Delegate OS, Inc. (“Delegate OS,” “we,” “our,” or “us”) provides a macOS application and supporting cloud infrastructure that allow you to delegate tasks across your connected accounts (collectively, the “Service”). This Privacy Policy explains what information we collect, how we use it, who we share it with, and the choices you have, including how we handle data we access from your connected Google, Microsoft, and Slack accounts. By using the Service, you agree to this Policy.
When you create an account we collect your name, email address, and authentication identifier (typically via Google or another OAuth identity provider). When you subscribe, our payment processor (Stripe) collects billing details on our behalf; we do not store full payment card numbers.
When you connect an external service (Gmail, Google Calendar, Google Drive, Google Contacts, Slack, Outlook, Microsoft Teams, iMessage, or others added over time), you grant the Service the OAuth scopes you select. Those tokens are stored encrypted, scoped to your user, and used solely to execute the actions you delegate. You may revoke any integration at any time from your dashboard.
When you connect an account, you authorize the Service to access and act on that account to carry out the instructions you give. We request the narrowest scopes that support the features we offer, and you can decline any scope on the provider’s consent screen (some features will then be unavailable). Depending on what you connect and the permissions you grant, the data we access includes:
To make drafts sound like you, the Service can process your recent outbound messages to learn your writing style — your openings, sign-offs, level of formality, and emoji use — and reuse that voice when it drafts on your behalf. This is on by default, and you can turn it off at any time in Settings › Privacy on the dashboard or in the Mac app’s settings; turning it off stops any further upload immediately.
When Catchup runs, the Service can read your incoming iMessages — messages other people sent you — so it can surface the ones that need a reply and draft a response in your voice. This requires Full Disk Access, which you grant during setup; granting it is your permission for this use, and you can turn the feature off at any time in Settings › Privacy on the Mac app. It is limited to one-to-one conversations; group chats are skipped.
We access connected-account content only to provide the user-facing features you request. We do not browse, mine, or process your connected accounts for any other purpose. In carrying out your instructions we may necessarily process information about third parties contained in your accounts (such as the names and email addresses of people you correspond with); we process that information solely to provide the Service. You should connect an account only if you are authorized to do so.
Delegate OS’s use and transfer of information received from Google APIs to any other app adheres to the Google API Services User Data Policy, including the Limited Use requirements. In particular:
Content we access from Microsoft and Slack is handled on the same basis: processed only to deliver the features you request, and never used to train artificial-intelligence models.
Speech-to-text runs entirely on your Mac. Audio captured by the microphone is transcribed locally on the Apple Neural Engine via WhisperKit. Raw audio is never transmitted to our servers, never stored on our infrastructure, and never available to us. Only the resulting text transcript and the structured action you confirm are forwarded to your dedicated instance for routing.
Transcripts and the resulting messages, drafts, calendar events, other actions, and metadata linking a message we sent on your behalf to the reply that closes it are retained on your private instance so you can audit and recall what was sent. You may delete individual records or your entire history at any time from the dashboard.
On our website, we and our service providers may use cookies and similar technologies for technical operation, functionality, and analytics. Most browsers let you reject or remove cookies; disabling them may impair website functionality.
To interpret your instructions and draft actions, your transcripts and the relevant context for a task are sent to third-party large-language-model providers (see Sub-processors below). We contractually require those providers to process your data only to provide inference to us and not to train their own models.
We do not use your content, transcripts, or connected-service data to train artificial-intelligence models by default. Depending on your subscription plan and/or your account settings, we may use your voice transcripts and product-usage data to train, fine-tune, or otherwise improve the models that power the Service. Where we do, we will make the applicable setting available to you and you may opt out at any time without losing access to the Service. We will not enable training on your data without the plan or setting that authorizes it.
Connected-account content — including all Google, Microsoft, and Slack data — is never used to train, develop, or improve any artificial-intelligence model, regardless of your plan or settings. We also use anonymized and aggregated information, stripped of identifiers and not linked to you, to understand usage and improve the overall experience.
We do not sell your personal information. We do not share it for cross-context behavioral advertising, and we do not use your data for third-party advertising, to determine credit-worthiness, or for lending.
We use the following sub-processors to operate the Service. Each is contractually bound to maintain confidentiality and security commensurate with our own:
Your dedicated instance is provisioned in AWS us-east-2 (Ohio, USA). Account metadata is stored in the same region. We do not retain raw audio recordings. We fetch connected-account content (such as Gmail, Calendar, and Drive data) on demand to carry out your instructions and do not maintain a separate copy of it on our servers beyond the transcript and record of the action you confirmed. Account data is retained for the life of your account; deleted records and deleted accounts are purged from primary storage within 30 days and from backups within 90 days, except where retention is required by law.
We use industry-standard safeguards including TLS 1.2+ in transit, AES-256 at rest, KMS envelope encryption for OAuth tokens, per-user instance isolation, and least-privilege IAM. No system, however, is perfectly secure. You are responsible for safeguarding your account credentials, devices, and the services you connect to Delegate OS. That includes keeping your Mac up to date, using a strong account password, enabling multi-factor authentication on your identity provider, and revoking integrations you no longer use. We strongly recommend you do all of the above. We are not liable for losses caused by your failure to secure your own credentials or devices, by malware on your Mac, or by your decision to grant Delegate OS access to a particular connected service.
California residents have the right to know, access, correct, and delete personal information we hold, and to opt out of any “sale” or “sharing.” We do not sell personal information and do not share it for cross-context behavioral advertising as those terms are defined under the CCPA. To exercise your rights, email hello@delegateos.ai.
If you are in the EEA, UK, or Switzerland, you have rights under the GDPR / UK GDPR including access, rectification, erasure, restriction, portability, and objection. Our lawful basis for processing is performance of contract (to provide the Service), legitimate interests (to secure and improve the Service), and consent (where required for optional features, including any use of your transcripts for training). You may withdraw consent at any time. To exercise your rights, email hello@delegateos.ai. You may also lodge a complaint with your local supervisory authority.
Our primary infrastructure is located in the United States. If you access the Service from outside the U.S., your data will be transferred to and processed in the U.S. Where required, we rely on Standard Contractual Clauses or other approved transfer mechanisms.
The Service is not directed to and may not be used by anyone under 18. We do not knowingly collect personal information from children. If you believe a child has provided us with information, please contact us and we will delete it.
We may update this Policy from time to time. If we make material changes we will notify you by email or in-app notice at least 14 days before the changes take effect. Your continued use of the Service after the effective date constitutes acceptance.
Questions, requests, or complaints? Email hello@delegateos.ai. You also have the right to lodge a complaint with your local data protection authority.
