Privacy notice¶
Draft: needs the owner's lawyer review. Not legal advice. Replace every
<...>before publishing. It describes what the repository does today; counsel decides the legal bases, wording and any missing sections. Roles: processor for customer content, controller for account and billing data.
Controller of account and billing data:
1. Two roles¶
- Customer content (what people say to the agents, meeting audio and transcripts, task inputs and outputs): we process it for the customer on its instructions, as a processor. The customer's own privacy notice to its staff and guests applies; our terms are the DPA (the Data Processing Agreement). Requests about this data go to the customer first.
- Account and billing data (sign-in identity, contact details, subscription and invoices): we decide why and how, as a controller.
2. What we process¶
| Data | Examples | Where it comes from | Role |
|---|---|---|---|
| Account | Name, work email, identity provider ids, role assignments | The customer's admin or the person at sign-up (Microsoft Entra or Google sign-in) | Controller |
| Billing | Company name, billing contact, plan, seats, invoices | The customer | Controller (Stripe controls its own payment data) |
| Chat | Messages to Bill or Ben in Teams, answers, task records | The person | Processor |
| Meetings | Audio, transcript, chat messages of meetings the agent joins, participant names | Teams meeting through Attendee | Processor |
| Agent work | Task inputs and outputs, files in the sandbox, agent session files, company library documents | The person or the customer | Processor |
| Usage and logs | Meter counts, model usage records, service logs | Our services | Controller for billing meters; processor for model logs |
| Audit | Who did what and when (logins, setting and role changes, denied requests, exports, deletions) | Our services | Controller (security and accountability) |
| Sign-up and enquiries | Name, work email and company given on the sign-up or contact form, plan asked about | The person | Controller. |
| Website visits | Page, referrer, browser and country class, and clicks on the sign-up and sales buttons, counted by our own Umami with no cookie and no stored IP address (a visitor id is a hash that changes daily). Switch it off with the link in the website footer, or with Do Not Track. |
Visitors | Controller |
| Website errors | The text and stack trace of a script error in your browser, sent to our own GlitchTip with no user data, no cookies and IP scrubbing switched on. |
Visitors | Controller |
3. Why, and on what legal basis¶
| Purpose | Data | Legal basis |
|---|---|---|
| Provide the service the customer ordered | Account, chat, meetings, agent work | |
| Take payment and issue invoices, keep tax records (usage and billing records are kept 7 years) | Billing | |
| Security, abuse prevention, audit trail | Audit, logs | |
| Meeting recording and transcription | Meetings | <customer's basis as controller; see the meetings DPIA> |
| Marketing email, if any | Contact | |
| Answer sign-up and contact requests | Sign-up and enquiries | |
| Understand which pages and buttons work; keep the website working | Website visits, website errors |
4. Who receives data¶
The sub-processors and where they process are listed in the Sub-processors list; customers get 30 days notice of a change.
Categories: cloud hosting (Hetzner), language model vendors (Anthropic, OpenAI, Google), speech services (Deepgram, ElevenLabs),
Microsoft (Teams, Graph, sign-in), sandbox and web tools (E2B, Exa, Firecrawl), payments and tax (Stripe), monitoring (Better Stack)
and email delivery (
5. AI use¶
People talk to AI agents named "Bill (AI)" and "Ben (AI)". The agent says it is an AI assistant before its first answer in a Teams
conversation and when it joins a meeting (see the AI transparency notice). Automated decisions with legal or similarly significant
effects on a person:
6. How long we keep data¶
Defaults a customer can change per data class in the console (section "Data classes and retention"):
| Data class | Default |
|---|---|
| Meeting transcripts and recordings | 90 days |
| Chat, agent sessions, task journal | 365 days |
| Model logs | 365 days |
| Usage records | 7 years (tax) |
| Knowledge documents | Until the customer sets a policy or deletes them |
| Audit log | Pruned nightly by the retention job once older than your plan's period: 365 days on Trial and Team, up to 2555 days (7 years) on Business and Enterprise. |
| Sign-ups never verified | 30 days |
| Contact-form enquiries | 24 months |
| Website visit counts and error reports | Counts: kept as aggregate numbers; error reports: 30 days |
| Backups | Encrypted copies are kept by rotation: 7 daily, 4 weekly and 12 monthly, so up to about 12 months. They are not edited when you ask for erasure; erased data leaves them as old copies expire. |
A nightly job deletes expired data from our database, the agents' working storage, the company knowledge base, meeting recordings and transcripts, and model logs. When a tenant is deleted, its data, agent storage, model access and sign-in organisation are removed; the Stripe customer is kept in a minimal form for tax.
7. Your rights¶
Access, rectification, erasure, restriction, portability, objection, and complaint to a regulator (
8. Security¶
Per-tenant isolation (the database hides one tenant's rows from another, and each tenant has a separate agent environment), a permission check on every action, a tamper-evident audit log, encryption in transit and backups. The full measures are Annex 2 of the DPA.
9. Cookies and the console¶
The console uses a session cookie needed to keep you signed in. The marketing website sets no cookies. Its visit counts (Umami) and error reports (GlitchTip) run on our own servers, use no cookies and no device storage except one flag that remembers your choice to switch counting off.
10. Changes¶
We post changes here and tell customers