Privacy Policy

Account and workspace information. We collect information such as your name, business email address, telephone number, job title, company, workspace role, authentication information, preferences, and support requests.

Content you provide. We process messages, interview responses, uploaded files, instructions, feedback, notes, and other content you provide to the service. The service may retain conversation state, agent memory, summaries, and artifacts needed to provide continuity within your workspace.

Connected-service information. If a workspace owner or administrator connects a third-party service, we receive the authorization credentials and the data necessary to perform the features they enable. Depending on the connection and permission level, this may include mailbox identity, email metadata and content, drafts, accounting records, workforce records, applicant information, or other business-system data.

Usage and technical information. We collect device, browser, IP address, authentication, diagnostic, security, feature-usage, and service-performance information. Our payment processor may collect billing information directly; Acropora receives payment status and transaction identifiers rather than complete payment-card details.

We use information to:

• provide, personalize, maintain, secure, and improve the service;
• answer requests, generate analyses and artifacts, and preserve authorized context;
• operate connected features at the permission level selected by the workspace;
• authenticate users, enforce roles and approvals, and prevent fraud or abuse;
• provide support, communicate service notices, and administer subscriptions;
• comply with law and enforce our agreements; and
• analyze aggregated or de-identified service performance and usage.

Acropora does not sell customer content, use it for targeted advertising, or use customer content to train general-purpose foundation models. We use commercial AI and infrastructure services under their applicable business data controls to provide requested features.

When you connect Gmail, Acropora requests only the Google permissions displayed during authorization and selected by your workspace. Read access supports bounded email search, reading, and summaries. Compose access supports creating drafts for human review and, only when enabled, sending an unchanged draft after an authorized owner or administrator gives explicit confirmation.

Acropora’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. Google user data is used only to provide or improve prominent user-facing features requested by the user. It is not sold, used for advertising, used to determine creditworthiness, or used to train a general-purpose AI model.

We disclose Google user data only to service providers acting on our behalf where necessary to provide or secure the requested feature, when you direct or consent to the disclosure, or when required by law. Human access is limited to circumstances authorized by you, needed for security or support, or required by law.

We may share information with authorized members of your workspace and with vendors that help us provide hosting, databases, authentication, communications, AI processing, payment, monitoring, security, and support. These providers receive information only for the services they perform for us and are subject to contractual and technical controls appropriate to their role.

We may also disclose information when reasonably necessary to comply with law, protect rights or safety, investigate abuse, or complete a merger, financing, acquisition, reorganization, or sale of assets, subject to applicable law and continued protection of the information. We do not sell personal information or connected-service content.

We retain information for as long as reasonably necessary to provide the service, maintain security and audit records, resolve disputes, comply with law, and enforce agreements. Retention depends on the type of information, workspace configuration, contract, and legal requirements. Backups may persist for a limited period after deletion from active systems.

A workspace owner or administrator can disconnect Gmail or another connected account in Acropora settings, which removes the stored connection credentials. You can also revoke Google access from your Google Account permissions. Workspace owners may request account closure or data deletion through Acropora support. Some information may be retained where required for security, legal, billing, or audit purposes.

We use administrative, technical, and organizational safeguards designed to protect information, including access controls, workspace isolation, encrypted connector credentials, and approval gates for consequential actions. No security measure is perfect, and we cannot guarantee that information will never be accessed, used, or disclosed without authorization.

The standard public service is not intended for protected health information (“PHI”). Do not submit PHI unless Acropora has confirmed in writing that your specific agreement, deployment, model route, and connected tools are configured for that use, including an applicable business associate agreement where required.

The service is intended for business users and not for children under 18. If you use the service from outside the United States, information may be processed in the United States and other countries where our providers operate, subject to applicable safeguards.

We may update this policy as the service or law changes. We will post the revised policy here, update the date above, and provide additional notice when required by law.

Questions, privacy requests, and complaints may be sent to hello@theacropora.com. Please do not include confidential connected-service content in an unencrypted email.