Privacy Policy

1. Information We Collect

Account information

When you create an account, we collect your name and email address. You may sign in with Google, in which case Google shares the basic profile information (name and email) you authorize with us. You may also sign up with an email address and password.

Connected source data

When you connect a Google Drive / Google Docs account, a Notion workspace, or a Slack workspace, we retrieve and store the documents and content you choose to sync, along with document metadata such as the file name, modification time, version, revision identifiers, view links, and comments associated with those documents.

Document and collaboration content

We store the managed documents, versions, folders, workspaces, comment threads, review requests, proposals, and audit records you and your agents create or import within ArtifactBridge.

Agent and integration data

When an AI agent (such as Claude) connects through our MCP server, we record scoped API-token activity, agent tool calls, and consent decisions. If you enable push notifications we store device tokens needed to deliver them.

Usage and technical data

We collect logs, metadata, and similar technical information about your use of the Service, including authentication events, IP address, browser type, and access times for security, reliability, and auditing.

2. How We Use Your Information

• To provide, operate, and maintain the Service, including syncing documents to and from your connected sources.
• To create, store, version, and organize your managed documents and artifacts.
• To authenticate you and authorize AI agents to act within the workspaces you grant them access to.
• To communicate with you about your account, security, and the Service.
• To monitor and prevent fraud, abuse, and security incidents.
• To comply with our legal obligations.

3. Google API Data and Limited Use

ArtifactBridge's access to and use of information received from Google API Services complies with the Google API Services User Data Policy, including the Limited Use requirements. We only request the scopes necessary to read and export the Google Docs you choose to sync. We do not use Google API data for advertising, and we do not transfer or sell it to third parties for that purpose.

4. How We Share Information

We do not sell your personal information. We share data only as described below:

• Service providers: We use trusted infrastructure and integration providers that process data on our behalf, including Supabase (database hosting), Cloudflare (application and static-site hosting), and Pipedream (which brokers your authorized connections to Google Drive and Notion). These providers are bound by obligations to protect your data and use it only to provide their services to us.
• Integrations you authorize: When you connect Google Docs, Notion, or Slack, we exchange data with those services to the extent necessary to perform the sync and collaboration features you requested.
• Within your workspaces: Members of a workspace you belong to may see documents, comments, and activity you create there, in accordance with workspace membership and permissions.
• Share links: If you create a share link, anyone with the link may view the shared document according to the visibility you set.
• Legal requirements: We may disclose information when required by law, court order, or to protect the rights, property, or safety of ArtifactBridge, our users, or others.

5. Data Retention

We retain your information for as long as your account is active or as needed to provide the Service. Imported external document content is retained until you delete the document or choose to delete content when disconnecting a backing Google or Notion account. Comment history and audit records may be retained as conversation and system history even after document content is removed. Disconnecting or deleting an account inside ArtifactBridge never edits, archives, or deletes the original document in Google Docs, Notion, or any other source outside ArtifactBridge.

You can request deletion of your account and associated data at any time by contacting us at the address below.

6. Data Security

We protect your data using industry-standard measures, including encrypted credentials, hashed API tokens (we store only SHA-256 hashes of your afb_ tokens and never the raw value), OAuth 2.1 scoped access for agents, and row-level security policies on our database. No method of transmission or storage is fully secure, but we work to protect your information using reasonable technical and organizational safeguards.

7. Your Choices and Rights

• Manage connections: You can connect or disconnect Google, Notion, or Slack accounts at any time, and choose whether to keep or delete imported content on disconnect.
• Revoke agent access: API tokens and OAuth grants are revocable. You can delete tokens or deny consent requests from your settings.
• Access and deletion: You may request access to, correction of, or deletion of your personal data by contacting us.
• Notifications: You can enable or disable push notifications from your account or device settings.

If you are located in the European Economic Area, the United Kingdom, or certain other jurisdictions, you may have additional rights under applicable data protection laws, including the right to access, port, rectify, restrict, or object to processing, and the right to lodge a complaint with your local data protection authority.

8. International Transfers

Your information may be processed in countries other than your own. By using the Service, you consent to the transfer of your data to, and storage and processing of it in, those jurisdictions.

9. Children's Privacy

The Service is not directed to children under 16, and we do not knowingly collect personal information from them. If you believe we have collected information from a child, please contact us so we can delete it.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will post the revised policy on this page and update the “Last updated” date above. Material changes will be communicated through the Service or by other reasonable means.