Privacy Policy

1. Information we collect

We collect information you provide, information needed for accounts you choose to connect, and limited technical information needed to operate and secure the service.

• Account information such as email, display name, authentication records, and language preferences.
• Content and instructions such as prompts, drafts, customer records, tasks, knowledge, and approved actions.
• Connected-account identifiers, permissions, credentials, and content needed for a feature you request.
• Technical information such as session, device, IP address, timestamps, errors, security events, and limited usage logs.

2. How we use information

We use information to authenticate you, provide requested features, maintain your workspace, carry out approved actions, prevent abuse, troubleshoot errors, and comply with law. We do not sell personal information or use connected-account data for targeted advertising.

3. Product analytics and your choices

For signed-in users, Basic product analytics and masked session replay are enabled by default. Afield may record templated page routes, stable control identifiers, clicks, visible and hidden dwell time, flow outcomes, errors, hesitation signals, and coarse input statistics such as a length range, editing duration, edit count, paste count, and whether an edit was submitted or abandoned. Basic analytics does not store input text, visible page text, URL parameters, passwords, payment data, credentials, contact content, or file contents. Product events are retained for up to 90 days.

Optional content review is off by default. If you separately enable it, authorized Afield administrators may review a server-redacted copy of instructions you explicitly submit at supported product submission boundaries for support and quality analysis. Passwords, payment information, credentials, tokens, contact content, and file contents are never collected by this feature. Turning content review off removes stored instruction text while retaining non-content event statistics.

Masked session replay may retain a doubly masked structural reconstruction for up to 30 days so authorized administrators can diagnose usability problems. Text and inputs are masked, media is blocked, and chat, payment, integration-credential, contact, file, iframe, and canvas areas receive additional blocking. You can turn Basic analytics and replay off in Settings; disabling Basic analytics stops new behavior events and replay, and withdrawing replay consent removes stored replay data.

4. Connected accounts and Google user data

When you connect an account, Afield uses only the permissions displayed during authorization and needed for the features you request. You may disconnect an account or revoke access through the connected service.

If you connect Gmail, Afield uses read-only access to retrieve the messages, headers, threads, and attachments needed to show your inbox, analyze requested conversations, identify replies, and prepare reply drafts. Send access is used only when you instruct Afield to send an email or approve a prepared draft. Afield does not delete Gmail messages or change mailbox settings.

Afield may store connected Gmail account identifiers and encrypted access credentials, along with inbound message metadata, message content, downloaded attachments, analysis results, and reply drafts in your owner-scoped workspace so the requested inbox and agent features can operate. This data is retained until you delete it, disconnect the account where applicable, or request account deletion, subject to limited security, backup, fraud-prevention, and legal needs.

Gmail data is disclosed only to Google, our email integration provider Aurinko, infrastructure providers, and AI service providers acting on our behalf when needed to provide a feature you request, or when required for security or law. It is not sold, used for advertising, used to build advertising profiles, or used to determine creditworthiness. Human access is limited to security, legal, or support purposes, or when you separately consent. Afield's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.

If you connect Google Analytics or Google Search Console, Afield reads only the reports needed to answer the analysis you request, such as traffic sources, landing pages, conversion events, and search performance for sites you have verified. Afield does not change your Google Analytics or Search Console data, does not sell that data, and does not use it for advertising. You can disconnect the connection or revoke Google access at any time.

5. AI-assisted features

When you request an AI-assisted feature, the text, files, or connected content needed to fulfill the request may be processed by service providers acting on our behalf. We limit submitted material to what is reasonably needed for that feature.

6. Sharing

We share information only with service providers needed to operate Afield, with a connected service when carrying out your requested action, or when required for law, safety, or legal rights. We do not sell or rent personal information.

7. Storage and security

Some desktop features store information locally. Features requiring account sync, authorization callbacks, or cloud processing store the necessary information in Afield’s hosted environment. We use reasonable safeguards, but no storage or transmission method is completely secure.

8. Retention and deletion

We retain account information while your account is active and retain connected credentials until you disconnect, revoke access, or request deletion. Workspace content remains until you delete it or request account deletion, subject to limited security, fraud-prevention, backup, and legal needs.

9. Your rights

Depending on where you live, you may have rights to access, correct, delete, restrict, object, or receive a portable copy of certain information. You may withdraw connected-account consent at any time.

10. Children and changes

Afield is a business productivity service and is not directed to children under 16. We may update this policy and will post the current version and effective date here.