Privacy Policy

At Any Enterprises, Inc. d/b/a AnyTeam (“AnyTeam,” “we,” “us,” or “our”), we respect your privacy and are committed to protecting personal information. This Privacy Policy explains how we collect, use, share, and protect information when you use our websites, desktop applications, and services (collectively, the “Services”).

Key points

• Agent-powered product: our AI features can process meeting transcripts, summaries, connected-account data, and other content you provide or authorize, in order to deliver the Services.
• Sensitive data rules: meeting transcripts/summaries, audio, and similar content are treated as sensitive and governed by the “Sensitive Data & Agent Execution” section below (Section 6). Where this policy discusses logging/analytics/AI processing generally, Section 6 is authoritative for sensitive data.
• No sale or cross-context behavioral advertising sharing: we do not sell personal information or share it for cross-context behavioral advertising.

---

1. Scope and roles (Controller vs. Processor)

This Privacy Policy applies to personal information we collect when you use the Services.

• Individual customers / self-managed workspaces: AnyTeam typically acts as a data controller for personal information processed to provide the Services.
• Business/enterprise workspaces: if your organization provides you access to AnyTeam, your organization may be the data controller for certain content and connected-account data (for example, meeting content, emails, calendar entries, CRM records). In those cases, AnyTeam generally acts as a processor/service provider on behalf of that organization, and your organization’s policies may also apply.
• Our own business operations: even for an enterprise workspace, AnyTeam may act as a controller for personal information it processes for purposes it determines, such as managing its website, business contacts, billing, and its own account administration. The role depends on the particular data and purpose, not solely on whether a user belongs to an enterprise workspace.

---

2. Information we collect

The table below describes the categories of personal information we process, examples, sources, purposes, and categories of recipients for business-purpose disclosures. Collection and disclosure depend on the features you enable, permissions you grant, and services you connect.

Categories disclosed for a business purpose: the categories above may be disclosed to the listed recipients when needed for the applicable feature or service. Categories sold: none. Categories shared for cross-context behavioral advertising: none. The named providers are described in Section 4.1; no provider receives every category for every user.

Important notes

• Permissions: desktop access to microphone/system audio and file system is governed by OS permissions and in-app settings. We only process these data types when the corresponding permission/feature is enabled.
• Data minimization: we aim to collect and process only what is necessary to provide the Services.

---

3. How we use information

We use information for the following business and commercial purposes:

• Provide, operate, and maintain the Services, including transcription, summarization, drafting, analysis, and agent-driven workflows
• Authenticate and authorize access, including workspace and role-based access controls
• Execute actions you request or approve (e.g., creating calendar events, drafting/sending emails, updating CRM records) where offered and enabled
• Security and fraud prevention, including detecting misuse and enforcing our terms
• Debugging and reliability, including investigating errors, monitoring system performance, and fixing issues
• Customer support and communications
• Legal compliance and responding to lawful requests

---

4. How we share information

We may share information with:

• Service providers / subprocessors that help us provide the Services (for example: hosting, infrastructure, identity/authentication, security, observability/error tracking, customer support, transcription, AI processing, notifications/push delivery). Contracted providers may process information solely to deliver enabled AnyTeam services, not for their own independent purposes.
• Third-party services you connect (for example, Google Workspace, Microsoft 365, Salesforce/HubSpot, and other integrations), consistent with the permissions you grant.
• Payment processors (for example, Stripe) to process payments.
• Legal and safety recipients where required by law or where we believe disclosure is necessary to protect rights, safety, or security, investigate fraud, or enforce our terms.
• Business transfers in connection with a merger, acquisition, reorganization, or sale of assets.

We do not sell personal information or share it for cross-context behavioral advertising.

4.1 Primary subprocessors

We use certain third-party service providers (“subprocessors”) to help us operate the Services. Depending on the features you enable, these subprocessors may process personal information (including sensitive data as defined in Section 6) on our behalf and under contractual confidentiality and security obligations.

Our primary subprocessors include:

• Clerk: authentication, session management, and identity services.
• Google Cloud Platform (GCP): cloud infrastructure, hosting, storage, and related processing, including Google Cloud Vertex AI where enabled.
• MongoDB Atlas: managed database infrastructure used to store certain application data.
• Anthropic: AI processing for Claude language-model features, including when accessed through Google Cloud Vertex AI where enabled.
• OpenAI: AI processing for language-model features (where enabled).
• AssemblyAI: transcription and related speech-to-text processing (where enabled).
• Perplexity: AI processing for research and search-oriented model features (where enabled).
• ElevenLabs: text-to-speech and related voice synthesis features (where enabled).
• Langfuse: LLM observability, tracing, and related debugging/reliability workflows (where enabled).
• Sentry: error tracking, crash reporting, and related diagnostics (where enabled).
• Mixpanel: product analytics and usage measurement (where enabled).
• Composio: connected-account authorization and selected integration inputs and results (where enabled).
• Firebase / Firestore: real-time backend, notification, and related application support services used by certain current or legacy product flows.
• Mailchimp / Mandrill: transactional email delivery and related messaging workflows.
• Apple Push Notification service: push notification delivery where enabled.

This published inventory is intended to reflect current operational reality, including legacy service providers that may still process user or customer data today. It does not define the SOC 2 security-readiness boundary for this repository.

We may add or replace subprocessors over time to operate or improve the Services. We will update this Privacy Policy (or otherwise provide notice) as appropriate when we make material changes.

---

5. AI processing, providers, and training

5.1 AI processing providers

Some features may send relevant content to third-party AI processing providers (such as OpenAI, Anthropic, Google Cloud Vertex AI, and Perplexity) to generate outputs (for example, summaries, research results, or drafts), when enabled. We aim to minimize what we send and apply controls described in Section 6 for sensitive data.

Our agreements with third-party AI providers prohibit them from using Your Data or Customer Data to train or fine-tune their models. We configure the shortest retention period available for customer data on each AI provider platform we use. The available setting may differ by provider and service.

5.2 Training

• Model training: we do not use Your Data or Customer Data to train or fine-tune models. This is a continuing commitment to customers and users who agree to terms containing it.
• Product improvement: we may use service usage data, diagnostics, feedback, and aggregated or de-identified usage and performance insights to improve the Services. Where the applicable agreement and third-party terms permit it, we may also use the substance of prompts, conversations, transcripts, recordings, files, connected-service records, or other user or customer content for product improvement only after the individual user or, for an enterprise workspace, the Customer separately and affirmatively opts in for that purpose. Accepting terms or using the Services is not an opt-in. An opt-in may be withdrawn for future product-improvement use by contacting privacy@anyteam.com; withdrawal does not undo improvements already made. Data derived from content that reveals its substance is subject to the same opt-in requirement, including when such content is submitted with feedback.
• Third-party platform restrictions: if a connected Third-Party Platform (such as Google APIs) prohibits certain uses (including model training), we will not use that platform’s data for those prohibited purposes.

5.3 Google API user data compliance

If you connect AnyTeam Services using Google APIs (including Google Workspace, OAuth, or other Google services), our access, use, storage, and transfer of Google user data is intended to comply with the Google API Services User Data Policy (including Limited Use requirements), available at:

https://developers.google.com/terms/api-services-user-data-policy

In practice, this means we use Google user data only to provide or improve user-facing features in AnyTeam, and we do not use Google user data for advertising, personalized marketing, or model training.

5.4 On-device vs. cloud execution

Some processing may occur in the cloud and some may occur locally on your device. Regardless of where processing occurs, sensitive data is governed by Section 6.

---

6. Sensitive Data & Agent Execution (Authoritative)

This section describes our privacy posture for sensitive data and for agent-based execution (including tool use, approvals, and evidence).

6.1 What we treat as sensitive data

For purposes of our product and operational controls, we treat the following as sensitive:

• meeting transcripts, summaries, and related meeting content
• audio recordings (microphone/system audio) and derived transcripts
• email content, documents, and file contents you upload or authorize
• other content that could reasonably contain confidential, personal, or regulated data

6.2 Purpose limitation

We process sensitive data only to provide the features you request or enable (for example: transcription, summarization, drafting, research, and actions you approve), and for security/reliability purposes that are necessary to operate the Services.

6.3 Consent and approvals

• Desktop capture (audio/files): we require explicit user-granted device permissions and feature enablement before collecting or processing desktop audio or file access.
• High-risk actions (for example: sending email, creating calendar events, updating CRM records): we require user confirmation/approval where applicable, and we record approval outcomes for auditability.

Processing location depends on the device and enabled feature. On supported Apple Silicon desktops, microphone and system audio are processed on-device for transcription. On supported x64 macOS and Windows desktops, microphone and system audio are sent to AssemblyAI for transcription. Other enabled features may send relevant content to contracted AI providers solely to provide the requested feature. We minimize information sent to providers where feasible.

6.4 Logging and analytics restrictions for sensitive data

We design our systems to avoid placing sensitive content into telemetry, analytics, or error logs.

• No sensitive-content analytics by default: analytics events should not include raw transcript text, email bodies, or documents.
• Crash/error reports: when crash/error diagnostics are collected, we aim to avoid including sensitive content. Where any diagnostic payload could contain sensitive data, access is restricted and retention is limited.

For operational observability and debugging of agent execution, we may retain limited, highly filtered, and redacted fragments of prompts, tool inputs/outputs, or agent events in observability and tracing systems (for example, Langfuse and related supporting infrastructure). We do not intentionally log full transcripts, full email bodies, or full document contents into analytics systems.

6.5 Agent runs, tools, and audit records

To operate agent workflows safely, the Services may create operational records such as runs, steps, tool calls, policy/approval decisions, and artifacts (for example, generated drafts and evidence needed to debug a tool call).

These records are used for:

• providing the requested feature (e.g., streaming a response, generating a summary/draft)
• enforcing policies and approvals (preventing unauthorized actions)
• security, abuse prevention, and incident response
• reliability and debugging

Access to these records is restricted by role-based access controls.

6.6 AI providers and sensitive data

Where sensitive data is sent to third-party AI processing providers (Section 5.1), we do so only when necessary to provide enabled features, and we apply minimization and access controls consistent with this Section 6.

---

7. Data retention

We retain personal information for as long as reasonably necessary to provide the Services, for legitimate business purposes (such as security and fraud prevention), and to comply with legal obligations.

Retention depends on the category of data and your settings (and, for enterprise customers, organizational configurations). Examples:

• Audio data: audio used for transcription is generally processed and deleted after transcription, typically within 24 hours, subject to operational needs, legal requirements, and configuration.
• Transcripts and summaries: retained to provide ongoing service functionality unless deleted by you/your organization or limited by configured retention.
• Agent traces and observability logs: we may retain limited, highly filtered, and redacted agent traces (for example, in Langfuse or related supporting observability infrastructure) for security, reliability, and debugging, generally for up to 90 days.
• Uploaded documents and files: we generally do not store complete original files permanently unless necessary for ongoing service functionality; derived outputs (summaries/insights) may be retained as part of your workspace.
• Diagnostics and security logs: retained for a limited period to maintain service reliability and security.

Where permitted and appropriate, we may retain information in aggregated or de-identified form.

Captured Device Data is collected only when you enable the relevant feature and for the duration necessary to provide that feature, subject to your settings and applicable law.

---

8. Your choices and controls

Depending on your plan, workspace configuration, device permissions, and applicable law, you may be able to:

• Manage desktop permissions (microphone/system audio and file access) via OS and in-app settings.
• Connect or disconnect integrations and revoke third-party access.
• Control AI processing modes where offered (for example, enabling/disabling certain cloud processing features).
• Control analytics/telemetry where offered and required (including cookie preferences on the web).
• Access, export, and delete data through in-app controls (where available), account deletion tools, or by contacting us (see Section 12).

If you are using AnyTeam through your employer or another organization, some controls may be managed by your organization.

---

9. Recording laws and user responsibilities (audio/system audio)

If you enable audio capture (including system audio), you are responsible for complying with applicable laws and obtaining any required consents from meeting participants. Recording consent requirements vary by jurisdiction and may require consent from all participants.

AnyTeam provides technical capabilities; we do not monitor or guarantee your compliance with recording laws.

---

10. Security

We implement reasonable technical and organizational measures designed to protect personal information against unauthorized access, disclosure, alteration, and destruction. These measures may include encryption in transit and at rest, access controls, monitoring, and secure development practices.

No security program can be guaranteed to be 100% secure, and you use the Services at your own risk.

---

11. International transfers

We may process and store information in the United States and other countries. If you are located in the EEA/UK/Switzerland or other regions with cross-border transfer restrictions, we use appropriate safeguards such as Standard Contractual Clauses where required.

---

12. Privacy rights (GDPR/UK GDPR/Swiss, CCPA/CPRA, and others)

Depending on where you live, you may have rights to:

• Access your personal information
• Correct inaccurate personal information
• Delete personal information (subject to exceptions)
• Export/port your information
• Object to or restrict certain processing
• Withdraw consent where processing is based on consent

How to exercise your rights

Email us at privacy@anyteam.com with your request, or use any in-app controls provided. We may need to verify your identity before fulfilling a request.

If you use AnyTeam through an enterprise workspace, your organization may need to submit or coordinate certain requests.

---

13. Children’s privacy

The Services are not intended for children under 16, and we do not knowingly collect personal information from children under 16.

---

14. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. If we make material changes, we will update the “Last Updated” date and provide additional notice as required by law.

---

15. Contact

Any Enterprises, Inc. 541 Jefferson Ave., Ste 100 Redwood City, CA 94063

Email: privacy@anyteam.com