Privacy Policy

1. Who we are and what this policy covers

This Privacy Policy explains how Untoil, Inc., a Delaware corporation (“Untoil,” “we,” “us,” or “our”), collects, uses, and shares information when you use Untoil: the website at untoil.com, the web application, the Untoil browser extension, the Untoil Slack, Google Chat and Microsoft Teams apps, the Untoil MCP server, and related services (together, the “Service”).

Untoil is a tool for teams. An organization (the “Customer”) creates a workspace, connects its tools, and invites its people. For data inside a Customer’s workspace, including content from connected tools and information about the Customer’s workforce, the Customer decides what is collected and why, and we process it on the Customer’s behalf and instructions (as a “service provider” or “processor”). For account, website, billing, and usage information, we decide how it is used (as a “business” or “controller”). If you have questions about your employer’s use of Untoil, contact your employer first; we will help them respond.

2. Information we collect

We collect the following categories of information.

Information you give us

• Account information. Your name, work email address, profile photo, role, department, and sign-in details (we support email magic links, Google and Microsoft sign-in, and company single sign-on; we never see your Google, Microsoft, or SSO password).
• Content you submit. Toil reports, comments, replies, votes, Ask Untoil conversations, feedback on Untoil’s replies, roadmap requests, files and images you attach, links you paste, and emails you send to Untoil to post toil. If you post anonymously, your identity is stored with the post and shown to everyone in your workspace, including Managers, as Anonymous. It is left out of notifications, exports, the API, and the text we send to AI models. Untoil staff can see it on an internal audit surface when needed to operate or secure the Service.
• Voice input. If you use the microphone, speech is transcribed by your browser’s speech recognition, which may send audio to your browser vendor (for example Google or Apple) under their terms. We receive the transcript, not the audio.
• Screenshots and recordings. When you open the browser extension’s side panel, it takes a screenshot of the tab you are on and uploads it to your drafts so it is ready to attach; you can remove it before you post. Screen recordings start only after you pick a screen or window in Chrome’s own picker. The help panel can attach a screenshot of the Untoil page you are on when you ask for help. Nothing is captured while the extension is closed.
• Workspace settings. Headcount, departments, average or per-person hourly rates, and company facts a Manager enters so Untoil can estimate cost.
• Support and early-access requests. Whatever you include when you email us or request access, including your company name and website.

Information from connected services

When a Manager connects a tool, we receive the data that tool’s permission screen describes. Sections 3 through 6 list each tool. Across all of them: we read content that is visible to the whole team (public channels, shared drives, and team sites); we do not read direct messages, private channels, or personal mailboxes. We store what we extract: team facts, estimates, summaries, and quoted excerpts of up to a few paragraphs with a link back to the source. We also keep the text that was sent to the model when a toil was identified from Slack, and the full text of a channel window or transcript that a Manager imports by hand, so that a Manager can review where a fact came from. We do not download or keep copies of your Drive, OneDrive, or SharePoint files.

Information about your colleagues

A Customer’s directory, HR, or payroll connection gives us names, work emails, job titles, departments, managers, and whether someone is still employed. Where the Customer connects payroll, we read pay data once to compute an hourly rate and store only that rate, not the salary, pay history, or currency it came from. This includes people who never sign in to Untoil. Untoil may also identify colleagues as affected by a toil based on what others report. Managers can correct or remove any of this.

Payment information

Subscriptions are billed through Stripe. Stripe collects your card and billing details directly on its own pages. We store a Stripe customer identifier, the subscription identifier, its status, plan, and billing period. We never receive or store card numbers, expiry dates, or the last four digits.

Information collected automatically

• Usage and device data. Pages and features you use, actions you take, errors, browser and device type, operating system, referring page, and approximate location from your IP address.
• Session recordings. On the customer-facing app we use PostHog session replay, which records page structure and interactions so we can fix bugs and improve the product. Every text field is masked before it leaves your browser, so what you type is not recorded; page text that is already on screen is. We do not use replay on our administrative surfaces. You can ask us to exclude your account (section 10).
• AI interaction logs. To debug and improve Untoil’s AI features we log the prompts we send to model providers and the responses they return, linked to your account and session. These logs can contain your words and excerpts from connected tools. They are stored with our analytics provider, which deletes the prompt and response text after 30 days and keeps only the model, token counts, cost, and timing.
• Cookies and similar technologies. See section 10.

Browser extension

The extension asks for access to all sites because Chrome requires it to take a screenshot of whatever tab you are on. It uses that access only to know which tab is active and to take the screenshot described above. It does not read page content, selected text, form data, or browsing history, it runs no scripts on other sites, and the only thing it sends to Untoil besides what you type is the screenshot or recording you attach. It stores your Untoil sign-in token and unsent drafts on your own device.

3. Slack

When a Slack workspace admin installs the Untoil app, Untoil receives permission to join and read public channels and their history and files, to look up members’ names and email addresses so posts and notifications reach the right account, to respond to slash commands and mentions, and to send messages. Untoil uses this to let people post toil from Slack, to identify repeated work in channels the whole team can see, and to send notifications and digests as the Untoil bot. Untoil does not read direct messages or private channels. The admin can remove the app from Slack or disconnect it in Untoil at any time.

4. Google user data

When your organization installs Untoil from the Google Workspace Marketplace or connects Google in Untoil, we access Google user data only to provide the Untoil features you request:

• Drive (read-only) to find files where work is stuck, duplicated, or waiting on someone.
• Google Chat (read-only spaces, messages, and memberships) to read discoverable spaces for the same kind of toil, and to let people post toil to Untoil from Chat. We also send Chat messages as the Untoil Chat app when you turn on Google Chat notifications.
• Directory (read-only users and organizational units) to map people to departments and to deliver notifications to the right Workspace account.

Untoil’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not sell Google user data, use it for advertising, or use it to develop or train generalized AI or machine-learning models. Humans do not read it except to provide the Service, to secure it, to comply with law, or with your permission (for example, when you contact support). Google user data is sent to our model providers only to produce the features described here and is not retained by them. A Super Admin can revoke access in Google Admin, and anyone can disconnect Google in Untoil.

5. Microsoft 365 data

When your organization connects Microsoft 365 in Untoil or installs the Untoil Teams app, we access Microsoft Graph and Teams data only to provide the Untoil features you request:

• Files (read-only OneDrive and SharePoint) to find documents where work is stuck, duplicated, or waiting on someone.
• Teams channels (read-only channel messages and basic team information) to read team channel conversations for the same kind of toil. We do not read personal 1:1 or group chats.
• Calendar (read-only events) to confirm the connection works and to find the Teams meetings your team holds. We do not change anything in your calendar, and we do not store calendar events, attendees, or durations.
• Directory (read-only users and groups) to map people to departments and to deliver Teams notifications to the right Microsoft 365 account.
• Teams notifications we send as the Untoil Teams app when you turn them on. That bot does not read your chats.

We do not sell Microsoft 365 data, use it for advertising, or use it to train generalized AI models. An Entra admin can revoke admin consent and remove the Untoil Teams app at any time.

6. HR, payroll, and company website

A Manager can connect an HR or payroll provider (such as Gusto, BambooHR, or Workday) through Finch, which gives Untoil read access to the employee directory and, where enabled, pay data used to compute hourly rates. Finch’s privacy policy governs its handling of that connection. A Manager can also give Untoil the company’s public website address; we crawl public pages to learn what the company does. Both can be disconnected in Untoil at any time.

7. How we use AI

Untoil sends your words, attachments, and excerpts from connected tools to third-party large language models to write up toil, detect duplicates, estimate time and cost, identify who is affected, draft solutions, and answer Ask Untoil. We currently use models from OpenAI, Anthropic, and Google, accessed through Vercel’s AI Gateway. These providers process your data to return a response and, under Vercel’s agreements with them, do not use it to train their models. Some providers keep prompts for up to 30 days to monitor for abuse and then delete them. We also create numeric embeddings of toil and team facts to find related items; those are stored in our database.

8. How we use and share information

We use the information we collect to:

• Provide, operate, maintain, and improve the Service.
• Identify repeated work, estimate its cost, and show your team what it is spending time on.
• Authenticate users, secure accounts, and prevent fraud and abuse.
• Send notifications, digests, and transactional email through SendGrid, and respond to support requests.
• Bill subscriptions and manage accounts.
• Analyze usage and AI performance to fix bugs and improve features.
• Comply with legal obligations and enforce our terms.

We do not sell personal information, and we do not share it for cross-context behavioral advertising. We share information only:

• Within your workspace. Your name, photo, posts, comments, and the toil you are affected by are visible to other members of your Team according to your Customer’s settings. Managers see more than members, including hourly rates and department-level cost. Content you share anonymously is shown without your name.
• With service providers who process data for us under contracts that limit their use of it: hosting and infrastructure (Vercel, Supabase), AI model providers (OpenAI, Anthropic, Google via Vercel AI Gateway), product analytics, session replay, and server logs (PostHog, Vercel Analytics), payments (Stripe), inbound and outbound email (SendGrid), HR data connectivity (Finch), and website crawling (Firecrawl). A current list is kept at untoil.com/subprocessors.
• With connected services at your direction. When you post from Slack, Chat, or Teams, turn on notifications, or connect an AI client through our MCP server, data flows to that service under its own terms.
• For legal reasons. When we believe disclosure is required to comply with law, legal process, or a governmental request, or to protect the rights, property, or safety of Untoil, our users, or others.
• In a business transfer. In connection with a merger, acquisition, financing, or sale of assets, subject to this policy.
• In aggregate. We may share aggregated or de-identified statistics that do not identify any person or Customer.

9. Data retention and deletion

• Workspace content (toil, comments, attachments, conversations, extracted context) is kept while the Customer’s workspace is active. When a Customer asks us to delete its workspace, or 120 days after a subscription ends, we delete it from production systems within 30 days and from backups within 120 days.
• Connected-tool data stops being collected the moment a tool is disconnected. Extracted context already in the workspace stays until the workspace is deleted or a Manager removes it.
• Account information is kept while you have an account and deleted or anonymized within 30 days of a verified deletion request, except where we must keep it for legal, billing, or security reasons.
• Attachments (files, screenshots, recordings) are kept with the workspace, and are deleted when you remove them. Attachments are served from long-lived links that are not guessable but do not expire, so anyone you give a link to can open that file while it exists. Do not attach anything you would not want forwarded. When a toil is deleted, its files are removed 120 days later, which is also how long you have to restore it.
• Session recordings are kept for up to 90 days. AI prompt and response text is kept for 30 days. Other usage data and error reports are kept for up to 7 years and then deleted or aggregated.
• Billing records are kept as long as tax and accounting law requires.

10. Cookies, analytics, and your choices

We use cookies and similar technologies to keep you signed in, remember preferences such as the rail width and your last workspace, measure usage, and record sessions as described in section 2. We do not use advertising cookies. You can control cookies in your browser, but the Service will not work without the sign-in cookie. Our analytics are first-party (events go through our own domain). We do not sell personal information or share it for advertising, so Global Privacy Control and Do Not Track signals do not change how the Service behaves. Analytics and session recording are part of how the Service runs and cannot be switched off separately. You can still ask us to delete the data we hold about you under section 12, by emailing team@untoil.com.

11. Data security

We use administrative, technical, and organizational measures designed to protect your information, including encryption in transit and at rest, least-privilege access for staff, audit logging of administrative actions, and masking of typed input in session recordings. Our security page describes these in more detail, including what we have not done yet. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If we learn of a breach affecting your information we will notify the Customer and, where required, you and regulators, without undue delay. Report security concerns to team@untoil.com.

12. Your rights and choices

Depending on where you live, you may have the right to access, correct, delete, or receive a copy of your personal information, to restrict or object to certain processing, and to not be discriminated against for exercising these rights. You can update most account information in the Service. To make a request, email team@untoil.com. We will verify your identity and respond within the time the law requires. You may appoint an authorized agent where the law allows.

If the information is in an employer’s workspace, we will refer the request to that Customer and help them respond, since they control it.

United States state privacy laws

In the past twelve months we have collected the categories of personal information listed in section 2 (identifiers, professional and employment information, commercial information, internet activity, audio and visual information, and inferences drawn from them), from the sources listed there, for the purposes in section 8, and disclosed them to the service providers in section 8. We do not sell personal information or share it for targeted advertising.

California treats the contents of messages as sensitive personal information when the company handling them is not the intended recipient. Reading a team’s channels and documents means we handle that information, and we use it only to run the features described in this policy. Pay rates are not sensitive personal information under that law, though we treat them carefully for obvious reasons.

California no longer exempts data about employees or business contacts, so the people in a Customer’s workspace have the same rights as anyone else, whether or not they ever signed in. Those rights run against their employer, who decides what Untoil reads. We act on the employer’s instructions and help them answer.

European Economic Area, United Kingdom, and Switzerland

Where we act as controller, our legal bases are performance of a contract (providing the Service to you), legitimate interests (securing and improving the Service, communicating with you), consent where we ask for it, and legal obligation. You may lodge a complaint with your supervisory authority.

Untoil is offered to organizations in the United States and we do not currently market the Service in these regions. If that changes we will update this policy first.

13. Where we process data

Untoil is based in the United States and our service providers process data in the United States. If you use the Service from elsewhere, your information is transferred to and processed in the United States, which may not provide the same protections as your home jurisdiction. Where required, we rely on Standard Contractual Clauses or other approved mechanisms for those transfers.

14. Children’s privacy

The Service is for use at work and is not directed to children under 18. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, contact us so we can delete it.

15. Changes to this policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email to workspace Managers or by notice in the Service before the change takes effect, and we will update the “Last updated” date above. Your continued use of the Service after changes take effect constitutes acceptance of the revised policy.

16. Contact

Untoil, Inc.
2261 Market Street STE 12903
San Francisco, CA 94114
United States
Privacy questions, requests, and security reports: team@untoil.com