Your privacy at ismee.

1. Who we are

ismee.ai ("ismee", "we", "us") provides a platform that helps organisations create trusted virtual versions of their people and knowledge. This policy explains how we handle personal data across our website (ismee.ai), our help centre (support.ismee.ai) and our product (app.ismee.ai).

ismee.ai is currently operated as a research preview. A formal legal entity is being established; the registered company name and business address of the data controller will be added here before general availability. For any privacy question or request, please use our contact form or email us.

Where you use ismee as part of an organisation, that organisation is typically the controller of the knowledge and content it uploads, and we act as its processor for that content (see section 10).

2. The information we collect

Information you give us

• Account & workspace details: your name, email address, organisation name, sector and role.
• Knowledge you add: the documents, files and text you upload, or that you choose to bring in from a source you connect (Microsoft 365 or Google Drive). ismee reads these to build the knowledge your assistant answers from, and that your team can read in the Documents library. We keep that resulting knowledge; we do not keep the original source files (see section 9). These may contain personal data you choose to include.
• Questions & conversations: the messages you and your team send to the assistant, and its answers.
• Anything you send us: for example via our contact or beta sign-up forms.

Information we collect automatically

• Usage & audit data: actions taken in the product, kept for security, accountability and to improve the service.
• Technical data: such as IP address, device/browser type and log data, used to run and secure the service.

Documents published to your team. Your administrator can choose which approved knowledge is published to a Documents library that colleagues can read and download. Only signed-in members of your workspace can reach it, and only the documents your administrator has chosen to show.

3. How we use your information

• To provide and operate the service, including generating answers grounded in your own knowledge.
• To create, secure and administer your account and workspace.
• To keep the service secure and detect, prevent and investigate abuse or misuse.
• To respond to your enquiries and provide support.
• To improve and develop the product (using aggregated or de-identified data where practical).
• To send service and administrative messages (for example email verification and workspace-approval emails).
• To comply with our legal obligations.

Product check-in emails. During the beta, if you start a workspace and don't return, we may send you up to two occasional check-in emails to see how you're getting on and to invite feedback. You can opt out of these at any time using the unsubscribe link in the email. Opting out does not affect essential account emails, such as sign-in codes and security or account notices.

4. Our legal bases (UK GDPR)

• Performance of a contract: to provide the service you or your organisation have signed up for.
• Legitimate interests: to secure, maintain and improve the service, and to communicate with you, balanced against your rights.
• Consent: where we ask for it (for example certain communications); you can withdraw it at any time.
• Legal obligation: where we're required to process data by law.

5. The AI provider and how it handles your data

The intelligence behind ismee is provided by OpenAI's API Platform, not the consumer ChatGPT app. Based on OpenAI's current published terms for the API:

• Data sent through the API is not used to train OpenAI's models by default.
• OpenAI may retain API inputs and outputs for up to 30 days to run the service and detect abuse, then deletes them (unless legally required to keep them).
• The API Platform is SOC 2 Type 2 certified, with encryption in transit and at rest.

Please note these reflect OpenAI's published terms and may change; see our Data & compliance page for more.

6. Connected sources and Google API Services

An administrator can connect a source such as Microsoft 365 or Google Drive so that documents can be brought into ismee without downloading them first. Where a source is connected, ismee reads from it once, at the moment of import, using read-only access the administrator grants, and acts only as that administrator, so it can reach only what that person can already see. This is a one-time read rather than a live sync: ismee does not watch or monitor your files, and does not update itself when something changes at the source. A connection can be removed at any time. Microsoft and Google are your organisation's providers, not ours.

ismee does not keep the original files. It extracts the text, uses it to draft knowledge for your administrator to review, and discards it once reviewed (see section 9).

Google API Services and Limited Use. Where your administrator connects Google Drive, ismee's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. In practice, ismee requests the narrowest access Google offers for this purpose (the drive.file scope), so it can only ever see the individual files your administrator chooses through Google's own file picker, and not the rest of your Drive. Those files are read once to build knowledge you approve. ismee does not use Google user data for advertising, does not sell it, and does not use it to develop, improve or train generalised AI models. Access is read only and can be revoked at any time, either from within ismee or from your Google account. Gmail and Google Chat are not accessed.

7. Who we share your data with (sub-processors)

We don't sell your data. We use a small number of trusted providers to run the service:

Provider	Purpose	Location
OpenAI	AI model that generates answers	US
Neon	Database (accounts, knowledge records, logs)	EU (London)
Render	Application hosting	EU (Frankfurt)
Backblaze B2	Object storage for workspace logos and a per-workspace audit record	US
Resend	Transactional email (verification, invitations)	US/EU

We may also share data where required by law, or in connection with a business transfer, and with professional advisers under confidentiality.

8. International transfers

Our application and primary database are hosted in the EU. Some processing takes place in the US, currently our object storage (workspace logos and audit records) and our AI provider. Where personal data is transferred outside the UK/EEA, we rely on appropriate safeguards such as the UK International Data Transfer Agreement / Addendum, EU Standard Contractual Clauses, or an adequacy decision, together with our providers' own commitments. We're working towards full EU data residency.

9. How long we keep it

Source files are not retained. When you add a document, or bring one in from a connected source, ismee extracts its text to build knowledge, then discards that working text once you have reviewed the result. The original file is not stored on our systems. What we keep is the knowledge you approve.

We keep personal data for as long as your account or workspace is active, and for a reasonable period afterwards to meet legal, security and operational needs, after which we delete or anonymise it. Data held by our AI provider is subject to its short retention window (see section 5). Backups are retained for a limited period.

10. If you use ismee as part of an organisation

If your organisation provides ismee to you, it controls the knowledge and content in its workspace and decides who can access it. For that content we act as the organisation's processor and handle it under our agreement with them. Please direct requests about that content to your organisation's administrator. A Data Processing Agreement is available to customers on request.

11. Security

We take security seriously. Measures include encryption in transit and at rest, strict tenant isolation (each organisation's data is kept separate), role-based access controls, email verification, and audit logging. No system is perfectly secure, but we work to protect your data and to respond quickly to any issue.

12. Your rights

Under UK GDPR you have the right to access, correct, delete, restrict or object to the processing of your personal data, to data portability, and to withdraw consent where we rely on it. To exercise any of these, contact us or email us. You also have the right to complain to the UK's Information Commissioner's Office (ICO) at ico.org.uk.

13. Cookies

Our product uses essential cookies needed to sign you in and keep your session secure. Our marketing site does not currently use non-essential or advertising cookies. If this changes, we'll update this policy and seek consent where required.

14. Children

ismee is a business tool and is not directed at children. It is not intended for anyone under 18, and we don't knowingly collect their data.

15. Changes to this policy

We may update this policy from time to time. We'll change the "last updated" date above and, for material changes, take reasonable steps to let you know.

16. Contact us

Questions or requests about your data? Use our contact form, or email us.