Privacy Policy
1. Who we are and what this policy covers
Exo is a knowledge and AI assistant service operated by SageCreek AI ("we," "us," or "our"). This policy explains how we handle information when you visit Exo, use an account, connect a service, or participate in a meeting captured by Exo. Our Terms of Service govern use of the Service.
If your employer or another organization provides your workspace, it also determines what business information may be imported and shared. Contact your workspace administrator about its internal policies. Questions or privacy requests for us can be sent to connor@sagecreek.ai.
2. Information we collect
- Account information: email address, display name, password hash, account role, invitations, and sign-in and security records. Passwords are stored as hashes, rather than readable passwords.
- Content and conversations: uploaded files, pasted text, notes, questions, AI conversations, agent requests, feedback, and the answers, facts, summaries, relationships, and other records produced from that content.
- Connected services: content and metadata from services you or your workspace authorize. Google connections can access Gmail messages and attachments, Calendar events and attendees, Drive files and metadata, and completed Meet transcripts and participant information. Slack connections can access selected channels, messages, and associated member information. Other workspace-enabled sources may include GitHub. We also store connection settings and the credentials needed to maintain authorized access.
- Meetings: meeting details, participant and speaker information, timestamps, transcripts, and capture status. When manual or calendar-based capture is enabled, Recall.ai processes meeting audio through the visible Exo Notetaker participant. Exo imports transcript text; it does not download or store meeting audio or video files in its application database.
- Technical information: session identifiers, IP addresses and request metadata available to our hosting and security systems, error and activity logs, and operational records used to diagnose problems and run the Service.
3. How we use information
We use information to authenticate users, import and organize authorized content, maintain searchable knowledge, generate embeddings and summaries, answer questions, carry out permitted agent requests, and support workspace collaboration. We also use it to maintain integrations, provide support, prevent abuse, investigate security issues, improve reliability, and meet legal obligations. We do not sell personal information or use imported content for advertising or cross-context behavioral advertising.
4. Workspace sharing and private content
Exo distinguishes account-private sources from sources shared with the workspace. In Exo, "Public" visibility means shared with authorized workspace users; it does not mean published on the open internet. Shared content and knowledge derived from it may appear in searches, answers, and tools used by those users and their authorized AI agents. Content deliberately published through a sharing feature is available according to that feature's access settings.
Review connection and source visibility before importing confidential material. New live meeting captures create a transcript shared with the workspace. Earlier private captures retain their existing visibility. A meeting participant's individual account settings do not make a new shared meeting transcript private.
5. AI processing and service providers
Relevant content, questions, and context are sent to AI providers to perform the features you use, including embeddings, extraction, summaries, and answers. Exo supports OpenAI and Anthropic; the provider used depends on the feature and model configuration. Their handling and retention of API data are subject to applicable provider terms and data controls. Google data is additionally subject to the Limited Use restrictions below.
Our service providers include Vercel for hosting, Neon for database storage, Recall.ai for meeting capture and transcription, and the AI providers described above. Connected services such as Google and Slack also process information when their integrations are used. We disclose information to providers as needed to operate the Service. Authorized personnel may access information when necessary for support, security, or legal compliance, subject to the restrictions applicable to that information.
We may also disclose information with your direction, to comply with law or lawful requests, to protect rights and safety, or in connection with a merger, acquisition, or transfer of the Service subject to appropriate privacy protections.
6. Google API data and Limited Use
Connecting Google is optional. Exo requests read-only access to the Google services you connect, plus identity information to label the connection. These permissions do not allow Exo to send email or modify or delete content in your Google account.
Exo's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Google user data is used only to provide or improve the user-facing features described in this policy. It is not sold, used for advertising, or used to train generalized artificial intelligence or machine learning models. Human access is limited to your affirmative consent for specific data, security investigations, legal requirements, or aggregated and anonymized internal operations as permitted by that policy.
7. Cookies and browser storage
Exo uses essential cookies to keep you signed in, select an account, and secure authentication and connection flows. Browser storage can remember interface preferences such as your theme. Exo does not use advertising cookies. You can clear cookies and browser storage in your browser settings; blocking essential cookies may prevent sign-in or integrations from working.
8. Retention, disconnection, and deletion
Exo is designed to keep durable work history. Imported content and derived knowledge can remain until deleted or removed under applicable workspace retention rules. Disconnecting a service stops future sync and removes Exo's stored connection credentials; it does not, by itself, delete previously imported information. Where offered, you can choose to delete imported connection data when disconnecting. Completed shared meeting transcripts are managed separately from calendar connections.
Exo requests indefinite retention of transcript artifacts for new Recall.ai captures until they are explicitly deleted. Exo does not automatically delete Recall.ai artifacts after importing a transcript. Existing captures may have different provider retention settings. Deleting a source in Exo does not itself delete the provider's copy; include provider-held artifacts in any meeting deletion request to us.
Some unaccepted connector payloads expire under connector-specific retention rules. Security, audit, operational, and backup records may be retained separately as needed for recovery, legal obligations, and legitimate security purposes. Removal from active use may occur before copies expire from backups or provider systems. We do not promise that every copy is erased immediately.
You can disconnect integrations in Exo and revoke Google access through your Google Account permissions. Exo attempts to revoke the Google grant when you disconnect; you can also revoke it directly with Google. To request account deletion or help removing content, including shared meeting or provider copies, email connor@sagecreek.ai.
9. Security and international processing
We use safeguards including encrypted network connections, password hashing, encrypted stored integration credentials, and access controls. No service can guarantee complete security. Use a unique password and keep your account and agent tokens confidential. Our providers may process information in the United States and other countries where they operate; local privacy protections may differ from those in your country.
10. Your choices and privacy rights
You can choose which services to connect, review available source and connection settings, disconnect access, and request correction or deletion. Depending on applicable law, you may also have rights to access or receive a copy of your information, restrict or object to processing, withdraw consent, or appeal a privacy decision. Contact us at connor@sagecreek.ai to make a request. We may need to verify your identity and authority, and some requests are subject to legal exceptions or the rights of other workspace users. You may also contact your local data protection authority where that right applies.
11. Children
Exo is intended for adult business users, not children under 18. We do not knowingly collect personal information from children using the Service. Contact us if you believe a child has provided personal information so we can investigate and take appropriate action.
12. Changes and contact
We will post revisions here and update the effective date. For material changes, we will provide notice through the Service or another appropriate channel before the changes take effect where required by law. Questions about this policy or your information: connor@sagecreek.ai.