AI Workspace Privacy Policy

1. Who is responsible

Network Integration Specialists ("NIS", "we") runs AI Workspace for your organization. For the content your members put into AI Workspace, your organization decides what is kept and NIS processes it on your organization's behalf.

2. What we store

• Accounts. Each member's name, work email address, role, and the Microsoft or Google organization they sign in through.
• Sign-up. The organization's name, the email address and name of the person who signed up, the starting credit, the versions of these terms they accepted and when. To limit abuse, we keep a keyed hash of the sign-up's internet address, not the address itself.
• Conversations. Messages and answers, as your organization's logging setting allows. Sensitive values that your privacy rules replace are stored as placeholders. Where the original values are kept so that an answer can show them, they are encrypted with your organization's own key.
• Files. Text taken from files your members attach, after your privacy rules run on it, and images after a safety scan.
• Connected sources. When a member connects Google Drive, OneDrive, SharePoint or mail, the connection and its access token, encrypted with your organization's key.
• Usage and billing. Which model was used, how many tokens, the cost, budgets, seats and payments.
• Audit records. Who changed a setting and when, and which privacy rules found something (the kind of value, never the value).

3. What we do not store

• Card numbers. Stripe holds your card.
• Passwords. Your members sign in with Microsoft or Google.

4. How long we keep it

• Conversations are deleted when they pass your organization's retention period. Your administrator sets it, within a range NIS sets (7 to 365 days by default). A legal hold keeps a conversation past that period until the hold is lifted.
• Temporary chats store no content.
• Sign-up records are kept for 90 days. The accepted terms are also kept on your workspace's record.
• Billing records are kept as long as tax and accounting law requires.
• When a workspace closes, its content is deleted. Billing and audit records are kept as the law requires.
• Backups are encrypted and age out on a fixed schedule.

5. Who processes data for us

AI Workspace uses these services to run:

• Supabase hosts the database and the sign-in sessions.
• Cloudflare carries the traffic to the app, and runs your organization's AI gateway. Your administrator can turn on a content safety check. The gateway then keeps the checked text in a log that NIS can read, outside the app's retention period.
• AI model providers receive the messages your members send to their models, after your privacy rules run. NIS approves each provider and keeps a record of its data-use terms. A provider that trains on customer data is not used for customer workspaces.
• Stripe processes payments and keeps the card.
• Microsoft and Google sign your members in. Your members' own browsers may send speech to their vendor if your administrator turns on voice input.

NIS also uses its own support and accounting systems (Halo and QuickBooks) for your organization's billing contact and invoices.

6. How we use data

• To run the service for your organization, and to support it.
• To bill your organization.
• To keep the service secure, and to find and stop abuse.

We do not sell personal data. We do not use your content to train AI models.

Data from Google APIs

AI Workspace's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy and the Google Workspace API User Data and Developer Policy, including the Limited Use requirements. The use of raw or derived user data received from Workspace APIs will adhere to the Google User Data Policy, including the Limited Use requirements.

When a member connects Google Drive, Gmail or Google Calendar, AI Workspace reads only the files, messages and events that member picks or asks about, and uses them only for the AI Workspace features that member uses. In particular:

• Google user data, raw, aggregated or derived, is never used to create, train or improve AI or machine learning models, foundational or general, ours or anyone else's.
• The AI model providers that receive it to answer the member are bound by their terms not to train on it (section 5).
• It is never sold, never used for advertising, and never transferred to anyone except to provide the feature the member uses, for security, or where the law requires it.
• People at NIS do not read it, except with the member's agreement, for security, or where the law requires it.

7. Who can see conversations

• Your members see their own conversations.
• Your administrators and content auditors can see what your settings allow, and their access is recorded.
• NIS staff are blocked from your conversation content in the normal running of the service.

8. Your choices

• A member can ask your administrator for a copy of their data, or for it to be corrected or deleted.
• Your administrator can export your organization's content, and can change logging and retention.
• For anything else, contact NIS support.

9. Security

Data is encrypted in transit and at rest. Each organization's sensitive values are encrypted with its own key. Access by NIS staff is limited and recorded.

10. Changes

NIS can change this policy. The version date is at the top. NIS tells existing customers before a change applies to them.