Privacy Policy

Data we collect

• Account: your phone number (to verify you and link your messaging accounts), your name, passkeys you register, and your settings (language, time zone, which proactive features are on).
• Conversations and tasks: messages you send the assistant, its replies, the tasks it runs for you, their results, and your approval decisions.
• Files: photos, documents, voice notes and videos you send, and the text, page images and transcripts made from them.
• What it keeps for you: facts it remembers about you, notes it keeps on things you are working on with it, so they can be continued in a later conversation, your to-dos and reminders, the commitments it tracks (what you owe others and what they owe you), pages and deliveries it watches, what the daily email scan found for you to consider, and a record of messages it sent you on its own.
• Google account data, if you connect Google - see “Google user data” below.
• Browser tasks: pages it visits for you, screenshots you ask for, and sign-in details, addresses or cards you store in the vault.
• Usage and service records: AI usage and cost per task (to enforce spending limits), delivery status of messages, and service logs that exclude message content.

Most of this comes from you. Some is about other people - senders and recipients of your email, calendar guests, your contacts - and comes from the accounts you connect; we use it only to act for you.

How we use it, and our legal basis

• Running the assistant you asked for - understanding your messages, doing tasks, remembering what you ask it to, and replying on the channel you use. Basis: our contract with you.
• Following up for you - reminders, the daily brief, nudges when something is overdue, meeting prep, calendar change alerts, and checking replies and payments against your email. Before a meeting where something is open with a guest, meeting prep looks up your most recent email with each guest and shows you its subject. The daily brief is written by the AI model from the senders and subjects of your new email, the titles and times of today's meetings, and your to-dos and commitments; the meeting prep note is worded by it too, from the same kind of detail. These are on by default and each can be switched off in Settings. Basis: our contract with you, and our legitimate interest in helping you not miss what matters.
• Finding deadlines in email - once a day, the text of the past day's email is sent to the AI model to find bills, deadlines, requests and promises. What it finds is offered to you on Today to track or dismiss, kept for a week, and never made a to-do without you. Basis: legitimate interest; you can object at any time by switching off “Find deadlines in my email” in Settings.
• Security, abuse prevention and spending limits. Basis: legitimate interest.
• Meeting legal obligations. Basis: legal obligation.

A phone number is needed to create an account; without it we cannot provide the service. We do not make decisions about you that have legal or similarly significant effects by automated means alone: anything consequential the assistant does - sending a message to someone, a purchase, a booking - waits for your approval.

Google user data

If you connect Google, Operator Brief asks for these permissions and uses them only for the features named:

• Gmail (read, compose, send, label): search and read email you ask about, draft replies, send email you approve, watch for replies you are waiting on, the daily brief, meeting prep, and finding deadlines and payments in your email.
• Calendar: check your availability, create, move or cancel events you ask for, and alert you to changes, clashes and upcoming meetings.
• Contacts (read only): find the right address when you name someone.
• Google Drive (only files it creates): make the Docs, Sheets and Slides you ask for, and share them when you approve. It cannot open your other Drive files.
• Google Meet (read only): read transcripts of your meetings when you ask for notes.
• Google Tasks: keep your to-do list and Google Tasks in step.

Operator Brief's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. The use of information received from Google Workspace APIs will likewise adhere to that policy, including the Limited Use requirements.

Google data is used only to provide the features above to you. It is never used for advertising, never sold, never transferred to advertising platforms, data brokers or information resellers, never used to decide on credit or lending, and never used to train AI models. Our staff do not read it, except with your explicit permission for a specific item, when needed for security or to investigate abuse, or to comply with the law. It is shared only with the service providers below that process it for us, and is stored and deleted as described in this policy. Google data sent to the AI model is processed under the same terms as the rest of your conversation.

Who receives your data

We use service providers that process data on our behalf, under contracts that restrict them to that purpose:

• Amazon Web Services - hosting, databases, encrypted storage and keys, and web search (Amazon Bedrock AgentCore, in Japan, and its search provider receive search queries and results).
• Microsoft Azure OpenAI - the AI model. It processes your messages, files, audio and any email text sent to it, may do so in any Azure region, does not use them to train models, and may keep them for up to 30 days to detect abuse of its service.
• Messaging providers - Meta (WhatsApp Cloud API), Telegram, and Sendblue (iMessage, RCS and SMS) carry messages on the channel you choose.
• Google - processes the Gmail, Calendar, Contacts, Drive, Meet and Tasks actions you authorise.
• Websites you ask it to use receive the information a browser task needs, such as a form you ask it to fill.

We do not sell your personal information and do not share it for cross-context behavioural advertising, and have not done so in the past 12 months. Your phone number and your consent to receive messages are never shared with third parties for their marketing. We may disclose data if the law requires it, or to protect the safety of any person. If the service is ever transferred to another company, we will tell you first.

International transfers

Our servers are in India, web search runs in Japan, and the AI model may run in any Azure region, so your data may be processed outside your country, including outside the European Economic Area and the UK. Where the law requires it, these transfers rely on the standard contractual clauses included in our providers' data processing terms.

Storage and security

Data is stored in an encrypted database and private object storage, with encryption keys managed by AWS KMS. Vault credentials use envelope encryption and are not readable by the assistant, application logs, screenshots, or automated browser inspection. Browser automation runs in an isolated container with no access to your device. Operational access to provider dashboards and production data is limited to authorized personnel and used only to operate, secure, and support the service.

Data retention and deletion

We keep workspace data while your account is active - your to-dos, commitments and watches until you close or delete them; each conversation for 30 days after it ends; what the email scan found, and a record of messages the assistant sent you on its own, for seven days - and remove it when you delete the account. Sendblue message records are queued for soft deletion after required media and delivery state are safely recorded; soft deletion does not recall a message from a recipient's device. Meta and Telegram keep delivered messages under their own retention and deletion rules. Disconnecting Google removes the local grant immediately; if Google is unavailable, token revocation is retried. Microsoft may keep model prompts and responses for up to 30 days to detect abuse of its service. Our service logs, which exclude message content, are kept for 30 days. Encrypted backups of the service are kept for about 120 days, so data from a deleted account remains in them until they expire. Provider security logs and backups may remain for their documented or legally required retention periods. See our Data Deletion instructions for how.

Your rights

Wherever you live, you can ask us to access, correct, delete or export your data, to restrict or object to how we use it, and you can withdraw any permission you gave. Much of this you can do yourself: edit what the assistant remembers and switch proactive features off in Settings, disconnect Google on the Connections page, and delete your account in Settings. For anything else, email events@anything.ai from the address or number linked to your account; we will verify it is you, and may accept a request from someone you authorise if they can show your permission. We answer within one month (45 days for California residents). We will not treat you differently for using these rights.

If you are in the European Economic Area or the UK, you can also complain to your data protection authority (in the UK, the Information Commissioner's Office). California residents have the rights to know, delete and correct their personal information; we do not sell or share it, and we use sensitive information such as email content and stored credentials only to provide the service you asked for.

Cookies

We use only the cookies needed to keep you signed in: a first-party session cookie, which lasts up to seven days, short-lived cookies used while you sign in with a passkey, and one that remembers whether the app's sidebar is open. We use no analytics, advertising or tracking cookies, so we do not show a cookie banner.

Children

Operator Brief is for adults aged 18 and over. We do not knowingly collect data from anyone under 18, and will delete it if we learn we have.

Changes to this policy

If this policy changes materially - including any change in how we use Google data - we will tell you in the app or by message before it takes effect, and update the date above.

Contact

anything.ai, operator of Operator Brief. Questions about this policy or your data can be sent to events@anything.ai.