Privacy Policy
Draft of October 2026
Draft for legal review. This page is not in effect yet and may change before it is.
Aftermyth runs AI agents for your business: they answer calls, emails, texts and web chats, and help your team. To do that, we handle your account details and the conversations your agents have.
The short version: we use your data to run your agents and nothing else. We don't sell it, we don't use it for ads, and we don't train AI models on it. Your agents run on your own AI and phone accounts. You can delete your data.
Who we are
Aftermyth ("we", "us") is operated by [legal entity name], [address]. This policy covers aftermyth.ai, app.aftermyth.ai, the Aftermyth desktop app for Mac and Windows, and the web chat that businesses put on their own sites.
Questions or requests: [email protected].
Two kinds of data are covered here. Your account data (who you are, your plan) is ours to look after. The data your agents handle for your business, such as your customers' calls, emails and chats, belongs to your business: we process it for you, to run your agents, following your settings. If you are a customer of a business that uses Aftermyth, contact that business first; we will help them answer you.
What we collect
- Account: your name, email address and profile picture from Google sign-in, your organization's name, and who is on your team.
- Billing: Stripe takes your payment. We get your subscription status and invoice status, never your full card number.
- Keys you bring: the API keys or sign-ins you connect for OpenAI, OpenRouter, Anthropic, Google Gemini, xAI, Twilio and Apollo. We store them encrypted.
- What your agents work with: their instructions, the knowledge you upload or sync, conversations (calls, emails, texts, web chats and team chats), call recordings and transcripts, notes and memories agents save, leads and other records, and files agents make.
- Connected accounts: Google (Gmail, Calendar, Drive, Sheets), Discord, Slack, GitHub and Linear, only when you connect them. What we do with Google data is set out below.
- Desktop app: your sign-in (kept in the Mac Keychain or Windows Credential Manager), meeting notes you save, and, only while you use Listen, meetings, dictation or Ask, your microphone and a screenshot you choose to share.
- Technical data: IP address, browser and device details, and logs. We keep traces of how agents ran (timings, steps, errors) with the message text removed.
How we use it
- To run the service: your agents, the console, the desktop app and the web chat.
- To bill you and stop use when a subscription isn't paid.
- To keep the service safe: sign-in checks (Cloudflare Turnstile), abuse prevention, and investigating problems.
- To support you when you ask for help.
- To keep the service working well, using counts and traces without message text.
We don't sell personal information, we don't share it for advertising, and we don't use your data or your customers' data to train AI models.
Your AI and phone accounts (bring your own keys)
Your agents run on accounts you own. To do each task, we send what that task needs (the conversation, the knowledge that applies, the email being answered, a call's audio) to the AI provider you chose, under your account and that provider's terms with you. We don't run your agents on our own AI or phone accounts.
- OpenAI: chat, the live voice on calls, transcription, and knowledge search.
- OpenRouter: when you pick a model from it, we ask OpenRouter to use only providers that keep no data (zero data retention) and to deny data collection. "US-based AI companies only" is on unless you turn it off.
- Anthropic, Google Gemini and xAI: when you connect them and pick their models. How long they keep requests follows your agreement with them.
- Twilio: your phone numbers, calls and texts.
- Apollo: lead search, if you connect it.
Calls, recordings and texts
Every call an agent answers or makes is recorded, both sides, and transcribed, so you can review it. Live audio goes from Twilio to OpenAI on your account. We keep our copy of a recording for 30 days and then delete it automatically. Twilio also keeps a copy in your Twilio account until you delete it there. Transcripts stay with the conversation.
You are responsible for telling callers that they are talking to an AI and that the call is recorded, where the law requires it. Some places require everyone on a call to agree to recording. Putting it in your agent's greeting is the simplest way.
Texts: replying STOP to one of your numbers stops texts from it. We record opt-outs and respect them everywhere in the product.
Google user data
You choose which Google connections to make, in Connectors. Each asks only for what it needs:
- Sign in with Google: your name, email address and profile picture, to identify you.
- Gmail: the email agent reads new mail in your inbox to answer it; when you ask in team chat, agents search and read your threads; and agents send the replies you approve. The connection also includes Google's permission to change mail (gmail.modify), because OpenAI's hosted Gmail connector requires it when you ask an agent to analyze emails. We don't delete, move or label your mail.
- Google Calendar: agents read your primary calendar to offer open times, and create and update events, with invitations, when they book a meeting.
- Google Drive: agents read the folders you choose as knowledge, files you link or name, and search your Drive when you ask. They create Google Slides decks and Sheets. If you turn on "Let agents update your lead sheets", they update those sheets too.
What we keep: new emails that arrive in a connected inbox (sender, recipients, subject and body) and the replies agents send, the text of knowledge files, and your Google connection, encrypted. We keep them until you delete them or the agent that uses them (see How long we keep it).
Who it goes to: only to provide the features you use. Google data that a task needs goes to the AI provider on your own account. When you ask an agent to analyze emails or Drive files, we give OpenAI's hosted connector, on your OpenAI account, a short-lived access token so it can read the items involved.
We don't sell Google user data or use it for advertising. We don't use data from Google Workspace APIs to develop, improve or train generalized AI or machine-learning models. People at Aftermyth don't read it unless you ask us to (for support), it is needed for security or to investigate abuse, or the law requires it.
Aftermyth's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
To stop it: Connectors > Disconnect removes the connection and revokes our access at Google. You can also remove Aftermyth at myaccount.google.com/permissions.
How long we keep it
- Conversations, transcripts, emails, notes, memories, leads and files: until you delete them or the agent they belong to, or close your account.
- Call recordings: 30 days in our storage (your Twilio copy follows your Twilio settings).
- Traces of agent runs, without message text: about 90 days.
- Delivery and processing records: 7 days after they finish.
- Sign-in sessions: 24 hours in the browser; the desktop app stays signed in for up to 90 days.
- Billing records: as long as tax and accounting law requires.
- Backups: [backup period] before they roll off.
Deleting your data and your choices
- Delete things yourself in the console: agents, knowledge, agents' files, keys and connections. Deleting an agent deletes its conversations, emails, recordings, memories, traces and files. To delete leads or other single records, ask us.
- When you tell an agent to forget something, it stops using it right away. It is deleted for good when you delete the agent, or when you ask us.
- Cancel your subscription any time in Settings > Billing.
- Delete your whole account: email [email protected] from the account owner's address. We delete your organization's data within 30 days, except billing records we must keep.
- Get a copy of your data, or correct it: email [email protected]. You can also download your usage from the console.
Depending on where you live (for example California, the EU or the UK), you may have further rights, such as to know what we hold, to object, or to complain to a regulator. We honor them, and we won't treat you differently for using them.
Security
Traffic is encrypted in transit. Keys, tokens and Google connections are encrypted with AES-256 before we store them, and only our account service can decrypt them. Each service gets only the secrets it needs. Card details stay with Stripe. No system is perfectly secure; if a breach affects you, we will tell you as the law requires.
Children
Aftermyth is a business service for people 18 and over. It is not meant for children, and we don't knowingly collect their data.
Where your data is
We store data in the United States. AI providers you choose may process it elsewhere, under your agreement with them.
Changes to this policy
If we change this policy in a way that matters, we will tell account owners by email or in the app before it takes effect. The date at the top shows the latest version.