If you grant gmail.readonly, AI Matrx can search your mailbox when you request it, show message headers and snippets in the results, and read the body of a message you select. That permission does not let AI Matrx delete, organize, or send messages. Connected Shadow Inbox is temporarily unavailable while we complete deletion controls for retained Rulebook material. If it becomes available and you separately start it, AI Matrx reads up to 50 recent threads you replied to in your chosen lookback period. It retains qualifying thread content as Rulebook raw material to derive draft rules, and the configured AI model provider may process that content for that request. Connecting Gmail alone does not start Connected Shadow Inbox.

Gmail changes are a separate, optional feature in internal testing. If you grant gmail.modify, AI Matrx can change an opened message in the Google account you chose when you explicitly select Archive or Restore to inbox, Mark read or unread, Star or unstar, or Add or remove one of your named labels. The screen retrieves your labels so you can choose one by name; it does not change your whole mailbox in the background. Google’s permission also technically permits reading, composing, and sending email, but this Gmail changes screen does not send email. Reviewed Gmail sending remains a separate action that you confirm. Google does not provide this screen with a native Gmail Snooze operation.

If you separately register a Gmail mailbox for outreach replies, AI Matrx checks new messages in that mailbox to determine whether they reply to your tracked outreach. This check reads message content before it can determine whether a message matches. A matched reply may be saved as a CRM interaction with its subject, message identifiers, classification, and up to 20,000 characters of body text. Unmatched messages are not saved as CRM interactions.

Google Workspace content is used to provide the feature you request. It is not sold, used for advertising, or used to determine creditworthiness. Gmail search results and opened messages are not automatically sent to an AI agent. Saved CRM interaction subjects and bodies, including matched outreach replies, are also excluded from automatic agent context. Once available, separately starting Connected Shadow Inbox is an explicit request to process its qualifying Gmail thread content to derive Rulebook draft rules. If you choose to provide other Google content to an agent in a chat or another explicit request, the configured model provider may process that content to answer your request, as described in Section 3.1. We do not use Gmail content to train our own generalized AI models.

The use of information received from Google Workspace APIs will adhere to the Google User Data Policy, including the Limited Use requirements.

YouTube account data

AI Matrx uses YouTube API Services. If you connect YouTube, we access channel details, uploaded-video details and public statistics. If you also authorize YouTube Analytics, we retrieve the selected channel’s private, non-monetary reports, including views, watch time and subscribers gained for the date range you request. These read permissions do not let AI Matrx upload, edit or publish videos.

On-demand reports are displayed in AI Matrx. A separately requested channel sync can save video details and daily channel metrics in your account. Disconnecting stops future access but does not itself erase those saved records. For deletion requests or questions, contact support@aimatrx.com. If you explicitly include YouTube results in an agent request, the configured model provider may process that information as described in Section 3.1.

You can revoke access through your Google Account permissions. Google’s handling of information is described in the Google Privacy Policy.

Mobile information and text-message opt-in data and consent are not sold, rented, or shared with third parties or affiliates for marketing or promotional purposes. We disclose this information only to service providers that deliver and secure the SMS program, when you direct us to, or when required by law.

2.10 Amazon Selling Partner data (optional)

If you connect an Amazon selling account, AI Matrx accesses Amazon Selling Partner API data only after you authorize the connection through Amazon’s OAuth workflow. The initial integration uses the Product Listing and Inventory and Order Tracking roles to create and maintain your listings, synchronize quantities across channels, and show non-restricted order information such as order identifiers, line items, status, and totals. It does not request Restricted roles or Restricted Data Tokens and does not obtain buyer names, addresses, or contact details through other means.

Amazon Information is isolated to your organization and used only to provide the features you request. We do not sell it, use it for advertising, combine it across sellers for unrelated purposes, or use it to train or fine-tune generalized AI models.

3. Where your data goes

3.1 Sub-processors

We share data with the following providers strictly to operate the Service:

Supabase — authentication, database storage, and realtime cross-device messaging. Hosts your account record, conversation history, and saved artifacts. (Supabase privacy policy)
Amazon Web Services (AWS) — hosts the AI Matrx server that processes connected-service requests, including Gmail reading and outreach replies. (AWS privacy notice)
Vercel — hosting for our web application and API routes. Receives request metadata (IP address, user-agent) as part of normal HTTPS serving. (Vercel privacy policy)
Groq — speech-to-text. Receives the audio you submit when you use voice input. (Groq privacy policy)
Cartesia — text-to-speech. Receives the text submitted for synthesis. (Cartesia privacy policy)
Twilio — phone-number verification and SMS delivery. Receives the mobile number and message data needed to verify enrollment and deliver texts. Twilio may process delivery metadata and opt-out keywords to operate the messaging service. (Twilio privacy notice)
Large language model providers — Anthropic, OpenAI, Google (Gemini), and other providers as configured per agent. When you send a message to an agent, the agent backend forwards your message and any included page context to whichever provider that agent is configured to use, so it can generate a response. Each provider’s own privacy and data-retention policies apply to that processing. We do not train models on your content, and we use providers’ non-training, non-logging endpoints where they are offered.

3.2 What is stored on our servers

Your account record (email, profile fields), your conversation history, agents and prompts you have configured, and artifacts you save (notes, guidance items, recorded demos that you choose to sync) are stored on our infrastructure (Supabase) under your user id.

These are retained until you delete them. You can delete individual conversations, artifacts, or your entire account at any time. Deleting your account removes your stored data within a commercially reasonable period, except where we are required to retain a record for legal, security, or fraud-prevention reasons.

3.3 Cross-device messaging

The Extension subscribes to a per-user Supabase Broadcast channel so that messages sent from your other devices or from the web app can be delivered to the Extension in real time. Only your authenticated sessions can publish or receive on your channel.

3.4 In-page integrations (WebMCP and externally connectable origins)

On a small allowlist of origins we control (aimatrx.com and our development hosts), the Extension exposes its tool catalog to in-page agents via the WebMCP API and accepts authenticated messages via Chrome’s externally_connectable bridge. These bridges only operate on origins on the allowlist; arbitrary websites cannot use them to call the Extension.

3.5 Google Workspace credentials and content

The Google refresh token is encrypted in AI Matrx’s server-side user secrets vault. A short-lived access token restricted to basic account identity plus drive.file may be held in browser memory while Google Picker is open; it is not written to browser storage. We store safe connection metadata and references for the individual files you selected. On-demand document and spreadsheet operations do not save document contents or spreadsheet cell values as records. A file you explicitly import from Drive is a separate saved copy in Matrx Files; disconnecting Google does not delete that copy. The on-demand Gmail search/open reader does not save search queries or opened message bodies as records. Qualifying Gmail thread content from past Connected Shadow Inbox use remains retained as Rulebook raw material; once the feature is available again, new qualifying content may be retained after you separately start it; disconnecting Google stops future reading but does not erase that retained Rulebook content. The separately configured outreach-reply feature saves matched replies as described in Section 2.9; that CRM copy remains after you disconnect Google until you request its deletion or delete your account.

3.6 Amazon credentials and information

Amazon OAuth credentials are encrypted in AI Matrx’s server-side credential vault. Amazon Information is processed by our contracted infrastructure providers — AWS for application compute, Supabase for managed database storage, and Vercel for the web frontend — only as needed to operate AI Matrx. We do not place Amazon credentials or Amazon Information in public repositories or share them with advertisers, data brokers, or unrelated third parties.

4. How we use the information

To authenticate you and keep your session active.
To run the AI agent you have invoked: deliver your prompts and the context you have authorized, return responses, and execute the browser tools you ask it to use.
To maintain conversation history so the agent has memory across sessions.
To support, debug, and improve the Service. We may review aggregated, de-identified usage signals (for example: error rates, tool failure counts) for reliability work; we do not use the contents of your conversations or page captures for product analytics.
To comply with applicable law, prevent abuse, and protect the security of the Service.

We do not use your personal data for behavioral advertising, and we do not sell or rent it to anyone.

5. Retention

Account record: kept until you delete your account.
Conversations and saved artifacts: kept until you delete them or your account.
Microphone audio (voice input): processed for the request and not retained by us. Provider retention is governed by Groq’s and Cartesia’s respective policies.
Server logs: request-level operational logs (IP, timestamps, error codes) are retained for a limited period for security and debugging, then rotated out.
SMS consent and delivery records: retained as needed to honor opt-outs, demonstrate consent, prevent abuse, and meet legal or carrier requirements.
Google Workspace connection: encrypted credentials and selected-file references are kept until you disconnect Google or delete your account. A Drive file you explicitly copy into Matrx Files remains there until you delete the copy or your account. On-demand document and spreadsheet operations process content without storing those values as records. The Gmail search/open reader processes selected message bodies without saving them as records. Qualifying Connected Shadow Inbox threads from past use remain retained as Rulebook raw material; disconnecting Google stops future access but does not itself delete that retained content. Matched outreach replies saved as CRM interactions are retained until you request their deletion or delete your account; disconnecting Google stops future access but does not itself delete those existing CRM interactions. Deleting a CRM copy from the active database does not immediately remove earlier backup copies. Our daily S3 database backups have a 365-day expiration rule. The separate point-in-time recovery window was about seven days when last checked in September 2026; other copies may have different retention.
Amazon Selling Partner connection: encrypted credentials and seller-authorized listing, inventory, and non-restricted order records are kept until you disconnect Amazon, delete those records, or delete your account, subject to legal, security, and fraud-prevention retention requirements.
Local extension data: stays on your device until you clear it, uninstall the Extension, or wipe Chrome’s extension storage.

6. Your choices and rights

Access and export. Sign in to the web app to view your account record, conversations, and saved artifacts.
Delete. Delete individual conversations or artifacts from inside the app. To delete your entire account, email support@aimatrx.com from the address on file.
Revoke optional permissions. In the Extension open Settings → Advanced agent capabilities, or open Chrome’s extension settings page, to revoke any optional permission at any time.
Disconnect Google Workspace. Use the Google Workspace connection control in AI Matrx to revoke Google authorization and remove the saved server-side credential and selected-file references. This does not delete any CRM interactions previously saved from matched outreach replies. To request deletion of those CRM copies, contact support@aimatrx.com, or request account deletion. You can also revoke AI Matrx from your Google Account permissions.
Disconnect Amazon. Use the Amazon connection control in AI Matrx to revoke the connection and remove the saved server-side credential. You can also revoke the application from your Amazon selling-account settings.
Uninstall. Uninstalling the Extension removes the Extension and its locally stored data from that device. Your server-side account record is unaffected; delete it separately if you want it gone.
EU/UK/California rights. Depending on where you reside, you may have rights of access, rectification, erasure, portability, restriction, and objection (GDPR, UK GDPR, CCPA/CPRA). To exercise any of them email support@aimatrx.com and we will respond within the timeframes required by the applicable law.

7. Security

We use HTTPS for all client-server traffic, store credentials with our authentication provider (Supabase) rather than rolling our own, encrypt refresh tokens at rest in extension storage and in the server-side user secrets vault, and gate privileged tool actions and Gmail sends behind explicit user confirmation. No method of transmission over the Internet or method of electronic storage is 100% secure; we cannot guarantee absolute security but we work to keep practices in line with the sensitivity of the data.

8. International data transfer

We are based in the United States. Data we process may be stored or processed in the United States or in any other country where our sub-processors operate. By using the Service you consent to such transfers. We rely on the standard contractual mechanisms our sub-processors offer for international transfer where applicable.

9. Children

The Service is not directed to children under 13 (or the equivalent minimum age in your jurisdiction). We do not knowingly collect personal data from children under that age. If you believe a child has provided us personal data, please contact support@aimatrx.com and we will delete it.

10. Third-party links

The Service and the agents you run through it may navigate to or retrieve content from third-party websites. We are not responsible for the privacy practices of those sites, and this policy does not cover them.

11. Changes to this policy

We may update this policy from time to time. The "Last updated" date at the top reflects the most recent change. For material changes that affect how your data is handled, we will notify active users by email and/or through an in-product notice prior to the change taking effect.

12. Contact

ALL GREEN ELECTRONICS RECYCLING, LLC
AI Matrx product
Email: support@aimatrx.com