Privacy

Last updated 11 October 2026.

Company keeps what you add to it, and what you ask it to bring in from the tools you use, so that you can find it and ask about it. It never records anything on its own. Company is operated by Claps Artificial Intelligence, Inc.

What Company keeps

Your account. Your name, your email address, your profile picture when you sign in with Google, your mobile number if you add it, and the spaces you belong to.

Your entries. What you add and what you ask Company to import: meetings and their transcripts, notes and voice notes, conversations with AI assistants, chats, emails, calendar events, documents and, if you turn it on, a summary of each day from Apple Health. Each entry keeps its date, its source and the people who took part, and the title and summary Company writes for it.

Your connections. For each service you connect, such as Fathom, Google, Microsoft or Slack: the account you connected, the settings you chose, and the credentials that let Company import on your behalf, which are stored encrypted.

Your tokens. For each token that lets Claude Code, ChatGPT or Claude reach one of your spaces: its name, its first characters, the space it opens, and when it was created and last used. Company never stores a token itself, only a one-way hash of it.

Your plan. For a team space that subscribes to a paid plan: the plan, the state of its subscription, the number of members billed, when the current period ends, and the references Stripe gives to the customer and the subscription. Card details are typed into Stripe's checkout and never reach Company.

Technical data. The IP address and browser details that come with each request, which Company and its hosting provider use to deliver and protect the service and keep only for a limited time. The pages load their typeface from Google Fonts, which receives your IP address when you open them.

What it is used for

Only to provide Company to you: to sign you in, to import what you authorize from the services you connect, to keep, search and show your entries to you and to the people you share a space with, to write titles, summaries, observations and answers, to send the invitations you ask it to send, to bill the paid plans, and to keep the service secure. Company sets only the cookies needed to keep you signed in, and uses no analytics or advertising trackers.

Company's use and transfer to any other app of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Who receives it

The people you share a space with. In a team space, the other members read the entries filed there and see your name and email address. A private entry, such as one of your emails, is read only by you and the people you give access to, and a private meeting also by the members who took part in it. The rest of the space sees only that it is there, its kind, its date and that it is yours.

Service providers. Vercel hosts Company and Supabase runs its database and sign-in, both in the United States, and your data is encrypted in transit and at rest. Resend sends the invitations to a team space that you ask Company to send. Sendblue provides Company's iMessage number and carries the messages of the groups and chats that include it. Stripe processes the payments of the paid plans: it receives the name and email address of the space's owner, and the card details typed into its checkout.

AI providers. Company uses an AI provider, OpenAI or Anthropic, to write the titles and summaries of new entries and the observations and answers you ask for, and OpenAI to transcribe the audio files you upload. They receive only the content each task needs, under terms that do not allow them to use it to train their models. Your emails and Apple Health days are never summarized on their own: they reach an AI provider only as part of something you ask for, such as a summary or an answer. Voice notes recorded in the iPhone app are transcribed on your iPhone, and the audio never leaves it. Dictation on the web uses your browser's speech recognition, and Company receives only the text.

We do not sell your data, share it with advertisers, or use it to train AI models, and we disclose it to authorities only when the law requires it.

Apps and connectors (ChatGPT, Claude)

You can add Company to ChatGPT or Claude as an app or connector. To connect it, you sign in to Company and choose one of your spaces: the connection reads only what you can already read in that space, and saves only there.

Company receives from ChatGPT or Claude only what you explicitly share through the connection: what to search for, the question you ask, or the text you ask it to save, which becomes a new entry in that space. It never receives your chat history or your other conversations, and it saves nothing unless you ask it to.

ChatGPT or Claude receives what it reads to answer you: the titles, snippets, dates and links of the entries it finds, the whole entry when it opens one, the answers Company writes from that space, and the names of your spaces. What it does with them is governed by the terms of OpenAI or Anthropic and by your settings there.

Each connection is a token that you can see in Settings, with when it was created and last used, and revoke there at any time. Revoking it disconnects the app at once.

Apple Health

Apple Health is read only by the Company iPhone app, on your iPhone, and only after you turn it on and allow it. While it is on, the app sends Company each day once it is over: your sleep, heart rate variability, resting heart rate, steps, active energy, workouts, VO2 max and weight. Each day is saved as a private entry in your personal space: only you can see it, and it is never shared with your team. It reaches an AI provider only as part of something you ask for in your personal space, and ChatGPT or Claude only if you connect them to your personal space and they read it to answer you.

iMessage

Company's iMessage number belongs to one space, and everything it hears goes to that space alone. Company listens to the groups and chats that include that number, and never writes in them or sends a message, not even to say that it is there.

Each conversation becomes one entry per day in that space, with that day's messages and the number that sent each one, and every member of the space can read it. Muting a conversation in Sources stops its entries, although Company still keeps its messages. Deleting it there deletes the conversation, its messages and its entries.

In those entries, the number of a member of that space appears as their name once they have told Company it is theirs. Any other number appears as the name a member gave it or, if no member has, as the name its owner's iPhone shared with Company's number. Names given to numbers are kept only in that space: no other space sees them.

Google data

When you connect a Google service, Company asks only for the permissions that service needs, and you can see them on Google's consent screen before you agree. Google Calendar (read): the title, time, attendees and conference link of your events, so that each meeting appears in Company and each recording or transcript is attached to the right meeting and people; Company never changes your calendar with this permission. Let Company create events (write, optional): only when you ask Company in a chat to schedule, move or cancel a meeting, and only that event. Google Meet: the recordings, transcripts and attendees of your Meet conferences, filed as the entry of that meeting. Gemini notes (optional): the notes document Gemini attaches to a meeting, read only to add it to that meeting's entry. Google Drive: only the files you pick yourself in Google's file picker, and nothing else in your Drive.

What Company keeps of this is the entries it makes from it, in the space you chose, under the same rules as every other entry; it does not copy your calendar or your Drive. You can revoke Company's access at any time at myaccount.google.com/permissions or by disconnecting the service in Sources; either way Company deletes the credentials it held, and disconnecting a calendar deletes the events it imported. Google data is never used for advertising, never sold, and never used to train AI models, and Company's handling of it follows the Limited Use requirements of the Google API Services User Data Policy.

How your data is protected

In transit and at rest. Every connection to Company uses TLS, and the database and the files you upload are encrypted at rest by the providers that store them (Supabase, in the United States).

Credentials. The tokens Google and the other services hand Company are encrypted a second time, with AES-256-GCM, with a key that lives only in the server's environment and never in the database or in any backup of it. Your own API tokens are kept as a hash: Company cannot read them back, only check them. Passwords are handled by Supabase's sign-in service, never by Company's code.

Access. Everything you file belongs to a space, and the server checks on every request which spaces you are a member of and what each entry lets you read; the database enforces the same boundaries with row-level security. A private entry is read only by its author and the people they let in. The people who operate Company can reach production data only to fix a problem or at your request, and every such access leaves a record.

Retention and deletion. What you delete is deleted at once, not hidden. Disconnecting a service deletes its credentials, and deleting your account deletes your entries, your connections and your tokens, as described below.

If something goes wrong. If a security incident affects your data, Company tells the account owners by email without undue delay, with what happened, what data was involved and what to do.

How long it is kept

Your account and your entries are kept for as long as your account exists. An entry you delete is deleted from the database at once. The messages of an iMessage conversation are kept until the conversation is deleted. When you disconnect a service, Company deletes the credentials it held for it and stops importing; what it already imported stays until you delete it, except calendar events, which go with the calendar. A revoked token stops working at once and stays in your list of tokens as a record. The plan of a team space is deleted with the space, while Stripe keeps its own record of the payments. When you ask us to delete your account, we delete it and all of its data within 30 days.

Your controls

You can delete any entry, or several at once. You can export everything in a space, as Markdown or JSON, from Settings. You can disconnect any service and mute or delete an iMessage conversation in Sources, turn Apple Health off in the iPhone app, leave a team space, and revoke any token in Settings. To delete your account and all of its data, write to us from the address you sign in with.

Contact

Questions and requests about your data: hi@company.inc. When this page changes, the date at the top changes with it.