Last Updated: August 28, 2026
This Privacy Notice for AppyPeople, Inc. ("we," "us," or "our") describes how and why we might access, collect, store, use, and/or share ("process") your personal information when you use our services ("Services"), including when you:
Questions or concerns? Reading this Privacy Notice will help you understand your privacy rights and choices. If you do not agree with our policies and practices, please do not use our Services. If you still have any questions or concerns, please contact us at [email protected].
Capitalized terms not defined in this Privacy Notice have the meaning given in our Terms of Service or our Data Processing Addendum, as applicable.
Two different roles. We handle personal information in two distinct capacities, and different rules apply to each.
Where we are a controller. We decide how and why personal information is processed when it concerns your account and your relationship with us. This covers account registration and authentication data, billing and payment data, usage and diagnostic data about how the Platform is used, personal information collected through our websites and marketing activities, and correspondence with our support team. This Privacy Notice describes that processing.
Where we are a processor. When a Customer uses the Platform to build and operate AI agents, the content that flows through those agents - messages, documents, files, prompts, outputs, and data retrieved from systems the Customer connects - is processed on that Customer's instructions, not ours. In that context the Customer is the controller and we act as a processor on its behalf. That processing is governed by our Data Processing Addendum at https://appy.ai/dpa, not by this Privacy Notice. If your personal information reached us because an organisation uses our Platform, that organisation determines how it is handled, and you should direct your privacy requests to it in the first instance. We will forward any request we receive directly to the relevant Customer.
Controller. The controller responsible for the processing described in this Privacy Notice is:
AppyPeople, Inc.
68 SE 6th St, Apt 2704
Miami, FL 33131
United States
[email protected]
Representative. We have appointed Prighter Group, with its local partners, as our privacy representative and your point of contact for the following regions:
Prighter gives you an easy way to exercise your privacy-related rights, such as requests to access or erase personal data. To contact us via Prighter, or to make use of your data subject rights, please visit https://app.prighter.com/portal/appy-ai
What personal information do we process? When you visit, use, or navigate our Services, we may process personal information depending on how you interact with us and the Services, the choices you make, and the products and features you use.
Do we process any sensitive personal information? Some information may be considered "special" or "sensitive" in certain jurisdictions, for example racial or ethnic origin, sexual orientation, and religious beliefs. We do not process sensitive personal information, and our Terms of Service prohibit Customers from submitting it to the Platform.
Do we collect any information from third parties? Yes. When you create an account or sign in, we receive profile information from Slack or Microsoft, which are the only ways to create an account with us. Where a Customer connects a third-party system to the Platform, we also receive data from that system on the Customer's instruction.
How do we process your information? We process your information to provide, improve, and administer our Services, communicate with you, for security and fraud prevention, and to comply with law. We may also process your information for other purposes with your consent. We process your information only when we have a valid legal reason to do so.
Do we use your data to train AI models? No. We do not use Customer content or the personal information described in this notice to train, fine-tune, or otherwise develop artificial intelligence models, and we require the same of our providers.
In what situations and with which types of parties do we share personal information? We share information in specific situations and with specific categories of third parties, listed in Section 4.
How do we keep your information safe? We maintain organisational and technical measures designed to protect personal information, described in Annex II to our Data Processing Addendum. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.
What are your rights? Depending on where you are located, applicable privacy law may give you certain rights regarding your personal information.
How do you exercise your rights? The easiest way is by submitting a data subject request, or by contacting us. We will consider and act on any request in accordance with applicable data protection laws.
In Short: We collect personal information that you provide to us.
We collect personal information that you voluntarily provide when you register for the Services, express an interest in obtaining information about us or our products and Services, participate in activities on the Services, or otherwise contact us.
Personal Information Provided by You. The personal information we collect depends on the context of your interactions with us, the choices you make, and the products and features you use. It may include:
Payment information. We do not collect or store payment card numbers. Payments are processed by Stripe, which collects your card details directly. We receive only limited billing information from Stripe, such as the last four digits of the card, the card brand, and the outcome of the transaction. Stripe's handling of your payment information is governed by its own privacy policy.
Sensitive Information. We do not process sensitive information.
Information received when you sign in. Accounts on the Platform can only be created and accessed through Slack or Microsoft. When you sign in, we receive profile information from that provider, as described in Section 6.
Customer Data. In using the Services, Customers and Authorized Users provide us with Customer Data. We use Customer Data other than personal information in accordance with our Terms of Service. Personal information contained in Customer Data is processed on the relevant Customer's instructions under our Data Processing Addendum, as described in "Our role" above, and not under this Privacy Notice.
Data from connected systems. Where a Customer authorises the Platform to access a third-party system - for example a messaging workspace, email account, file store, or business application - we receive data from that system in order to provide the functionality the Customer has configured. The Customer determines what is connected and what scope is granted.
We do not collect personal data directly from End Users unless they contact us through the Contact Us feature of our website. Each Customer is responsible for maintaining its own privacy notice, terms of use, and any applicable disclosures for each Delivery Channel through which it makes an AI agent available, and is responsible for all use of information collected from its End Users.
All personal information you provide to us must be true, complete, and accurate, and you must notify us of any changes.
In Short: Some information - such as your IP address and browser and device characteristics - is collected automatically when you visit our Services.
Log and Usage Data. Service-related, diagnostic, usage, and performance information that our servers automatically collect when you access or use the Services and record in log files. This may include your IP address, device information, browser type and settings, and information about your activity in the Services.
Device Data. Information about the computer, phone, tablet, or other device you use to access the Services, which may include IP address or proxy server, device and application identification numbers, location, browser type, hardware model, internet service provider or mobile carrier, operating system, and system configuration information.
Product analytics. We use PostHog to understand how the Platform is used so that we can operate and improve it. This includes event data associated with your account, including your email address. This is our own operational analytics and is separate from the Customer content we process as a processor.
Cookies and similar technologies. We use cookies and similar technologies as described in our Cookie Policy at https://appy.ai/cookie-policy.
Google API. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
In Short: We process your information to provide, improve, and administer our Services, communicate with you, for security and fraud prevention, and to comply with law.
We do not use the personal information described in this notice to train, fine-tune, or otherwise develop artificial intelligence models.
In Short: We only process your personal information when we believe it is necessary and we have a valid legal basis to do so under applicable law.
If you are located in the EU or UK, this section applies to you.
If you are located in Canada, this section applies to you.
We may process your information where you have given express consent, or in situations where your permission can be inferred (implied consent). You can withdraw your consent at any time.
In Short: We share information in the situations described in this section and with the categories of third parties listed below.
Vendors, consultants, and other third-party service providers. We share data with third-party vendors, service providers, contractors, and agents who perform services for us or on our behalf and require access to such information to do that work. We have contracts in place with these third parties designed to safeguard your personal information, and we remain responsible for their handling of it.
The categories of third parties we share personal information with are:
Named providers. The providers that process personal information contained in Customer content on our Customers' behalf are named in Annex III to our Data Processing Addendum at https://appy.ai/dpa. In addition to those providers:
Business Transfers. We may share or transfer your information in connection with, or during negotiations of, any merger, sale of company assets, financing, or acquisition of all or a portion of our business to another company.
International Transfers of Your Information. We are based in the United States and our providers process personal information in the United States. If you are located in the European Economic Area, United Kingdom, or Switzerland, your personal information may therefore be transferred to, stored, and processed in a country whose data protection laws differ from those in your jurisdiction. Where we transfer personal information out of the EEA, UK, or Switzerland, we rely on appropriate safeguards, such as the European Commission's Standard Contractual Clauses together with the UK International Data Transfer Addendum where applicable, or, where a recipient is certified under the EU-U.S. Data Privacy Framework, that framework. Further detail on transfers relating to Customer content is set out in Section 12 of our Data Processing Addendum. You may request a copy of the relevant safeguards by contacting us at [email protected].
We do not sell your personal information and we do not share it for cross-context behavioural advertising.
In Short: Yes. We offer products, features, and tools powered by artificial intelligence and machine learning.
Use of AI technologies. We provide our AI products through third-party providers ("AI Service Providers"), currently Anthropic, OpenAI, Google, xAI, Together AI, and fal.ai for model inference, and ElevenLabs for speech synthesis. Your input, output, and any personal information contained in them will be shared with and processed by these providers to enable your use of the AI products. The current list is maintained in Annex III to our Data Processing Addendum at https://appy.ai/dpa, and Customers are notified by email before a new provider begins processing. You must not use the AI products in any way that violates the terms or policies of any AI Service Provider.
Training. We do not use your input or output to train, fine-tune, or otherwise develop AI models, and we require our AI Service Providers not to use it to train or improve their models.
Automated decision-making. Our AI products generate content and can take actions that a Customer has configured them to take. We do not use them to make decisions producing legal effects concerning you, or similarly significant effects, without human involvement. Output may be inaccurate or incomplete, and it should be reviewed before it is relied on.
How we process your data using AI. All personal information processed through our AI products is handled in line with this Privacy Notice, our Data Processing Addendum, and our agreements with the relevant providers.
In Short: Accounts can only be created and accessed using Slack or Microsoft, and we receive certain profile information from whichever you use.
Our Platform does not offer password-based registration. The only ways to create an account and sign in are through your existing Slack or Microsoft account. We do not create or store a password for you.
When you sign in this way, we receive profile information from the provider, which will typically include your name, email address, profile picture, and an identifier for your account and organisation. We use that information only for the purposes described in this Privacy Notice.
Slack and Microsoft authenticate you as their own user and decide independently how they handle your information in doing so. We do not control, and are not responsible for, their use of your personal information. Their handling is governed by their own privacy policies.
Where a Customer separately connects Slack or Microsoft Teams as a channel through which its AI agents operate, that connection is authorised and controlled by the Customer.
In Short: We keep your information only for as long as necessary for the purposes set out in this Privacy Notice, unless a longer period is required or permitted by law.
We will keep your personal information for as long as you maintain an account with us, and thereafter only as long as necessary for the purposes described here or as required by law, such as for tax or accounting purposes.
The following retention periods apply to specific categories:
When we no longer have an ongoing legitimate business need to process your personal information, we will delete or anonymise it. Where that is not immediately possible - for example because it is held in backup archives - we will securely store it and isolate it from any further processing until deletion is possible. Retention and deletion of Customer content is governed by Section 10 of our Data Processing Addendum.
In Short: We maintain organisational and technical security measures designed to protect personal information.
We have implemented technical and organisational security measures designed to protect the personal information we process. These measures are described in detail in Annex II to our Data Processing Addendum at https://appy.ai/dpa, and include encryption in transit and at rest, access control and authentication requirements, continuous monitoring of access rights, logging, change management, and independent penetration testing.
Despite these safeguards, no electronic transmission over the internet or information storage technology can be guaranteed to be completely secure, so we cannot promise or guarantee that unauthorised third parties will not be able to defeat our security and improperly collect, access, steal, or modify your information. You should only access the Services within a secure environment.
In Short: We do not knowingly collect data from or market to children under 18 years of age.
We do not knowingly collect, solicit data from, or market to children under 18 years of age, nor do we knowingly sell such personal information. By using the Services, you represent that you are at least 18, or that you are the parent or guardian of such a minor and consent to that minor's use of the Services.
If we learn that personal information from a user under 18 has been collected, we will deactivate the account and take reasonable measures to promptly delete the data from our records. If you become aware of any data we may have collected from a child under 18, please contact us at [email protected].
In Short: Depending on your location, you may have rights that give you greater access to and control over your personal information.
In some regions, including the EEA, UK, Switzerland, and Canada, you have certain rights under applicable data protection laws. These may include the right (i) to request access to and obtain a copy of your personal information; (ii) to request rectification or erasure; (iii) to restrict processing; (iv) where applicable, to data portability; and (v) not to be subject to automated decision-making. In certain circumstances you may also have the right to object to processing.
You can make a request by contacting us using the details in Section 14, or through our representative, Prighter, at https://app.prighter.com/portal/appy-ai
Where an organisation uses our Platform. If your personal information is held in Customer content because an organisation uses our Services, that organisation is the controller. Please direct your request to it. If you contact us instead, we will acknowledge your request and forward it to the relevant Customer without undue delay.
Lodging a complaint with a supervisory authority. If you are located in the EEA, UK, or Switzerland and you believe we are unlawfully processing your personal information, you have the right to lodge a complaint with your local data protection supervisory authority. A list of EEA supervisory authorities is available at https://edpb.europa.eu/about-edpb/about-edpb/members_en. In the UK, the supervisory authority is the Information Commissioner's Office at https://ico.org.uk. You may also contact our EU or UK representative, Prighter, using the details above.
Withdrawing your consent. Where we rely on your consent, you have the right to withdraw it at any time by contacting us. This does not affect the lawfulness of processing carried out before withdrawal.
Opting out of marketing communications. You can unsubscribe at any time by clicking the unsubscribe link in our emails or by contacting us. You will then be removed from our marketing lists.
Account information. If you would like to review or change the information in your account, or terminate your account, you can contact us using the details in Section 14. On your request to terminate, we will deactivate or delete your account and information from our active databases, subject to the retention periods in Section 7.
If you have questions or comments about your privacy rights, you may email us at [email protected].
Most web browsers, and some mobile operating systems and applications, include a Do-Not-Track ("DNT") feature you can activate to signal your preference not to have your online browsing activities monitored and collected. No uniform technology standard for recognising and implementing DNT signals has been finalised, and we do not currently respond to DNT browser signals.
Separately, some browsers and extensions transmit an opt-out preference signal, such as Global Privacy Control ("GPC").
In Short: If you are a resident of California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Tennessee, Texas, Utah, or Virginia, you may have specific rights regarding your personal information.
Your rights. These rights are not absolute, and in certain cases we may decline a request as permitted by law. They include:
Sale, sharing, and sensitive personal information. We do not sell personal information, we do not share it for cross-context behavioural advertising, and we do not process sensitive personal information. We do not use or disclose personal information for purposes that would require us to offer a right to limit the use of sensitive personal information.
Where we act as a service provider. Where we process personal information on behalf of a Customer, we act as a service provider or processor under these laws, and the Customer is the business or controller. Requests should be directed to that Customer.
How to exercise your rights. You can contact us by submitting a data subject request or by emailing [email protected].
Request verification. On receiving your request, we will need to verify your identity. We will only use personal information provided in your request to verify your identity or authority to make the request.
Appeals. If we decline to act on your request, you may appeal by emailing [email protected]. We will inform you in writing of any action taken or not taken in response to the appeal, including a written explanation of the reasons.
California "Shine the Light" law. California Civil Code Section 1798.83 permits our users who are California residents to request and obtain from us, once a year and free of charge, information about categories of personal information we disclosed to third parties for direct marketing purposes and the names and addresses of all third parties with which we shared personal information in the immediately preceding calendar year.
In Short: Yes, we will update this notice as necessary to stay compliant with relevant laws.
We may update this Privacy Notice from time to time. The updated version will be indicated by an updated "Last Updated" date at the top. If we make material changes, we may notify you either by prominently posting a notice of the changes or by sending you a direct notification. We encourage you to review this Privacy Notice regularly.
If you have questions or comments about this notice, you may email us at [email protected] or contact us by post at:
AppyPeople, Inc.
68 SE 6th St, Apt 2704
Miami, FL 33131
United States
EU and UK data subjects may also contact our representative, Prighter, at https://app.prighter.com/portal/appy-ai
Depending on the applicable laws of your country or state of residence, you may have the right to request access to the personal information we collect from you, details about how we have processed it, correction of inaccuracies, or deletion of your personal information. You may also have the right to withdraw your consent to our processing.
To request to review, update, or delete your personal information, please email [email protected] or submit a data subject request through https://app.prighter.com/portal/appy-ai
If your personal information is held in Customer content because an organisation uses our Platform, please direct your request to that organisation, as described in Section 10.
