01What this policy covers
This policy explains how we handle two very different kinds of information: account information about the people who use the service, and the business data you connect so that questions can be answered.
We treat connected business data as yours. We process it only to answer the questions your workspace asks, and only for as long as you keep the source connected.
02Information we collect
Account information you give us when you sign up or contact us:
- Name, work email, company name, role and industry.
- Plan selection, billing contact and invoicing details.
- Anything you type into a contact or signup form, including your first question.
Connected business data, which you choose to make readable:
- Spreadsheets, exports and files you upload or authorise.
- Tables and columns you whitelist on a database connection.
- Column mappings and saved definitions you create in your workspace.
Usage information: questions asked, answers returned, timestamps, the sources and rows each answer read, and standard technical logs such as IP address and browser type.
03How we use it
- To answer the questions your workspace asks and show the source, rows and query behind each answer.
- To send your login details, scheduled answers and service notices.
- To bill your plan and enforce question and seat limits.
- To detect misuse, investigate incidents and keep the service available.
- To reply when you contact us.
We do not sell personal information. We do not use connected business data for advertising, profiling or benchmarking against other customers.
04AI models and your data
Answers are produced with the help of large language models. When a question is asked, the model receives your workspace schema, the question, and only the rows needed to produce that answer.
- Your data, questions and answers are never used to train or fine-tune models, ours or any third party’s.
- Model providers we use are contractually prohibited from retaining your inputs for training.
- Your data is never used to improve answers for any other customer.
05Read-only access
Every connection is read-only. We request view-only scopes from file and accounting providers, and refuse database connections whose user holds write or schema-change privileges. Generated queries are parsed and blocked unless they are read statements.
06How we protect it
- Encryption in transit using TLS 1.2 or higher on every connection.
- Encryption at rest using AES-256 for stored files, credentials and cached results.
- Connection credentials stored in a dedicated secrets vault, never in application logs.
- Role-based access for our own staff, with access to customer data logged and limited to support cases you open.
- Column-level permissions so you can hide sensitive fields such as salary from selected seats.
08Retention and deletion
- Disconnecting a source purges its cached data and mappings within 24 hours.
- Question history is kept for the period your plan includes, then deleted.
- Closing a workspace deletes all connected data, history and credentials within 30 days.
- Billing records are kept for as long as tax law requires.
You can ask for deletion of any personal information at any time through the contact page.
09Your choices and rights
You can access, correct, export or delete your account information, withdraw consent for optional emails, and object to particular processing. Workspace admins can export question history and remove users at any time.
Where data protection law gives you additional rights, including under India’s Digital Personal Data Protection Act, we will honour them. Contact us to make a request and we will respond within 30 days.
11Changes to this policy
If we change how we handle your information in a way that matters, we will tell workspace admins by email before the change takes effect.
Questions about this page? Contact us and a member of our privacy and legal desk will reply.