Draft Privacy Notice

1. Scope and roles

This Notice applies when we determine why and how personal information is processed, such as account administration, billing, website operations, security, and support. When a business customer submits personal information for processing within its workspace, that customer generally controls the data and we process it on the customer's behalf. Questions about such workspace data should first be directed to the relevant customer.

2. Information we collect

• Account and profile information: name, email address, organization, role, authentication identifiers, preferences, and account status.
• Commercial information: plan, seats, orders, invoices, payment status, usage credits, and transaction identifiers. Payment-card details are handled by Stripe rather than stored by us.
• Email content and metadata: message bodies, attachments, headers, sender and recipient addresses, timestamps, thread and message identifiers, labels, and proposed classifications or follow-ups from connected mailboxes.
• Meeting media and intelligence: audio, video or other recordings when enabled, transcripts, speaker labels, timestamps, summaries, action items, and meeting-derived proposals.
• CRM and go-to-market records: account, contact, lead, and opportunity or deal fields; activities and relationship context; source provenance; and proposed additions, corrections, enrichments, or follow-ups pending review.
• AI prompts, instructions, and outputs: messages, agent configurations, uploaded files, connected business context, tool requests, results, proposed CRM mutations, and user feedback.
• Knowledge-graph data: entities, relationships, assertions, provenance, confidence or review state, and proposed graph entries generated from authorized workspace sources.
• Workspace and integration data: projects, tasks, meetings, artifacts, repository references, connected-account identifiers, and data you choose to exchange with an integration.
• External-partner collaboration data: invitation and identity details, deal or workspace information selected for sharing, comments and review activity, access status, revocation state, and related audit records.
• Usage and device information: pages and features used, timestamps, browser and device details, IP address, diagnostics, and approximate location inferred from network information.
• Security and audit information: login events, permissions, approvals, administrative actions, agent activity, abuse signals, incident data, and records needed to investigate or prevent misuse.
• Communications: support requests, feedback, survey responses, and other messages you send us.

3. How we use information

• provide, operate, personalize, maintain, and support the Service;
• authenticate users, manage tenant access, and enforce permissions and customer instructions;
• process AI requests, run authorized agents and tools, and return or retain requested outputs;
• administer subscriptions, usage credits, billing, refunds, disputes, and customer support;
• monitor reliability, measure usage, debug problems, and improve features and user experience;
• detect, investigate, prevent, and respond to fraud, abuse, security incidents, and violations;
• communicate service, transaction, security, support, and policy information; and
• comply with law, enforce agreements, and protect rights, safety, and property.

We do not use Customer Content to train a generally available AI model unless the applicable customer has expressly agreed to that use. Service providers may process content only under their applicable service terms and our instructions or configuration.

4. How we disclose information

We may disclose personal information:

• To your organization and authorized users according to workspace roles, permissions, and business workflows.
• To service providers that support cloud hosting, AI processing, authentication, communications, security, analytics, support, and payment operations. Stripe's privacy notice is available at stripe.com/privacy.
• To customer-selected integrations when an authorized user enables or invokes them.
• To authorized external partners when a workspace owner shares selected deal or workspace information for collaboration. Revocation is intended to stop future access through the Service, but the final policy must address information a partner lawfully received or copied before access was revoked.
• For legal and safety reasons when reasonably necessary to comply with law, lawful process, or valid requests; enforce agreements; or protect users, the public, rights, property, or security.
• In a business transaction such as financing, merger, acquisition, reorganization, or sale of assets, subject to appropriate protections.
• With consent or direction when you or the relevant customer asks us to do so.

We do not sell personal information for money.

5. Cookies and similar technologies

We use cookies and similar technologies to maintain sessions, remember preferences, protect accounts, understand Service performance, and support permitted analytics. Browser settings may block some cookies, but essential features may not function correctly without them.

6. Retention

We retain information for as long as reasonably necessary to provide the Service, fulfill the purposes described here, comply with legal and accounting obligations, resolve disputes, enforce agreements, and protect the Service. Retention depends on the type of information, workspace settings, contractual requirements, sensitivity, and risk. Some security, billing, and audit records may be retained after account closure. We may de-identify information and retain it where it no longer reasonably identifies an individual.

7. Security

We use administrative, technical, and organizational measures designed to protect personal information. No method of storage or transmission is completely secure. You are responsible for maintaining accurate user access, protecting credentials, configuring integrations, and notifying us promptly of suspected unauthorized activity.

8. Your choices and rights

You may update certain profile information and communication preferences through the Service. Depending on where you live, you may have rights to request access, correction, deletion, portability, restriction, or objection, or to appeal a decision about a request. These rights can be limited by law and may require identity verification. If your account is controlled by an organization, contact that organization first for workspace-data requests.

Submit a request to hammer@ai-manager.io with “Privacy Request” in the subject line. We will not discriminate against you for exercising an applicable privacy right.

9. International processing

We and our providers may process information in the United States and other countries where privacy laws may differ from those in your location. Where required, we use appropriate contractual or other safeguards for cross-border transfers.

10. Children

The Service is intended for business use and is not directed to children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided information to us, contact us so we can evaluate and address the request.

11. Changes to this Notice

A future approved notice may describe how changes are published and when additional notice is provided. This draft has no effective date and creates no change-notice commitment.

12. Counsel-review checklist (applicability not determined)

Inclusion in this checklist does not assert that any particular law applies or that this draft complies with it. Before approving a final notice, qualified counsel and the relevant product, security, and data owners should confirm:

• the correct legal entity, controller or processor roles, business address, privacy contact, covered services, users, regions, and effective date;
• the complete categories and sources of personal and sensitive information, purposes and applicable legal bases, recipients, service providers, cross-border transfers, and retention periods or criteria;
• whether any activity is a sale, sharing, targeted advertising, profiling, or sensitive-data use, and any required opt-out or limitation mechanism;
• applicable methods and verification rules for requests to know or access, delete, correct, port, opt out, limit, object, restrict, appeal, use an authorized agent, and receive non-discriminatory treatment;
• recording and transcript notices or consent, email and CRM authority, partner sharing and revocation behavior, subprocessors, cookies, children's data, security practices, and incident notices; and
• that statements about AI training, confidentiality, minimization, provider use, deletion, retention, and protection match tested product behavior and binding vendor terms.