Privacy Policy

This policy separates two things, because different parties decide how each is handled. The description below follows the specific data and purpose — neither party is simply “always the controller” or “always the processor”.

• Information EM ES handles for its own purposes — account administration and authentication records, platform security records (sign-in events, failed-attempt counters, credential public keys), diagnostics, support records, service communications, and information we need for legal compliance. For this limited information, EM ES may be responsible for deciding how it is handled.
• Customer Content — messages, files, tasks, meetings, Vault entries, calendar information, and other workspace data submitted through a Customer’s workspace. EM ES generally processes Customer Content to provide the service according to the Customer’s instructions. The Customer determines why its Authorized Users use the workspace and is responsible for appropriate notices, permissions, lawful authority, and user administration within its organization.

The Platform handles only what it needs to function:

• Account information — an Authorized User’s name, email address, role, and (optionally) a profile photo. Passwords are stored only as one-way bcrypt hashes — no one can read them back.
• Customer Content — tasks, meetings, meeting notes and minutes, templates, reminders, and the messages, voice notes (with an automatic text transcript when transcription is enabled), photos, and files sent in workspace chat, along with reactions and read receipts.
• Call records — for workspace video calls: who called, who was invited, whether each person answered, declined, or missed, when the call started and ended, and who (if anyone) recorded it.
• Device & notification data — a push notification address and its delivery keys, a basic device label and browser description, an installation id, and the app version, so reminders and alerts reach a device even when the app is closed.
• Security records — sign-in events, failed-attempt counters that temporarily lock accounts after repeated wrong passwords or PINs, and the credentials described under “Biometrics” below. EM ES handles these to keep the Platform secure.
• Usage & activity logs — a capped, rolling record of workspace actions (for example, when a task is completed or a reminder is sent) used for accountability within the workspace and for troubleshooting.
• Diagnostics & feedback — upload diagnostics are numeric timings only and are structurally incapable of containing files or messages. Feedback a user chooses to send includes the message, optional screenshots or a voice memo, the page they were on, and a basic device description.

Biometric unlock (fingerprint / Face ID) is performed entirely by your device and its platform (WebAuthn, or the Android system biometric prompt). EM ES never receives, stores, or has access to your fingerprint, face, or any biometric template. What the Platform stores is only a public key with a signature counter (created by your device when you enrol), and — for the Android app’s saved sign-in — a revocable device token kept in your phone’s secure keystore, of which the Platform keeps only a cryptographic hash. Removing a device or changing your password invalidates these credentials.

Customer Content is processed to provide the workspace to the Customer: to run tasks and meetings, deliver reminders and notifications, enable messaging and calls, and keep the workspace’s activity history. Information EM ES handles for its own purposes is used to administer accounts, secure and support the Platform, communicate about the service, and meet legal obligations. EM ES does not use this information for advertising, and the Platform contains no advertising or third-party analytics/tracking SDKs.

EM ES does not sell personal information and does not share it with third parties for their own purposes. Customer Content is visible to the other Authorized Users of the same workspace as the workspace’s rules allow (for example, a task’s assignees or a chat’s participants) — that visibility is administered by the Customer, not by EM ES.

Direct 1:1 messages are treated as private: the activity log records only that a message event happened (never its text, subject, or file names), deleted direct messages are not recoverable by anyone — including workspace administrators and EM ES support — and system backups keep only the conversation skeleton, never direct message bodies.

Blitz learning from chats (automated, no person reads them): unless a person switches it off in Settings → Blitz, the Blitz assistant reads that person’s one-to-one chats automatically overnight, without any person seeing them, only to learn how that person works. A one-to-one chat is read only when both participants have this on, and messages sent before October 14, 2026 are never read. Blitz does not save the messages it reads: it keeps only short notes of what it learned (for example, which client someone usually handles), which only that person can see, remove or clear, and which only their own Blitz uses. These notes are used only to teach Blitz how that person works; the content is not used to train Anthropic’s models under its commercial terms. Turning it back on after switching it off requires the person’s password. Group and task chats are read the same way to keep a playbook of how each team works, which that team’s members and workspace administrators can see. Passwords, account and card numbers, and personal matters are excluded from both.

Who can see workspace information from inside the Platform is described in the next section; a Customer’s separate agreement with EM ES, where one exists, may also govern processing.

EM ES uses service providers to host and operate the Platform. Based on the current build:

• Hosting and delivery — the Platform runs on Vercel; its database and file storage run on Supabase (files live in a private bucket, accessed via short-lived signed links).
• Email — invitations, password resets, optional daily agendas, and reminder emails are sent through Google’s Gmail service.
• Notifications — push alerts are delivered through your platform’s notification service (your browser’s push service on the web; Google Firebase Cloud Messaging in the Android app). Notification previews can include the sender’s name and a short excerpt of the message so the alert is useful; those previews pass through these delivery services.
• Office file previews — when you preview a Word/Excel/PowerPoint attachment in chat, the preview is rendered by Microsoft’s Office Online viewer, which fetches that file via a temporary signed link in order to display it.
• When the feature is enabled — workspace video calls run on Daily.co (your display name and an internal id are shared to join a call; in-call recordings, always visibly indicated, are stored with the video provider); the optional AI assistant sends the content you give it to Anthropic, and the chat text it reads for the automated Blitz learning described above, and voice-note transcription sends the audio to the configured transcription provider (OpenAI or Groq); optional two-way calendar sync writes task/meeting titles and details to a connected Google or Microsoft calendar; and a Customer-administrator- enabled calendar share feed exposes non-personal tasks and meetings to anyone holding its private link.

Four different levels of access exist, and they are not the same. This section states what the Platform actually does today.

• Customer administrators. Admins of a Customer’s workspace can see and manage their organization’s operational data (tasks, meetings, templates, group and task chats, the activity log) and administer members and per-section access. Customer administrators can manage users and Customer Content through the administrative features currently made available in the Platform.
• EM ES operator access. EM ES operates the Platform through an operator account, but that account has no standing access to Customer Content — support access is not permanently enabled. To receive help, an Authorized User generates a time-limited support code; access begins only when the specific EM ES operator redeems that code, and a code cannot be reused by any other operator. A support grant is read-only, and never authorizes more than the person who granted it can already see: a grant from an ordinary Authorized User is limited to information already visible to that user, and only a Customer administrator may authorize workspace-wide support visibility. While connected the operator may inspect but not change — a support grant does not permit EM ES to create, edit, delete, restore, migrate, export, email, or otherwise modify Customer Content, and does not permit creating accounts, sending invitations, resetting passwords, impersonating a user, switching into a user’s account, changing permissions, or deleting accounts; those remain the Customer administrator’s responsibility. Vault (Pass Board) entries, another user’s personal tasks, direct-message contents, credential hashes, and biometric data stay inaccessible through support access. The grant is time-boxed and ends the moment it expires or the user disconnects it; and if the person who granted it loses the necessary authority — their account is deactivated or their role is reduced — the access ends or narrows immediately. Support-access events are recorded with non-content audit information (who connected, when, and the category of access — never the content itself), kept on a rolling, bounded basis rather than permanently. Separately, EM ES may publish platform and release announcements to users as the Provider; those product communications are independent of support access and do not contain Customer Content.
• Infrastructure access. As the party that runs the Platform’s infrastructure, EM ES holds the database, file-storage, backup, and server-side encryption keys (including the Vault’s — see Security). Such access is used to operate, secure, and support the service, under confidentiality and the safeguards described in this policy.
• What stays inaccessible to all of the above. Another person’s personal tasks are denied to administrators and to the operator account alike (and are redacted from backups, exports, and the activity log). Direct 1:1 conversations can be opened in-app only by their participants (the automated Blitz learning above reads them without any person seeing them); their deleted content is unrecoverable by anyone and their bodies never enter backups. Passwords and App Lock PINs exist only as one-way hashes, biometric templates never reach the Platform at all, and vault-security and challenge records are excluded from every export.

The Platform uses only its own first-party cookies — a sign-in session cookie (30 days), a short-lived vault-unlock cookie (15 minutes), and short-lived security challenge cookies (about 5 minutes). There are no advertising or third-party tracking cookies. On your device, the app stores preferences (theme, sounds), drafts, and — for offline use — a local copy of your workspace data that is wiped when you sign out.

Data is encrypted in transit (HTTPS/TLS). Passwords and App Lock PINs are stored as one-way bcrypt hashes. Pass Board (Vault) entries are additionally encrypted at rest with AES-256-GCM; the encryption keys are held server-side so the service can operate — this is not zero-knowledge encryption, and access to the Vault is therefore also protected by unlock locks, short-lived unlock sessions, and audit logging. Access to a workspace is restricted to its Authorized Users, sensitive areas can require an additional in-app lock, and sessions are revoked when a password changes. No system is perfectly secure, but EM ES takes reasonable measures to protect information on the Platform.

EM ES retains personal information for as long as reasonably necessary to provide and secure the Platform, support the Customer relationship, maintain business and audit records, comply with legal obligations, resolve disputes, and enforce agreements. Ending an account or workspace relationship does not necessarily immediately delete Customer Content. Some information may remain in soft-deleted records, backups, security records, or audit history.

In practice on the Platform today: deleting or removing content from the active interface may not immediately erase every stored copy. Some information may remain in soft-deleted records, internal recovery records, audit history, or backups — deleted tasks, meetings, and accounts are retained as deleted records, and files attached to deleted messages may remain in storage. These retained copies are not currently available to Customer administrators through a self-service recovery feature. The fixed periods the Platform actually implements are: vault trash is purged after about 30 days, saved device sign-ins expire after 90 days, sign-in sessions after 30 days, and short-lived security records (unlock challenges, support codes, notification-open records) expire within minutes to a day. A nightly backup snapshot is kept in private storage. No other automatic deletion deadline is promised, because none is implemented.

A nightly snapshot supports disaster recovery. It never includes password hashes, invite tokens, or vault-security records; private direct-message bodies are stripped; and personal tasks are redacted. These snapshots are internal recovery records and are not currently available to Customer administrators through a self-service export or recovery feature. Availability of a recovery or export feature is not promised by these Terms or this Privacy Policy. Requests concerning access to or copies of personal information may be submitted to the Customer Organization or to the EM ES Privacy Officer, depending on who controls the information.

You can mute alert devices and set quiet hours in Settings. For requests about Customer Content or your workspace account (access, correction, deactivation, deletion), start with your Customer Organization’s administrator — workspace content and membership are administered by the Customer, and such requests may need to be directed there. For requests about an EM ES account, platform security records, or EM ES’s own handling of personal information, contact the EM ES Privacy Officer (below). Deleting an account removes access immediately and marks the account deleted; Customer Content already contributed remains part of the workspace’s records as described under Retention.

EM ES operates from Montréal, Québec, Canada. The Platform is hosted on the cloud providers listed above. EM ES and its service providers may process or store personal information outside Québec or Canada, including in the United States. Information processed in another jurisdiction may be subject to that jurisdiction’s laws. EM ES uses contractual and other safeguards appropriate to the information and service involved.

The Platform is intended only for Authorized Users who are at least 18 years old. It is not directed to children. EM ES does not knowingly collect information from children.

EM ES may update this policy from time to time. Material changes will be reflected by updating the effective date and version at the top of this page.