Privacy Policy

This Privacy Policy explains how SmartManager LLC ("we," "our," or "us") collects, uses, discloses, and retains personal information when you use the Smart Manager websites, desktop and mobile applications, AI features, and related services (collectively, the "Service").

SmartManager LLC is the service operator. Legal notices may be sent to jonathan@smartmanager.ai or to 480 Boynton Ave, San Jose, California 95117, United States. This policy does not govern third-party services that you choose to connect; their policies govern their own processing.

This policy is intended to give you the information required by the EU General Data Protection Regulation (GDPR), the UK GDPR, the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA), and other applicable privacy laws. Sections that apply only in some places say so.

For personal accounts, SmartManager LLC is the controller of your personal information: we decide why and how it is processed, as described in this policy.

When an organization uses the Service for its business, the organization is the controller of the content its members put into its workspace, and we process that content as its processor under our Data Processing Addendum (DPA), which is available on request. In that case, the organization's own privacy notice explains its processing, and we pass on requests we receive about that content to the organization. We remain the controller of the account, billing, security, and usage information we need to run the Service for that organization.

At or before collection, we collect the following categories of personal information for the purposes summarized below:

• Identifiers and account details, such as name, email, user and organization identifiers, authentication records, and contact details, to create, secure, and support your account
• Commercial and billing information, such as plan, subscription status, transaction identifiers, and payment-related records received from Stripe, to provide subscriptions, prevent fraud, and maintain financial records
• User Content and connected-service data, such as prompts, AI conversations, files, documents, emails, calendars, contacts, tasks, messages, photos, audio, and instructions, to provide the features you request
• Internet, device, and usage information, such as IP-derived information, browser, device, operating system, diagnostics, feature activity, and security logs, to operate, secure, debug, and improve the Service
• Inferences and generated information, such as AI classifications, summaries, recommendations, embeddings, and Outputs, to provide search, organization, automation, and assistant features
• Sensitive personal information that may appear in content you choose to provide, connected-account credentials or tokens, precise location when enabled, communications contents, and face-matching data only if you turn on face matching, solely to provide and secure the requested feature

We do not sell personal information or share it for cross-context behavioral advertising. We do not show ads, and we never use your content to train AI models. We keep each category for the periods listed in Data Retention.

Providing account and authentication information is necessary to use an account. Other information is optional, but a feature may not work if you do not provide or connect the information it needs.

4.1 Account and Profile Information

We collect information such as your name, email address, phone number if provided, profile details, organization, role, account dates, settings, authentication events, and legal-consent receipts.

4.2 User Content and AI Activity

We process prompts, conversations, instructions, uploaded or generated files, documents, images, audio, transcripts, feedback, Outputs, and actions you request. We also keep memory the assistant builds from your activity so it can help you later. You can pause memory or clear all of it in Settings, correct it by telling the assistant, or ask us for a copy of what is remembered. Content may contain personal information about you or others.

4.3 Connected Services

When you authorize an integration, we receive the data and permissions needed for that connection. Depending on your choices, this can include email, calendars, contacts, files, cloud storage, tasks, messages, social content, meeting data, activity archives, and provider account metadata. OAuth tokens or similar credentials are used to maintain the connection and are stored in protected form. If you use your Smart Manager mailbox (your login name @smartmanager.email), we receive the mail sent to it and store it in your account.

4.4 Device, Usage, and Diagnostics

We collect device and browser type, operating system, IP address, approximate location derived from IP, login and activity times, referring pages, feature interactions, API events, crash reports, performance data, and security signals. Our server-side operational logs follow a fixed format that excludes your content. Error reports from the app can include fragments of text that were on screen or in the browser console when the error happened. When you send a support ticket or feedback, the app attaches recent app logs from that device so support can fix the problem. The app keeps these logs in memory only, removes tokens, keys, and other credentials it can detect, and caps them at about 256 KB. Attaching them is on by default, and you can turn it off in Settings or for a single ticket. It is not available in HIPAA mode.

4.5 Payment Information

Stripe processes payment-card details. We receive subscription, customer and transaction identifiers, billing status, plan, amount, currency, invoices, and limited payment-method details. We do not store full payment-card numbers.

4.6 Photos, Audio, Face Matching, and Location

If you enable relevant features, we process microphone recordings, transcripts, photos, and device location. Face matching is off by default. If you turn it on, we create face-matching representations from photos you select in order to organize or link them; we do not use them to authenticate identity. You can turn face matching off at any time to stop new matching, and you can delete existing matches in the Service or ask us to delete them.

We collect information:

• Directly from you, including information you enter, upload, say, approve, or generate
• Automatically from your device and use of the Service
• From services you connect, such as Google, Microsoft, iCloud, messaging, storage, social, and meeting providers
• From identity, payment, security, analytics, hosting, and AI service providers
• From an organization that invites you to or administers a Smart Manager workspace
• From other users when they share content or collaborate with you
• About people who are not Smart Manager users, when their information appears in accounts a user connects, such as emails, calendar invitations, and contacts

Google Services You Connect

When you connect a Google account, you choose which Google services Smart Manager may use. We ask only for the access each choice needs:

• Google account name and email address (userinfo.profile and userinfo.email): to show which Google account you connected and to sync the right account when you connect more than one.
• Gmail, read only (gmail.readonly): your email messages and attachments. We use them so you can search your mail, see it sorted, get summaries, and have the assistant draft replies. This access cannot change, label, or delete your mail.
• Send from Gmail (gmail.send), off unless you turn it on: lets Smart Manager send an email or reply from your Gmail address. It sends a message only after you approve that message, and it sends the text you approved. This access cannot read your mail.
• Google Contacts, read only (contacts.readonly): the contacts saved in your Google account. We use them to show the right names on your mail and events, find the right address when you ask to contact someone, and group people into your circles.
• Google Calendar, read only (calendar.readonly): the calendars your account can see, including shared calendars, and their events. We use them to show your schedule, prepare you for meetings, and warn you about conflicts.
• Google Drive, read only (drive.readonly): your Drive files and their content. We use them so you can search and ask questions across your documents. You can pick files and folders with the Google Picker, or import your full Drive history where that option is available.
• Google Tasks, read only (tasks.readonly): your task lists and tasks. We use them to show your tasks with the rest of your day and to remind you about due dates.

Through this Google connection, Smart Manager never changes or deletes anything in your Gmail, Contacts, Calendar, Drive, or Tasks. The only thing this connection can do in your Google account is send an email you approved, and only if you turned on Send from Gmail.

Other Google Products You Connect Separately

Some other Google products have their own connection. Each one shows its own Google consent screen and asks only for its own access. Some of them can act in your account, but only in the ways listed here:

• YouTube (youtube.readonly, with userinfo.profile and userinfo.email): read only, as described in YouTube API Services below. Smart Manager does not currently request YouTube upload or channel management access.
• YouTube History Import (dataportability.myactivity.youtube, dataportability.youtube.comments, dataportability.youtube.subscriptions, dataportability.youtube.private_playlists, dataportability.youtube.public_playlists, and dataportability.youtube.unlisted_playlists): only the groups you select, as described in Google Data Portability below.
• Google Chat (chat.spaces.readonly, chat.messages.readonly, and chat.memberships.readonly): your spaces, messages, and members, so you can search and summarize them. Send Google Chat messages (chat.messages.create) is off unless you turn it on.
• Google Business Profile (business.manage): your business listing and its reviews, so you can read reviews, reply to them, and publish posts to the listing after you approve them.
• Google Nest (sdm.service): your Nest devices and their state, and the device commands you ask for.
• Other Google services listed in Settings, such as Google Books, Google Classroom, and Google Workspace admin reports, ask for their own access when you connect them. Settings shows what each one can read or do.

These connections follow the same rules for use, storage, disclosure, Limited Use, and model training as the Google connection above.

How We Use Google User Data

We use Google user data only to provide the features you turned on, for you. We keep it in your own private data silo, not in a table shared with other users. The assistant may remember facts from it, such as who a contact is, so it can help you later. You can review and clear what it remembers in Settings. We send parts of it to AI providers only when a feature you use needs them, such as sorting mail, writing a summary, drafting a reply, or making your content searchable. See AI Processing and Model Training for how those providers handle it. Circles use the people in your email, calendar, and contacts as described in Circles, never the content of your mail, files, or events.

SmartManager LLC never uses Google user data to train AI models. We never sell it, use it for ads, or use it to decide credit or lending.

Storage, Disclosure, and Retention

We store OAuth tokens in protected form and keep Google user data, including YouTube records, in your private Smart Manager data silo. We disclose Google user data only to service providers acting on our behalf when necessary to provide or secure the feature you requested, as described in How We Disclose Information. We do not sell Google user data, use it for behavioral advertising, or permit humans to read it except with your affirmative agreement for a specific item, when necessary for security or abuse investigation, or when required by law.

Who Receives Google User Data

Each provider receives only the part of your Google user data that the feature you use needs:

• Vercel, Convex, Amazon Web Services, and Trigger.dev host, store, and process it to run the Service.
• Upstash QStash delivers scheduled jobs back to our servers. A job can carry details of the task it runs, such as a reminder drawn from your data.
• Anthropic, OpenAI, Hemmingway, Groq, Inception Labs, and TypeSafe run the AI steps, such as sorting mail, writing summaries, and drafting replies. Voyage AI turns text into search embeddings. ElevenLabs turns an answer into speech when you listen to it. None of these AI providers trains models on what we send. Voyage AI, Inception Labs, and ElevenLabs train by default; we turned that off at each of them on October 22, 2026.
• CloudConvert converts a file that is not a PDF, such as a Drive document, so it can be read. It does not train on or read your files, and it deletes them within 24 hours.
• When the assistant searches the web for you, the search text (which can include words from your Google user data) goes only to LLMLayer, which states it does not train AI models on it and passes questions to OpenAI's API, which does not train on API data by default; SerpApi and Serper never receive search text written for you. For example, the search text can include a flight number from an email when your request needs it.
• Google Maps Platform and the other mapping providers on our Subprocessors page receive a place or an address, such as an event location, when you ask for a map or directions.
• OpenWeather receives a place to show its weather. When we only have the place's name, we send that name as written, such as a city you ask about or the location of a calendar event, which can be a full address, and OpenWeather returns its map coordinates. We then send those coordinates to get the forecast. When the place is already coordinates, such as a shared location or a trip destination from your calendar or email, we send only those coordinates, and OpenWeather returns the place's name.
• Telnyx receives a contact's phone number when you call that contact. It does not train on call data without our written consent.
• Stream receives the names and email addresses of the people you invite to a call, the call's title, and its audio and video. It does not receive your mail, files, or tasks.
• PostHog and Axiom receive no content.

Disconnecting and Deleting Google Data

You control what stays:

• Disconnect in Settings, Connections: Smart Manager stops syncing that Google account and deletes its stored Google token. Calendar events from that account are hidden from your calendar; we keep them so they come back if you reconnect. Mail, contacts, files, and tasks already imported stay in your data silo until you delete them.
• Disconnect and delete in Settings, Privacy, Imported data: Smart Manager disconnects the account and, a few minutes later, deletes the email, calendar events, and contacts that account imported. Its Drive files leave your library and search, and the stored copies are deleted when you delete your account. Facts the assistant learned from the account stay in its memory, where you can review and clear them. Imported Google Tasks are not yet removed by this step; you can delete them in the app or by deleting your account.
• Delete your account: we delete your Google user data with the rest of your account data, as described in Account Deletion and Export.

Disconnecting does not by itself remove Smart Manager's access grant at Google. To remove it, use Google's third-party access settings. See Connecting your accounts for step-by-step controls. To ask us to delete Google user data, email jonathan@smartmanager.ai.

YouTube API Services

Smart Manager uses YouTube API Services when you connect YouTube. The ordinary YouTube connection can collect your subscriptions, liked and disliked videos, playlists and playlist items, and related video, playlist, channel, and account metadata that the YouTube Data API makes available. It does not provide Smart Manager with YouTube watch history, search history, Watch Later, or a complete history of comments you authored.

Google Data Portability

If you separately enable YouTube History Import, Smart Manager uses the Google Data Portability API to request the YouTube resource groups you select. The import requests the available history for those groups and can include YouTube watch and search activity, YouTube ad interactions, related image, audio, or CSV attachments, comments, subscriptions, private, public, and unlisted playlists, and associated metadata. Data Portability authorization is separate from the ordinary YouTube connection. After a successful capture, Smart Manager asks Google to reset the import authorization rather than retaining an ongoing Data Portability grant. Smart Manager does not use scraping to obtain unavailable YouTube data.

YouTube Use and AI Processing

We use connected YouTube data to provide the synchronization, import, search, and organization features you authorize. The ordinary YouTube Data API connection temporarily queues factual records for synchronization and does not create derived metrics or preference memories or send those records to AI providers for interest inference. YouTube History Import stores factual imported records by default. If you separately select Reviewable preference evidence, Smart Manager creates a deterministic, source-attributed evidence summary for you to inspect. That summary is not sent to an AI provider and is not promoted into assistant memory or treated as an accepted statement about your preferences. A view is not treated as endorsement, missing activity is not treated as a dislike, and no sensitive identity traits are inferred.

YouTube Retention

We do not persist Google's temporary signed archive download links. Completed ordinary YouTube Data API queue records are deleted after synchronization; a delayed deletion backstop removes an abandoned queue generation within 29 days. Smart Manager periodically reconfirms ordinary YouTube authorization and deletes the corresponding Authorized Data if Google reports that access was revoked. Data Portability records and any optional reviewable evidence summary are retained only as long as needed for the user-facing import purpose you authorized.

Disconnecting YouTube

YouTube works differently from the other Google services, because YouTube policy requires deleting Authorized Data after access is revoked. When a YouTube disconnect completes, Smart Manager asks Google to revoke or reset the selected authorization and deletes records and review artifacts obtained under that YouTube authorization. If deletion cannot be completed, the Service reports the failure and preserves enough connection state to retry instead of falsely reporting success. Other YouTube accounts that remain connected are not deleted. See Manage and delete YouTube data for step-by-step controls. You can also revoke Smart Manager from Google's third-party access settings, request deletion through the Service, or delete your Smart Manager account.

Your use of the YouTube connection is also governed by the YouTube Terms of Service and Google Privacy Policy.

Limited Use

Smart Manager's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Smart Manager's use and transfer of information received from the Google Data Portability API also adheres to the Data Portability API Additional Requirements.

We use personal information to:

• Provide, personalize, and maintain the Service
• Authenticate users, provision accounts and their isolated data stores, and enforce permissions
• Process prompts, generate Outputs, search content, and perform approved actions
• Synchronize and maintain connected services
• Process subscriptions, send transaction notices, and provide billing support
• Detect abuse, prevent fraud, protect users, and secure the Service
• Diagnose errors, measure performance, and improve features
• Communicate about the Service, legal updates, security, and support
• Enforce our agreements and comply with legal obligations

We may create aggregated or de-identified information, such as counts of how often a feature is used or fails, and use it only to operate, secure, and improve the Service. We do not sell it, use it for advertising, or use it to train AI models. We do not attempt to re-identify information that has been de-identified except to test whether de-identification is effective.

If you are in the European Economic Area, the United Kingdom, or Switzerland, we rely on the following legal bases:

8.1 Performance of a Contract

To create and run your account, provide the features you use, sync the services you connect, carry out the actions you request, process payments, and provide support, including reading the app logs attached to a support ticket or feedback you send.

8.2 Legitimate Interests

We rely on legitimate interests for:

• Securing the Service, preventing fraud and abuse, and limiting request rates
• Diagnosing failures with operational logs that exclude your content
• Privately distilling generic procedures from completed tasks to improve future work, as described in Smart Manager Commons
• Grouping users into circles and, once both people accept a circle, showing its members each other's availability, as described in Circles
• Processing information about people who are not users that appears in a user's connected accounts, as described in People Who Are Not Smart Manager Users
• Sending service, security, and legal notices that are not marketing

We have weighed these interests against your rights. The processing is limited to what each purpose needs, uses information you would expect a service like ours to use, is protected by the safeguards in Security, and does not involve selling or advertising. You can object at any time, as described in Your Rights and Choices; for procedure distillation, you can also turn it off in Settings.

8.3 Consent

We ask for your consent before we:

• Collect optional browser diagnostics (Axiom)
• Turn on face matching, which can involve biometric data
• Use precise device location
• Contribute a generic procedure to the shared commons library

In these regions, we also ask for your consent before we use optional product analytics (PostHog, Vercel Web Analytics, and Vercel Speed Insights).

You can withdraw consent at any time in the Service, including through Privacy choices on the Cookies page. Withdrawal does not affect processing that took place before it. We tell whether you are in these regions from your device's time zone and language settings. When they are unclear, we ask first.

8.4 Legal Obligation

To keep billing, tax, and legal-consent records, respond to lawful requests, and handle privacy requests.

We do not ask for special category data (such as health, racial or ethnic origin, religious beliefs, sexual orientation, or biometric data) except face matching, which is off by default and runs only with your explicit consent. Special category data may still appear in content you choose to upload or connect. We process it only to provide the feature you asked for, and we do not use it to infer traits about you.

Smart Manager does not currently accept protected health information (PHI) as defined by the US Health Insurance Portability and Accountability Act (HIPAA). We are not a HIPAA covered entity. We would act as a business associate only under a signed business associate agreement (BAA), and we do not sign BAAs today. Do not use the Service to store or process PHI. Once our HIPAA mode and the necessary vendor agreements are in place, a BAA will be available on request for eligible customers.

We send prompts and relevant content to AI providers when needed to perform the feature you request. We choose the model for each task based on quality, cost, reliability, and safety, so the provider can vary between requests. The current providers are listed on our Subprocessors page.

SmartManager LLC never uses your content to train AI models. We never sell or rent your personal information, and the Service has no ads. We use business or API services whose terms restrict providers to processing data for our authorized service purposes. Voyage AI, Inception Labs, and ElevenLabs do not train on our data; they train on customer data by default, and we turned that off at each of them on October 22, 2026. Some providers may still train on data we send. When a meeting host turns on captions or transcription, Stream's terms let it use that caption and transcript data to improve its AI services, with no opt-out. SerpApi and Serper, two of our web search providers, publish no statement about training, so they never receive search text written for you; it goes only to LLMLayer, which states it does not train AI models on it. PostHog, which receives product analytics but no content, trains its own models on anonymized analytics data by default; we turned that off on October 23, 2026. Our Subprocessors page shows each provider's current status. We have not signed zero-data-retention agreements, so providers may keep inputs and outputs for a limited period under their own terms, such as for abuse monitoring. Two features keep data at OpenAI beyond a single request. Whenever our browsing agent visits websites for you, whether it is only reading pages to answer a question or completing a task on a site, OpenAI stores each of its turns (your task, screenshots of the pages it visits, and the actions it takes) so the next turn can build on it, and keeps them under its API data retention terms. When we classify your email in bulk, the files we upload to OpenAI's batch service stay there until we delete them after processing, and for no more than 7 days. Our other OpenAI requests are sent with response storage turned off. The browsing agent is not available in HIPAA mode.

You should not submit information that you are not authorized to process. Avoid including highly sensitive information unless it is necessary for the feature and you understand the applicable controls.

We do not make decisions that produce legal effects or similarly significant effects on you based solely on automated processing, as described in Article 22 of the GDPR and UK GDPR. AI features rank, summarize, draft, and suggest; you decide what to act on, and actions with outside effects ask for your approval.

Automated safety systems may slow or block requests that look abusive. If one restricts your account, you can ask for a person to review the decision by emailing jonathan@smartmanager.ai.

Smart Manager Commons shares only three kinds of information: generic how-to steps from finished tasks, with personal details removed, warnings about sites members report as harmful, such as scam or phishing sites, and patterns in email members mark as spam or phishing. It never shares your personal data, such as your name, contact details, account details, messages, files, or prompts. To stop contributing, turn off Shared learning in Settings, AI and memory.

Members who share what worked get back what worked for others. This works in stages:

• Private distillation: when enabled, the Service may turn a completed task into a generic procedure with personal details removed. It stays in your own data store. It is on by default for individual accounts, except in the EU and UK and when we cannot tell your region, where it is off until you turn it on. You can turn it off in Settings. If you belong to an organization whose owner is on the Business plan, it is off unless you turn it on.
• Submissions from your own agent: if you connect your own AI agent to Smart Manager and share, your agent can submit a how-to it followed. Your agent must use placeholders instead of personal details such as your name, email address, phone number and company. We refuse submissions that still contain them or that contain links, and save the result in your own data store before it counts toward the shared library.
• Link reports: when you report a harmful link, in the app or through your agent, we keep a keyed fingerprint of the link's site and of your account, never the full address. On a file, form or page sharing service such as Google Drive, Microsoft Forms or Dropbox, we keep a keyed fingerprint of the one shared item instead, never of the service itself, and links to the service's own pages cannot be reported. Other members see a warning only after accounts from at least three independent organizations report the same site or shared item.
• Spam and phishing reports: when you mark an email as spam, phishing or not spam, we keep keyed fingerprints of the sender's domain (only when the sender's mail server proved it owns that domain), of the domains it links to (for a link an email security service rewrote, the domain it leads to), and of its wording after names, addresses, numbers, standard footers and other personal details are removed. We never keep the sender's address, the subject or the text. Who reported it is kept only as keyed fingerprints of your account, of your organization and of its group of related organizations, so that one organization cannot count as several; never your address or your organization's name. Automatic sorting is never reported; only your own choices count, and only from accounts at least a week old on a paid plan. Some domains are never flagged as a whole: free and shared email services such as Gmail or Proton, bulk email senders and their click-tracking links such as SendGrid, Mailchimp or Klaviyo, email security services that rewrite links such as Proofpoint or Mimecast, shared company mail domains such as onmicrosoft.com, well-known companies, public bodies, shared website hosts and content delivery networks. On a shared website or blog host, only the one customer site that was reported can be flagged, never the host itself or the addresses we know it runs for all its customers. Other members' email is flagged only after accounts from at least three independent organizations report the same wording, or five report the same domain. A flag on a domain an email links to, or a harmful-site warning on one of its links, never moves an email on its own and never turns spam into phishing: it adds weight only when the sender's domain, the wording or a reported shared item has already flagged the email. "Not spam" reports count against a flag, and reports expire after 30 days. To check new email, we compare the same fingerprints against these flags and against harmful-site and shared-item warnings.
• Shared library: a procedure can be added to the shared library only after you accept the contribution disclosure, once at least three contributors from at least three independent organizations have produced the same procedure, and after a person at Smart Manager reviews it. Only members who share receive procedures from the shared library, link warnings and spam and phishing warnings.

Shared entries hold no account details, prompts or content. We keep a keyed fingerprint of each contributor and organization, used only to count independent contributors and to withdraw contributions. When your organization opts out, its contributions are withdrawn; when you close your account, yours are withdrawn. Turning sharing off stops new contributions and withdraws yours, including ones already counted; turning it back on does not bring them back. HIPAA accounts never take part.

Smart Manager groups you with people you already live or work with into circles, such as household, work, project, and personal circles, so you can coordinate with them. It infers circles with fixed rules, not an AI model. It uses these signals: the senders and recipients of your email; your calendar attendees; your contacts, including contacts linked to you as household; meetings in your Family or Home & errands calendar categories, which count as household evidence; directed requests, where one Smart Manager user asks another for access; and a verified company email domain or company that you share with another user, which counts only as work evidence. Calendar events in the Health category, events marked sensitive, and birthdays are never used as evidence.

• A new circle is visible only to you until it has enough members and confidence. After that, the other members who use Smart Manager can see it.
• Nothing is shared through a circle until you both accept it. If you and another Smart Manager user have both accepted the same circle, are both active members of it, and have not set your own sharing rules, each of you can see the other's availability as busy times, or the categories of calendar events, from 30 days ago to 90 days ahead. In a shared room, everyone in the room must have accepted the circle.
• You can withdraw your acceptance at any time, and sharing through that circle then stops. Withdrawing is never blocked.
• Circle sharing never includes the content of your emails, files, messages, or events. Events are treated as sensitive unless marked otherwise. Sensitive events, including the health and money-and-legal categories, show only as busy times.
• A sharing rule you set yourself can show more to the people you choose, such as event titles or health and money-and-legal events. Your own rules do not depend on accepting a circle.
• Partner, parent, and child roles apply only when both people confirm them.
• A membership fades when you stop interacting, and circle sharing stops when it fades below a set level.
• People who do not use Smart Manager appear in circles only as hashed references and never receive any data.
• Circles are not available in the European Union or the United Kingdom. If your account is there, or we cannot tell where it is, you cannot accept a circle and we do not form circles for you.
• You can accept or withdraw from a circle, end, ignore, or block it, accept members, set your own sharing rules, and decide requests for access. You can also object to circle inference by emailing jonathan@smartmanager.ai.

When a user connects an email, calendar, contacts, messaging, or meeting account, we process information about the people in it, such as names, email addresses, phone numbers, messages they sent, and meeting invitations. We receive it from the user's connected provider, not from those people. We use it only to provide the Service to that user: to show, search, and organize their information, draft replies, and help with tasks. The user's assistant may also remember facts about their contacts. We keep this information in that user's private data silo for as long as the user keeps it, as described in Data Retention.

We rely on legitimate interests, ours and the user's, in managing their own communications, calendar, and contacts. People who are not users never receive data from circles, and we do not sell this information or use it for advertising.

If you are not a Smart Manager user and want to ask about, access, correct, delete, or object to the processing of your information, email jonathan@smartmanager.ai. Because each user's data is kept separately, tell us the email address or phone number we should look for.

We disclose information only as needed for the purposes described in this policy:

15.1 Service Providers and Subprocessors

Our main providers include:

• Vercel for application hosting, delivery, runtime logs, and product analytics
• Convex for search, databases, and the isolated data store each account gets
• Amazon Web Services for file storage, sending and receiving email, and infrastructure
• Trigger.dev for durable background tasks and workflows, and Upstash QStash for delivering scheduled jobs
• WorkOS for identity and authentication
• OpenAI, Anthropic, Hemmingway, Groq, Inception Labs, Voyage AI, and TypeSafe for AI inference, embeddings, and search ranking
• Anthropic and OpenAI when you ask us to build or change an interface component. Your request, the names of the windows you have open, outside web material gathered for it, and the resulting code go to a coding agent in an isolated machine we operate, reached through ngrok. The agent sends them to Anthropic, whose models plan and review the code, and to OpenAI, whose model writes it, with response storage turned off. A person at SmartManager LLC reviews the code before it becomes part of the Service, and an approved change, including the words of your request, is recorded on GitHub, where we host our source code
• HeyGen (HeyGen Technology Inc., United States), for AI video generation you request, including recasting a video you upload with a new character; HeyGen runs its service, including its Video 1 model, on Amazon Web Services in the United States, with no processing in the EU or UK; it receives your prompt and, for a recast, the video, including the people in it, and the picture of the new character; it keeps these and the generated video under its own retention terms and has agreed not to use our data, including data sent before that agreement, to train its models; we copy the video to our own storage when it is ready
• ElevenLabs for voice features
• Stream for meetings and video calls, Telnyx for phone features, and Expo for mobile push notifications
• CloudConvert for document conversion and Daytona for running code in isolated sandboxes
• SerpApi, Serper, and LLMLayer for web search, and OpenWeather for weather forecasts
• Google Maps Platform, Cesium, OpenStreetMap public services, and other mapping providers listed on our Subprocessors page for place search, maps, and directions
• Stripe for subscription billing and payment processing
• Arcjet for abuse protection, Axiom for operational diagnostics, and PostHog for product analytics
• Google, Microsoft, Apple/iCloud, and other providers you choose to connect

The full list, with what each provider receives and where it processes data, is on our Subprocessors page. We post changes there 30 days in advance where feasible. We require providers to protect information and process it only for authorized purposes.

15.2 Your Organization and Other Users

Workspace administrators may manage memberships, access shared workspace information, and control organization settings. We disclose content to other users when you direct us to share or send it.

15.3 Legal, Safety, and Corporate Events

We may disclose information when reasonably necessary to comply with law, protect rights or safety, investigate fraud or abuse, or respond to lawful process. Information may be transferred in a merger, financing, acquisition, reorganization, bankruptcy, or sale of assets, subject to appropriate confidentiality protections. As a condition of any such transfer, we will require the successor or acquirer to keep these commitments for the information it receives: no use of it for advertising, no sale or rental of it, and no use of it to train AI models.

We never sell or rent your personal information, and the Service has no ads.

We do not sell personal information for money or other valuable consideration, and we do not share personal information for cross-context behavioral advertising as those terms are defined by California law.

We do not disclose mobile phone numbers, messaging consent, or messaging-originator data to third parties or affiliates for their own marketing or promotional purposes. Service providers may process this data only to deliver and support the messaging feature.

We honor Global Privacy Control, Do Not Track, and similar opt-out preference signals. When your browser sends one, product analytics and diagnostics stay off.

SmartManager LLC is based in the United States, and we and our providers process information in the United States. Some providers may process it in other countries, as shown on our Subprocessors page.

When we transfer personal data from the European Economic Area or Switzerland, we rely on the European Commission's Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) where a provider's data processing terms include them. For the United Kingdom, we rely on the UK International Data Transfer Agreement or the UK Addendum to those clauses where a provider's terms include them. We have not yet confirmed or countersigned any provider's data processing terms, so our Subprocessors page lists each transfer mechanism as not yet confirmed. You can ask us for the current status of any provider, or for a copy of the relevant safeguards, at jonathan@smartmanager.ai.

We keep personal information for these periods. A period marked as a target is our policy, but we do not yet delete automatically when it ends; ask us and we will delete sooner where the law allows.

• Account and profile information: while your account is open, then deleted through account closure, except for the records listed below
• Conversations, files, notes, and other User Content: until you delete them, choose Disconnect and delete for the account that imported them, or delete your account. A plain disconnect stops syncing but keeps what was already imported; see Google and YouTube Data for what each option removes
• Smart Manager mailbox (your login name @smartmanager.email): we sort each message as important, unimportant, or spam, and phishing counts as spam. Sorting uses the same AI classification we already run on your mail. If you share with the Smart Manager network, sorting can also flag mail that members of other organizations reported as spam or phishing; that check sends only keyed digests, never your address, subject, or body. The AI can file mail as spam or unimportant. Only a sender you know makes new mail important: a contact, someone you write to, or a sender you mark "Not spam". Opening, replying to, starring, or keeping a message marks it important. "Not spam" restores a message and trusts its sender, and "Report phishing" takes one tap. Your choice always beats the automatic label. We store trusted senders as keyed digests, not addresses. Deleting your account deletes all of your mailbox
• Important mailbox messages (mail from senders you know, and mail you open, reply to, star, or keep): kept until you delete them or your account. After 90 days, the original message may move to cheaper archive storage; search still works
• Unimportant mailbox messages (including mail from other senders that we could not sort): after 90 days, we delete the copy of the text used for search and keep a short preview and the original message. After 180 days, they move to Trash
• Mailbox spam and Trash: deleted for good 30 days after a message lands there. Spam is never indexed for search or archived
• Mail with a virus is never stored; we record only a count. Mail with attachments that could not be scanned for viruses goes to spam, except mail that arrives while your device-held access has lapsed, which is filed later without that check. Mail that fails sender authentication from a domain that asks receivers to reject such mail is dropped
• Assistant conversations, by your choice in privacy settings: until you delete them (the default), 1 year, or 90 days. With 1 year or 90 days, older conversations are deleted automatically by a cleanup that runs when you use the Service
• Conversation memory summaries: 90 days, with at most 400 kept per account; older ones are removed automatically
• Temporary sync data, such as sync previews: 7 days (up to 14 days if you choose to keep a sync preview longer), then deleted automatically by the cleanup that runs when you use the Service
• Components and layouts the assistant generates for you: 30 days, then deleted automatically by the same cleanup
• Exports you create in privacy settings: 30 days, then deleted automatically by the same cleanup. If you choose to delete the recovery export when you delete your account, they are deleted when closure completes
• Account-closure exports: 30 days after a manual account deletion completes, then deleted automatically. If you choose to delete the recovery export when you delete your account, none is kept and any from an earlier deletion attempt is deleted when closure completes
• Legal-consent receipts: kept while your account is open, to show what you agreed to, with a target of deleting them 6 years after the account closes. Automatic deletion is not yet in place
• Billing, transaction, and tax records: for the period financial and tax law requires
• Prior versions of stored files: up to 90 days after they are replaced or deleted, removed automatically by a storage rule. We do not currently keep separate scheduled database backups; see Disaster recovery
• Connected-service tokens: while the integration is connected; they are removed or invalidated when the connection or account is deleted, subject to provider behavior
• Security, audit, and diagnostic logs: for the shortest period reasonably necessary for security, reliability, fraud prevention, and troubleshooting, under each logging provider's retention setting
• A standalone trial provides seven days of access. Synchronization and background processing stop when access ends, service emails are sent on day 9 and day 11, and permanent trial-account deletion begins after eleven complete days unless the account converts to a paid plan; a trial already in progress when this schedule took effect moved to it, and none of its dates moved earlier
• Raw synced emails, files, messages, contacts, calendar content, prompts, and similar User Content are not retained merely to analyze why a trial did not convert. We may retain non-identifying aggregate trial outcomes and privacy-minimized operational counts that do not contain content, addresses, provider object identifiers, filenames, or user identifiers

We may keep information longer when the law requires it or to establish or defend legal claims. When a retention period ends, we delete or de-identify the information.

We protect personal information with safeguards that include encrypted transport, encryption at rest by our infrastructure providers, protected storage of connection tokens, a separate data store for each account, access controls, and content-free operational monitoring. Searchable workspace content is not yet encrypted at the application level. We hold no security certifications. Our Security page lists each control with its current status: in place, partial, or planned.

Each account's structured data is kept in its own isolated database, called a data silo. Our database provider encrypts it at rest, but we do not add our own field-level encryption, so our servers can read silo data while they provide the Service. Our servers reach a silo with a revocable credential for that silo alone, which we store encrypted. We are introducing device-held access: once it is turned on for your account, our servers can reach your silo only while one of your trusted devices has renewed access within a limited period (48 hours by default), and background processing for your account pauses when that access lapses. Even then, a small number of operator credentials held by SmartManager LLC for provisioning, software releases, and account deletion, and our database provider, can still reach silos. We work to keep the contents of your messages, documents, and prompts out of our operational logs, which mostly record identifiers, counts, and error types; error details returned by our service providers can occasionally include fragments of a request, and we keep reducing them.

No system is perfectly secure. You are responsible for protecting your devices and authentication methods and for promptly reporting suspected unauthorized access to jonathan@smartmanager.ai. If a breach affects your personal information, we will notify you and the relevant authorities as the law requires.

Depending on where you live, you have the right to:

• Access the personal information we hold about you and receive a copy
• Correct inaccurate or incomplete information
• Delete your personal information
• Receive information you provided in a portable, machine-readable format
• Restrict processing while a concern is resolved
• Object to processing based on legitimate interests
• Withdraw consent at any time for processing based on consent
• Not be subject to decisions based solely on automated processing that significantly affect you
• Opt out of sale or sharing for cross-context behavioral advertising, and limit the use of sensitive personal information (we do neither of the first two, and we use sensitive personal information only to provide the features you request)
• Appeal a decision we make about your request

You can exercise each right in the Service or by emailing jonathan@smartmanager.ai. In the Service, you can update your profile, pause or clear assistant memory (and correct it by telling the assistant), change privacy choices, disconnect integrations, export your data, and delete your account. We respond within one month of receiving your request. If a request is complex or we receive many, we may extend that by up to two further months, and we will tell you why within the first month.

We may need to verify your identity before completing a request. Authorized agents must provide proof of authority. We will not discriminate against you for exercising a privacy right.

If you are in the EEA or UK and are unhappy with how we handled your information, you can complain to your local data protection authority. In the UK, that is the Information Commissioner's Office. In the EU, you can find your authority in the European Data Protection Board's list of members. We would appreciate the chance to address your concern first.

California residents may request the categories, sources, purposes, recipients, and specific pieces of personal information covered by applicable law. Because we do not sell or share personal information for behavioral advertising, there is no sale or advertising-sharing activity to opt out of.

Account settings provide an account deletion flow. Unless you choose to delete the recovery export too, the Service attempts to create an export before deleting active account data and fails closed if that export cannot be created. If deletion only partially completes, we preserve any export and direct you to support rather than reporting a false success.

For a manual account deletion, active account data is deleted through the durable closure process and the recovery export and its receipt may be retained for up to 30 days in case you need the exported data. The export is stored with our storage provider's encryption at rest; we do not add our own encryption to it. It is not used for analytics, model training, or ordinary product processing. It is deleted automatically when that period ends, and you can ask us to delete it sooner. This recovery export does not restore the deleted account.

When you delete your account, you can choose to delete the recovery export too. We then create no recovery export. When closure completes, we delete every export we hold for your account, including recovery exports from earlier deletion attempts and exports you created in privacy settings. The deletion receipt is still kept for up to 30 days.

For automatic trial-expiry deletion, an export may exist transiently only while the deletion process verifies that every destructive step can complete. It is purged when deletion completes rather than retained for 30 days.

Account deletion does not require deletion of records we must retain for billing, fraud prevention, security, legal compliance, or the establishment or defense of legal claims. It may not remove content that another user lawfully retains in a shared workspace. Prior file versions expire within 90 days.

We use cookies and browser storage to sign you in, keep your session secure, and remember your choices. Product analytics is on by default, and you can turn it off at any time in Settings, Privacy, or with Privacy choices on our Cookies page. It counts which features get used and how pages load, never the content of your mail, files, or conversations. We never sell analytics data or use it to train AI. In the European Economic Area, the United Kingdom, and Switzerland, it runs only if you allow it. Optional diagnostics run only if you allow them, wherever you are. A Global Privacy Control or Do Not Track signal, or HIPAA mode, keeps both off. The Cookies page lists every item, what it does, and how long it lasts.

The Service is intended for adults and is not directed to anyone under 18. We do not knowingly collect personal information from children. If you believe a child has provided personal information, contact jonathan@smartmanager.ai so we can investigate and take appropriate action.

We have not appointed a representative in the EU or the UK, or a data protection officer. Send privacy questions and requests, including from the EEA, the UK, and Switzerland, to jonathan@smartmanager.ai.

We may update this policy to reflect changes in the Service, providers, law, or our practices. We will post the revised policy, update the date above, and record the change on our Legal updates page. If a change materially affects your privacy rights or how we use previously collected information, we will provide additional notice in the Service and obtain consent when required by law.

Privacy questions and requests may be sent to jonathan@smartmanager.ai.

Postal address:

SmartManager LLC

480 Boynton Ave

San Jose, California 95117

United States