Privacy Policy — Version History

Voice moved to Amazon Web Services: dictation (Amazon Transcribe) and Airis read-aloud (Amazon Polly) now run inside our own AWS account, the audio is not stored, and AWS does not use it to train or improve its services under our account-level opt-out. OpenAI no longer receives voice audio or speech text, and its entry no longer lists voice features. Removed the three-minute recording limit in chat. No other changes.

AI models: Moonshot AI (Kimi K3 and Kimi K3 Fast) and xAI (Grok 4.7, Grok 4.3 and Grok 4.1 Fast) are added to the list of optional AI model providers; like DeepSeek and Alibaba Cloud they are reached through Vercel under contracted zero data retention and no-training terms, and the Vercel entry names them. Your own API keys: a new paragraph explains that you may add your own key for Anthropic, OpenAI, Google, xAI or Moonshot AI, that requests to that provider then go directly to it on your key under your own agreement with it (the Vercel zero data retention and no-training terms do not apply to those requests), that the key is encrypted at rest and used only for your requests, and that those requests are not charged credits. No other changes.

Added Section 9, Google User Data: if you connect a Google account, we access that data only to provide the features you ask for, our use of it adheres to the Google API Services User Data Policy and the Google Workspace API User Data and Developer Policy, including the Limited Use requirements, and it is not used to create, train or improve generalized AI/ML models. Retention for Anthropic, OpenAI and Google Gemini is now stated separately from training: prompts and responses are not used to train AI models, and may be retained by the provider, typically for up to 30 days (Anthropic, OpenAI) or up to 55 days (Google), before deletion; the earlier statement that zero data retention terms apply to these three is removed. The Perplexity entry now states that search queries are not retained or used to train AI models. No other changes.

AI models: you choose which AI models handle your work, and DeepSeek V4.1 Flash is now the default unless you choose another. DeepSeek V4.1 Flash and Alibaba Cloud (Qwen 3.8 Flash, optional) are added to the list of AI model providers; both are reached through Vercel under contracted zero data retention and no-training terms. The Vercel entry is reworded to match. The Anthropic, OpenAI and Google entries now state their no-training and zero data retention terms; for provider-restricted models currently unavailable for zero data retention, the strongest available market terms are obtained, typically a 30-day retention period before records are deleted. No other changes.

Two AI model routes are now described. Vercel: if you choose one of the free AI models offered through Vercel, your prompts and relevant workspace context are routed through Vercel for contracted zero data retention and no-training terms. Amazon Web Services: if your turn runs on Amazon Nova, the model runs inside AWS, which does not retain your prompts or use them for training. No other changes.

Email sent to a PRISM email address: we store the email, including the sender's name and address, its contents and its attachments, in the inbox of the account the address belongs to, whether or not the sender has a PRISM account. If you ask Airis about something in your PRISM inbox, Airis may read the relevant messages, including those emails and their attachments. The Resend entry now says it receives email sent to PRISM addresses as well as sending email from PRISM. No other changes.

Clarified the Daily (hosted video meetings) entry: a call is transcribed only when the call owner turns on recording. No other changes.

Updated the third-party processor list to match the services actually in use: added Voyage AI (text embeddings for knowledge search), Amazon Web Services (background job execution and the isolated browser used to read web pages), Google Web Risk (screening web page addresses before they are fetched), Deepgram (meeting transcription, with an AWS-only alternative), and Daily (hosted video meetings). Removed Firecrawl and Trigger.dev, which are no longer used. Added a note that the list reflects our standard configuration and that some vendors apply only to particular features.

Expanded the third-party processor disclosure to name all providers that process user content: AI model and research providers (Anthropic, OpenAI, Google Gemini, Perplexity), sandboxed code execution (E2B), integration orchestration when tools are connected (Composio), and analytics (PostHog, Microsoft Clarity). Disclosed session replay (Microsoft Clarity) under analytics cookies and made it strictly consent-gated.

Rewrote data retention around criteria-based retention: some actions delete immediately and permanently, deleted content is removed from view and from AI context, and records may be retained where necessary for legal claims. Qualified the right to erasure per GDPR Article 17(3).

Initial published Privacy Policy.