Privacy Policy

This policy covers Orwot's website, web app, desktop and mobile apps, and API. It applies to people with a Orwot account, guests who join a meeting or receive an invite, and visitors to our website.

For content inside a workspace, the workspace owner decides who can see it. We process that content on the workspace's behalf, to provide the service.

Account information

• Your name, email address, and profile picture if you add one.
• Your password, stored only as a one-way hash. We never see it in plain text.
• Two-factor authentication settings and backup codes, if you turn them on.
• Which version of these policies you accepted, and when.

Content you create

• Tasks, projects, comments, documents, diagrams, files, chat and direct messages, and calendar events.
• Names and email addresses of people you invite to a workspace or a meeting.

Video calls

• Audio, video and screen shares are sent in real time through our video servers. We do not record calls, unless the call's host turns on meeting notes. See Meeting notes and recording.
• We store details about each call: the room, who started it, start and end times, and names given by people asking to join.

Usage and security data

• IP address, browser or device type, and login times.
• An activity log of important actions, such as creating or deleting items, downloading files and changing members. Workspace admins can see the log for their workspace.

Device data

• A push notification token, if you allow notifications. It lets us deliver alerts to your device.

Billing data

• Your plan and subscription status. Payments are handled by Lemon Squeezy. We never receive your full card number.

Data from integrations you connect

• If you connect services such as Google Calendar, Outlook, Slack, GitHub or Calendly, we receive the data needed to sync with them. For example: calendar events and attendee emails, messages in channels you bridge, or issues and pull requests.

• To run Orwot: store and sync your content, deliver messages and calls, and send notifications.
• To send service emails: account verification, password resets, workspace invitations and meeting invites.
• To keep accounts and workspaces secure, prevent abuse and investigate problems.
• To process payments and manage your plan.
• To meet legal obligations.

We do not sell your data, do not use it for advertising, and do not use your content to train AI models.

Orwot has optional AI features, such as catch-up summaries, help writing documents, task suggestions, Ask Orwot and workflows with AI steps. AI is off by default. A workspace owner or admin decides whether to turn it on for their workspace. When AI is off, none of the content below is sent to an AI provider.

What AI processes, when it is on

• When you use an AI feature, we send the content that feature needs to an AI provider. For example: the document you ask it to rewrite, the task you ask it to fill in, or the question you ask Ask Orwot. It only uses content you are allowed to see.
• In the background, AI looks at new tasks, task comments and to-dos to offer suggestions, such as a priority, an assignee, a possible duplicate, or a to-do for someone you mentioned. Suggestions never apply themselves: nothing changes until a person accepts one.
• Workflows that a member sets up with AI steps send the item the workflow is working on to an AI provider, with the permissions of the member who last changed the workflow.
• Chat messages, only in channels and direct messages where AI is on (see below).
• Meeting audio and transcripts, only when the host of a call turns on meeting notes (see Meeting notes and recording).

AI in chat

Messages are encrypted when we store them. For AI to read a message, our servers decrypt it and send its text to an AI provider. Because of this, chat has extra switches, and all of them are off by default:

• A workspace owner or admin must first allow AI in chat for the whole workspace.
• Channels: the channel owner or a workspace owner or admin turns AI on for that channel. Members are not asked one by one, but everyone is told: a message is posted in the channel saying who turned it on or off. If you do not want AI to read your messages in a channel, you can ask the owner to turn it off, or leave the channel.
• Direct messages: AI reads a direct message only after every person in it has accepted. We record which version of this policy each person accepted. Any person in it can turn AI off again at any time, for everyone in it.
• Never processed: messages from guests and other people who are not members of the workspace, messages copied in from connected services (for example a bridged Slack channel), and support channels.

In a channel, what AI produces (for example labels on messages, catch-up summaries and possible decisions) can be seen by every member of that channel.

What we store

• Usage records for every AI request: who made it, which feature and model, its size and cost. They do not contain your content. We use them to count AI credits against your plan.
• Suggestions and labelsthat AI made, and whether someone accepted or dismissed them. Labels on chat messages do not store the message text, except a short excerpt for a "possible decision" or a message that "needs your reply". For suggestions about tasks and to-dos, we may keep the text the AI looked at, to measure how accurate the suggestions are.
• The decision log of a conversation, if members pin decisions to it. It is encrypted when stored.
• Text that AI writes for you, such as a summary, a sprint summary or your daily digest, and any feedback you give on it (thumbs up or down, and an optional comment).

Turning AI off

• Turning AI off for a channel, a direct message or the whole workspace stops new processing right away. Messages sent while it was off are not processed later.
• When you turn it off, you choose whether to keep or deletethe AI labels already made. Kept labels can be deleted later with "Delete AI labels" in the channel, direct message or workspace settings.
• You can delete the AI labels made from your own messages at any time with "Delete labels made from my messages" under Profile › AI.

AI providers do not train on your content

We use our AI providers (listed under Who we share data with) on terms under which they do not use your content to train their models. They process it only to answer our request, and may keep it for a limited time where their terms allow, for example to detect abuse.

Meeting notes are an AI feature that records a call to write a summary, decisions and action items.

• Off by default. A workspace owner or admin must allow meeting notes for the workspace, and AI must be on.
• Only the host of a call can start or stop recording.
• Everyone is told, and this cannot be turned off: a banner and a REC badge in the call, a notice before joining for guests and people who join late, and a message in the call's channel.
• If you do not want to be recorded, you can leave the call. Guests' speech in a recorded call is included in the transcript.

What happens to the audio

• A "Orwotnotes" participant joins the call and sends what each person says to a speech-to-text provider. With live transcription, only speech is sent and no audio is stored.
• Otherwise, short pieces of audio are stored briefly, sent to a speech-to-text provider, and deleted as soon as they are transcribed.
• Transcripts are encrypted when stored and deleted after the period the workspace chooses: 30, 90 (the default) or 365 days, or kept until deleted.
• The notesbecome a normal document, shared with the people in the call and the members of the call's channel. Action items are offered to people as suggested to-dos; nothing is created until they accept.

• Contract: to provide the service you signed up for.
• Legitimate interests: to keep Orwot secure and improve its reliability.
• Consent: for push notifications and connected integrations. You can withdraw consent at any time.
• AI features and meeting notes: the workspace decides to use them, and we process that content on its behalf. The workspace is responsible for having a legal basis and for informing its members. For AI in a direct message, we also ask every person in it to accept.
• Legal obligation: for example, tax records for payments.

Your workspace:other members can see content according to the workspace's settings. Owners and admins can manage members and see the activity log.

Service providers process data for us only to run Orwot:

• Hosting and database providers. Our servers store your account and workspace data.
• Amazon Web Services (S3), for file storage.
• Pusher, or our own real-time servers, for live updates and chat delivery.
• Google Firebase Cloud Messaging, for push notifications.
• Resend or useSend, for sending emails.
• Lemon Squeezy, for payments, as merchant of record.
• Composio, for connecting the third-party integrations you choose.

AI providers receive content only when AI features are on, as described in AI features:

• Anthropic (Claude), for summaries, writing help, Ask Orwot and the in-app assistant.
• Google (Gemini), for the same kinds of text features, and for turning meeting audio into text when live transcription is not used.
• Deepgram, for live transcription of meeting notes.
• TypeSafe AI (Jev), for suggestions and decisions, such as labelling messages or suggesting a task's priority. It does not write text.

We may also share data if the law requires it, to protect people's safety or our rights, or as part of a merger or acquisition. If that happens, this policy will continue to apply.

Essential cookies keep you signed in and protect your account. They are always on, because Orwot cannot work without them. Your browser or app also saves a few preferences on your device: your theme, your push notification token, which banners you have dismissed, and your cookie choice.

Optional analytics cookies are used only if you allow them. We do not use advertising cookies.

On your first visit to our website, we ask for your choice. You can change it at any time using "Cookie settings" at the bottom of any page. We keep your choice for 12 months, then ask again. The desktop and mobile apps use only essential storage.

• We keep account and workspace data while your account or workspace is active.
• When you delete content or your account, we remove it from our active systems. Backup copies are cleared on a rolling basis.
• We keep security logs and billing records for as long as needed for security, accounting and legal purposes.
• AI labels and suggestions are kept until they are deleted: by turning AI off with "delete", with "Delete AI labels", or with "Delete labels made from my messages". AI usage records are kept with billing records.
• Meeting audio is deleted as soon as it is transcribed, or never stored. Transcripts are deleted after the period the workspace chooses. Meeting notes documents are kept like any other document.

Depending on where you live, you may have the right to:

• access the personal data we hold about you, and get a copy of it;
• correct inaccurate data;
• delete your account and data;
• object to or restrict certain processing;
• withdraw consent you have given.

For AI, you can also turn AI off in a direct message at any time, and delete the AI labels made from your messages under Profile › AI.

To use these rights, email [email protected]. We will reply within 30 days. You can also complain to your local data protection authority.

We protect your data with encrypted connections (HTTPS/TLS), hashed passwords, optional two-factor authentication, access controls and audit logging. No system is perfectly secure. If a breach affects your personal data, we will notify you as the law requires.

Our providers may process data in countries other than yours. When data leaves the EEA or UK, we rely on safeguards such as Standard Contractual Clauses.

Orwot is not for children under 16, and we do not knowingly collect their data. If you believe a child has given us personal data, contact us and we will delete it.

If we make significant changes, we will update the date at the top and notify you by email or in the app before they take effect.

Questions or requests about your privacy? Email us at [email protected].