Effective date: October 20, 2026
This policy explains how OpenTeams, Inc. (“OpenTeams,” “we,” “us”) collects, uses, and shares information when you use the Collab desktop application and the Collab Hub (together, the “Services”).
It does not cover openteams.com, which is governed by a separate privacy policy at https://openteams.com/privacy-policy.
Capitalized terms not defined here have the meaning given in our Terms of Service at https://openteams.com/collab-terms-of-service.
You can contact Us about privacy matters at [email protected] or by mail at the address above.
Collab runs partly on your device and partly on our hosted Hub, and where your content goes depends on choices you make. In summary:
What
Where it lives
Your conversations with Agents
On your device
Prompts sent for AI inference
Account information — name and email address, and authentication credentials, held in our identity system.
Content you create — Frames and Frame groups, their version history, the permissions you set on them, and suggestions you submit.
Support and correspondence you send us.
If you link a Connector, we retrieve data from that service at your direction — for example messages, files, calendar events, or channel history. This is “Connector Content,” and §5 sets out how we handle it.
Usage events. The application reports events about your use of the Services to our Hub, associated with your account, so we can operate and improve the product and understand adoption.
Service and request logs. Our Hub records operational logs for requests it serves, including timestamps, the route called, and the account making the request.
Update checks. The application periodically requests a signed update manifest. That request necessarily reveals your IP address, application version, and operating system. It carries no account or content data.
The desktop application contains no third-party analytics or telemetry software. Errors reported by the interface are written to the local log on your device, not transmitted to us.
The following are stored locally and are not transmitted to or stored by us, though content from a conversation is sent to an Inference Source when you take a turn (§6):
We use information to:
We do not use your content, including your prompts, Outputs, Frames, and Connector Content, to train or improve generalized artificial intelligence or machine learning models. We would do so only with your separate, affirmative, revocable consent, and subject to §5.2 below. If you revoke consent, we will stop using your content for training going forward.
When you connect a service, you authorize it to issue a credential that is held by our hosted Hub. The desktop application, Cogs, Skills, and code running in a Sandbox never receive that credential. Our Hub uses it to call that service only in response to a request originating from your session, and returns only the data responsive to that request.
A single Google authorization currently grants read access to Gmail, Google Drive, and Google Calendar together, even if you connected the Connector for only one of them.
The access continues until you disconnect the Connector in the Services or revoke it in your account at that service. Disconnecting stops further access. It does not delete Connector Content already retrieved, which remains in your local conversation history until you delete it.
Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Specifically, for data obtained from Google Workspace scopes:
The same handling applies to data retrieved from Slack, GitHub, and other services you connect. Your use of each connected service remains governed by your agreement with its provider.
When you take a turn in a conversation, the content of that turn is sent to the Inference Source you have selected. That content can include your prompt, the Frames applied to the conversation, and results returned by tools — including Connector Content retrieved from Gmail, Drive, Calendar, Slack, or GitHub.
There are three kinds of Inference Source, and your choice determines where the content goes.
Content does not leave your device through the Services.
Content is sent to our infrastructure and processed by our inference providers. We configure those providers for zero data retention: they do not retain your prompts or the responses they generate, and they do not use them to train models. Hosted inference is processed in the United States; some models are served through multi-region endpoints, so an individual request may be handled in any United States region.
You may supply your own API key for an external provider. If you do, you are contracting with that provider directly. We transmit your content to them at your direction, and from that point their terms govern — including whether they retain it, and whether they or their downstream model providers use it to train. Those terms are yours to review and yours to accept. If you have also connected a Connector, note that Connector Content can reach that provider by this route.
We use service providers to host and operate the Services, including cloud infrastructure, model hosting, and email delivery. They act on our instructions and are bound by contract. A current list is maintained in the Collab documentation.
We do not sell your information. We do not share it for cross-context behavioral advertising. We do not use advertising trackers, advertising networks, or identity-resolution or data-append services in the Services.
Our Services are operated from the United States, and information is stored and processed there. If you use the Services from outside the United States, you understand that your information will be transferred to and processed in the United States, where data protection law may differ.
Third-party service providers which we use to process your data may also be located, or store data, outside of the United States.
Category
Account and identity data
Deleting your account does not remove data stored locally on your device. Conversation history, Workspace files, installed Skills, and provisioned environments remain until you remove them.
AI-specific risks. Content a Cog reads can contain instructions designed to make it disclose information or take actions you did not intend (sometimes called prompt injection). We design the Services to limit what a Cog can reach, but no safeguard is complete. Our Terms of Service (§7.4) explain how to reduce this risk.
No system is completely secure. We will notify you of a breach affecting your information as required by applicable law. You can report a vulnerability or suspected misuse to [email protected].
If you use the Services through a Hubspace provisioned by an organization — typically your employer — that organization, not OpenTeams, controls that tenancy. Its administrators may create, suspend, or remove your access, manage which features and Inference Sources are available to you, and access, export, retain, or delete content associated with your account within that Hubspace. Your use is also subject to that organization’s policies.
Choices in the product. You can choose which Inference Source processes your content, connect and disconnect Connectors at any time, choose which Connectors a conversation may use, and delete your Frames and local conversation history.
Rights. Depending on where you live, you may have the right to access, correct, delete, your personal information, to receive a copy in a portable format, and to withdraw consent. To exercise these, contact us at [email protected]. If your account is administered by an organization, we may direct your request to that organization. We will verify your identity before acting on a request, and you may use an authorized agent where the law allows. If we decline a request, we will explain why, and you may appeal by replying to our decision. We will not discriminate against you for exercising these rights.
We do not sell or share personal information as those terms are defined under California law, so there is no opt-out to offer.
The Services are not directed to, and may not be used by, anyone under 18. We do not knowingly collect personal information from children.
We will post changes here and update the date below. For material changes we will give notice in the application or by email at least 30 days before they take effect.
