app0 Privacy Policy

1. Who we are and how to contact us

Yori AI Limited is a company incorporated and registered in England and Wales with company number 16594533. Our registered office is at Pure Offices, Wilton Drive, Warwick, Warwickshire, United Kingdom, CV34 6RG. app0 is one of our products; our other product is Yori.

For privacy questions and requests, email legal@askyori.ai. We have not appointed a data protection officer or a representative in the European Union. If we do, we will say so here.

2. When we are a controller and when we are a processor

We are the controller for personal data that we decide how and why to process. That covers account and sign-in data, billing, security and fraud prevention, our website, support and feedback, our own business records, and the operation and improvement of the Services using usage data.

We are a processor for personal data that a Customer puts into its Workspace or connects to it: the companies, contacts, deals, leads, emails, calendar events, Teams messages, meeting transcripts, files, chats and other Customer Content, and the data of Connected Services. The Customer decides why that data is processed and is responsible for its lawful basis. We process it on the Customer’s instructions under the DPA. Where this Privacy Policy describes that processing, it does so for transparency; the DPA governs it.

If your data is in someone else’s Workspace. If you are a contact, prospect, customer or email correspondent of a company that uses app0, that company is the controller of your data. Please direct questions and requests about it to that company first. We will help the company respond, and we will pass on any request we receive.

If you use app0 through your employer. Your employer, or whoever owns your Workspace, controls the Workspace. Its owners and admins can see members, settings, usage and costs, and can access, export and delete Workspace content. Only the owner of an assistant inbox can read its email, but admins can see its address and counts.

3. The personal data we collect

We do not require anyone to put special category data, criminal offence data or children’s data into the Services. If a Customer chooses to, it is responsible for having a lawful basis and safeguards.

Information you must provide. You must give us a name and email address to create an account, and billing details to start seat billing or buy AI Credit. Without them we cannot provide the Services. Everything else is optional, although features will not work without the data they are designed to process.

4. How we use personal data and our lawful bases

Where the UK GDPR or EU GDPR applies and we are the controller, we rely on the lawful bases below. Where we are the processor, the Customer decides the lawful basis and we process under the DPA.

Where we disclose personal data to prevent or detect crime, protect vulnerable people, respond to an emergency or for national security, we may rely on a recognised legitimate interest under Article 6(1)(ea) of the UK GDPR.

5. AI Features and Third-Party AI Providers

How AI requests travel. The Services do not run their own large language models. We send each AI request through Vercel AI Gateway, our AI routing provider, which passes it to the Third-Party AI Provider that serves the model chosen for that feature. By default the research agent uses a model served by Z.ai, assistants and most drafting use models served by OpenAI, company assessment and email sorting use a model served by TypeSafe, and GEO can ask OpenAI, Google and Anthropic models through their own search tools. Workspace admins can choose other models from the catalogue the Services offer, in which case the provider of that model receives the request. The current providers are listed in section 15 of the DPA.

What a request contains. A request contains what the feature needs: the records, emails, files, transcripts, chat messages and instructions involved, together with workspace, assistant and session identifiers. Company assessment sends only public company fields and your workspace’s description of what it sells, never mailbox content. GEO sends only the approved question and language.

No training. We do not use Customer Content to train, fine-tune or improve AI models, and we do not allow Third-Party AI Providers to do so. We select models whose providers are identified by our AI routing provider as not using requests to train their models.

Provider retention. We do not request zero data retention. Third-Party AI Providers may keep requests and responses for a limited period for abuse monitoring, safety, security, debugging and legal compliance under their own terms and policies, which vary by provider and model.

Sandboxes. When an Agent runs shell commands or works with files, it does so on a cloud machine provided by Boat, which has internet access, or, when Boat cannot provide one, in a Vercel Sandbox with no internet access. These machines hold the files the Agent works on for the life of the session and hold none of our secrets.

Memory. Assistants can keep memory about you and your preferences and an “About you” note shared by all your assistants. You can view, edit, export and clear memory in the assistant’s Memory tab.

Operational review. We may access and review Customer Content, including chats and Agent activity, where reasonably necessary to provide, support, secure, debug and improve the Services, to investigate misuse or security incidents, or to comply with law.

Automated decisions. We do not make decisions about you that have legal or similarly significant effects based solely on automated processing. Agents suggest, draft and enrich; people approve, send and decide. Customers must not use the Services to make such decisions except in compliance with the law.

6. Email, calendar, Teams and connected services

Microsoft 365. When a person connects Outlook, we use Microsoft Graph with the permissions they grant: reading mail, reading and writing mail so that an assistant can save drafts in their Drafts folder and routine updates can be placed in their inbox, reading calendars, and, if they turn it on for an assistant, reading Teams chats and channels. Sending email for sequences needs a separate permission that each person grants themselves, and Agents never receive it. Sync is forward-only from the time of connection and is stored in the person’s Workspace. People can disconnect in Settings, Connections.

Google Workspace. Sign-in with Google and Gmail and Google Calendar sync are built into app0 and will be offered once Google has verified our app. When available, we will use the scopes openid, email, profile, gmail.readonly, calendar.readonly and, only when a person allows sending for sequences, gmail.send. We use Gmail and Calendar data only to provide the features the person asks for: showing conversations, contacts, companies and meetings in their Workspace, drafting with their assistants, and sending the sequence emails they start. app0’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular, we will not use Google user data for advertising, will not sell it, will not allow humans to read it except with your consent, for security purposes, to comply with law or where it has been aggregated and anonymised for internal operations, will transfer it only to provide or improve the features you use, for security or to comply with law, and will not use it to develop, improve or train generalised AI or machine learning models.

Composio. When you connect a third-party application through Composio, Composio stores the credentials for that connection and carries out the actions your assistants and apps request within the permissions you granted. The application’s own privacy policy applies to the data it receives.

Treg. Assistants can use outside tools and data through Treg. Each call carries your workspace and assistant identifiers and the inputs the assistant chose, and is paid from your Included Usage and AI Credit at the cost Treg reports. Treg’s own policy applies to the tools it serves.

Firecrawl. If a workspace admin saves a Firecrawl key, website reads and web search for enrichment use Firecrawl under the Customer’s own Firecrawl agreement.

Outside Agents. When you connect an Outside Agent through our MCP server, it receives whatever it reads from your Workspace through the access you approved, and its provider’s privacy policy applies to that data. We store the agent’s identity, your consent and hashed tokens, and we record that an agent made a change where the Services support it.

7. The meeting notetaker

When an Authorised User sends the notetaker into a Google Meet, Teams or Zoom call, an audio-only bot named “app0 notetaker” joins as a visible participant. The bot runs on our own self-hosted notetaker service, built on Vexa, which produces a speaker-labelled transcript while the call is live. The transcript is saved in the Workspace, after which the call is deleted from the notetaker service. Notes and suggested actions are written from the transcript by a Third-Party AI Provider. The Customer is responsible for telling participants and obtaining any consent the law requires. If you were a participant in a call and have questions about a transcript, please contact the company that invited the notetaker.

8. Assistant email addresses

An assistant can have its own email address. Mail sent to it is received by Amazon Simple Email Service, stored and scanned for spam and viruses, then passed to the Workspace, where the assistant works on it in a chat its owner can see. Mail that fails those checks is held and deleted after 14 days, or 7 days for a virus. Mail is kept in the inbox for the period the owner chooses, up to 365 days, and raw copies on Amazon Web Services are deleted after 30 days. Nothing is sent from an assistant address until a person checks and approves it. Each outgoing email carries a footer identifying the assistant.

9. Who we share personal data with

We share personal data with the providers that help us run the Services. Those that process Customer Content on our Customers’ behalf are also listed as sub-processors in section 15 of the DPA.

We also share personal data:

• within your Workspace, with owners, admins and other Authorised Users according to roles and settings;
• with Connected Services and Outside Agents that you choose to connect;
• with our professional advisers, auditors, insurers, banks and other business operations providers;
• with courts, regulators, law enforcement and other authorities where the law requires, to protect rights or safety, or to enforce the Terms; and
• with a buyer or successor in a merger, acquisition, financing, reorganisation or sale of assets, subject to appropriate safeguards.

We do not sell personal data and we do not share it with third parties for their own marketing.

10. International transfers

We are based in the United Kingdom, and our database and application functions run in London. Some of our providers process data in the United States, including hosting, file storage, payments, email delivery, connectors, issue tracking and Third-Party AI Providers. The research agent’s default model is served by Z.ai, and requests to it may be processed outside the United Kingdom, the European Economic Area and the United States. Treg, Context.dev and Boat process data in the regions their own infrastructure uses.

Where the UK GDPR applies, we transfer personal data outside the United Kingdom only under UK adequacy regulations, including the UK Extension to the EU-US Data Privacy Framework for certified US recipients, or, where none apply, under the International Data Transfer Agreement or the International Data Transfer Addendum to the EU Standard Contractual Clauses, supported by a transfer risk assessment. Where the EU GDPR applies, we rely on European Commission adequacy decisions or the EU Standard Contractual Clauses with supplementary measures where needed. You can ask for a copy of the relevant safeguards by emailing legal@askyori.ai.

11. How long we keep personal data

We keep personal data only as long as needed for the purposes in this Privacy Policy, the Terms, the DPA, our Customers’ instructions and the law.

• Accounts. Account data is kept while the account exists. You can ask us to delete your account by emailing legal@askyori.ai. We may keep a minimal record to show that we did, and to keep you out of a workspace you were removed from.
• Sign-in. Email sign-in codes last 10 minutes. Sessions last 7 days from their last daily refresh. Invitations expire after 7 days. Outside Agent access tokens last one hour and refresh tokens 30 days; consents last until disconnected.
• Workspaces and Customer Content. Kept while the Agreement with the Customer lasts and for 90 days after it ends, so the Customer can export it or ask us for a copy. Then deleted as the DPA sets out.
• Synced mail and calendar. Kept in the Workspace as Customer Content. A person who disconnects Google can purge what was synced from it.
• Assistant email. Kept for the period the inbox owner chooses, up to 365 days. Held mail is deleted after 14 days, or 7 for a virus. Raw copies on Amazon Web Services are deleted after 30 days.
• Meeting transcripts. Kept in the Workspace as Customer Content. Deleted from the notetaker service once saved.
• Enrichment. Website pages read for enrichment are kept for the period the admin chooses, and the history of enrichment fields and deal fields is kept for 30 days.
• Apps. App runs and outside-service receipts are kept for 90 days.
• Billing records. Invoices, receipts, tax and accounting records are kept for six years from the end of the financial year they relate to, or longer where needed for legal claims.
• Feedback. Kept in the Services and in Linear until the issue is closed and then for as long as it is useful to us for support and product history.
• Logs and audit records. Technical and security logs are kept for a limited period, normally no more than 12 months, and audit records of changes are kept with the Workspace.
• Backups. Copies may remain in backups for a limited period after deletion, subject to ordinary backup rotation and access controls.
• Aggregated data. Information that no longer identifies anyone may be kept for lawful business purposes.

12. Security

We use technical and organisational measures designed to protect personal data against unauthorised access, loss, misuse, alteration and disclosure. They include encryption in transit and at rest; workspace isolation enforced in the database with row-level security and separate database roles; single sign-on enforcement; hashed Outside Agent tokens; sealed storage of connection secrets; sandboxes that hold no secrets; approval steps before Agents change, send or spend; spam, virus and sender authentication checks on assistant email; rate limiting; signed webhooks; audit logging; restricted staff access; and written agreements with our providers. Section 16 of the DPA describes these measures in more detail. No internet service is completely secure, and you should not put data into the Services where disclosure would cause unacceptable harm unless you have agreed controls with us.

13. Your rights

Under the UK GDPR you have the right to access your personal data, to have it corrected or deleted, to restrict or object to its use, to receive a portable copy of it, to withdraw consent where we rely on it, and to not be subject to solely automated decisions with legal or similarly significant effects. If the EU GDPR or another privacy law applies to you, you may have similar rights.

Your right to object. You can object at any time to our use of your personal data based on legitimate interests. Email legal@askyori.ai.

How to exercise your rights. Email legal@askyori.ai with enough detail for us to verify your identity and understand the request. Where we are the controller, we will respond within one month, which we may extend by two months for complex requests, and we will tell you if we do. Where we are a processor for a Customer, we will refer the request to that Customer or act on its instructions. Many things can also be done in the Services: you can change your name, photo and preferences in Settings, manage assistant memory in each assistant’s Memory tab, disconnect services and Outside Agents, and export the Workspace data the Services offer an export for. For anything else, ask us for a copy.

14. Complaints and the ICO

If you are unhappy with how we have used your personal data, please email legal@askyori.ai. We will acknowledge your complaint within 30 days, look into it, keep you informed and tell you the outcome without undue delay.

You also have the right to complain to the Information Commissioner’s Office (the “ICO”), the UK regulator for data protection, at ico.org.uk, by phone on 0303 123 1113, or at Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. If you are in the European Economic Area, you can complain to your local data protection authority.

15. Children

The Services are for business use and are not intended for anyone under 18. We do not knowingly collect personal data from children. If we learn that a person under 18 has an account, we will close it and delete their personal data unless the law requires us to keep it.

16. Marketing and service messages

We send service messages that are needed to run the Services, such as sign-in codes, invitations, billing emails and notices about assistant email or routines. You cannot opt out of these while you have an account.

We do not currently send marketing email from app0. If we start, we will only email you where the law allows: with your consent, or under the soft opt-in in regulation 22(3) of PECR for existing customers, and always with an unsubscribe link. Where you are a corporate subscriber, we may contact you about app0 under our legitimate interests, and you can ask us to stop at any time.

17. Cookies

app0 uses only strictly necessary cookies and similar browser storage, to keep you signed in, protect sign-in and remember interface choices. We use no analytics or advertising cookies. See the Cookie Policy for the full list.

18. Changes to this Privacy Policy

We may update this Privacy Policy to reflect changes to the Services, the law, our providers or our practices. If we make material changes, we will tell you in the Services or by email before they take effect, and we will update the date at the top. Where we plan to use personal data for a materially new purpose, we will tell you first and obtain consent where required.