Privacy Policy

1. Information We Collect

Account information

When you create an account, we collect your name and email address. You may sign in with Google, in which case Google shares the basic profile information (name and email) you authorize with us. You may also sign up with an email address and password.

Connected source data

When you connect a Google Drive / Google Docs account, a Notion workspace, or a Slack workspace, we retrieve and store the documents and content you choose to sync, along with document metadata such as the file name, modification time, version, revision identifiers, view links, and comments associated with those documents.

Document and collaboration content

We store the managed documents, versions, folders, workspaces, comment threads, review requests, proposals, and audit records you and your agents create or import within ArtifactBridge.

Agent and integration data

When an AI agent (such as Claude) connects through our MCP server, we record scoped API-token activity, agent tool calls, and consent decisions. If you enable push notifications we store device tokens needed to deliver them.

Usage and technical data

We collect logs, metadata, and similar technical information about your use of the Service, including authentication events, IP address, browser type, and access times for security, reliability, and auditing.

Acquisition analytics

On the public landing site we record cookieless funnel events (page views, call-to-action clicks, and first-time signups and product-update leads). The browser talks only to our own collector. We forward those events, together with the visitor IP address for coarse country or region, to PostHog Cloud in the European Union. We do not set an analytics cookie, we do not build a person profile from these events, and we do not send your email address, user id, or workspace id with them.

2. How We Use Your Information

• To provide, operate, and maintain the Service, including syncing documents to and from your connected sources.
• To create, store, version, and organize your managed documents and artifacts.
• To authenticate you and authorize AI agents to act within the workspaces you grant them access to.
• To communicate with you about your account, security, and the Service.
• To monitor and prevent fraud, abuse, and security incidents.
• To measure how people find and start using the Service (campaign, page, and conversion counts, and coarse location).
• To comply with our legal obligations.

3. Google API Data and Limited Use

ArtifactBridge's access to and use of information received from Google API Services complies with the Google API Services User Data Policy, including the Limited Use requirements. We only request the scopes necessary to read and export the Google Docs you choose to sync. We do not use Google API data for advertising, and we do not transfer or sell it to third parties for that purpose.

4. How We Share Information

We do not sell your personal information. We share data only as described below:

• Service providers: We use trusted infrastructure and integration providers that process data on our behalf, including Supabase (database hosting), Cloudflare (application and static-site hosting), Pipedream (which brokers your authorized connections to Google Drive and Notion), and PostHog (identifier-free landing and signup funnel events, plus visitor IP for coarse location). These providers are bound by obligations to protect your data and use it only to provide their services to us.
• Integrations you authorize: When you connect Google Docs, Notion, or Slack, we exchange data with those services to the extent necessary to perform the sync and collaboration features you requested.
• Within your workspaces: Members of a workspace you belong to may see documents, comments, and activity you create there, in accordance with workspace membership and permissions.
• Share links: If you create a share link, anyone with the link may view the shared document according to the visibility you set.
• Legal requirements: We may disclose information when required by law, court order, or to protect the rights, property, or safety of ArtifactBridge, our users, or others.

5. Data Retention

We retain your information for as long as your account is active or as needed to provide the Service. Imported external document content is retained until you delete the document or choose to delete content when disconnecting a backing Google or Notion account. Comment history and audit records may be retained as conversation and system history even after document content is removed. Disconnecting or deleting an account inside ArtifactBridge never edits, archives, or deletes the original document in Google Docs, Notion, or any other source outside ArtifactBridge.

You can delete your account yourself in Settings → Account. You can delete a workspace you own in the workspace settings danger zone. Both deletions start a grace period during which you can cancel them: 30 days for an account, 7 days for a workspace. After the grace period we permanently remove the data from our live systems and keep only a deletion record that contains step names, counts, and timestamps. Three kinds of copy remain for a limited time after that: our database backups, until the backup window ends; our service providers' own operational logs, until their retention period ends; and payment and invoice records, which our payment processor and we must keep for the statutory financial record period. Funnel events and the visitor IP we send to PostHog remain there until PostHog's project retention window ends; we cannot target a person delete for those events because they have no person identifier. We may pause a deletion when the law requires us to keep the data; in that case we complete the deletion after the legal reason ends. If self-serve deletion is not available to you, you can still request deletion by contacting us at the address below.

6. Data Security

We protect your data using industry-standard measures, including encrypted credentials, hashed API tokens (we store only SHA-256 hashes of your afb_ tokens and never the raw value), OAuth 2.1 scoped access for agents, and row-level security policies on our database. No method of transmission or storage is fully secure, but we work to protect your information using reasonable technical and organizational safeguards.

7. Your Choices and Rights

• Manage connections: You can connect or disconnect Google, Notion, or Slack accounts at any time, and choose whether to keep or delete imported content on disconnect.
• Revoke agent access: API tokens and OAuth grants are revocable. You can delete tokens or deny consent requests from your settings.
• Access and deletion: You can delete your account in Settings → Account, and a workspace you own in the workspace settings danger zone. You may request access to or correction of your personal data, or deletion by another route, by contacting us.
• Notifications: You can enable or disable push notifications from your account or device settings.

If you are located in the European Economic Area, the United Kingdom, or certain other jurisdictions, you may have additional rights under applicable data protection laws, including the right to access, port, rectify, restrict, or object to processing, and the right to lodge a complaint with your local data protection authority.

8. International Transfers

Your information may be processed in countries other than your own. By using the Service, you consent to the transfer of your data to, and storage and processing of it in, those jurisdictions.

9. Children's Privacy

The Service is not directed to children under 16, and we do not knowingly collect personal information from them. If you believe we have collected information from a child, please contact us so we can delete it.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will post the revised policy on this page and update the “Last updated” date above. Material changes will be communicated through the Service or by other reasonable means.