Privacy Policy

1. Overview

Jarvis Workspace Assistant ("Jarvis") is a private, personal-use assistant operated exclusively for its account owner. This policy explains how Jarvis accesses, uses, stores, and shares information for authorized workspace tasks and on-demand research.

Jarvis is not offered as a public service and does not accept registrations from third parties. Its public homepage and this policy provide information about the application; they do not provide public account onboarding.

This policy describes data categories and purposes, not a list of enabled integrations. Actual access depends on the specific connection, available functionality, and permissions explicitly granted. A category described here may not be available or enabled for a particular connection. Access to one account or service does not authorize access to another.

2. Categories of data accessed

Jarvis may access the following information only as needed for functions requested or authorized by the owner and within the permissions granted for the relevant connection:

• Account identifiers and basic profiles: identifiers, display names, account addresses or usernames, and basic profile information returned to identify an authorized account or understand a retrieved public profile. This is a description of data handled, not a publication of account details.
• Email and explicitly enabled communications: email messages, message metadata, labels, drafts, and sending capabilities. Private communications are accessed only through a specifically enabled and authorized workflow. This category does not by itself authorize additional private inboxes or messaging functions.
• Calendars and events: calendar information, events, and associated details needed to read, create, update, or organize the owner's calendar.
• Files, documents, and spreadsheets: file contents and metadata, documents, and spreadsheet contents needed for authorized file and document tasks.
• Contacts: contact information needed for an authorized task.
• Public posts, threads, and profiles: publicly available content and associated information needed for an on-demand research request.
• Separately authorized social collections: the owner's following, lists, saved items, or bookmarked content, only where the relevant service supports access and the owner separately authorizes it. An owner's collection may be account-related or private even when an item within it is public.
• Authorization and operational records: authorization credentials and permission information, task instructions, operational records, task history, and generated outputs. These records may include relevant data or excerpts from the categories above.

Not every task requires every category. A permission grant does not remove the requirement to limit access to the requested or authorized function. New connections must request only the permissions needed for their enabled functions, not access for hypothetical future features.

3. How data is used

Data is used solely to provide personal-assistant functionality to the authorized account owner, including:

• finding, reading, summarizing, organizing, drafting, and managing email;
• sending email only when directed or approved by the owner through an enabled, authorized workflow;
• creating, reading, updating, and organizing calendar information;
• locating, reading, creating, updating, organizing, and sharing files, documents, and spreadsheets when requested;
• reading contact information when needed for an authorized task;
• finding, reading, summarizing, and comparing public posts, threads, and profiles for on-demand research;
• consulting the owner's following, lists, saved items, or bookmarks for separately authorized research, where supported;
• maintaining task context, diagnosing operational failures, and keeping relevant operational records for those functions.

Signing in, granting API access, or connecting an account is not by itself consent for an action on the owner's behalf. Actions must stay within the specific function and instructions the owner has authorized. Access to public content or an account-associated collection is not permission to publish, message, or engage with other accounts. Continuous monitoring is not authorized by the on-demand research described here.

Integration data is not sold or used for advertising, profiling, or creditworthiness decisions. Reading a public profile for research is not permission to create unrelated profiles of people. The operator does not use integration data to create, train, or improve generalized artificial-intelligence or machine-learning models.

Jarvis will follow the Google API Services User Data Policy, including its Limited Use requirements, when using or transferring information received through Google Workspace APIs.

4. AI and service-provider processing

Relevant task instructions, retrieved information or excerpts, and intermediate or generated outputs may be processed by AI inference providers and infrastructure services to provide the functionality requested by the owner. Private operation does not mean that all task content remains within a single environment.

Such processing is limited to the requested functionality, subject to the owner's authorization and applicable restrictions on the source data. This policy does not authorize sending data to a processor for an unrelated purpose.

The operator's prohibition on generalized-model training is distinct from an external provider's terms and settings. External handling, including retention and any model-improvement use, depends on the provider and configuration; this policy does not give a blanket assurance that every AI vendor never retains data or trains on it. A processing route must not be used where its handling would conflict with the restrictions applicable to the data. Provider conditions must be checked before task data is sent; disclosing uncertainty is not permission for prohibited processing.

5. Data storage and retention

Authorization credentials are stored locally in the private operating environment, not on this public disclosure website.

Operational records, assistant task history, generated artifacts, and other task records may retain data or excerpts needed to complete tasks, preserve requested context, diagnose failures, or provide a relevant operational audit trail. Summaries and other generated outputs can themselves contain personal or account-related information.

Retention is limited to those purposes and subject to applicable source-service restrictions. This policy does not authorize indefinite archives, permanent copies, or caching beyond what the source service permits. No fixed retention period or automated deletion schedule is established for operational records. Records should not be assumed to disappear automatically when a task ends or access is revoked. The owner may request or perform deletion of local records through the operator.

Copies processed or retained by external providers are subject to their applicable arrangements and any restrictions attached to the source data. Local deletion does not by itself confirm deletion of external copies. No universal deletion deadline or automated removal across providers is promised. A shorter period or removal obligation imposed by the source service must still be respected; the absence of a general schedule is not an exemption.

6. Data sharing

Jarvis does not sell integration data or give unrelated third parties access to it for their own purposes.

Data may be transmitted only:

• To the relevant source service: authorization information, API requests, and data needed to perform authorized operations may be sent to the connected provider, including Google or X when the relevant connection is used.
• To necessary processors: relevant task content may be sent to AI inference or infrastructure providers for the requested functionality, with the owner's consent and subject to section 4 and the source service's restrictions.
• To owner-directed recipients: information may be sent when explicitly directed by the owner, such as in an approved email or a requested file share, only through an enabled and authorized function.
• For limited security or legal purposes: information may be disclosed when necessary for security, investigating abuse, or compliance with applicable law.

The owner directing a transfer does not override service restrictions or another person's access rights. API access is not permission to redistribute retrieved content. Public dissemination, sharing protected information, and engaging with other accounts are not authorized merely by the research functions described in this policy.

Human review of private task content is not authorized merely because a person provides infrastructure or support. Apart from the account owner's own access, such review requires the owner's specific affirmative agreement to the data concerned, unless a narrowly applicable security or legal exception permits it. Reading or sharing data must also remain within the restrictions applicable to its source.

7. Security

Jarvis uses provider authorization, including OAuth where supported. An OAuth connection does not require the owner to provide Jarvis with an account password; sign-in and consent take place with the provider. Authorization credentials are restricted to the private operating environment, with access controls and restrictive permissions for locally stored credentials.

Data handling must also respect the security requirements applicable to each authorized connection. This policy describes data-handling practices without disclosing credentials or private operational details; it does not certify a security assessment.

No method of electronic storage or transmission is completely secure. Absolute security cannot be guaranteed.

8. User control, revocation, and deletion

The owner can decline a connection, refuse additional permissions, or stop requesting use of a function. Access can be revoked through the relevant provider's account-permissions or connected-app settings. The owner may also stop local use of the connection and remove its locally stored authorization credentials.

The provider determines the behavior and timing of revocation. This policy does not guarantee instantaneous invalidation of every credential or cancellation of a request already in progress.

Revocation, removing local credentials, and deleting retained information are separate actions. Revocation does not automatically erase task history, operational records, or generated artifacts already stored. The owner may request or perform local deletion through the operator. Relevant records and outputs must be considered separately from the credentials used for the connection.

For external-provider copies, the applicable provider process and terms must also be considered. Deleting local records does not establish that a provider or an owner-directed recipient has deleted its copies. Contact the operator through section 10 for assistance with authorization or deletion requests; no automated or immediate deletion across all recipients is promised.

9. Changes to this policy and additional connections

This policy may be updated when data access, purposes, sharing, permissions, processors, or other handling practices change. The published "Last updated" date identifies this page's revision.

An additional connection may use the existing policy without adding a provider-specific section only when its actual data categories, purposes, sharing, and handling practices are already accurately and fully described here. Each connection still requires its own credentials and permissions, the owner's separate informed authorization, and any contextual notices or provider approvals required for the specific use. Existing authorization, signing in, or continued use is not blanket consent for another connection.

Before accessing a previously undisclosed type of data, using data for a new purpose, introducing new sharing, or making a material change to handling practices, Jarvis must update the relevant disclosures and obtain informed consent to the change. Broader labels must not be used to conceal a new sensitive subtype or materially different use. The change must be explained in context before processing begins; updating the page alone is not consent.

Permissions must be limited to enabled functionality. This policy does not authorize speculative access for future features, and it does not override source-service restrictions.

10. Contact

Questions and requests about authorization, privacy, or data deletion may be sent to the support contact displayed on the relevant consent screen, if one is supplied. Otherwise, the account owner can use the established private communication channel with the operator. Jarvis has no public registration or third-party onboarding.