Privacy Policy

What we collect

Account information. Your name, email, and the names of workspaces you create.

Google Sign-In. If you sign in with Google, we receive your name, email address, profile photo, and Google account ID from Google — and nothing else. We use this only to create and secure your account and to pre-fill your profile. We store it the same way as any other account information (see “How long we keep it” below), and we never sell it, use it for advertising, or share it with anyone outside Guest Machines. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Google Workspace (optional). Connecting Google Workspace requires separate consent from Google Sign-In. We receive the connected account’s identity and, as needed for what you authorize, the details and content of Google Docs, Sheets and Slides files you select or ask an agent to create. Agents can use only what you explicitly grant to each of them: connecting an account or selecting a file doesn’t give every agent access. Google’s consent screen can describe broader access than you grant here; agents are limited to the files, mailbox and calendars you choose in Guest Machines.

If you turn on Gmail reading, agents you grant mailbox access can search and read your messages, other than spam and trash, and download the attachments you allow. A mailbox grant covers the whole mailbox; search filters only narrow the results. Sending email and working with drafts each need separate consent and a separate permission for each agent, and permission to send doesn’t let an agent read your mailbox or your existing drafts. You approve every email before it’s sent, including its recipients, content and attachments. Drafts an agent writes are saved in your Gmail account. If you let an agent attach files, it can attach private files from that run; saving them in a draft uploads them to Google, so that also needs your approval. Drafts and your approvals are kept with the run’s history and deleted with it. Disconnecting Google or deleting a run file doesn’t remove copies already saved in Gmail or delivered to recipients.

If you turn on Google Calendar, agents can use only the calendars you select and grant to each of them, including shared calendars where Google allows it. Reading events can include titles, descriptions, locations, attendees and recurrence details. A separate availability permission shows only when you’re busy, without event details. If you turn on Calendar changes, agents can create, reschedule or cancel events and respond to invitations as you, on granted calendars that Google lets you edit. You approve each change, including the complete event, its attendees and whether Google notifies them. Google sends invitations and updates to attendees even if Gmail isn’t connected. Your approvals are kept with the run’s history and deleted with it. Removing a calendar or turning Calendar off stops future access but doesn’t delete what’s already in your run history, and deleting run history or disconnecting doesn’t undo events or notifications already sent.

We encrypt the credentials that keep your Google account connected, and we never give them to agents or model providers.

You can also approve private automations that use your Google access: scheduled tasks, tasks started with your personal API key, and triggers that start an agent when new mail arrives or a calendar changes. Each one runs only with the agent, permissions, inputs and limits you reviewed, and its results, files and approval requests are private to you. Anyone holding your API key can use the access you approved for it, so keep it secret. Workspace admins can stop or delete your private automations but can’t see their prompts, Google permissions or results. Pausing an automation or revoking its access stops further actions but doesn’t undo anything already sent to Google. Emails and Calendar changes still need your approval each time.

When a Gmail or Calendar trigger is on, we check that mailbox or calendar for new activity, and Google can also notify us when something changes. To decide whether a change matches, we look only at what your trigger needs: for a calendar, which event changed and when; for Gmail, a new message’s labels, arrival time and sender. We don’t store event titles, descriptions, locations or guests, or message subjects, contents or senders. We keep identifiers for each matching event or message until it has been passed to your agent or skipped. For calendars, we also keep identifiers of recent changes for up to 30 days, so the same change, or one your agent made itself, doesn’t start another run. Each match starts a private run in which the agent reads the event or message through its own permission, and that content is kept like the rest of your private run history. To show you which Gmail labels you can filter on, we read your label names without storing them. If Google can’t tell us what changed for a while, the trigger pauses and we keep the time it may have missed changes from. After you turn it back on, you can ask it to catch up on up to six days of what it missed: we then read the same details for that time and keep identifiers of what matches until each has been passed to your agent. Turning a trigger off stops checking that calendar, or that mailbox once none of your triggers on it is on. Deleting a trigger also discards anything still waiting.

Content you upload. Documents, prompts, agent configurations, environment variables, and other data you put into the Service so your agents can use it.

Usage data. Logs of what your agents and team members did on the platform — runs, tool calls, costs, errors, and timestamps. This is what powers the audit history and usage dashboards you see in the product.

Device and connection data. IP address, browser type, and similar information collected automatically when you use the Service. We use this to keep the Service secure and reliable.

Billing information. If you’re on a paid plan, we collect what we need to bill you. Card details are handled by our payment processor — we don’t store full card numbers ourselves.

How we use it

We use what we collect to:

• Run the Service and the agents you ask us to run.
• Show you usage, costs, audit trails, and other dashboards inside the product.
• Keep the platform secure and prevent abuse.
• Handle billing and account communications (receipts, security alerts, important policy updates).
• Improve the product, debug issues, and measure how features are used in aggregate.

We don’t sell your personal information, and we don’t train our own AI models on the content you upload.

Third parties we share with

To run the Service we work with a small set of providers, each of whom is contractually bound to handle your data on our behalf:

• Model providers (such as OpenAI and Anthropic) — when an agent calls a model, the prompt and any context you’ve attached are sent to the provider you chose. For authorized Google Workspace tasks, this may include file details, Gmail messages, calendar events, selected attachments, and other content retrieved to carry out your request.
• Sign-in providers (Google). When you sign in with Google, Google verifies your identity and shares your basic profile information with us as described in What we collect above.
• Security checks (Cloudflare). On email sign-in and contact forms, Cloudflare Turnstile processes your IP address and browser information to detect automated abuse. See Cloudflare’s Turnstile privacy notice.
• Hosting and infrastructure — the cloud providers that run our servers, databases, and backups.
• Payment processors — for billing and tax reporting on paid plans.
• Tools you connect. When you connect a third-party tool to an agent, the data you choose to send flows to that tool’s provider under their terms.
• Workspaces you connect with. When your workspace connects with another business’s workspace, what your agents and people send in conversations with its agents is delivered to that workspace, along with your workspace’s name, a domain you verified, and the names and descriptions you give the agents you make available to it. People’s names go with their messages only if your workspace chooses to show them. That workspace keeps its copy under its own settings, and we process these exchanges for both workspaces.
• Analytics. If you opt in via our cookie banner, we use Google Analytics and Grafana Cloud frontend observability to understand usage, performance, and browser failures. See Cookies below for details and how to opt out.

We’ll also share data when required by law, when necessary to investigate fraud or security incidents, or as part of a merger or acquisition (in which case we’ll let you know).

How long we keep it

We keep account and content data while your account is active, and for a reasonable period afterward to support backups, billing reconciliation, and legal obligations. A workspace’s audit log is kept for as long as the workspace exists and is deleted with it.

You can delete content from inside the product at any time. To close your account, email us using the address below. Closing your account ends your ability to sign in right away. If you ask us to delete your account, we delete the content it owns, except what we’re required to keep (for example, for tax or fraud-prevention reasons). Your actions recorded in a shared workspace’s audit log stay with that workspace until the workspace is deleted.

Model providers keep their own copies for a short time. When an agent calls a model, the provider may retain the prompt and context it receives for a limited period under its own terms, usually to monitor for misuse. Those periods are set by the provider rather than by us, and deleting content here doesn’t remove a copy a provider is still holding.

Google Workspace content and results can be saved in your private chats, automation runs and run files, including Gmail attachments an agent downloaded and text extracted from them. Disconnecting a Google account blocks new access and asks Google to revoke ours; it doesn’t delete existing chats, run files or anything in your Google account. Delete chats or run files to remove what’s saved. The retention terms above still apply.

Each workspace in a connection keeps its own copy of their conversations and controls only that copy. Deleting your copy, disconnecting, or deleting your workspace doesn’t delete the other workspace’s copy, and it can’t delete yours.

A private API task keeps the definition you reviewed until you delete the task. For as long as the task exists, we keep a minimal record of each request, without its content, to enforce the task’s limits and avoid duplicate work, even after you delete its run history. Each run keeps a record of what you approved until you delete the run.

Your controls

Depending on where you live, you may have rights to access, correct, export, or delete the personal information we hold about you, and to object to or restrict certain processing. You can exercise most of these directly inside the product — and for anything you can’t, email us using the address below and we’ll help.

Cookies

Essential cookies. We use cookies and similar technologies for sign-in, security, and remembering your preferences. These run automatically because the Service can’t function without them.

Analytics cookies. With your consent, we use Google Analytics to understand how visitors use our site (pages viewed, general location, device type) and Grafana Cloud to collect browser errors, performance measurements, and request traces. We do not send form values, console contents, account identity, or URL query strings to Grafana, and we do not record session replays. These providers may process data on servers outside your country. We don’t use third-party advertising cookies.

You choose whether to allow analytics cookies the first time you visit, and you can change your mind at any time from the “Cookie Preferences” link in the site footer.

Security

We use industry-standard practices — encryption in transit and at rest, access controls, audit logging, and regular reviews — to protect the data you trust us with. No system is perfect; if we ever discover a breach affecting your account, we’ll tell you promptly.

Children

The Service isn’t intended for people under 18. We don’t knowingly collect personal information from children.

Changes to this policy

We may update this policy from time to time. If a change is material, we’ll let you know in the product or by email before it takes effect.

Contact

Questions about privacy, or want to exercise a right? Email privacy@guestmachines.com.