Privacy Policy

We may collect:

• —Account information: your name, email address, organization details, and authentication information.
• —Usage information: your interactions with the Service, feature usage, workflow activity, logs, and diagnostics.
• —Connected-service data: information you choose to connect from services such as Google and Slack so Spectra can provide the features you request.
• —Device and technical data: IP address, browser type, device information, and performance telemetry.
• —Communications: support requests, feedback, and other messages you send us.

We access connected-service data only after you connect a service and authorize the requested permissions. You can disconnect a service at any time.

We use personal data to:

• —Provide, operate, maintain, and secure the Service.
• —Perform searches, drafts, updates, workflows, and other actions you request.
• —Authenticate users and administer accounts and organizations.
• —Prevent fraud and abuse, troubleshoot problems, and improve reliability.
• —Communicate service, support, security, and legal notices.
• —Comply with law and enforce our agreements.

We do not sell personal data or use it for targeted advertising.

We may disclose personal data only as needed to provide and protect the Service:

• —Service providers and subprocessors: infrastructure, hosting, security, support, analytics, and AI-model providers that process data for us under contractual restrictions. See our current list at getspectra.com/subprocessors.
• —Your organization: authorized members of the Spectra organization or workspace in which you use the Service, according to its settings and your instructions.
• —At your direction: third-party services and recipients you ask Spectra to contact, update, or otherwise interact with.
• —Legal and safety reasons: when required by law or reasonably necessary to protect rights, safety, security, or prevent abuse.
• —Business transfers: in connection with a merger, financing, acquisition, reorganization, or sale of assets, subject to applicable confidentiality protections.

We do not sell Google user data. We do not share Google user data with data brokers or advertising platforms.

We use administrative, technical, and organizational safeguards designed to protect personal data. These include encryption in transit, access controls, restricted production access, monitoring, and security controls appropriate to the nature of the data.

No system is completely secure. We therefore cannot guarantee absolute security, but we work to prevent unauthorized access, use, alteration, and disclosure.

We retain personal data only for as long as needed to provide the Service, meet legal obligations, resolve disputes, and protect the Service.

You can disconnect an integration to stop future access. You can also request account and data deletion through the Service or by emailing privacy@getspectra.com. When a deletion request is confirmed, active-system data is deleted or de-identified within 30 days. Residual copies in encrypted backups are removed through our normal backup rotation within 90 days, unless a longer period is required by law or necessary for security, fraud prevention, or dispute resolution.

More information is available on our Data & Account Deletion page at https://getspectra.com/data-deletion.

This section explains the five parts of Spectra's handling of information received through Google APIs: the data we access, how we use it, how we share it, how we protect it, and how long we retain it. It applies only to the Google services available in Spectra's production product.

6.1 Google data we access

Spectra requests access only after you choose a Google service and approve the permissions shown on Google's consent screen. The production product supports these nine Google services:

The exact permissions depend on the service and access level you choose. The Google consent screen shows the requested permissions before you connect an account.

Not part of the production OAuth request: Google Classroom, Google Chat, Google Admin Directory, Google Ads, and Google Tasks are not available in Spectra's production product.

6.2 How we use Google user data

We use Google user data only to provide or improve the user-facing features you request. For example, Spectra may use it to find an email or file, summarize content, answer a question, prepare a draft, update a spreadsheet, create a document, schedule a calendar event, manage a contact, or run a workflow you direct.

When an AI feature is needed to complete your request, Spectra may send the minimum relevant content to an AI-model provider acting as our processor. We do not allow those providers to use Google user data to train generalized AI or machine-learning models.

We do not use Google user data to:

• —Serve advertisements or build advertising profiles.
• —Determine creditworthiness or for lending purposes.
• —Train or improve generalized AI or machine-learning models.
• —Create, augment, or sell user profiles for unrelated purposes.
• —Monitor individual activity for employee surveillance.

Human access to Google user data is prohibited except when you provide explicit permission for support, when access is necessary for security or abuse investigation, when required by law, or when the data has been aggregated and anonymized for internal operations in a way that cannot identify you.

6.3 How we share Google user data

We transfer or disclose Google user data only:

• —To subprocessors, including hosting, security, and AI-model providers, when necessary to provide a feature you request and under contractual confidentiality and data-use restrictions.
• —Within your Spectra organization or workspace, to authorized members and audiences according to your instructions and workspace settings.
• —To a third party when you explicitly direct Spectra to send, create, update, share, or otherwise act in that third party's service.
• —When required by applicable law or necessary to address a security incident, fraud, abuse, or a threat to safety.
• —As part of a business transfer, subject to applicable law and continued protection of the data.

We do not sell Google user data. We do not transfer it to data brokers, advertising platforms, or other parties for advertising, retargeting, or unrelated profiling.

6.4 How we store and protect Google user data

Spectra may process Google user data transiently to complete a request. It may also store data you ask it to keep, such as messages, drafts, workflow context, files, spreadsheet data, summaries, records, and search indexes.

We protect Google user data with safeguards that include encryption in transit, encryption at rest where supported, access controls, production-access restrictions, monitoring, and separation of OAuth credentials from the agent's working environment. We retain access and refresh tokens only to maintain the connection you authorize and protect them from unauthorized disclosure.

6.5 How long we retain Google user data

We retain Google user data only while it is needed to provide the features you request, maintain security, comply with law, or resolve disputes.

Disconnecting a Google service stops Spectra's future access and causes the OAuth credentials we hold for that connection to be revoked or deleted. To delete Google user data already stored in Spectra, delete the associated content or account in the Service, or email privacy@getspectra.com. After a confirmed deletion request, active-system copies are deleted or de-identified within 30 days. Residual copies in encrypted backups are removed within 90 days through our normal backup rotation, except where limited retention is required by law, security, fraud prevention, or dispute resolution.

You can also revoke Spectra's Google access from your Google Account permissions at https://myaccount.google.com/permissions. Revocation prevents future access but does not by itself delete data that you previously asked Spectra to store. Use the deletion methods above to remove stored copies.

6.6 Google API Services User Data Policy and Limited Use

The use of raw or derived user data received from Workspace APIs will adhere to the Google User Data Policy, including the Limited Use requirements.

Spectra does not use or transfer Google Workspace user data, whether raw, aggregated, anonymized or derived, to create, train or improve generalized or foundational AI or machine-learning models, and does not send it to any AI provider that uses it for training.

See the Google Workspace API User Data and Developer Policy at https://developers.google.com/workspace/workspace-api-user-data-developer-policy.

Spectra's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy at https://developers.google.com/terms/api-services-user-data-policy, including the Limited Use requirements.

Consistent with those requirements:

• —We use Google user data only to provide or improve user-facing features that are prominent in Spectra's requesting interface.
• —We transfer Google user data only as necessary to provide or improve those features, with your affirmative consent, for security purposes, to comply with applicable law, or as part of a business transfer subject to the policy.
• —We do not use or transfer Google user data for advertising, including personalized, retargeted, or interest-based advertising.
• —We do not allow humans to read Google user data unless we first obtain your affirmative agreement to view specific data, doing so is necessary for security or abuse investigation, doing so is required by applicable law, or the data is aggregated and anonymized for internal operations.
• —We do not use or transfer Google user data to create, train, or improve generalized AI or machine-learning models.

We and our service providers may process personal data in countries other than the country where you live. When required, we use safeguards designed to protect personal data during international transfers.

Depending on your location, you may have the right to access, correct, delete, restrict, object to processing of, or export your personal data. You may also withdraw consent where processing is based on consent and lodge a complaint with a supervisory authority.

To exercise a privacy right, email privacy@getspectra.com. We may need to verify your identity before completing a request.

The Service is not directed to children under 13, or a higher minimum age where required by local law. We do not knowingly collect personal data from children in violation of applicable law.

We may update this Privacy Policy to reflect changes in the Service, our practices, or applicable law. We will post the revised policy with a new "Last updated" date and provide additional notice when required.

Spectra is a product operated by Engold, Inc. Questions or requests about this policy can be sent to privacy@getspectra.com.