Privacy policy

1.Who we are

Indalbo ("we", "us") makes Indalbo, a service that gives every teammate a private AI agent. The app lives at app.indalbo.com and this website at indalbo.com.

This policy explains what we collect, how we use it, who helps us handle it, and the choices you have. If anything here is unclear, write to us at support@indalbo.com.

2.What Indalbo does

Your agent learns your work from the accounts you choose to connect. With that, it can:

• draft replies for you to review,
• keep track of the promises you make,
• show you what's waiting on you across your connected tools,
• prepare you for meetings,
• run the mandates (standing jobs, like "no customer email waits over a day") and workflows you set up,
• suggest workflows from work you repeat, such as an email you send every week,
• bring you a morning edition of company news that teammates chose to announce and that involves you,
• write proactive messages, like a morning brief or a heads-up, and
• cover for you while you're away by answering teammates' questions, within the sharing rules you set.

To do this, Indalbo has to read and process data from the accounts you connect. The rest of this policy explains how we handle it.

3.What we collect

Account information. You sign in through our sign-in provider, Clerk, using Google or your email address. We receive your name, your email address and the organization you belong to.

What you give us. Your chats with your agent, files you upload or edit (including files in shared workspaces, where every saved version is kept), the mandates and workflows you set up, and your settings, including your sharing rules.

Data from the accounts you connect. You choose which services to connect. Examples include Gmail, Google Calendar, Google Drive, Docs, Sheets and Slides, Outlook, Slack, Notion, HubSpot, Salesforce, Linear, Jira, Asana, GitHub, Zoom, Calendly, Stripe and QuickBooks. Connections use OAuth through Composio, and we access only what falls within the permissions (scopes) you grant. Depending on the service, that can include emails, calendar events, documents, messages, tasks or records, which may contain information about the people you work with.

What your agent knows. From your connected data, your agent pulls out facts (for example, "Dana asked for the Q3 numbers by Friday") and keeps them in your private work graph, which you see as "What your agent knows" on your You page. Section 5 explains who can see what.

Work patterns. To suggest workflows, your agent looks for work you repeat, such as an email you send to the same person on the same weekday, or the same request you make in chat on different days. These patterns are kept for your account only, are never shown to anyone else, and are deleted with your data.

Usage and technical data. Logs, error reports, and metering of AI usage and cost. We need these to run the service, fix problems and track credits correctly.

Bug reports. If you use "Report a bug", we receive your note and, unless you leave them out, a screenshot of the page you were on and diagnostics (the page address, your browser and screen size, and recent errors and failed requests). A screenshot can show whatever was on your screen, so check it before you send. The Indalbo team reads these reports to fix problems.

Payment information. Payments are handled by Stripe. We never see your full card number.

Push notification subscriptions. If you turn on browser notifications, we store the subscription details your browser gives us so we can send them. This is optional.

4.How we use your data

We use your data to provide Indalbo and keep it running:

• to run your agent and the features described above,
• to answer teammates' questions within your sharing rules,
• to show you what's waiting for your approval and send you notifications,
• to meter AI usage, track your credits and process payments,
• to keep the service secure and reliable, and to fix errors,
• to reply when you contact us, and
• to meet our legal obligations.

We don't use your data for advertising, and we don't use it to train AI models.

5.How sharing works on your team

Your agent works for you. Your work stays private unless your own rules say otherwise.

• Your data lives in your private work graph: facts extracted from the accounts you've connected.
• Teammates never see your raw email or messages.
• When a teammate, or the shared workspace agent called Indalbo, asks your agent something, it answers only with facts your sharing rules allow.

You set those rules per person or per workspace:

• AllowYour agent can share the answer.
• Ask firstYour agent checks with you before it answers.
• DenyYour agent won't share.

• If no rule covers a question, your agent asks you first.
• A refusal looks exactly like "no information", so nobody can tell something was held back.
• Every answer your agent gives is recorded, and you can see it in your Activity.
• Facts that look like passwords, keys or other secrets are never shared.
• Announcing to the whole company is a separate permission. A fact appears in teammates' Company news only if you share it, or if you turn on a standing rule for it (off by default). You can unshare it later.
• Files in a shared workspace can be seen by the members of that workspace, and by default any member can edit them. Every edit is saved as a version that can be restored.
• You can see and delete what your agent knows at any time.

6.Nothing goes out without your approval

Anything that sends, shares or spends waits for your explicit approval. That includes emails, invites, messages, purchases and shares. Your agent drafts and prepares. You decide what actually goes out.

7.Who helps us run Indalbo

We rely on a small number of service providers. Here is who they are and what each one does.

• OpenAIProcesses prompts and content through its API to generate your agent's responses and embeddings (which help your agent find relevant information). Under OpenAI's API terms, data sent through the API is not used to train OpenAI's models.
• Our own AI modelA small open-source model running on our own servers may be used to classify emails.
• ClerkSign-in and account management.
• ComposioBrokers your OAuth connections. It stores the connection tokens and relays requests to the services you connect.
• CloudflareNetwork and DNS services, and hosting for this website.
• StripePayments.
• Our serversServers we operate in the United States host the app, its database, bug reports, and each member's sandboxed agent computer. That computer holds no passwords or keys.
• Browser push servicesApple, Google or Mozilla, depending on your browser, deliver notifications if you turn them on.
• SlackIf your Slack workspace installs the Indalbo Slack app, messages to and from Indalbo in Slack pass through Slack.

The services you connect also process your data under their own terms and privacy policies. Your relationship with each of them is directly between you and them.

Indalbo runs in the United States. If you use it from somewhere else, your data will be processed in the United States.

8.What we never do

• We don't sell personal data.
• We don't show ads.
• We don't use customer data to train AI models.

Beyond the providers listed above, your data leaves Indalbo only when you send or share it yourself (always with your approval), or when the law requires us to disclose it.

9.Google user data

If you sign in with Google, or connect Google services such as Gmail, Google Calendar, Google Drive, Docs, Sheets or Slides, Indalbo receives Google user data within the permissions you grant. Here is how we treat it:

• We use it only to provide the user-facing features you asked for, like drafting replies, tracking promises, showing what's waiting on you, preparing meetings, suggesting workflows from work you repeat and answering teammates within your sharing rules.
• To provide those features, we may send it to the service providers in section 7 (for example, to OpenAI to write a draft). We don't transfer it for any other purpose.
• We don't use it for advertising.
• We don't sell it.
• We don't use it to train generalized AI or machine learning models.
• No one at Indalbo reads it, except with your consent, for security purposes, to comply with the law, or when it has been aggregated and anonymized for internal operations.

You can disconnect a Google service in Indalbo at any time.

10.Keeping and deleting your data

• We keep your data while your account is active.
• You can disconnect any connected service at any time. New syncing from that service stops.
• To remove what was already collected, delete facts from what your agent knows, put a person or domain on your never-read list (their stored mail and what was learned from it are deleted), or ask us to delete your data.
• To request deletion, delete your company in Indalbo or email support@indalbo.com. We'll delete or de-identify your data within 30 days, except for records we must keep by law, such as payment records.

11.Your choices

• Choose which accounts to connect, and disconnect any of them whenever you like.
• Set and change your sharing rules, per person or per workspace, and decide separately what to announce to the whole company.
• See every answer your agent gave on your behalf in your Activity.
• See and delete what your agent knows, and see who saw what.
• Turn browser notifications on or off.
• Ask us for a copy of your personal data, or ask us to correct or delete it, by emailing support@indalbo.com.

Depending on where you live, you may have additional rights under local law.

12.Cookies

We use only essential cookies: the ones that keep you signed in, set by our sign-in provider, Clerk. We don't use advertising or analytics cookies, in the app or on this website. Our website and app load fonts from Google Fonts, so Google receives your IP address and browser details when a page loads; Google doesn't set cookies for this.

13.Security

We take reasonable measures to protect your data. These include HTTPS everywhere, an isolated agent computer for each member that holds no passwords or keys, and access controls.

No system is perfectly secure, so we can't promise your data will never be accessed without permission. If you think you've found a security problem, please email support@indalbo.com.

14.Children

Indalbo isn't for anyone under 16, and we don't knowingly collect their data. If you believe someone under 16 has given us data, contact us and we'll delete it.

15.Changes to this policy

We may update this policy as Indalbo changes. We'll post the new version here with a new effective date. If a change is material, we'll also tell you by email or in the app.

16.Contact us

Questions, requests or concerns about your privacy: support@indalbo.com.