Last updated: October 2026

Privacy Policy

Your privacy is our primary concern. This policy explains how your personal information is collected and used when you interact with Privasys websites and services. This Privacy Policy applies to all Privasys services available through privasys.org, developer.privasys.org, docs.privasys.org, privasys.id, and the applications we run on apps.privasys.org. By accessing or using Privasys services, you agree to this Privacy Policy.

The type of personal information we collect

Privasys currently collects and processes the following information:

  • Account information (e.g. your login details via GitHub, information stored on your account, and other details about your use of our services).
  • Technical data (e.g. internet protocol (IP) address, browser type and version, time zone setting and location, operating system and platform, and other technology on the devices you use to access our websites).
  • Usage data (e.g. information about how you use our websites and services and engage with our content).
  • Communications data (e.g. when you contact us, subscribe to updates, or request information about our services).

How we get the personal information and why we have it

The personal information we process is provided to us directly by you for one of the following reasons:

  • Creating an account on the Developer Platform
  • Deploying applications through our services
  • Contacting us via email or our website
  • Browsing our websites

We do not receive personal information indirectly. We do not purchase data from third parties or data brokers.

We use the information that you have given us to:

  • Provide and maintain our services
  • Authenticate your identity via Privasys ID, our OIDC identity provider
  • Maintain developer communication and support
  • Improve our websites and services

How we store your personal information

Your information is securely stored. We keep account information for as long as necessary to fulfil the purposes we collected it for, including for the purpose of satisfying any legal, accounting, or reporting requirements.

Authentication is handled by Privasys ID, our OIDC identity provider. Privasys does not store passwords. Account identifiers and metadata are kept for as long as your account is active.

We keep basic information about visitors, usage data, and technical data that is tracked for routine administration and maintenance purposes only.

Accounts you connect, and the data in them

A Privasys application can connect an account you already have, such as a mailbox, a calendar, a cloud drive or a meeting service, so that an assistant acting for you can work with what is in it. This section explains what happens to that data, including data we receive from Google APIs, and it applies in addition to everything above.

What we access, and why

You choose which account to connect, what it is for, and how far the access goes. The boundary is the capability you approve on your own device, not a promise on this page: an assistant can only do what that capability allows, and an assistant may of course be built to do less.

  • Mail (Gmail and other IMAP mailboxes): read the messages in the mailbox you connect, write drafts, apply labels, and send a message where you have granted that.
  • Calendar: read your events and when you are busy, propose events for you to confirm, and create events and send invitations where you have granted that.
  • Files (Google Drive, OneDrive, SharePoint): read the documents you point it at, and write files where you have allowed it to write.
  • Meetings: read the transcripts of meetings you hosted, and write them into your own Privasys Drive.

How it is accessed

Every connector runs inside a confidential computing enclave whose code you can verify by attestation before you trust it. Before any access happens, you approve a capability on your own device that names the account and the purpose, and you can withdraw it at any time. The credential that opens your account is held in the memory of that enclave and on your own device. It is not written to our disks and does not appear in our logs.

How it is used

Data from a connected account is used only to produce the result you asked for, in your own session: a triage, a draft, a summary, an answer. It is never used to train or improve any model, generalised or otherwise. It is never used for advertising, profiling or analytics. No Privasys employee can read it: it lives inside the enclave, and running the platform gives us no path to that memory.

How it is stored and shared

We do not store the content of your mail, your calendar, your files or your transcripts. Connectors read on demand and keep nothing at rest. The one exception is the one you asked for: a meeting transcript is written into your own Privasys Drive, encrypted for you, because a transcript has no other durable home. We do not transfer this data to any third party, and we do not sell it.

Limited Use

Privasys's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Withdrawing access

You can disconnect an account at any time in your Privasys wallet, which withdraws the capability and forgets the credential immediately. You can also remove our access at the provider: Google at myaccount.google.com/permissions, Microsoft at myapps.microsoft.com, and Zoom in the Zoom App Marketplace. Anything the assistant has already left in your own account, such as a draft, a label, a proposal or a transcript in your Drive, remains yours to keep or delete.

Share links in Privasys Drive

A Privasys Drive user can share a file or folder with a link, and can restrict it to people they approve. A restricted link asks the visitor to present details the sharer chose, such as a name, an email address, or a fact certified from a government ID (for example, that they are 18 or older).

  • What is shared, and with whom. The visitor approves each detail in their Privasys Wallet before it is sent. The details go to the sharer, so they can decide whether to grant access, and to no one else.
  • How long it is kept. Privasys Drive keeps the visitor's details, encrypted inside the Drive enclave, only while the request waits for the sharer's decision. They are deleted as soon as the sharer approves or declines, and after 7 days at the latest if no decision is made. The sharer's Privasys Wallet also receives them in a notification, on the sharer's own device.
  • Government-certified facts. A fact certified from a government ID is a signed statement from the Privasys identity verifier, which Privasys Drive checks before showing it. The visitor's document itself is never shared. The sharer pays for each certified fact a visitor presents.
  • The sharer. Visitors are not shown the sharer's name or account identifier; a link reads as shared with them, or names the workspace it comes from.

Your data protection rights

Under data protection law, you have the following rights:

  • Right of access -- You have the right to ask us for copies of your personal information.
  • Right to rectification -- You have the right to ask us to rectify personal information you think is inaccurate, or to complete information you think is incomplete.
  • Right to erasure -- You have the right to ask us to erase your personal information in certain circumstances.
  • Right to restriction of processing -- You have the right to ask us to restrict the processing of your personal information in certain circumstances.
  • Right to object to processing -- You have the right to object to the processing of your personal information in certain circumstances.
  • Right to data portability -- You have the right to ask that we transfer the personal information you gave us to another organisation, or to you, in certain circumstances.

You are not required to pay any charge for exercising your rights. If you make a request, we have one month to respond to you.

Please contact us at contact@privasys.org if you wish to make a request.

Cookies

We do not use tracking cookies on our websites. The Developer Platform uses session cookies after you have signed in to maintain your authenticated session.

Advertising and third parties

We do not display advertisements and do not collect information for advertising purposes.

Links to third-party websites

Our websites may contain links to other websites. We are not responsible for the privacy policies on those websites, and they may differ from our own. When you leave our websites, we encourage you to read the privacy policy of every website you visit.

Security

We use commercially reasonable means to protect your personal information. Privasys is a confidential computing company; data security is at the core of everything we build. However, no method of transmission over the Internet, or method of electronic storage, is 100% secure.

Changes to this Privacy Policy

This Privacy Policy is effective as of March 2026. If any details of our policy change, this page will be updated, and the changes posted will be effective immediately. We reserve the right to update or change our Privacy Policy at any time and you should check this Privacy Policy periodically.

How to complain

If you have any concerns about our use of your personal information, you can make a complaint to us at contact@privasys.org.

You can also complain to the ICO if you are unhappy with how we have used your data.

The ICO's address:
Information Commissioner's Office
Wycliffe House, Water Lane
Wilmslow, Cheshire, SK9 5AF
Helpline number: 0303 123 1113
ICO website: https://www.ico.org.uk

Contact

Company Name: Privasys Ltd.
Registered Company: UK-16866500
Email: contact@privasys.org