Draft, 14 October 2026. This policy is being reviewed and will change before Embassys opens to everyone. Items marked “To confirm” are not settled yet.
Privacy policy
Embassys lets other people's AI assistants, and your own, ask for specific information from accounts you connect, such as your email, calendar, documents or location. Nothing reaches another person's assistant until you approve it, and you choose which parts are shared and for how long. This policy explains what we keep, what passes through us, and who else is involved.
To confirm: the legal entity that runs Embassys, its address, and the law it operates under.
What we keep
- Your account. Your name and email address from sign-in, your username, and settings such as time zone and whether others can find you.
- Connected accounts. Which accounts you connected and their status. The sign-in tokens for Google and other services are held by our integration provider (see below); we keep only a reference to them.
- Requests and permissions. Who asked, what they asked for, the reason they gave, the parts you approved, when access ends, and who can use it. When an assistant asks to send an email or add an event for you, we keep the proposed text until it is sent, withdrawn or ended.
- Activity. A record of each use of a permission: who used it, when, which kind of information, how many items and which fields, and whether it succeeded. It holds a salted hash of the network address, never the address itself, and the browser or app name. It never holds the content that was shared. You see this record in Activity.
- Notifications and devices. Which devices should receive notifications for you, and a record of each notification, which holds no content and is deleted after 90 days.
What passes through and is not kept
When an approved request is answered, we read the approved parts from your account, check them against what you approved, and pass them on. We do not store the contents of emails, events, documents or attachments. A location reading, or events read from a device calendar, are held in temporary storage for up to 10 minutes while the request is answered.
What the other side receives
The parts you approve go to the person who asked and to their assistant, and through it to the company that runs that assistant (for example Anthropic for Claude or OpenAI for ChatGPT). Their chat may keep a copy, and the Embassys card in their chat can keep a copy on their device. Once information has been shared we cannot take it back, so approve only what you are happy for them to keep. The same applies to your own assistants.
Who else is involved
- Amazon Web Services hosts Embassys and its database. To confirm: the region at launch (today in the United States; a move to the European Union is planned).
- WorkOS handles sign-in and receives your name and email address.
- Composio connects Embassys to Google and other services. It holds the sign-in tokens for your connected accounts and carries the information read or written for an approved request. Its storage of that information is turned off. To confirm: checked for the production project.
- Google, Microsoft and Notion are the services you choose to connect; their own privacy policies apply to your accounts there.
- Apple and Google deliver notifications to the Apple and Android apps. Each notification is encrypted for your device, so they see only that a notification was sent, not what it says. Location maps are drawn by Apple Maps on the viewer's device.
- Resend sends the email that tells someone without an account that they have been asked for something. It never includes what was asked for.
Information from Google
Embassys's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We use it only to answer requests you approve and to show it to you; we do not use it for advertising or to train AI models, and we do not sell it.
Cookies
We use no analytics, advertising or tracking. The site sets only the cookies it needs to work:
| Cookie | What it is for | How long |
|---|---|---|
envoy_session | Keeps you signed in | Up to 7 days, ending after 8 hours without use |
envoy_login_state | Finishes signing in safely | 10 minutes |
envoy_mobile_connect | Finishes connecting an account from the app | 10 minutes |
The sign-in pages are run by WorkOS, which may set its own cookies.
How long we keep things
- Proposed emails and events are removed once sent, withdrawn or ended. Requests nobody answers expire after 7 days.
- When you disconnect an account, we stop using it and ask our integration provider to revoke access and delete its record. When you end a permission, it stops at once; its history stays in Activity.
- The activity record is kept as your record of who used your information, and it stays even if the person who asked closes their account. To confirm: how long activity and request history are kept.
- Backups of the database are kept for a limited time. To confirm: the backup period at launch.
Your choices
- Decline any request, switch off parts of it, and choose how long access lasts.
- End a permission, block an assistant, or disconnect an account at any time.
- Stop people from asking you by email through Embassys, with the link in any such email.
- Ask us for a copy of your information, or to delete your account, by writing to
hello@embassys.ai. To confirm: deleting an account from the app is not available yet, and how erasure treats the activity record.
Security
All connections are encrypted. Notifications are encrypted for each device. Network addresses are stored only as salted hashes, and the activity record cannot be edited or deleted by the service.
Children
To confirm: the minimum age for an account.
Changes and contact
We will post changes here and say what changed. Questions about privacy: hello@embassys.ai.