Privacy.

This Privacy Policy describes Our policies and procedures on the collection, use and disclosure of Your information when You use the Service and tells You about Your privacy rights and how the law protects You.

We use Your Personal Data to provide and improve the Service. We collect, use, and disclose Your information as described in this Privacy Policy and, where required by applicable law, only where We have a valid legal basis to do so, including Your consent (where consent is required).

While using Our Service, We may ask You to provide Us with certain personally identifiable information that can be used to contact or identify You. Personally identifiable information may include, but is not limited to:

When You pay for a product and/or a service via bank transfer, We may ask You to provide additional personal information to facilitate this transaction and to verify Your identity and to comply with anti-fraud/legal requirements. Such information may include, without limitation:

Usage Data is collected automatically when using the Service.

Usage Data may include information such as Your Device's Internet Protocol address (e.g. IP address), browser type, browser version, the pages of Our Service that You visit, the time and date of Your visit, the time spent on those pages, unique device identifiers and other diagnostic data.

When You access the Service by or through a mobile device, We may collect certain information automatically, including, but not limited to, the type of mobile device You use, Your mobile device's unique ID, the IP address of Your mobile device, Your mobile operating system, the type of mobile Internet browser You use, unique device identifiers and other diagnostic data.

We may also collect information that Your browser sends whenever You visit Our Service or when You access the Service by or through a mobile device.

While using Our Application, in order to provide features of Our Application, We may collect, with Your prior permission:

We use this information to provide features of Our Service and to improve and customize Our Service. The information may be uploaded to the Company's servers and/or a Service Provider's server or it may be simply stored on Your device.

You can enable or disable access to this information at any time, through Your Device settings.

We use tracking technologies (such as cookies) to track the activity and to improve Our Service. The technologies We use may include:

Cookies can be "Persistent" or "Session" Cookies. Persistent Cookies remain on Your personal computer or mobile device when You go offline, while Session Cookies are deleted as soon as You close Your web browser.

Where required by law, We use non-essential cookies (that is, Cookies other than the Necessary / Essential Cookies described below) only with Your consent. You can withdraw or change Your consent at any time using Our cookie preferences tool (if available) or through Your browser/device settings. Withdrawing consent does not affect the lawfulness of processing based on consent before its withdrawal.

We use both Session and Persistent Cookies for the purposes set out below:

The Company may use Personal Data for the following purposes:

We may share Your Personal Data in the following situations:

You have the option to receive text (SMS) messages from Us. If You opt in to text messages, We will send You updates, notifications, and other communications as described below. When You opt in, We will collect and store the information You provide in connection with text messaging, such as Your phone number, the date and method of Your consent, and message delivery and read information.

No mobile information will be shared with or sold to third parties or affiliates for marketing or promotional purposes. The phone numbers and consent records We collect for texting are never shared with anyone for any purpose, except the Service Providers that technically have to handle them to deliver the texts.

Consent to receive text messages is not a condition of any purchase or use of Our Service. If You consent to receive SMS from Us, You agree to receive text messages from Us related to:

Reply STOP to opt-out. Reply HELP for support. Message & data rates may apply. Messaging frequency may vary. Carriers are not liable for delayed or undelivered messages.

The Company will retain Your Personal Data only for as long as is necessary for the purposes set out in this Privacy Policy. We will retain and use Your Personal Data to the extent necessary to comply with Our legal obligations (for example, if We are required to retain Your data to comply with applicable laws), resolve disputes, and enforce Our legal agreements and policies.

Where possible, We apply shorter retention periods and/or reduce identifiability by deleting, aggregating, or anonymizing data. Unless otherwise stated, the retention periods below are maximum periods ("up to") and We may delete or anonymize data sooner when it is no longer needed for the relevant purpose. We apply different retention periods to different categories of Personal Data based on the purpose of processing and legal obligations:

Usage Data is retained in accordance with the retention periods described above, and may be retained longer only where necessary for security, fraud prevention, or legal compliance.

We may retain Personal Data beyond the periods stated above for different reasons:

You may request information about how long We will retain Your Personal Data by contacting Us.

When retention periods expire, We securely delete or anonymize Personal Data according to the following procedures:

Your information, including Personal Data, is processed at the Company's operating offices and in any other places where the parties involved in the processing are located. This means that this information may be transferred to — and maintained on — computers located outside of Your state, province, country or other governmental jurisdiction where the data protection laws may differ from those of Your jurisdiction.

Where required by applicable law, We will ensure that international transfers of Your Personal Data are subject to appropriate safeguards and, where relevant, supplementary measures. The Company will take all steps reasonably necessary to ensure that Your data is treated securely and in accordance with this Privacy Policy and no transfer of Your Personal Data will take place to an organization or a country unless there are adequate controls in place, including the security of Your data and other personal information.

You have the right to delete or request that We assist in deleting the Personal Data that We have collected about You.

Our Service may give You the ability to delete certain information about You from within the Service.

You may update, amend, or delete Your information at any time by signing in to Your Account, if You have one, and visiting the account settings section that allows You to manage Your personal information. You may also contact Us to request access to, correct, or delete any Personal Data that You have provided to Us.

Please note, however, that We may need to retain certain information when We have a legal obligation or lawful basis to do so.

You may request deletion of Your Account, and of the Personal Data We hold about You, through the settings in Your Account or by using the contact methods in the “Exercising Your CCPA/CPRA Data Protection Rights” section, including if You can no longer access Your Account. If Your Account was provisioned by Your organization, Your organization’s administrator may also remove Your seat, which results in deletion of Your Account.

We will verify Your identity to a reasonable degree of certainty before acting, acknowledge Your request within ten (10) business days, and respond within forty-five (45) calendar days, extendable once by a further forty-five (45) days where reasonably necessary; if We extend, We will tell You why and when to expect a response. Where deletion is required by applicable law, We will delete, or de-identify beyond reasonable re-identification, the Personal Data We control, and We will direct Our Service Providers to do the same. Deletion of Your Account is permanent, ends Your access to the Service, and cancels any subscription as of the end of the then-current billing period; fees already paid are non-refundable except as required by law.

We may retain Personal Data where an exception under applicable law applies, including to complete a transaction You requested, detect and protect against security incidents or fraud, comply with a legal obligation (such as tax and accounting record-keeping), or establish, exercise or defend legal claims. Retained data is limited to what the exception requires, is subject to access controls, and is retained only for the period required. Copies in encrypted backups are deleted in the ordinary course of Our backup rotation and are not restored to active systems except as necessary for security, disaster recovery or legal compliance. We keep a record of Your request for twenty-four (24) months as required by California regulations. Deleting Your Account does not delete content stored in Your organization’s own Microsoft 365 environment, which remains under Your organization’s control.

Exercising Your privacy rights does not waive any other right You have, and We will not discriminate against You for doing so.

If the Company is involved in a merger, acquisition or asset sale, Your Personal Data may be transferred. We will provide notice before Your Personal Data is transferred and becomes subject to a different Privacy Policy.

Under certain circumstances, the Company may disclose Your Personal Data if required to do so by law or in response to valid requests by public authorities (e.g. a court or a government agency).

The Company may disclose Your Personal Data in the good-faith belief that such action is necessary to:

The security of Your Personal Data is important to Us, but remember that no method of transmission over the Internet, or method of electronic storage, is 100% secure. While We strive to use commercially reasonable means to protect Your Personal Data, We cannot guarantee its absolute security.

We maintain a written information-security and incident-response program that includes procedures to detect, investigate, contain and remediate security incidents. The program is reviewed periodically.

If We determine that a breach of the security of Our systems has resulted in the unauthorized acquisition of Personal Data that We own or license, We will notify affected individuals in the manner and within the time required by applicable law. For California residents, Cal. Civ. Code § 1798.82 requires notice within thirty (30) calendar days after discovery of the breach, subject to delays permitted by law for legitimate law-enforcement needs or to determine the scope of the breach and restore the integrity of the system, and requires notice to the California Attorney General where more than 500 California residents are notified in a single breach. Notices will contain the information required by law, including a description of what happened, the categories of information involved, what We are doing, what You can do, and how to contact Us.

Where We process Personal Data on behalf of Your organization as a service provider, Your organization is the owner of that data and is responsible for notifying its own users, employees and customers. In that case We will notify Your organization’s designated administrator by email at the administrator address associated with the organization’s Account, without unreasonable delay after We confirm the breach, and We will provide the information reasonably available to Us that Your organization needs to meet its own obligations.

Notice under this section may be delivered by email to the address associated with Your Account, which You agree constitutes written notice. If You believe Your Account or Personal Data has been compromised, contact Us immediately using the information in the “Contact Us” section.

We maintain a written disaster recovery and rollback plan for the components of the Service that We operate:

The Service is hosted in a single Microsoft Azure region; an outage affecting that region may render the Service unavailable until the region or the Service is restored. Recovery capabilities and times described in this section are targets based on Our plan and Our hosting provider’s published capabilities, are not guarantees, and do not create any service-level commitment. Your files, communications and other content remain in Your organization’s own Microsoft 365 environment and are not stored by Us; their availability and recovery are governed by Your organization’s arrangements with Microsoft.

The Application uses artificial intelligence (“AI”) to provide its features, including summarizing meetings, drafting content, identifying tasks and suggesting actions. To do so, the Application transmits the content You select — which may contain Personal Data found in Your files, email, calendar items, chats and meeting transcripts — to AI models. Those models are provided by third parties and are licensed by You or Your organization (for example, Microsoft 365 Copilot); the Company does not operate or control them. Your content is processed within Your organization’s own Microsoft 365 environment and is subject to Microsoft’s terms and privacy commitments, which govern Microsoft’s handling of that content.

No training. We do not use Your Personal Data or Your content to train, retrain, fine-tune or otherwise develop any AI or machine-learning model, whether Ours or a third party’s, and Our contracts with Service Providers prohibit them from doing so on Our behalf. We are not responsible for the practices of AI providers that You or Your organization license directly.

No automated decision-making. We do not use AI or other automated processing to make decisions about You that produce legal or similarly significant effects, including decisions concerning employment, credit, housing, insurance, education or access to essential goods or services. AI output is presented to a person, who decides whether to accept, modify or discard it before any action is taken.

Accuracy. AI output may be inaccurate, incomplete or misleading and is provided for informational purposes only. See the “Artificial Intelligence Features” section of Our End-User License Agreement, which governs Your use of AI features.

By using the AI features of the Application, You acknowledge that Personal Data contained in the content You select will be processed by AI as described in this section.

This Privacy Policy describes two different kinds of information, and Our role is different for each.

Information We collect for Our own purposes. When You visit Our Website, create or manage an Account, purchase a subscription, contact Us, or receive Our communications, We collect and use Personal Data — such as Your name, work email address, organization, billing details and Website usage information — as the “business” (or controller) of that information. The remainder of this Privacy Policy, including the “CCPA/CPRA Privacy Notice,” describes how We handle it.

Content We process on behalf of Your organization. When You use the Application’s features, the Application accesses and processes content in Your organization’s Microsoft 365 environment — such as email, files, calendar items, chats and meeting transcripts — that may contain Personal Data about You and about other people. As to that content, Your organization is the “business” (or controller): it decides what the Application may access and for what purposes, and it is responsible for providing any notices and obtaining any consents required by law from its employees, customers and other individuals whose information appears in that content. We act only as Your organization’s “service provider” (or processor), as those terms are defined in the California Consumer Privacy Act and comparable laws. We process that content only to provide the Application’s features to Your organization, in accordance with Our agreement with it, and We do not sell it, share it for cross-context behavioral advertising, use it to train AI models, or use it for Our own purposes. We do not store that content on Our systems beyond the transient processing needed to deliver a feature.

Requests about that content. If You wish to access, correct or delete Personal Data contained in Your organization’s Microsoft 365 content, please direct Your request to Your organization, which controls that data. If You contact Us about such a request, We will refer it to Your organization and will assist Your organization in responding to the extent required by law and Our agreement with it.

The Application connects to Your organization’s Microsoft 365 environment through Microsoft identity, Microsoft Graph and Microsoft 365 Copilot services. It does so only with the permissions granted to it through Microsoft, either by You when You sign in and consent, or by Your organization’s Microsoft 365 administrator on behalf of the organization. The permissions requested are those required for the Application’s features and are displayed by Microsoft at the time consent is given.

Through those permissions the Application may access the following categories of information from Microsoft 365: Your profile information (such as name, email address, user identifier and organization identifier) for authentication and Account provisioning; and, depending on the features You use, Your email, calendar, chat, meeting transcripts and recordings, and files stored in OneDrive and SharePoint, for the purpose of generating summaries, tasks, drafts and suggested actions for Your review.

Access is limited to what You or Your organization has granted, is subject to Your organization’s Microsoft 365 configuration and policies, and is governed by Microsoft’s terms for those services. Microsoft’s own handling of Your data is described in Microsoft’s privacy statement, available on Microsoft’s website. We do not receive Your Microsoft password.

You or Your organization’s administrator may review and revoke the Application’s permissions at any time through Microsoft 365 or Microsoft Entra ID account settings, and Your organization may remove the Application from its environment. Revoking permissions or removing the Application disables the corresponding features and stops further access, but does not by itself delete Your Account with Us; see “Deleting Your Account and Your Data” for that process.

We may use third-party Service Providers to maintain and improve Our Service.

As defined in the CCPA/CPRA, "sell" and "sale" mean selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a Consumer's personal information by the Business to a third party for valuable consideration. This means that We may have received some kind of benefit in return for sharing personal information, but not necessarily a monetary benefit.

As defined in the CCPA/CPRA, "share" and "sharing" mean disclosing, making available, or otherwise communicating a Consumer's personal information by the Business to a third party for cross-context behavioral advertising, whether or not for monetary or other valuable consideration.

We sell or share Personal Information as those terms are defined in the CCPA/CPRA. We do not sell Personal Information in exchange for money. However, We disclose online identifiers and Internet activity information to third-party vendors in ways that constitute "selling" or "sharing" under the CCPA/CPRA, as described below.

We allow certain third-party vendors to use Your Personal Information for marketing activities, and these disclosures may be deemed a "sale" or "sharing" under the CCPA/CPRA.

In addition, the analytics providers We use (as described in the "Analytics" section of this Privacy Policy) may use the information collected on Our Service for their own purposes. Because We receive analytics and related services in exchange for making this information available, these disclosures may be deemed a "sale" or "sharing" under the CCPA/CPRA even though no money changes hands.

These vendors place tracking technologies (such as cookies, tags, and pixels) on the Website, and through these technologies, online identifiers and information about Your online activity are disclosed to them.

These disclosures include disclosures for "cross-context behavioral advertising" as defined in the CCPA/CPRA.

We may disclose or may have disclosed in the last twelve (12) months the following categories in a manner that constitutes a "sale" or "sharing" as defined in CCPA/CPRA:

The categories listed above are those defined in the CCPA/CPRA. Listing a category does not mean that every type of information it describes was in fact sold or shared. It means only that, to the best of Our knowledge, some information within that category may be, or may have been, sold or shared.

We retain California residents' Personal Information for as long as reasonably necessary to achieve the purposes described in this Privacy Policy (including the purposes disclosed in this CCPA/CPRA notice), taking into account: (i) how long We need the information to provide and maintain the Service and Your Account; (ii) whether You have requested deletion (subject to applicable exceptions); (iii) Our legal, tax, accounting, and regulatory obligations; (iv) security, fraud prevention, and abuse monitoring needs; and (v) the time periods needed to resolve disputes and enforce Our agreements.

Specific retention periods for major data categories are described in the "Retention of Your Personal Information" section of Our Privacy Policy, and We may retain certain information longer where required or permitted by law (for example, to comply with recordkeeping obligations or to establish, exercise, or defend legal claims).

We do not knowingly collect personal information from minors under the age of 16 through Our Service, although certain third-party websites that We link to may do so. These third-party websites have their own terms of use and privacy policies and We encourage parents and legal guardians to monitor their children's Internet usage and instruct their children to never provide information on other websites without their permission.

We do not sell the Personal Information of Consumers We actually know are less than 16 years of age, unless We receive affirmative authorization (the "right to opt-in") from the parent or guardian of a Consumer less than 16 years of age. Consumers who opt-in to the sale of Personal Information may opt out of future sales at any time. To exercise the right to opt-out, You (or Your authorized representative) may submit a request to Us by contacting Us.

If You have reason to believe that a child under the age of 16 has provided Us with personal information, please contact Us with sufficient detail to enable Us to delete that information.

The CCPA/CPRA provides California residents with specific rights regarding their personal information. If You are a resident of California, You have the following rights:

Please see the “Do Not Sell or Share My Personal Information” and “Limit the Use or Disclosure of My Sensitive Personal Information” sections for how to exercise those rights.

To exercise Your rights to know, delete or correct, and if You are a California resident, You may submit a request by either of the following methods:

We operate exclusively online and interact with consumers directly through the Service; We therefore designate an email address and an online form as Our request methods under 11 C.C.R. § 7020.

Verification. We will verify Your identity to a reasonable or reasonably high degree of certainty, as the regulations require for the type of request, by matching information You provide against information We maintain and, where appropriate, by requiring You to respond from the email address associated with Your Account. We will not require You to create an Account to make a request. We will not verify Your identity for requests to opt out of sale or sharing or to limit the use of sensitive Personal Information, but We may ask for information reasonably necessary to identify the Personal Data concerned and to process the request. If We cannot verify Your identity or authority, We will tell You and will not act on the request except to the extent permitted without verification.

Authorized agents. You may designate an authorized agent to submit a request on Your behalf. We may require the agent to provide proof of signed written authorization from You and may require You to verify Your identity directly with Us or confirm that You authorized the agent, except where the agent holds a power of attorney under Cal. Probate Code §§ 4121–4130.

Timing. We will confirm receipt of a request to know, delete or correct within ten (10) business days and will respond within forty-five (45) calendar days of receipt. Where reasonably necessary, We may extend that period once by up to forty-five (45) additional days and will notify You of the extension and the reason within the initial period.

Limits. You may make a request to know no more than twice in any twelve (12) month period. Our response to a request to know covers the twelve (12) months preceding the request unless You request a longer period and the information was collected on or after January 1, 2022, in which case We will provide it unless doing so proves impossible or would involve disproportionate effort. If a request is manifestly unfounded or excessive, in particular because of its repetitive character, We may charge a reasonable fee or refuse to act on the request; in either case We will explain Our decision. Data provided in response to a request to know will be delivered in a portable and, to the extent technically feasible, readily usable format.

Denials. If We deny a request in whole or in part, We will explain the basis for the denial and, where applicable, the exception relied on.

You have the right to opt out of the sale and sharing of Your Personal Information. To exercise this right, click the "Do Not Sell or Share My Personal Information" link on Our homepage, contact Us using the methods listed in the "Contact Us" section, or follow the instructions below. We will not require You to create an account or verify Your identity in order to opt out, although We may ask for information reasonably necessary to identify the Personal Information to which Your request applies and to process the request.

Our Service recognizes and honors opt-out preference signals, such as the Global Privacy Control (GPC), as required by the CCPA/CPRA. If Your browser or browser extension transmits a legally recognized opt-out preference signal, We will treat it as a valid request to opt out of the sale and sharing of Personal Information linked to that browser or device and, where We can reasonably associate the signal with You, to Your Account. You may need to enable the signal separately on each browser and device that You use.

Please note that the other opt-out methods described below are specific to the browser You use. You may need to opt out on every browser that You use.

Click the "Do Not Sell or Share My Personal Information" link on Our homepage, or the "Privacy Preferences" / "Update Privacy Preferences" control on the Service, to review Your privacy preferences and opt out of cookies and other technologies that We may use.

Additionally, You can opt out of receiving ads that are personalized as served by Our Service Providers by following Our instructions presented on the Service:

The opt-out will place a cookie on Your computer that is unique to the browser You use to opt out. If You change browsers or delete the cookies saved by Your browser, You will need to opt out again.

Your mobile device may give You the ability to opt out of the use of information about the apps You use in order to serve You ads that are targeted to Your interests:

You can also stop the collection of location information from Your mobile device by changing the preferences on Your mobile device.

If You are a California resident, You have the right to limit the use and disclosure of Your sensitive personal information to that use which is necessary to perform the services or provide the goods reasonably expected by an average consumer who requests such services or goods.

We collect, use and disclose sensitive personal information only in ways that are necessary to provide the Service. For more information on how We use Your personal information, please see the "Use of Your Personal Information" section or contact Us.

To submit a request to limit the use or disclosure of sensitive personal information, please contact Us using the methods listed in the "Contact Us" section of Our Privacy Policy. We will not require You to verify Your identity in order to submit a request to limit, although We may ask for information reasonably necessary to process the request.

Under California Civil Code § 1798.83 (California's Shine the Light law), California residents with an established business relationship with Us can request information once a year about sharing their Personal Data with third parties for the third parties' direct marketing purposes.

If You would like to make such a request, or to ask that We not disclose Your Personal Information to third parties for their direct marketing purposes, please submit Your request in writing using the contact information provided in the "Contact Us" section of this Privacy Policy.

The Service is not directed to, and We do not knowingly collect Personal Information from, anyone under the age of 16.

If You are a parent or guardian and You believe Your child has provided Us with Personal Information, please contact Us. If We become aware that We have collected Personal Information from anyone under the age of 16, We will take steps to remove that information from Our servers as soon as reasonably possible.

Some countries and states set a higher age at which an individual can consent to the processing of their own Personal Information. Where We rely on consent as a legal basis and the law applicable to a User sets an age higher than 16, We may require the consent of that User's parent or guardian before We collect and use their Personal Information.

We may update Our Privacy Policy from time to time. We will notify You of any changes by posting the new Privacy Policy on this page.

We will let You know via email and/or a prominent notice on Our Service, prior to the change becoming effective and update the "Last updated" date at the top of this Privacy Policy.

You are advised to review this Privacy Policy periodically for any changes. Changes to this Privacy Policy are effective when they are posted on this page.