Privacy Policy

Last updated: November 4, 2026 (bring your own AI; account deletion). Controller: Automanton. Contact: support@automanton.com.

What we collect

• Account: your email address, your plan, and when you signed up.
• AI keys: the AI provider keys you connect, stored encrypted (AES-256-GCM) and never shown back, with the list of models each key can use and your model choices.
• Chats: your messages and Automanton's replies, which model answered, and token counts for each reply, so we can show history.
• Attachments: images are sent to your AI provider to answer your message, and PDFs are turned into text first; neither is stored. We keep only their file names, types and sizes.
• Screen sharing: while you share your screen, your browser takes one still each time you send a message, and it's handled like an attached image (checked, sent to your AI provider, not stored). The live picture stays in your browser.
• Voice: recordings made with the microphone (when your browser can't transcribe them itself) are turned into text and not stored.
• What Automanton knows about you: short facts about your business, tools and preferences, learned from your chats or added by you, kept until you delete them, and sent to your AI provider with your messages so replies fit you. See, edit or delete them, or switch off learning, under your email → What Automanton knows about you. Passwords, keys and card numbers are never kept.
• Scheduled tasks: what you asked for, when it runs, your timezone, and the result of the last run, kept until you delete the task.
• Email updates: a record of each update email we send you (what it was about and when), so we can keep to the daily limit; switch them off under your email → Email updates.
• Daily counts: how many PDFs you've had read and minutes of voice input you've used today, for the daily limits.
• Connections: API keys you paste, stored encrypted (AES-256-GCM), never shown back; figures read from connected Stripe or Shopify accounts, cached for up to 15 minutes to draw your charts.
• Payments: Automanton is free during the private beta, so we don't take payments. When paid plans launch, Stripe will handle them and we'll store only your Stripe customer and subscription identifiers and status, never your card details.
• Waitlist: your email, your answers (business type, stage, what would help), your referral code and how many friends joined with it, and a one-way hash of your network address used only to stop self-referrals. We use them to tell you when you can sign in and to plan what we build and which partners we bring on. Partners only ever see totals, never anyone's details.
• Partner applications: the company, contact name, email, website and offer you send through the partner form.
• Technical: your IP address is used briefly for rate limiting and security. We use one sign-in cookie, plus your browser's local storage to keep an unsent message. No advertising or analytics trackers.

Who processes it

• The AI provider you connect (for example Groq, Google, OpenAI, Anthropic, OpenRouter, Mistral or xAI): your messages, attachments and earlier messages in the chat go from our servers straight to the provider you chose, under your account and its terms, to generate replies (and to run the safety check on the rare occasions our own check below is unavailable or at its daily limit). Check your provider's data terms: Google AI Studio's free tier, for example, may use what you send to improve Google's products.
• Cloudflare: hosting, database and storage, and, through Workers AI: checking every message for safety before it's answered (Llama Guard for text, Llama 4 Scout for images); turning PDFs into text; and speech-to-text when you haven't connected Groq or OpenAI. When Hands launches, also cloud browsers (Browser Run).
• Resend: sends sign-in emails.
• Stripe: payments, once paid plans launch (not used during the free beta).
• Your browser's vendor (for example Google or Apple): when your browser does speech recognition itself, your audio goes to its service under its own terms.
• Services you connect (Stripe, Shopify): we read from them with the key you provide.
• Groq or OpenAI for voice: if you've connected one, voice recordings go there for speech-to-text, under your account.

Why

To provide the service you asked for, keep it secure, apply daily limits and, after launch, bill for paid plans. Where laws like the GDPR require a legal basis, we rely on contract (to provide the service you signed up for), legitimate interests (to keep the service secure, prevent abuse and apply limits) and legal obligation (for example, keeping payment records once paid plans exist). We don't sell your personal information or use it for advertising.

How long we keep it

Chats stay until you delete them; deleting a chat deletes its messages. Disconnecting a service deletes its key and cached figures. Sign-in links expire after 15 minutes; sessions after 30 days.

When you delete your account, we cancel any subscription and delete your account, chats and messages, usage records, saved connections and cached figures, pending approvals and any waitlist entry, and every session ends. Some copies sit outside our database: Stripe keeps records of past payments as the law requires; your AI provider handles what was sent to it under its own retention terms; and sign-in emails already sent stay in your inbox. Your email stays on the private beta's invite list until we remove it, so you can come back. Our database host keeps point-in-time backups for up to 30 days, so deleted data is gone from backups within 30 days.

Your choices and rights

You can delete chats, disconnect services and delete your whole account yourself (account menu → Delete my account). To get a copy of your data, email support@automanton.com.

Depending on where you live (for example under the GDPR in the EU and UK, or the CCPA in California), you may have the right to access, correct, delete or get a portable copy of your personal information, to object to or restrict how we use it, and to complain to your data protection authority. We don't sell or share personal information for cross-context behavioral advertising. To use any of these rights, email support@automanton.com; we'll reply within 30 days and won't treat you differently for asking.

Security

Connections are encrypted, sign-in links work once, and the app runs over HTTPS only. No system is perfectly secure; tell us at support@automanton.com if you find a problem.

Changes

We'll update this page and tell you about significant changes.