This page explains how Artie handles information when you connect tools such as Gmail and Slack. It summarizes our existing practices and does not create new commitments. Your agreement with us, the Data Processing Agreement and our Privacy Policy govern how we process data; if this page differs from them, those documents control. Our Security page describes the related controls.
1. Information Artie can access
When you connect Gmail, Slack or another supported tool, Artie processes information within the scope you authorize for the work you delegate. For email and messaging, this can include messages, participants, threads, attachments, and results returned by connected tools. See Privacy Policy section 2.
The connected app and the account permissions you grant govern what Artie can read, change or send. Available permissions differ by app and provider, so we do not claim that every app offers the same granular scopes. Limit permissions in the connected tool when an action must be technically restricted.
Artie also creates its own records, including Outputs such as drafts and task results, task history, execution logs, memory, and indexes that help locate permitted information. These records are separate from the source content in Gmail or Slack and can have different controls and retention.
2. How information is used
Artie uses information to carry out your requests and standing delegation, including work Artie performs within that delegation when no one is actively chatting. Relevant context is sent to model and tool providers to generate answers and complete tasks.
We also use information for support, security, billing and assessing the quality of the service delivered to you. These uses are part of providing the service and are distinct from the optional improvement described in section 5. See Privacy Policy section 3.
We do not use private workspace content, connected email or documents, credentials or private Outputs to select advertisements for unrelated third-party products.
3. Providers and processing locations
Our Privacy Policy section 7 names the providers in our architecture: Amazon Web Services for backend infrastructure, Vercel for web delivery, OpenRouter for access to permitted downstream model providers, Pipedream for supported managed integrations, and Infisical for designated secrets custody. Research, speech, transcription and other specialist providers vary by feature.
Sending context to a model provider for inference is not permission for that provider to train general-purpose models on identifiable or confidential content. Provider logging, retention and processing locations vary by route and feature. See Privacy Policy section 4.
Our infrastructure includes AWS hosting in the United States. That is not a promise that every copy, inference request or human access remains in the United States. See Privacy Policy section 14.
Applicable subprocessor details and change procedures are available through the Artisan trust center and the Data Processing Agreement.
4. Who can see information
Workspace access depends on roles and sharing settings. Ordinary nonsensitive business facts explicitly shared in a direct message may become shared company knowledge that authorized Artisans or workspace members can reuse. Raw direct-message conversations and member-private preferences remain restricted to their appropriate scope, and sensitive or restricted matters are not treated as ordinary shared knowledge.
Our authorized employees and contractors may access relevant content, task records and diagnostic information when reasonably needed for operations, support, security or legal purposes. Access is limited by purpose, role, confidentiality obligations, applicable agreements and source restrictions. This necessary access is not offered as a blanket account-level opt-out and is not controlled by the improvement opt-out. See Privacy Policy section 5.
5. AI training and improvement
We do not authorize general model training on identifiable or confidential content.
Where law, contracts and source restrictions allow, eligible information may be used to create genuinely anonymous data for evaluation, research, system improvement and model training. This optional use is on by default where permitted. Workspace administrators can opt out through an in-product control where one is available or by contacting hello@artisan.co.
Once effective, an opt-out stops new selection of workspace data for this use. It cannot necessarily remove a contribution already irreversibly anonymized or undo training already lawfully completed.
Covered Google Workspace data, including derived or anonymized forms, is excluded from generalized model training. Slack and other sources may impose narrower rules, and we apply them.
Processing needed for your own work continues after an opt-out, including answering your requests, maintaining your workspace memory, and necessary support and security.
6. Retention and deletion
We keep information for as long as reasonably needed for its purpose, considering your instructions, source restrictions, contracts and legal duties. Persistent memory does not mean unlimited retention. See Privacy Policy section 9.
When the relevant service ends, customer data is returned or deleted under the Data Processing Agreement, ordinarily within an outer limit of 90 days, with limited exceptions for protected backup copies and legally required retention. Shorter legal deadlines or source requirements control where they apply.
Deletion is not instant. Deletion from live systems may come before protected backup copies expire, and we cannot delete a separate copy held by a recipient or independent provider by removing our copy.
7. Your controls and contact
Stopping or pausing work prevents further steps, but it does not undo actions already submitted to another service, retract a delivered message or reverse a completed change.
Disconnecting an app withdraws usable access through that connection. It does not delete stored records or cancel your plan. Revoking access directly with the provider, such as Google or Slack, may be a separate step. See Privacy Policy section 10.
Source content, memory, Outputs, and copies held by recipients or external services are separate. Deleting one does not automatically delete the others.
For questions or requests, contact hello@artisan.co. Do not send passwords, API keys or other secrets by email or chat.