Privacy Policy

This policy covers SC Workspace (the app on your computer, its web app and the ws command line), our portal at portal.schlesinger.consulting, and our website at schlesinger.consulting. "We" means Haim Schlesinger, trading as Schlesinger Consulting.

In short

• Your work stays on your computer. Chats, notes, meetings, calendars and contacts are kept by SC Workspace on your own computer, not on our servers.
• Your workers run on your own AI account (Claude or ChatGPT). What a worker sends goes from your computer to that AI company under your account with them, not through us. We don't keep your chats on our servers.
• Google data you connect is read from Google by your computer and kept there. We don't sell it, use it for ads, or use it to train AI models.
• Our portal holds your account: your sign-in, your name and email, and your company's details.
• Soon we'll count visits to our website without a cookie, and set a cookie only if you say yes.
• Soon the app will send us daily counts of how it's used, never your content. An owner or admin can turn this off.
• Bank data you connect in Finance is read-only and kept encrypted on your computer. We never sell it.
• If you pay us, Stripe takes the payment. We never see your full card number.

What stays on your computer

SC Workspace keeps its data in its own folder on your computer. That includes:

• your chats and your workers' replies;
• your notes and each worker's notes;
• files you add and files workers make;
• jobs, workflows and their results;
• meetings: what each person said, as text. The sound itself is never saved, and voice prints are dropped when the meeting ends;
• your calendars and your contacts (see "Google user data");
• bank accounts, balances and transactions you connect in Finance (see "Bank data in Finance");
• local backups.

The SC Workspace web app talks only to SC Workspace on the same computer. It doesn't work from another machine.

We don't receive this data. It leaves your computer only in the ways listed in "What leaves your computer".

What our portal holds

The portal is how you sign in and how your company's members are managed. It holds:

• Your account: your name, email, role and photo.
• Your company: its name, its kind of business, its logo and settings, and the people you invite (their email and role).
• Sign-in: if you sign in with Google, we ask only for openid, email and profile, to know who you are. If you sign in by email, we send you a one-time code and a sign-in link through Resend, our email company. Sign-in cookies are used only to keep you signed in.
• Devices: a record of each computer or phone you sign in on, so you can remove one.
• An audit log: sign-ins and sign-outs, member and invite changes and settings changes, with the time, IP address and browser or app name. It never holds the content of your work, tokens or passwords. Owners and admins of your company can read it.
• Billing: if you buy a paid plan or add-on, you pay on Stripe's own page. Stripe keeps your card. We keep your plan, its status and dates, your card's brand, last 4 digits and expiry date, and your invoices (number, amount, date and status).
• Your customer record: see "Your customer record and who reads it".

The portal runs on Cloudflare.

Our website

We haven't switched this on yet. This section says how it will work.

We count how our website is used, on our own Cloudflare account. For each visit we count:

• the pages viewed;
• clicks on buttons and downloads;
• the campaign code in the link you followed, such as ?c= or utm_ tags;
• your country, as Cloudflare reports it;
• the kind of browser and device, such as Safari on iPhone.

These are counts only. We don't set a cookie for them, we don't keep your IP address, and we don't use third-party analytics, ad trackers or scripts from other companies.

If you say yes

The website asks once whether we may remember your visit. Yes and No are both one click.

• If you say yes, we set one cookie, sc_j, on schlesinger.consulting and its portal. It holds a random visit ID, nothing else, and lasts 90 days. If you sign up within that time, it links your visit and your download to your new account, so we know which link brought you.
• If you say no, or don't answer, we only count, as above.
• Global Privacy Control. If your browser sends a Global Privacy Control signal, we treat it as No and don't ask.
• To take it back, delete the cookies for schlesinger.consulting in your browser. To unlink a visit already tied to your account, email us.

How did you hear about us

When you sign up, we may ask how you heard about us. Answering is optional. We keep your answer with your customer record.

Product data from the app

We haven't switched this on yet. This section says how it will work.

After you sign in, SC Workspace sends our portal a short report once a day, so we can see how the app is used and fix what doesn't work. It holds only:

• counts of fixed actions: how often the app was opened, workers hired, workflows run and chats sent;
• your setup, as items from our own lists: the kinds of business you picked, your teams, the names of apps you connected (such as "Gmail"), and how many members and workers you have.

It never holds your chats, notes, files, names, contacts or anything you typed.

• It's on by default. An owner or admin of your company can turn it off for the whole company in Settings. It stops at once.
• Turning it off doesn't stop the app from checking in with the portal to keep you signed in, so we still see when each device was last used.

Your customer record and who reads it

We haven't switched this on yet. This section says how it will work.

For each company that signs up, we keep one customer record. It holds:

• your company's name and its people (names, emails and roles);
• where you are with us: signed up, set up, active or paying, and your plan;
• when the app was last used;
• where you came from: the campaign link, your visit if you said yes, and your answer to "How did you hear about us";
• your setup and counts from product data, if it's on.

Only our own staff read it, when they need it to support you, run the service or plan our marketing. Each staff member signs in with a second step, and every read is logged. When staff open your company's record, a row is added to your company's activity log, which your owners and admins can read.

Bank data in Finance

Finance can connect your bank so you see your accounts, balances and transactions in SC Workspace. We use Plaid to make the connection.

• Read-only. SC Workspace reads accounts, balances, transactions and investments. It can't move money or change anything at your bank.
• Kept on your computer, encrypted. Bank data is stored only on your own computer, in an encrypted database. Your bank connection's key is kept in your computer's secure keychain.
• What passes through our servers. Calls to Plaid go through our portal, which passes them on without storing what's in them. It keeps only a scrambled code for each connection, to limit how many connections an account can have.
• Never sold, never used for ads and never used to train AI models.
• Removed when you're done. When you remove a bank connection, we end it at Plaid and delete its key and every account, balance and transaction stored for it. If your computer is offline, the data is deleted at once and Plaid is told when you're back online. Signing out and resetting your workspace delete it the same way.
• Plaid handles your bank sign-in under its own End User Privacy Policy.

Your own AI account

• Your workers use your own account with Anthropic (Claude) or OpenAI (ChatGPT). That company's terms and privacy policy apply to what it receives, along with the settings you chose there.
• What a worker sends goes from your computer straight to that company. It doesn't pass through our servers, and we don't keep your chats.

When you ask us for help

If you open a support request and give our staff access, they can send a question to one of your workers. The worker's answer reaches us only after you've seen the exact words and allowed it. You can withdraw the access at any time.

What leaves your computer

Your AI company keeps what it receives under its own terms and your settings with it, not ours. Read their privacy terms before you connect an account.

Google user data

SC Workspace can connect your Google account to show your calendar and to import your contacts. It asks for read-only access:

SC Workspace can't change, send or delete anything in your Google account.

Where it goes. Google data goes straight from Google to SC Workspace on your computer. It doesn't pass through or get stored on our servers.

• Calendar: event titles, times, places, notes and the people invited are kept on your computer. Only you can see them, not other members of your company. Private events keep only their title and times. When you disconnect, the calendars and events are deleted from your computer at once, and SC Workspace asks Google to end its access.
• Contacts: Google contacts are read only when you start an import, and only the ones you choose to import are kept. Imported contacts join your company's contacts on your computer, so members of your company with access to contacts can see them.
• Your Google sign-in is kept in your computer's secure keychain, never in our files or on the portal.

What workers see. Today workers can't read your calendar or your Google contacts.

Gmail. SC Workspace doesn't ask for access to Gmail today. Before it does, we'll update this policy to say what it reads, what it keeps and for how long.

Limited Use. SC Workspace's use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

That means:

• We don't sell Google user data.
• We don't use Google user data for advertising, including retargeting or personalized ads.
• We don't use Google user data to train or improve AI or machine learning models, ours or anyone else's.
• We use and transfer Google user data only to provide the features you see in SC Workspace, for security, or to comply with the law.
• No person reads your Google user data, except when you agree to it for a specific support request, when it's needed for security (such as investigating abuse), or when the law requires it.

You can also remove SC Workspace's access at any time at https://myaccount.google.com/permissions.

Meta (Facebook, Instagram, WhatsApp)

SC Workspace doesn't connect to Meta today. If we add it, Meta data will follow the same rules as Google data: kept on your computer, used only for the features you turn on, never sold, used for ads or used to train AI models. We'll update this policy before we connect to Meta.

No ads, no selling, no third-party tracking

• We don't sell personal data.
• We don't show ads.
• We don't use your data, or anything read from your connected accounts, to train AI models.
• Our website and portal use no third-party analytics, ad trackers or tracking scripts. The counting we do ourselves is described in "Our website" and "Product data from the app".

Who we share data with

• Cloudflare, which runs our portal and website.
• Google, for "Sign in with Google".
• Resend, to send sign-in emails.
• Plaid, to connect your bank when you use Finance.
• Stripe, to take payments if you buy a paid plan or add-on.
• People in your company, as their role allows.
• Authorities, only when the law requires it, such as a valid court order or subpoena.

Your AI company and Google receive data from your computer under your own accounts with them. They don't work for us when they do.

How long we keep it

• On your computer: until you delete it, disconnect the account, or remove SC Workspace's data.
• On the portal: your account and company details while your account exists. The audit log keeps entries for 1 year.
• Bank data: on your computer while you keep the bank connection. It's deleted when you remove the connection, sign out or reset your workspace.
• Website counts: 2 years.
• Visit IDs never linked to an account: 90 days.
• Product data: 13 months.
• Notify me emails: until we send the email you asked for, and never longer than 12 months.
• Your customer record, and a visit linked to your account: while your company's account exists.
• Billing: our copy of your plan and invoices is deleted with your company. Stripe keeps its own payment records under its own terms.
• Backups: data you delete from the portal is removed from our backups on their normal cycle.

Getting a copy of your data

• On your computer: your data is already yours. It sits in SC Workspace's own folder on your computer, along with its local backups.
• On the portal: email haim@schlesinger.consulting from the address you sign in with. We'll send you a link to a file of what the portal holds about you, or about your whole company if you're its owner. The link works for 7 days.

Deleting your data

• On your computer: delete chats, notes and files in the app, or disconnect Google to delete your calendars and events at once.
• Your account: delete it yourself in SC Workspace, or run ws account delete in your own Terminal. Your account is deleted on the portal and you leave every company. Then this computer's SC Workspace data is deleted. Before anything is deleted, the app saves a copy of this computer's data in a dated folder next to it, so you can restore it. Delete that folder yourself if you don't want it.
• If you're the only owner of a company that has other members, make someone else an owner first.
• Your company: email us from the address you sign in with. When a company is deleted, its data on the portal is removed after a 30-day hold, which you can cancel. A company where you were the only member goes the same way when you delete your account. One record that the deletion happened stays for 1 year (a scrambled form of the company name, dates and counts, never your content).
• Google access: disconnect in SC Workspace, or remove access at https://myaccount.google.com/permissions.
• Bank data: remove the bank connection in Finance. Its data is deleted from your computer at once.
• Product data: an owner or admin turns it off in Settings. To delete what we already hold, email us.

Your rights

Depending on where you live, you may have the right to see, correct, delete or get a copy of your data, to object to or limit how we use it, and to complain to your local data protection authority. To use any of these rights, email haim@schlesinger.consulting from the address you sign in with. We'll answer, and we won't treat you differently for asking.

Children

SC Workspace isn't meant for anyone under 13, or under 16 in the European Union, and we don't knowingly collect their data. If you think a child has given us data, email us and we'll delete it.

Where data is stored

Your work stays on your own computer. We are based in Texas, USA. Portal data is stored with Cloudflare.

Changes to this policy

We'll post any change here with a new effective date. If a change matters, we'll tell account owners by email or in the app first.

Contact

Haim Schlesinger, trading as Schlesinger Consulting
PO Box 14426, Austin, TX 78761
haim@schlesinger.consulting