Privacy Policy

Account Information

• Email address
• Display name
• Profile picture (if provided)
• Account preferences and settings

OAuth Integration Data

• Access tokens (stored encrypted using AES-256-GCM)
• Refresh tokens (stored encrypted using AES-256-GCM)
• Integration metadata (account names, scopes granted, connection status)
• OAuth state parameters for CSRF protection

Payment Information

Payment information is processed by our payment processors (Stripe and PayPal). We do not store credit card numbers or payment method details. We only retain:

• Transaction identifiers
• Subscription status and billing history
• Invoice records
• Stripe customer identifiers

Usage Data

• AI action usage (number of actions consumed)
• Token consumption metrics (input and output tokens)
• Model selection and usage patterns
• Conversation metadata
• Request latency and performance metrics

Conversation History

Your conversation history with our AI assistant is stored in Zep Cloud, a third-party memory management service. This includes:

• Messages sent to and received from the AI assistant
• Extracted entities and facts from conversations
• Knowledge graph relationships
• Conversation context and summaries

Task Data

• User-created tasks and their descriptions
• Task completion status and timestamps
• Task metadata and analytics

User-Provided API Keys (BYOK)

If you use the Flex plan and provide your own API keys for third-party services, we encrypt and store these keys using AES-256-GCM encryption. We never use these keys for any purpose other than executing your requested actions.

Service Provision

• Execute AI actions based on your instructions
• Manage and maintain your integration connections
• Process and respond to your conversations with the AI assistant
• Provide customer support and respond to inquiries

Integration Functionality

• Connect to and interact with Gmail, Google Calendar, GitHub, Slack, Notion, Stripe, and PayPal on your behalf
• Send emails, create calendar events, manage repositories, post messages, and perform other actions as directed by you
• Maintain and refresh OAuth tokens to ensure continued access

AI Processing

• Route your messages to AI providers for language model inference
• Generate responses using state-of-the-art AI models
• Analyze conversation context to provide relevant responses

Memory Storage

• Store conversation context in Zep Cloud for continuity across sessions
• Build and maintain a knowledge graph of entities and relationships
• Provide personalized responses based on historical context

Billing and Payments

• Process subscription payments and action pack purchases via Stripe
• Track usage for billing purposes
• Generate invoices and maintain transaction records

Security and Fraud Prevention

• Detect and prevent fraudulent or abusive behavior
• Enforce rate limits and usage policies
• Protect the security and integrity of our Service

Information Collected

• Email address (required)
• Name (optional)
• Company (optional)
• Use case description (optional)
• Referral source (optional)
• IP address - for consent verification and fraud prevention
• User agent - for technical auditing
• Consent timestamp - exact date and time you agreed to receive communications
• Consent text - the exact language you agreed to at signup

Double Opt-In Process

We use a double opt-in process to verify your email address and ensure you intended to subscribe:

1. You submit your email on our signup form
2. We send a confirmation email to your address
3. You click the confirmation link to verify your subscription
4. Only after confirmation do you receive our communications

How We Use This Information

• Send launch announcements and product updates
• Notify you of early access opportunities
• Share relevant product news and features
• Communicate important service updates

We do not:

• Sell, rent, or share your email with third parties for their marketing purposes
• Send unsolicited commercial emails unrelated to Conduit
• Add you to any lists without your explicit consent

Unsubscribe Options

You can unsubscribe from our communications at any time through:

• One-click unsubscribe: Every email includes an unsubscribe link that immediately removes you from our list
• Email request: Contact us at support@conduitapp.ai to be removed

Unsubscribe requests are processed immediately upon clicking the link.

Data Retention

Interest list data is retained as follows:

• Active subscribers: Data retained until you unsubscribe or request deletion
• Unsubscribed users: Email address retained (marked as unsubscribed) to honor your preference and prevent re-subscription without consent
• Consent records: Retained for compliance and audit purposes

Encryption at Rest

All user-provided API keys and OAuth tokens are encrypted using AES-256-GCM cipher before being stored in our database. Each encrypted value includes:

• A random initialization vector (IV)
• An authentication tag for integrity verification
• The encrypted data itself

Format: iv:authTag:encrypted

Encryption in Transit

All communications between your browser and our servers use HTTPS/TLS encryption. OAuth flows use secure redirect URIs and state validation to prevent interception.

Token Storage and Management

• OAuth access tokens and refresh tokens are encrypted before storage
• Tokens are automatically refreshed when they expire
• Token transmission occurs over secure HTTPS connections only

Infrastructure Security

We use Supabase for our database infrastructure, which provides:

• Database encryption at rest
• Row Level Security (RLS) policies to isolate user data
• Automated backups
• Secure network isolation

Authentication

User authentication is managed via Supabase Auth using JWT-based session management. Sessions are securely stored and validated on each request.

CSRF Protection

OAuth flows include cryptographically random state parameters that are validated to prevent Cross-Site Request Forgery (CSRF) attacks.

Data Deletion

You may request deletion of your data by contacting us at privacy@brainsmithy.ai. We will delete your data within 30 days, except where retention is required by law or for legitimate business purposes (e.g., accounting records).

Essential Cookies

• Authentication Session: Supabase authentication cookie to maintain your logged-in session
• Theme Preference: Stores your light/dark mode preference (localStorage key: conduit-theme)

Third-Party Cookies

When you use our payment features, Stripe and PayPal may set cookies for payment processing purposes. These cookies are governed by their respective privacy policies.

Analytics

We currently have minimal tracking. Usage metrics are collected solely for billing purposes (counting actions consumed). We do not use third-party analytics services like Google Analytics.

How Advertising Works

• Third-party vendors, including Google, use cookies to serve ads based on your prior visits to our website or other websites
• Google's use of advertising cookies enables it and its partners to serve ads based on your visit to Conduit and/or other sites
• We do not control the cookies placed by third-party advertisers

Your Advertising Choices

You can opt out of personalized advertising by visiting Google Ads Settings. You can also opt out of third-party vendor use of cookies by visiting aboutads.info.

For more information about how Google uses data, visit How Google uses information from sites or apps that use our services.

Note: Paid subscribers do not see advertisements and are not subject to advertising cookies.