Privacy & Data Policy

Definitions

For purposes of this Privacy Policy:

• "Input" means any text, prompts, data, files, or other materials you submit to the Service.
• "Output" means any content, analysis, recommendations, or responses generated by the Service based on your Input.
• "Service" means the Executive Advisor product, including the 122ai website, applications, AI models, tools, and related services.
• "Notes" means key contextual information saved to your Notebook to personalize future interactions.

Data Controller

122ai.io
United States

Contact: privacy@122ai.io

Legal Basis for Processing (GDPR)

• Contractual Necessity: To provide our AI advisory services
• Legitimate Interest: To improve and secure our platform
• Consent: For optional features and communications
• Legal Obligation: To comply with applicable laws

How Executive Advisor Works

1. You type a message

   Your input is captured in your browser and authenticated via Clerk

2. Securely stored in cloud database

   Your conversation is saved to our Neon PostgreSQL database with SSL encryption, enabling multi-device access and sync

3. Sent to Anthropic's API

   Your message is securely transmitted to Anthropic's servers for AI processing. Quick and the background tasks (such as conversation titles and summaries, Notebook notes, the meeting prep on your calendar and the web searches for your briefing and company news) use Anthropic's API too. When you ask for a file made with AI (a designed PowerPoint, Excel workbook or Word document), that document's content is also sent to Anthropic, which builds the file

4. AI generates response

   Anthropic's models analyze your message and create strategic insights

5. Response stored and returned

   The response is saved to your database record and displayed in your browser. A local cache is maintained for offline access.

Boardroom Mode (Ephemeral Sessions)

For your most sensitive discussions, the Service offers "Boardroom Mode" — ephemeral sessions with enhanced privacy protections:

• Not Written to Your History: Boardroom messages are processed in real time and are not written to your conversation history.
• No Notebook Access: These sessions are excluded from your account's Notebook and personalization systems.
• Session-Only Context: Boardroom sessions load no profile, notes or memory, and are excluded from memory extraction.
• Content-Redacted Logging: For Boardroom and Quick requests, the main chat pipeline's request-scoped content-bearing error logger is disabled. Other application logs may still record content-safe operational metadata and account/request identifiers. Ordinary-session logs may include provider-error details. Boardroom and Quick are not no-logging modes.
• Session-Only Documents: Documents created in Boardroom can be downloaded during the session, but are not written to your history or document library, so they are not available after you leave the session in the app. Archiving is unavailable. Provider-side abuse-monitoring retention may still apply — see the note below.

Note: AI processing still occurs via Anthropic's API, which by default deletes API inputs and outputs within 30 days, with exceptions its policy describes, such as content flagged under its usage policies or a legal requirement to keep it. Boardroom Mode limits what 122ai stores; it does not remove the provider's temporary safety logs.

Quick Mode (Lightweight Sessions)

For fast, simple questions, the Service offers "Quick" — ephemeral sessions optimized for speed:

• Focused AI Workflow: Uses a faster, lighter-weight Anthropic model and a shorter prompt for straightforward questions.
• Not in Your Saved History: Quick conversations are not added to your saved conversation history.
• No Notebook Access: These sessions are excluded from your account's Notebook and personalization systems.
• Session-Only Context: Quick sessions load no profile or notes and are excluded from memory extraction.
• Still Processed Normally: Standard service processing, operational logging, and provider retention may still apply. AI processing occurs via Anthropic's API, and Anthropic's retention, described under Third-Party Data Processors, applies.

When to use: Quick is ideal for simple questions, clarifications, or tasks that don't require deep strategic analysis. For sensitive discussions, use Boardroom Mode instead: it loads no profile or notes, is excluded from memory extraction, and its documents are session-only rather than saved to your history or library.

Data Storage & Security Architecture

Database Storage (Neon PostgreSQL)

Your conversations are stored in a secure, serverless PostgreSQL database:

• Encryption in Transit: TLS 1.3 with SSL/TLS encryption for all database connections
• Encryption at Rest: AES-256 encryption for all stored data (managed by Neon)
• User-Scoped Queries: All database queries are filtered by your user ID - you can only access your own data
• Connection Pooling: Efficient, secure connection management with automatic timeout
• Data Isolation: Multi-tenant architecture with strict logical separation

Authentication & Access Control (Clerk)

User authentication and session management powered by Clerk:

• OAuth 2.0: Industry-standard authentication protocols
• Secure Sessions: JWT-based session tokens with automatic refresh
• Multi-Device Support: Access your conversations from any authenticated device
• Account Security: Password requirements, MFA support, and breach detection

API Security

All API endpoints implement security best practices:

• Authentication Required: All database operations verify user identity via Clerk middleware
• Parameterized Queries: SQL injection protection through prepared statements
• HTTPS Only: All communications encrypted in transit with TLS 1.3
• Security Headers: CORS policies, Content Security Policy (CSP), and X-Frame-Options
• Input Validation: Server-side validation and sanitization of all user inputs
• Rate Limiting: Protection against abuse and DoS attacks (planned)

Local Caching (Optional)

For improved performance and offline access, conversations are also cached in your browser's localStorage. This local cache is automatically synchronized with the cloud database.

What We Do

Store conversations securely

Your sessions are encrypted and stored in a secure cloud database with strict access controls

Enable multi-device access

Access your conversation history from any device after authenticating

Protect your data with encryption

All data is encrypted in transit (HTTPS/SSL) and protected by authentication

Give you full control

Export, delete, or manage your conversations anytime through your account

Maintain transparency

Clear documentation of all data collection, storage, and processing practices

What We Do NOT Do

Share or sell your data

We have no business model based on data monetization. Your data is never sold to third parties.

Train AI models on your conversations

Your conversations are used only to provide you with AI assistance, never for training purposes

Use tracking or advertising cookies

We use only essential cookies for authentication and functionality - no tracking or ad networks

Essential Cookies: Clerk session cookies (__session, __client_uat) for authentication and security. These are strictly necessary for the service to function.

Allow unauthorized access

Strict authentication and row-level security ensure only you can access your data

Third-Party Data Processors

122ai uses the following trusted third-party services to deliver our platform. Each has been selected for their strong security and privacy practices, and each processes data under its own data processing terms:

Anthropic (Conversations, Quick, Files Made with AI and Background Tasks)

Your conversations with the Advisor are processed by Anthropic's API to generate its answers. When you ask for a file made with AI (a designed PowerPoint, Excel workbook or Word document), the content of that document is also sent to Anthropic's API, which builds the file. Anthropic's API also answers Quick questions, runs Run a Plan, and runs background tasks, such as conversation titles and summaries, drafting and tidying your Notebook notes, your daily briefing, company research and company news, the meeting prep on your calendar and to-do prep, your prepared morning, and confirming possible duplicate to-dos.

• Web search: When your briefing, company research or company news needs current information, the search queries (built from your company, industry and topics) are run by Anthropic's web search tool, and the pages it finds are processed by Anthropic's API
• No training by default: Anthropic does not use data sent through its commercial API to train its models
• Retention: By default, Anthropic deletes API inputs and outputs within 30 days. Its policy lists exceptions: content flagged under its usage policies (inputs and outputs for up to 2 years, safety classification scores for up to 7 years), legal requirements, and services with their own retention, such as file storage
• Prompt caching: Anthropic may briefly cache reusable prompt prefixes to improve speed and cost
• Build environment: A file made with AI is built in Anthropic's code-execution environment; that environment and Anthropic's file storage follow Anthropic's own retention for them
• File copies: 122ai copies the finished file to your account, then asks Anthropic to delete it from its file storage. A deletion that is not confirmed is retried, and 122ai never treats a deletion as done until Anthropic confirms it; until then the file stays in Anthropic's file storage under its policy

View Anthropic's data retention information →

Clerk (Authentication)

User authentication and session management powered by Clerk.

• Secure authentication: Industry-standard OAuth 2.0 and JWT tokens
• Data collected: Email address, authentication credentials, session data
• Security features: MFA support, breach detection, secure password storage
• Compliance: SOC 2 Type II, GDPR, CCPA compliant

View Clerk's privacy policy →

Neon (Database Hosting)

Conversation data, messages, and metadata are stored in a Neon-hosted PostgreSQL database.

• Serverless PostgreSQL: Auto-scaling, high-availability database infrastructure
• Data encryption: SSL/TLS in transit, AES-256 encryption at rest
• Geographic location: US East (configurable)
• Compliance: SOC 2 Type II certified

View Neon's privacy policy →

Vercel (Application & File Hosting)

The 122ai application is hosted on Vercel's edge network. Uploaded files are stored in Vercel Blob Storage.

• Edge deployment: Global CDN for fast, secure delivery
• HTTPS only: All connections encrypted with TLS 1.3
• File storage: Uploaded attachments stored in Vercel Blob with private access (token-authenticated)
• File deletion: Uploaded files are permanently deleted when you delete a conversation or your account
• Logs: Request logs retained for 7 days for debugging and security
• Analytics: Vercel Analytics collects anonymized page view data (pages visited, geographic region, device type) to help us understand usage patterns. No personal information or conversation content is included in analytics.
• Compliance: SOC 2 Type II, GDPR compliant

View Vercel's privacy policy →

We also use these services. Each handles the data described here under its own terms, linked below:

Stripe (Payments)

Subscriptions and payments are handled through Stripe's hosted checkout and billing portal.

• Card details: Entered on Stripe's pages and processed by Stripe; they never reach 122ai's servers
• What 122ai keeps: Your Stripe customer and subscription identifiers and your plan's billing status

View Stripe's privacy policy →

Upstash (Rate Limiting)

Short-lived request counters protect the Service from abuse and overload.

• Data: Your account identifier and request counts; no conversation content
• Retention: Counters expire automatically at the end of each limit window

View Upstash's privacy policy →

Resend (Email to Our Team)

Delivers emails to the 122ai team, such as the feedback you give when you cancel a subscription.

• Data: Your email address, your cancellation reason and any comments you write

View Resend's privacy policy →

TypeSafe AI, Inc. (Specific Assistant Features)

TypeSafe's API helps with specific features: choosing which of your saved notes are relevant to a question you ask, checking a note learned from a conversation before it is saved, picking the latest of your saved figures, suggesting which figure or date in an email reply answers a request you sent, spotting to-dos that duplicate ones you already have, suggesting your industry from your company description, and preparing your morning (choosing what matters most, checking the Advisor's take against your records before it is shown, and sorting replies on Today).

• Data sent: Only the short pieces of text each feature needs, such as your question and the candidate notes, a reply's candidate figures or dates, the to-do titles being compared, or short descriptions of the day's meetings, to-dos and decisions
• Handling: TypeSafe processes this data under its own terms of use and privacy policy

View TypeSafe's privacy policy →

Services You Connect or Turn On

These run only when you choose to use them:

Microsoft (Outlook Connection)

If you connect Outlook, 122ai reads your calendar events and, for Requests, the replies to requests you sent, through Microsoft's API with read-only permissions you grant.

• Access: Granted by you through Microsoft's sign-in, and revocable in your Microsoft account
• Tokens: Microsoft access tokens are stored encrypted
• AI use: Details from your calendar and mail may be included when our AI providers answer your questions or build your briefing

View Microsoft's privacy statement →

Open-Meteo and OpenStreetMap (Weather)

If you turn on weather and allow location access, your browser sends your location (latitude and longitude) directly to Open-Meteo for the forecast and to OpenStreetMap's Nominatim service for your city's name.

• Direct from your browser: These services also see your IP address, as with any website request
• Not stored by 122ai: Your location is not sent to or stored on 122ai's servers

View Open-Meteo's terms and privacy →
View OpenStreetMap's privacy policy →

Data Retention & Your Rights

Data Retention

We retain your data only as long as necessary to provide our services and comply with legal obligations.

• Conversations: Retained until you delete them or close your account. We store conversations to enable multi-device access and continuity of your advisory sessions.
• Account data: Retained while your account is active. After deletion, database point-in-time restore capability maintains history for 6 hours (disaster recovery only), after which your data becomes permanently unrecoverable.
• Logs: Request logs retained for 7 days for security and debugging
• Anthropic processing (conversations, Quick, files made with AI and background tasks): Not used for model training by default. By default, Anthropic deletes API inputs and outputs within 30 days, with the exceptions its policy describes (such as content flagged under its usage policies). For files made with AI, the build environment and Anthropic's file storage follow Anthropic's own retention for them; 122ai asks Anthropic to delete each finished file once it is copied to your account, and retries until the deletion is confirmed.
• TypeSafe processing: Only the short excerpts its features need, retained under TypeSafe's terms.
• Prepared mornings: The morning prepared for a day (its writing, meeting prep, drafted follow-ups and your answer to its question) is deleted 14 days after that day. The record of what preparing it cost, which holds no content, is kept.
• Notes (Cross-Conversation Context): Key facts saved to your Notebook (e.g., your role, industry, preferences) to personalize future interactions. Retained until you delete them individually via the Notebook interface or close your account. You have full control to view, export, and delete all notes.

People Asked to Answer a Team Question

When a 122ai customer asks you a question through 122ai, we hold the name and email address they entered for you, your answer and anything you add, and, if you press Send, a random browser code in a cookie. To stop abuse, a scrambled copy of your network address is held for up to an hour. Answers stay hidden until answers close; then the person who asked, the decider and the people asked can see them (without names, if the question was anonymous), and in a team workspace the decision record keeps them for its leadership team. When answers close, we send the answers (and names, unless anonymous) to our AI provider, Anthropic, to write a summary and a recommendation; we never send your email address. We keep this for 12 months after answers close, then erase it. To have it erased sooner, ask the person who asked you or email privacy@122ai.io.

Your Data Rights (GDPR/CCPA)

We will respond to your data rights requests within 30 days.

• Right to Access: View all your stored conversations through the app
• Right to Delete: Delete individual conversations or your entire account
• Right to Export: Download your data in standard formats (Markdown, Word, PDF, JSON)
• Right to Rectification: Edit or update your conversations
• Right to Object: Stop processing by deleting your account
• Right to Opt-Out (CCPA): We do not sell or share your personal information for cross-context behavioral advertising

To exercise your rights, contact privacy@122ai.io

Account Deletion

You can permanently delete your account and all associated data:

• Self-Service: Use the account deletion endpoint (requires confirmation)
• Contact Support: Email privacy@122ai.io

Account deletion permanently removes your user profile, all conversations, messages, artifacts, attachments, and notes. This action cannot be undone.

Deletion Timeline: Your data is immediately removed from production systems. Database restore history (6 hours) exists solely for disaster recovery and cannot be accessed by users or staff. After 6 hours, your data becomes cryptographically unrecoverable.

Your Data Controls

You have complete control over your data:

Export Conversations

Download as Markdown, Word, PDF, or JSON formats

Delete Data

Remove individual conversations or your entire account

Manage Access

Control device access and session management

Recommendations for Sensitive Data

While Executive Advisor implements strong security measures, any AI-powered tool requires sending data for processing. If you're working with highly sensitive or regulated information:

• Avoid including specific names, account numbers, PII, or confidential identifiers
• Use general terms instead of specific details (e.g., "our Q3 revenue" instead of "$4.2M")
• Review Anthropic's API data controls if handling regulated data (HIPAA, SOX, GDPR)
• For HIPAA compliance, contact us about Business Associate Agreements (BAA)
• Regularly review and delete old conversations to minimize data retention

Security & Breach Notification

In the unlikely event of a data breach affecting your personal information, we will:

• Notify affected users within 72 hours of discovery (GDPR requirement)
• Provide detailed information about the nature and scope of the breach
• Explain steps taken to mitigate harm and prevent future incidents
• Notify relevant regulatory authorities as required by law

Report security concerns to security@122ai.io

Children's Privacy

Executive Advisor is not intended for users under 13 years of age. We do not knowingly collect personal information from children under 13. If you believe we have collected information from a child under 13, please contact us immediately at privacy@122ai.io and we will delete the information.

International Data Transfers

Our services are hosted in the United States. If you access Executive Advisor from outside the US:

• Your data will be transferred to and processed in the United States
• Transfers of the data our providers process are governed by each provider's own data processing and transfer terms

Privacy Policy Updates

We may update this Privacy Policy periodically to reflect changes in our practices or legal requirements. Material changes will be communicated via email or prominent notice in the app. Continued use of Executive Advisor after updates constitutes acceptance of the revised policy.

Questions or Concerns?

For questions about privacy, data handling, or to exercise your data rights:

Privacy inquiries: privacy@122ai.io

Security concerns: security@122ai.io

General support: support@122ai.io