Privacy Policy

The Service is provided and operated by UK G.K.. It is currently offered on a trial basis, as-is, without warranty of any kind, express or implied.

This Service acquires and uses the following information depending on how you use it.

Before you connect an account, this Service shows you — in the product itself — which types of data will be accessed and what they are used for, and you have to tick a consent box before it will proceed. Google's own consent screen then also shows exactly which permissions are being requested, and connecting requires that explicit approval as well.

• Google Account Information — the email address and OAuth token used for sign-in and service connections
• Slack Workspace Token — the access token issued by Slack when you connect
• Data Retrieved From Connected Services — email, calendar events, Drive file metadata, and Slack messages. This data is retrieved on each occasion, at the user's instruction, to perform searches and sends, and — apart from the records listed below — the retrieved data is never permanently duplicated or stored

The only information stored in this Service's database is the following.

• Connection tokens for each service (stored encrypted)
• Records of exchanges via "Questions & feedback" (the chat in the bottom right of the site), including answers to questions and content shared with the developer as feedback or requests
• Content that the user has instructed an AI assistant to create or record (scheduled requests and their run results — including the subject, sender, and excerpt of matched messages — tasks, notes, etc.)
• Answers to product-research surveys and timestamps for starting, submitting, and using survey actions, linked to the user's account so they can be compared with the setup stage already visible in service logs
• Text and state (completion, assignee, decline reason) of items placed in shared projects, and members' names and email addresses

What each connected data type is used for

There is no secondary use beyond what is listed below — each data type is used only for the purpose stated.

• Gmail (subject, body, sender/recipient, and labels) — to search and summarize messages, draft and send replies you confirm, and apply or remove labels at your instruction.
• Google Drive (file names, metadata, content, and sharing permissions) — to search your files and answer questions about them, including who they are shared with.
• Google Calendar (event details) — to list your schedule and create events from tasks or chat instructions.
• Google Contacts (names and email addresses) — to resolve a name you mention into the correct recipient address.
• Slack messages — to search and summarize messages and, at your instruction, send messages or replies.

Retention: unless you delete your account, the data above is kept as described below. In addition, some records have a mechanism that automatically deletes them once they pass the period listed.

• Connection tokens — kept until you disconnect the service or delete your account.
• Records of your "Questions & feedback" exchanges — automatically deleted once they pass 180 days.
• Content you asked an AI assistant to create or record — tasks and notes are kept until you delete them or delete your account. AI assistant conversation records are automatically deleted after 365 days, and scheduled-request results (the subject, sender, and excerpt of matched messages) after 180 days.
• Product-research surveys — answers are automatically deleted 180 days after their latest update; invitations and action timestamps are deleted 210 days after issue, or earlier if you delete your account.
• Items placed in a shared project — kept until the person who placed them deletes their account, and remain in the project after they leave.

To generate search queries, summarize content, and generate chat responses, we send the relevant data to Anthropic's Claude API for processing. Under Anthropic's commercial API policy, data sent is never used to train models. The one exception is image generation in a shared project's AI editing: only then do we send the instruction text used to generate the image to OpenAI's API (under OpenAI's API policy, data sent to the API is not used to train its models).

This Service's use of Google user data complies with the Google API Services User Data Policy (including the Limited Use requirements).

Specifically, Google user data is never used for advertising purposes and is never sold, and no human reads its contents — except with your explicit consent, where it is necessary for security purposes (such as investigating abuse), where required by applicable law, or where the data has been aggregated and anonymized for internal operations.

We ourselves do not use Google user data to create, train, or improve any machine learning or artificial intelligence model, and we do not permit our providers to do so beyond the processing described above. Any personalization is limited to that individual user's own experience.

Except for access by the AI assistants you connect yourself, and for showing what you place in a shared project to its members, we do not provide the information we obtain to third parties. Access by an AI assistant occurs only through a dedicated connect URL issued by the user themselves.

Separately from the above, the Service relies on the following providers to operate. Each of them processes data only on our instruction and only as far as running the Service requires, and none of them is permitted to use it for its own purposes.

• Anthropic — the Claude API, for the AI processing described in section 3. It does not use the data for its own purposes and does not use it to train models.
• OpenAI — the image generation API. Used only when an image is generated in a shared project's AI editing; we send it the instruction text for the image. Under OpenAI's published policy, data sent to its API is not used to train models, and abuse-monitoring logs are retained for up to 30 days.
• Vercel — hosting for the application, and the access analytics described in section 6.
• Supabase — the database.
• ImprovMX — forwarding of mail sent to the support address given in section 7.
• Resend — delivery of emails we send you, such as sign-in verification codes and product feedback surveys.
• Stripe — payment processing for optional support (gifts) made from the pricing page. Card numbers never reach us.
• Google — Google Analytics on public pages and selected signed-in screens, described in section 6.

Any disclosure beyond the above would be made only with your consent or where required by law.

Text and state of what you place in a shared project are visible to all its members, as are members' names and email addresses (including invitees). The content of the email, Slack and other accounts you connect, and anything we derive from it, is not shared unless you place it. You can leave at any time; items you placed stay in the project as read-only for the other members, and are deleted when you delete your account.

Apart from the Google Analytics usage information described in section 6, all data handled by the Service is processed and stored in the United States: the database is in Supabase's US West region (us-west-1), the application runs in Vercel's US West region (sfo1), and AI processing is performed by Anthropic's US-based service. Nothing is stored in Japan. The location where OpenAI's service, used for image generation in a shared project's AI editing, processes data is not covered by the statement above. The Google Analytics usage information is processed by Google on its own infrastructure, which may be in the United States or elsewhere.

All traffic to this Service is served over HTTPS (with HSTS enabled). Connection credentials for connected services are encrypted at rest (AES-256-GCM). Row-level security is enabled on every database table, and the browser never queries the database directly.

Access to production is limited to UK G.K., the operator of the Service.

If we become aware of unauthorized access to Google user data, we will notify affected users and Google without undue delay.

This Service uses Vercel's Web Analytics as an access analytics tool for service improvement. It collects anonymous statistical information such as page-view activity; it does not use cookies and does not collect personally identifiable information.

On our public pages and selected screens after you sign in, we use Google Analytics, provided by Google LLC, to understand usage paths and where people encounter difficulty. Google Analytics uses cookies to distinguish browsers and sends Google the page address without query strings or fragments (with any message IDs replaced by a fixed route label), a fixed page title, a two-value category indicating whether you are signed in or signed out at the time of the page view, the referring site origin or a similarly sanitized AccountHub page address, device and browser type, approximate location derived from the IP address, and similar usage information. We never send your name, email address, user ID, connected account contents, chat messages, shared AI memory or project names. Sign-in, consent, invitation and administration pages are excluded. Google signals and ad personalization are disabled. Google handles this information under its own policy (https://policies.google.com/technologies/partner-sites).

To stop Google Analytics from collecting this information, use the Google Analytics opt-out browser add-on. Blocking or deleting cookies in your browser only keeps Google Analytics from recognizing your browser across visits; on its own it may not stop the page-view information from being sent.

You can disconnect from each service at any time from the settings screen, which revokes the stored token. If you wish to have your account and stored data deleted, please contact the support email (support@accounthub.ai).

From Settings → "Manage your data", you can delete conversation records, support question records, and connection usage records individually, or delete your account entirely — disconnecting every connection and removing all the data described in section 2 (this cannot be undone). We also continue to handle requests sent to the support email above.

This Policy may be revised without notice. Significant changes will be announced on this page.