Privacy Policy
About this policy
This policy covers the website, hosted service, APIs, and memory capture plugin. For privacy requests, contact privacy@smrit.ai. For general inquiries, contact founders@smrit.ai.
Information we collect and how we use it
We receive account names, email addresses, sign-in identifiers, organization and membership details, and content submitted by you or authorized software. This includes documents, revisions, workbook records, files, memory profiles, and logs. Invitations and content can identify other people.
We use this information to authenticate users, provide storage and search, manage permissions, answer authorized requests, deliver service messages, provide support, and investigate errors and abuse. Activity records include identities, operations, affected resources, timestamps, outcomes, and actual search text. Infrastructure processes network request information.
We determine account, security, and operational processing. Your organization generally controls the purposes and sharing of its submitted content. Where privacy law requires a lawful basis, we rely on the applicable contract with the individual, legitimate interests in providing and securing the service, legal obligations, or consent where required.
Sign-in and AI features
Google sign-in and hosted search
Google sign-in supplies an account identifier, verified email, and available name. It does not give the service access to Gmail, Drive, Calendar, or Contacts. Hosted semantic search processes text using a model within the service's infrastructure.
Connected clients and memory
Authorized AI clients receive content within their permissions and may send it to their model providers. Personal memory can be delivered automatically to your authorized agent. Organization administrators cannot read another person's private memory through ordinary administrator access. Organization administrators can manage service account memory.
The optional capture plugin sends conversation excerpts to your configured model service for summarization and stores summaries in memory. Tool result blocks are excluded from extraction, but conversation text can still contain sensitive information. Your client's and model provider's privacy terms apply to their processing.
Sharing and international processing
Google Cloud provides hosting and related infrastructure, AWS Simple Email Service delivers transactional email, and Slack receives internal operational notifications. During alpha, notifications can include organization names, address slugs, regions, and usage counts. Support and infrastructure operations can require access to nonpublic information. Information may also be disclosed where law requires it.
Public content can be received and copied by anyone. Changing permissions cannot recall delivered copies. Hosting is documented in the United States; a selected region label does not guarantee that all processing, providers, or administrative access stays within that region.
Restrictions on data use
We do not sell or license customer personal information, use it for targeted advertising, or grant outside companies independent rights to use nonpublic customer content. We will not use nonpublic content, searches, or memory for general-purpose model training or external model evaluations without separate customer authorization and any other legally required authority. This restriction does not prevent the search and customer-initiated model processing described above.
Cookies and local storage
Cookies support sign-in and request security. Browser storage can retain unsaved drafts and interface state. The plugin retains cached context and pending or held summaries. Signing out does not necessarily remove these local copies.
Retention and deletion
Editing preserves earlier document revisions. Archiving and soft deletion do not permanently erase all information. Disabling memory retains it; current memory deletion is soft, and memory removed when leaving an organization can return on rejoining. Files, activity records, exports, and recovery copies have separate lifecycles. Some records have no automatic expiry. Ordinary exports do not include every category of personal information.
Your privacy rights
Contact privacy@smrit.ai to request access, correction, deletion, or other rights available under applicable law. We may verify identity and involve the organization controlling the information. We will handle requests and explain lawful exceptions within applicable legal deadlines. Technical limitations do not remove your legal rights. You may complain to the relevant privacy authority.
Security and policy changes
The service processes readable content and is not end-to-end encrypted. Security controls cannot prevent every loss or unauthorized access. Report security concerns to security@smrit.ai. We will update this policy when practices change and provide notice or obtain consent where required.