Privacy Policy

This policy explains what Actori collects, why, who else sees it, and what you can ask us to do about it. It covers the Actori console and the agent-governance service behind it. We do not sell your data and never will.

The service is operated by Aonuva Inc., a Delaware corporation, 548 Market St, PMB 70733, San Francisco, CA 94104-5401, United States. For anything in this policy, write to privacy@aonuva.com.

Who is responsible for your data

Your account data — your email address, name, picture, sign-in history and the audit record of what you did in the console — is ours to look after in every case. We decide how it is handled and are the controller of it.

The content your agents move — the parameters they send and the responses they receive — is different. If you signed up yourself and use a personal account, we are the controller of that too. If your organisation created the account, the organisation decides what the service is used for and what flows through it: it is the controller, and we process that content on its instructions, as its processor. Ask them about anything concerning your agents' activity — we cannot change or delete their records on your say-so alone. The terms on which we act for them are in the Terms of Service, under “Processing on your behalf”.

What we collect

Your account. Your email address, display name and profile picture. When you sign in with Google or GitHub we receive these from them; we never see your password for those services. Your name and picture are refreshed from your provider each time you sign in, so changing them there changes them here.

How you use the console. An audit record of administrative actions — who did what, when, and the IP address the request came from. This is the point of the product: it exists so that an agent's actions can be accounted for afterwards.

What your agents do. For every action an agent takes, we store the parameters it sent and the response the connected service returned. This is the content of your integrations. If you connect a mailbox, the stored response can contain the text of messages, including information about people who never used Actori. If you connect a database, it can contain rows from it. We store it because the audit trail is what the product is for, but you should treat it as a copy of whatever your agents touch and choose what you connect accordingly.

Approvals. Which person approved or rejected which action, when, and any note they wrote.

Credentials you give us. Access tokens and passwords for the services you connect. These are encrypted before they are stored. Note that this encryption covers machine credentials only — the rest of the data described on this page is not separately encrypted by the application, though the database and its backups are encrypted at rest by our hosting provider.

Correspondence. If you write to us, we keep the exchange so we have the history if you write again.

Cookies and browser storage

We use no analytics, no advertising, no tracking and no third-party scripts of any kind. Every cookie we set is needed for the service to work, so we do not ask for consent to set them:

• Your session — one cookie that keeps you signed in for eight hours. It cannot be read by page scripts.
• Sign-in protection — short-lived cookies (three to ten minutes) that protect the sign-in round-trip against forgery. They are deleted as soon as sign-in completes.
• Connecting a service — the same protection for the moment you connect a third-party integration.

Your browser also remembers, on your device only, which accounts you signed into recently, so the account picker can offer them. Nothing about that list is sent to us. You can clear it by clearing site data for this domain.

Two things your browser discloses to others while you use the console: connector logos are loaded from public icon services, and profile pictures are loaded from Google or GitHub. Those services therefore see your IP address and browser when a page shows them.

Our website

This policy also covers actori.ai, the site you may have arrived from. It sets no cookies and runs no analytics or tracking scripts. If you write to us through it, we keep the message as correspondence, as above.

Who else sees your data

Our sub-processors — the companies that handle your data so that we can run the service. There are three:

• Amazon Web Services, Inc. (United States, us-east-1) — hosting, the database and its backups, and the mail we send.
• Google LLC — sign-in, if you sign in with Google (Google tells us your verified email, name and picture), and the Google services you choose to connect, below.
• GitHub, Inc. — sign-in, if you sign in with GitHub. Likewise.

We will update this list here and notify account administrators by email before a new sub-processor handles customer content.

Only if you turn them on: the services you choose to connect, and the channels you choose to be notified through. Approval notifications carry a short preview of the action being approved, so a fragment of your agent's parameters reaches whichever channel you pick — your email provider, Slack, Telegram, WhatsApp, or a webhook you configure. If you configure an AI provider with your own key, the messages you send it go to that provider under your account with them.

When the law compels us. We disclose data to a government or court only on a legally binding order from an authority with jurisdiction over us, and only the minimum it requires. We tell the affected account before we disclose unless we are legally prohibited from doing so. We do not hand over data on an informal request.

If we are acquired. We have no plan for it, but if the business changes hands we will tell you before your data is transferred or becomes subject to a different policy.

Nobody else. No advertisers, no data brokers, no “partners”.

Data from the services you connect

If you connect a service to Actori — for example Microsoft OneDrive, Dropbox, GitLab, GitHub, Slack or a database — this is how Actori accesses, uses, stores and shares the data involved. It applies to every service you connect; Google has a section of its own, below.

Access. Only the data covered by the permissions you grant when connecting, and only when one of your agents performs an action you have allowed — the file it reads, the message it posts, the record it updates.

Use. To perform that action, to show the request to the people who approve it, and to keep the audit record of what was done. Not for advertising, and not to train any AI or machine-learning model.

Storage. The connection's access tokens, encrypted, until you delete the connection in the console. The arguments and results of each action, in the audit trail, for as long as the account exists (see “How long we keep it”).

Sharing. The result of an action goes to the agent that requested it, which runs on the AI model you configured. Approval notifications carry a short preview of the request to the channel you configured. No one else, beyond the sub-processors listed above.

You can also withdraw Actori's access at the service itself, in its list of connected or authorized apps; the connection then stops working until you connect it again.

Google user data

If you connect a Google account to Actori — Gmail, Calendar, Drive, Sheets, Docs, Slides, Forms, Tasks, Contacts, Meet or Chat — this is how Actori accesses, uses, stores and shares the Google data involved.

Access. Only the Google data covered by the permissions you tick when connecting, and only when one of your agents performs an action you have allowed — the email it sends, the events it reads, the rows it writes.

Use. To perform that action, to show the request to the people who approve it, and to keep the audit record of what was done. Not for advertising, and not to train any AI or machine-learning model.

Storage. The connection's access tokens, encrypted, until you delete the connection in the console. The arguments and results of each action, in the audit trail, for as long as the account exists (see “How long we keep it”).

Sharing. The result of an action goes to the agent that requested it, which runs on the AI model you configured. Approval notifications carry a short preview of the request to the channel you configured. No one else, beyond the sub-processors listed above.

Actori's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Where your data is

In the United States. We run in one region and there is currently no option to keep data elsewhere. If you are in the UK or the EEA, your data is transferred to the United States under the EU Standard Contractual Clauses and the UK Addendum to them, which form part of our Terms of Service.

How long we keep it

While your account exists: everything above is kept for as long as the account is open. There is no automatic expiry — an audit trail with holes in it is not an audit trail. Server logs are kept for 30 days and database backups for 7 days.

When your account is closed: ask us at privacy@aonuva.com. We delete the account, its members, its agents, the credentials it stored and the content its agents moved within 30 days of the request, and the copies in backups expire 7 days after that. A team account is closed by its administrator, not by an individual member; leaving a team removes your access but not the team's records of what was done in it.

Your rights

Wherever you live, we try to give you the same rights over your data:

• To know what we hold about you — this policy is the inventory.
• To see a copy of it, and to correct it.
• To have it deleted, subject to the limit below.
• To object to or restrict how it is used.
• To take it elsewhere in a usable form.
• Not to be subject to automated decisions with legal or similarly significant effect on you. The service makes none: approvals are decided by the people you configure, not by us.
• To complain to your data protection authority, if you are in the UK or the EEA.

To exercise any of them, write to privacy@aonuva.com. We will respond within one month. We may need to verify that you are who you say before acting, and if someone writes on your behalf we will need your written consent. We will never treat you differently for having asked.

What you can do yourself today, honestly: change your own name and picture at your sign-in provider, and they follow. Everything else — seeing what we hold, closing your account — is a request to us, because the self-service tools do not exist yet.

One limit worth stating plainly. Part of the audit trail is deliberately protected against modification and deletion, because a record that can be quietly altered is not an audit trail. If a record of an action taken in an organisation's account contains your personal data, we keep the record: the organisation instructed us to, and it has a legitimate interest in an intact account of what its agents did. Where we can remove or mask your personal data in it without destroying the record, we will.

If you are in California or another US state

We do not sell personal information, do not share it for cross-context behavioural advertising, and have not done either in the preceding twelve months, so there is no “Do Not Sell or Share” choice to make. We do not use sensitive personal information to infer characteristics about you. In the categories California law uses, we collect identifiers (name, email, IP address, account identifiers), professional information (your organisation and role, if you give them) and internet activity (your use of the console).

California residents may ask to know, access, correct or delete their personal information, and residents of other states with a comprehensive privacy law (Virginia, Colorado, Connecticut, Utah, Texas and others) have similar rights. Write to privacy@aonuva.com, yourself or through an authorised agent with your written permission; we will verify your identity and respond within 45 days, extending once where the law allows. Under California's “Shine the Light” law you may also ask about disclosures to third parties for their direct marketing — we make none. We will not treat you differently for exercising any of these rights.

Children

You must be at least 18 years old to use the service. It is not intended for people below that age, and we do not knowingly collect their data; if we learn that we have, we delete it.

Security

Sessions and sign-in are protected against cross-site attacks, credentials for connected services are encrypted before storage, and the database and its backups are encrypted at rest. Traffic between your browser and the service, and between the service and the systems you connect, is encrypted in transit. No system is perfectly secure; if you believe you have found a problem, write to security@aonuva.com and we will get back to you promptly.

Changes

We may change this policy. The current version is always on this page, with its date at the top. When a change is significant we will also email account administrators before it takes effect, and where the law requires your consent we will ask for it.