Privacy Policy

Depending on what you connect, we store the following.

• Account information: your name, email address, company name, job title and a salted password hash (or, if you sign in with Google, your Google account identifier, name and email).
• Gmail: the full content of the messages we read, including subject, sender and recipients, timestamps, message bodies and attachments.
• Google Calendar: events, including titles, times, attendees, locations and descriptions.
• Google Drive: the content of the files you select to share with OKAtlas (documents, sheets, slides and other files), plus their names and metadata.
• Slack: messages, channel and conversation names, and member names and email addresses from the workspaces and conversations your Slack account can read, including direct and group messages you take part in.
• Other connected tools: records such as tickets, deals and documents from any other integration you enable.
• Derived data: text embeddings, extracted entities and relationships, summaries and the situations and briefs generated from the above.
• Connection credentials: the access and refresh tokens that let us read your connected accounts. They are stored encrypted.
• Usage and conversation data: the questions you ask OKAtlas, its answers, and operational logs such as errors and request timings.

We use your data only to provide and improve your own OKAtlas workspace: to index it, answer your questions, detect patterns across your tools, surface situations that need your attention and, when you approve an action, carry it out in a connected tool. We do not sell your data, we do not use it for advertising, and we do not share it with other customers.

OKAtlas's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

• We use Google user data only to provide and improve the user-facing features you see in OKAtlas.
• We do not transfer Google user data to others except as needed to provide those features (for example, to the sub-processors listed below), to comply with law, or as part of a merger or sale with notice to you.
• We do not use Google user data for serving advertisements.
• We do not allow humans to read Google user data unless you give us explicit consent for specific content, it is necessary for security purposes or to comply with law, or the data is aggregated and anonymized.
• We do not use Google user data to develop, improve or train generalized AI or machine learning models.

We read Slack data through the Slack API with the permissions you grant when you install OKAtlas. We use it only to provide your workspace features. We do not use Slack data to train large language models or other generalized AI or machine learning models, and we do not sell it or use it for advertising. Uninstalling OKAtlas from Slack, or revoking its tokens, stops all reading and removes the stored Slack messages and files we hold from that workspace. Knowledge we derived from them (for example summaries, people and relationships) is not removed automatically; email [email protected] to have it deleted.

To answer questions and extract knowledge we send relevant excerpts of your data to large language models through OpenRouter, which routes each request to an upstream model vendor. We configure these requests so that providers do not retain the content and do not train on it. Google and Slack data are never used to train any model, ours or a vendor's.

We also rely on infrastructure and service providers to run OKAtlas: DigitalOcean (hosting), Neon (database), Cloudflare (network and security) and Resend (transactional email). They process data only on our instructions.

We keep your data while your account and the connection that produced it are active.

• Disconnect a tool: in OKAtlas, open Sources and disconnect it. We revoke our access token with Google or Slack and stop reading the account.
• Delete your data: in OKAtlas you can disconnect a connection and delete the source data indexed from it. Knowledge derived from that data (such as summaries, people and relationships) is not removed by this self-serve step; ask us to delete it as described below. Account deletion is by email, not in the app.
• Ask us to delete it: email [email protected] from the address on your account to delete your account, including derived knowledge, and we will confirm by reply. You can also revoke OKAtlas's access at any time from your Google account permissions or your Slack workspace's app settings.

Backups and logs that may still hold deleted data are overwritten on their normal rotation.

Data is encrypted in transit. Connection tokens are encrypted before they are stored. Access to production systems is limited to authorized staff, and our staff do not browse customer content. If you discover a security vulnerability, please report it to [email protected].

For questions about this policy or your data, contact us at [email protected] or [email protected].