Privacy Policy

1. Who This Policy Applies To

This policy applies to business customers and their authorized users who access Floppy. Floppy is a B2B product — we do not knowingly collect data from consumers outside of a business context. If you are a California consumer seeking rights under CCPA, please contact us at hello@seriouspeople.ai.

2. What Data We Ingest

Floppy ingests business content that you explicitly connect via our connector system. Depending on which connectors you authorize, this may include:

• Email — Subject lines, senders, recipients, and body content of messages you choose to sync.
• Calendar — Event titles, attendees, descriptions, and scheduling metadata.
• Meeting transcripts — Transcribed audio from meeting recordings synced via authorized integrations (e.g., Granola).
• Documents — Text content of files shared via authorized document integrations (e.g., Google Drive).
• Messaging — Messages from authorized workspace channels (e.g., Slack).
• Task and project data — Task titles, descriptions, comments, and status from authorized project management tools (e.g., ClickUp).

You control what is ingested. We only process data from connectors you explicitly authorize.

3. Account and Usage Data

We also collect:

• Account data — Email address, name, and organization name provided at registration via WorkOS.
• Usage data — Feature interactions, query logs (without content), error logs, and aggregate usage metrics. This helps us improve the Service.
• Analytics — Anonymized page-view and performance data via Vercel Analytics and Speed Insights.

4. How Your Data Is Used

We use your data exclusively to:

• Build and maintain your team's private knowledge base — deriving assertions, summaries, and sourced recall from the content you ingest.
• Power the AI recall and agent features you request within the Service.
• Authenticate users and manage workspace access.
• Debug errors and improve Service reliability.
• Communicate with you about the Service (security notices, product updates, beta program communications).

We do not sell your data. We do not share your Customer Data with third parties except as described in Section 6 (Subprocessors) or as required by law.

5. LLM Processing and Model Training

Floppy uses large language models (LLMs) to extract knowledge from your ingested content. Prompts sent to LLM providers may include excerpts of your Customer Data.

Anthropic does not train its models on Customer Data submitted via the commercial API. Anthropic's commercial API does not use inputs or outputs for model training without express permission.

Anthropic retains API inputs and outputs for up to 30 days for safety and abuse-monitoring purposes, after which they are deleted. We do not currently have Zero Data Retention (ZDR) enabled with Anthropic; the standard 30-day retention window applies.

6. Subprocessors

We use the following third-party subprocessors that may process your Customer Data on our behalf:

We will notify you before adding new subprocessors that process Customer Data.

7. Data Storage and Retention

Customer Data is stored on Google Cloud Platform (Cloud SQL) in the us-central1 region. Data is encrypted at rest and in transit (TLS 1.2+).

We retain Customer Data for the duration of your account. Upon account termination or deletion request, Customer Data is deleted from active production systems within 30 days. Aggregate, anonymized usage metrics may be retained beyond this period.

8. Security

Serious People implements commercially reasonable technical and organizational controls, including:

• Encryption at rest and in transit.
• Row-level multi-tenant isolation so one customer's data is not accessible to another.
• OAuth credential management via Nango, with no raw tokens stored by Serious People.

We do not guarantee absolute security. Please use the principle of least-privilege when authorizing connector scopes.

9. Your Rights and Choices

You have the right to:

• Access — Request a copy of the Customer Data we hold about your account.
• Correction — Request correction of inaccurate personal data.
• Deletion — Request deletion of your Customer Data. We will process requests within 30 days.
• Connector disconnection — Disconnect any integration at any time from the Connectors settings page. This stops future ingestion; existing ingested data is retained until you request deletion.
• Export — Contact us to request an export of your ingested data.

To exercise any of these rights, email hello@seriouspeople.ai.

Floppy is offered to United States–based business customers. The Service and its subprocessors store and process Customer Data in the United States. We do not currently offer the Service to customers in the European Union or United Kingdom.

10. Cookies and Tracking

The Service uses session cookies required for authentication and operation. We do not use advertising or behavioral-tracking cookies. Vercel Analytics collects anonymized, aggregate performance metrics that do not identify individual users.

11. Children's Privacy

The Service is not directed at or intended for individuals under 18. We do not knowingly collect personal data from minors.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via email or in-app notice at least 14 days before the changes take effect. The effective date at the top of this page will be updated.

13. Contact

Questions, requests, or concerns about this Privacy Policy? Contact us at hello@seriouspeople.ai.