Privacy Policy

2What we use it for

Only to run and improve the service: generating replies, doing the work you ask your employees for, maintaining each employee's memory, billing, preventing abuse, and telling you when something needs your attention. We never use one company's material or conversations for another company's employees. We do not sell any of it or use it for advertising. A waitlist email is used only to tell you when trial opens.

3Google user data

When you connect your Google account, we ask only for what the features you turn on need, one at a time:

Calendar — your events and the list of your calendars, read to answer questions about your schedule, plan and check for clashes; and the events you approve (with a Google Meet link when you ask for one).

Sending email — emails you have approved are sent from your Gmail. We cannot read your inbox or any email you did not ask your employee to write.

Contacts — names and email addresses, looked up when you ask your employee to write to someone by name.

Tasks — your open tasks, read when you ask, and the reminders you ask for, added to your list.

Drive — only the files you pick in Google's own file picker, and the files AAAAI creates in an "AAAAI" folder. A document you pick for the knowledge base is read into it. Photos you put in Products and services are sent by the Customer Service employee into a Telegram conversation when a customer asks to see them; for a photo sent on Telegram we keep only Telegram's id for it and your note, and for one picked from Drive only its Drive id — never a copy of the photo (Telegram keeps the photo it delivers, as part of that conversation). Your Social Media employee can also place one of these photos in a designed post: it is read when the page is drawn, kept only briefly in our server's memory to draw it again, and never stored. A picture or video you pick for a post is read when your Social Media employee drafts the post and again when it is published to Instagram or Facebook (for a video, our server briefly takes a few still frames for the employee to look at and repackages the file into the format both platforms accept, without changing its content, deleting both right after); we keep its Drive id, size and length, never a copy of the picture or video. Files you attach from your phone or computer in the chats of your Assistant, Marketing and Social Media employees (and files you upload in Google's picker there) are sent by your browser straight to Google and saved into an "AAAAI Media" folder in your Drive, without passing through our servers; from then on they are files you picked. A file you attach for the Assistant or Marketing employee — a picture, a PDF, a Word or Excel file — is read from your Drive when you send it, and again if that employee opens it later in the same conversation; its content goes to Anthropic for that reply only, and we keep only its Drive id, name and type, never a copy. If you ask the Assistant to hand the work to the Marketing employee, the same files go with it, read the same way. A presentation an employee made for you is saved, when you press "Save to Google Drive" on it, as a new Google Slides file in the "AAAAI" folder; product photos placed in a presentation are read when its pages are drawn, the same way as in a designed post, and never stored. We cannot see anything else in your Drive.

Signing in with Google — when you choose "Continue with Google", only your Google account's email address and Google's ID for that account, used to sign you in and kept on your AAAAI account. It asks for nothing else and gives your employees no access to your Google account; connecting Calendar, email or Drive is a separate step on your Assistant's page.

Gmail add-on — the one email you have open, read only after you press one of the add-on's buttons, and the reply draft it places in your reply box.

How we use it: only to provide those features to you. A person at AAAAI reads it only with your permission (for example when you ask for support), when needed for security or to investigate abuse, or when the law requires it. It is not sold, not used for advertising, and not used to develop, improve or train generalised AI or machine-learning models.

Who we share Google user data with. We share, transfer or disclose Google user data only with the parties below, only the part each one needs, and only to provide the features you use:

• Anthropic (AI processing). To do the task you asked for, the relevant part — for example the email you want answered, or the events you asked about — is sent to Anthropic's Claude models, which process it on our behalf under Anthropic's commercial terms. Anthropic does not train its models on data sent through its commercial API.

• Our hosting and database providers. Our servers run on Railway and our database is hosted by Neon. They store and process data on our behalf, only to run AAAAI, and do not use it for anything else.

• Telegram, when you use it. If you connect Telegram for notifications, a draft waiting for your approval — for example an event's title and time, or an email's recipient, subject and text — is sent to your own Telegram chat so you can approve or reject it there, and the reports you scheduled, such as the morning brief, which can mention the day's events, arrive there too. A product photo you picked from Google Drive is sent through Telegram to a customer of yours who asks to see it.

• Instagram and Facebook (Meta), when you approve a post. A picture or video you picked from Google Drive for a post — or a photo from Products and services that your Social Media employee placed in a designed post — is sent to the Instagram account or Facebook Page you connected, only after you approve that post.

• The people you choose. An email you approve is sent from your Gmail to the recipients you chose, and an event you approve reaches the guests you invited, through Google itself.

• When the law requires it, or to protect rights and safety. We disclose data if a valid legal process requires it, or where needed to prevent fraud, abuse or harm. If AAAAI is ever merged or acquired, your data would move to the new owner only under the same commitments as this policy, including the Limited Use requirements below, and we would tell you first.

We do not share, transfer, sell or disclose Google user data to anyone else — not to advertisers, data brokers or information resellers, and never for advertising.

How we protect it: every connection — between your browser and AAAAI, and between AAAAI and Google — is encrypted in transit (HTTPS/TLS). The access and refresh tokens for your Google account are encrypted with AES-256-GCM before they are stored, with a key kept apart from the database, and they never leave our servers: the file picker in your browser is given a separate short-lived token that can only reach the files you pick. Our database provider encrypts all stored data at rest. Every company's data is kept separate and every request is checked against the company it belongs to (section 6). Access to the systems that hold your data is limited to AAAAI's operators, for running and supporting the service. We ask only for the permissions a feature you turn on needs, when you turn it on. If we learn that your Google data was accessed without authorisation, we will tell you without undue delay.

How long we keep it: what becomes part of your chats, drafts or knowledge base is kept until you delete it or close your account. You can disconnect Google at any time on your Assistant's page, which deletes the stored access token at once, or revoke AAAAI's access in your Google Account's security settings.

AAAAI's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

4Facebook and Instagram data

When you connect a Facebook Page or an Instagram professional account, we keep its id, its name or username, and a token that lets us publish for it. We publish only the posts you approve. For Facebook posts we have published, we read their like, comment and share counts so your Social Media employee can review how they did. We do not read your messages, and we do not read comments beyond counting them.

You can disconnect either account at any time on your Social Media employee's page, which deletes the stored token at once, or remove AAAAI in Facebook's Business Integrations or Instagram's Apps and Websites settings. See the Data Deletion page for everything else.

5Other services we rely on

Replies are generated by Anthropic's Claude models: the relevant conversation, your company details, and the retrieved passages of your material are sent to Anthropic for processing. When an employee searches the web, the search is made through Anthropic's search tool. The Community Manager and owner notifications use the Telegram Bot API. The service is hosted on Railway and its database on Neon. Each processes data only to provide its part of the service.

6Separation between companies

Each company's data is stored under its own tenant identifier, and an AI employee can only read the material and memory belonging to its own company. Improvements to the shared role templates are based on anonymous statistics — how often a failure mode triggers — and never on any company's actual conversations.

7When a person reads a conversation

A platform operator may read conversation content in two situations: when you ask for support, and when the system has flagged a reply as possibly out of control and it needs human review. Outside those cases we do not read your conversations.

8Keeping and deleting data

Data is kept while your account is active. After you close your account there is a 60-day window in which it can be restored, after which it is permanently deleted. Operational logs are kept for 90 days. You can ask us to export or delete your data — including your uploaded material, conversations and employee memory — at any time. The Data Deletion page explains every way to do it.

9Your customers' data

Messages from people who talk to your Community Manager on Telegram, and the people your employees email on your behalf, are processed by us on your instruction, as the business. It is your responsibility to meet your own obligations to them under local law, such as Malaysia's PDPA 2010. The Community Manager states that it is an AI at the start of every conversation.