Privacy policy

Who is responsible for your data

Adoptai operates AdoptAI Personal and is responsible for the personal data described in this policy. Contact bertie@adoptai.studio for privacy questions, support or a data-rights request. This policy covers the hosted and desktop personal workspace and these product pages; it does not replace a separate agreement for a consultancy project or an organisation's own deployment.

Information we collect and why

• Account information: Google account identifiers and your email address, used to sign you in, check pilot access and associate you with your workspace. Google handles your Google password; AdoptAI does not receive it.
• Gmail, if connected: message bodies, headers, sender and recipient details, dates and supported attachments within your configured coverage. These support search, summaries and task extraction.
• Calendar, if connected: calendar names and identifiers, event details, dates, locations, descriptions and attendee information. These support calendar views, questions and task assistance.
• Drive, if connected: file names, identifiers, metadata and supported document contents from your selected folder. These support indexing, search and questions about your documents.
• Other connections you enable: selected Notion content, WhatsApp messages and associated contact or chat details, or files you choose to import, as applicable to the connection and coverage you select.
• Workspace information: your settings, questions, conversations, tasks, notes, generated summaries, action approvals and activity history, used to provide your workspace and its features.
• Connection credentials: access and refresh tokens, provider API keys and connection state needed to access services you enable.
• Service information: technical logs, errors, request information and support correspondence needed to operate, secure and troubleshoot the service. Hosting and network providers may receive IP addresses and browser information when handling requests.

Connected content may include personal information about other people. Only connect sources you are entitled to use. Import coverage can be narrower than the underlying Google permission: choosing a folder or date range in AdoptAI does not change the scope Google grants.

Google permissions and optional actions

Google sign-in is separate from permission to read Gmail, Calendar or Drive. Those services are accessed only when you connect them. Optional sending of email or creation and modification of calendar events requires the corresponding additional permission and approval of the proposed action. Approved messages and events are sent to Google and, where applicable, their intended recipients.

AI processing and other service providers

When you enable external AI, relevant source content, questions, conversation context and task information can be sent to the AI provider configured for your workspace. Background sorting can process newly imported content as well as questions you ask. Available providers include Anthropic, OpenAI, DeepInfra and a compatible endpoint you configure. If remote embeddings are enabled, relevant text is also sent to that embedding service to support search.

Your provider selection and its account settings determine which service receives this information. Provider retention and processing terms vary; do not assume that every provider retains nothing or has identical data protections. Review its terms before enabling it, particularly for confidential information or data about other people. You can disable external AI in your settings.

We use hosting, storage and network providers to deliver the service. The current hosted pilot uses an Adoptai-operated server, Google Cloud for public website hosting and offsite backups, and Cloudflare for network delivery to the app. Google and any other services you connect also process requests under their own terms. Service providers may process information outside the UK, depending on their infrastructure and your configuration. Contact us for information about the providers and transfer arrangements relevant to your workspace.

Limits on using Google data

We use Google data to provide the connected workspace features described here. We do not sell Google user data, use it for advertising, credit scoring or lending decisions, or use it to train our own general-purpose AI models.

Our use and transfer of Google API data must comply with the Google API Services User Data Policy, including its Limited Use requirements. Transfers to AI providers are for the features you enable, with your consent, and must meet those requirements.

Access by people is limited to support you authorise for specific content, necessary security or abuse investigations, or legal requirements. We may disclose information when required by law or necessary to protect the service and its users. Google-data transfers in a business sale would require prior explicit user consent.

Storage and security

The hosted app stores imported content and workspace records on its server; it is not a local-only service. Connection tokens and API keys are encrypted in the credential store. HTTPS protects public connections, and access controls separate user workspaces. Credential encryption does not mean that every document, search index, conversation or backup is separately encrypted by the app.

In the desktop app's Local mode, the workspace is stored on your computer under your user account. Packaged desktop credentials are encrypted using a key in your operating system's credential store. The app does not separately encrypt the full local index or history, so protect your computer and its backups. Connected services and any external AI you enable receive the requests and content needed for those features. A local workspace is not automatically uploaded to, or kept in sync with, the hosted workspace.

Operational backups and recovery copies can contain workspace data. No internet service can guarantee absolute security. Please protect your Google account and provider keys, and report a suspected problem to bertie@adoptai.studio.

Retention, disconnection and deletion

Workspace information is kept while needed to provide your active workspace, unless you clear it or request deletion. Import date ranges control what is fetched; they are not an automatic deletion schedule for existing records.

• Disconnecting Google removes its connection credentials from AdoptAI and stops future access through that connection. You can also revoke permission in your Google account.
• Clearing a source's index removes its indexed content. This does not automatically remove related tasks, conversation history, activity records or backups.
• Hosted workspace deletion is currently handled by request to bertie@adoptai.studio. Specify the account and whether you want particular data or the whole workspace deleted. Do not send passwords or API keys. We may need to verify your identity before acting.
• Local workspace deletion: uninstalling the desktop app leaves its workspace files in place. Contact us for help removing the local workspace and credential-store entry. We cannot remotely erase files or backups on your computer.

Deletion requests include review of active storage, recovery copies and backups. Backup copies can remain until their retention period expires; deleting an active workspace is not an immediate erasure of every backup. We will explain the applicable completion and backup-retention periods when handling your request. Records needed for a legal obligation or a dispute may be retained for that purpose. Provider-held copies are subject to the relevant provider's retention and deletion arrangements.

Cookies and public website logs

The app uses necessary session cookies to keep you signed in and secure account connection flows. Blocking these can prevent sign-in from working. These public product pages do not add advertising cookies or third-party analytics scripts. The website records page paths, referrers and campaign parameters in operational logs; infrastructure providers may also maintain access and security logs.

Your choices and rights

Where UK data-protection law applies, we rely on providing the service you request for essential account and workspace processing, consent for optional connections and external-AI processing, and legitimate interests in keeping the service secure and responding to support requests. We also process data where required by law. Refusing an optional connection limits the features using it; it does not require you to connect other sources.

Depending on applicable law, you may request access, correction, erasure, restriction or portability of your data, object to certain processing, and withdraw consent. Withdrawal does not invalidate processing already carried out. Contact bertie@adoptai.studio to exercise these rights. In the UK, you can also complain to the Information Commissioner's Office.

AI-generated suggestions can be wrong. AdoptAI is not intended to make decisions with legal or similarly significant effects on people automatically.

Children and policy changes

The pilot is intended for adults and is not directed at children. Contact us if you believe a child has provided personal data through the service.

We will update this page when our practices change and notify affected users of material changes. If a new use of Google data requires additional consent, we will request it before that use.