Privacy policy

abotcompany Ltd provides software that connects an organisation’s knowledge, builds a shared context graph, and helps its users create dashboards, retrieve source evidence and work with AI assistants through a context gateway. This policy covers personal information handled through our website, account administration and services.

We act as a controller when we decide how to use information for our own website, customer relationships, billing, security and support. When we process an organisation’s connected content on its instructions, that organisation generally acts as the controller and we act as its processor. The customer agreement and applicable data processing terms govern that processing.

For privacy questions or requests, email hello@abotcompany.com with the subject “Privacy request”. If your employer or another organisation provides your account, its own privacy notices also apply.

Account and organisation information includes names, work email addresses, account identifiers, memberships, roles and account status. You, your organisation’s administrators and our authentication provider may supply this information.

Connected directory information can include workspace and user identifiers, names, email addresses, profiles, group memberships, roles and whether accounts are active. It comes from the services your organisation authorises, such as Slack. Connection records include provider identifiers, granted permissions and credentials needed to maintain the connection.

Depending on enabled features, connected knowledge may include documents, messages, files, tickets, code, email and associated authors, timestamps, links and access permissions. We receive it through uploads and authorised integrations. Content may contain information about people without an abotcompany account.

AI and dashboard features may process queries, prompts, selected source context, generated results, feedback and associated activity. We also handle support messages and attachments you send us.

Service and billing information can include IP addresses, browser and device details, session information, request identifiers, errors, usage records, subscription details and payment status. Payment providers handle card information; the information available to us depends on the payment service and transaction.

We use information to administer accounts, authenticate users, connect approved sources, sync directories and permissions, index and retrieve knowledge, and generate requested dashboards and AI results. For information we control, the legal basis is performance of a contract with you or our legitimate interests in providing the service to your organisation, as appropriate.

We use account, activity and diagnostic information to protect accounts, prevent abuse, investigate incidents, maintain reliability and resolve support requests. Our legal basis is our legitimate interests in running a secure, reliable service, balanced against the rights of the people affected.

We use customer contact and billing information to manage subscriptions, communicate about the service and keep business records. The applicable bases are contract, legitimate interests in administering customer relationships, and legal obligations such as accounting requirements.

Where an activity requires consent, we request it separately and explain how to withdraw it. When we process customer content as a processor, we follow the customer’s instructions rather than choosing a separate legal basis for that content.

An authorised person connects a workspace through the provider’s authorisation process. The permissions granted, the connected account and the organisation’s configuration determine the information available. Authorising a directory connection enables directory sync; importing source content into Knowledge is a separate operation where that feature is enabled.

Directory sync identifies people and groups and supports access rules. Information available to a user depends on organisation, project and source permissions. Administrators manage membership and connections and may access account and activity information needed to administer their organisation.

You can revoke access through the connected provider, and administrators can use available connection controls in abotcompany. Revocation prevents future access using that authorisation. It does not automatically erase information already imported, backups or information retained by the provider. Contact your administrator or us about removing imported information.

To answer a question or generate a dashboard, the service may send the request and relevant source excerpts to the AI or embedding provider configured for that feature. Requests can contain personal or confidential information from authorised content. The providers involved depend on deployment and configuration.

Generating responses, embeddings, indexes or learning material is distinct from training a general-purpose model. The customer agreement and applicable provider terms determine permitted uses of customer content. Contact us before connecting information that requires additional processing restrictions.

AI output can be inaccurate or incomplete. The service is not intended to make decisions with legal or similarly significant effects on people without human assessment. Review source evidence and apply appropriate human oversight before using results for decisions about individuals.

Authorised users and administrators in your organisation may access information according to their permissions. Authorised abotcompany personnel may access information where needed to operate, secure or support the service.

Providers process information for infrastructure, authentication, payment processing, AI processing and other service functions, subject to applicable contractual arrangements. The relevant providers and locations depend on the services enabled and the deployment. Contact us for processor information applicable to your organisation.

We may disclose information when required by law, in response to valid legal requests, or where necessary to protect rights, safety and service security. Information may also be involved in a business reorganisation or transfer, subject to applicable law and confidentiality arrangements. We do not sell personal information.

Hosted deployments use infrastructure operated by us and our providers. In a bring-your-own-cloud deployment, the customer controls infrastructure specified in its agreement. Account administration, support, billing and external AI requests may still involve services outside that environment.

Information may be processed outside your country. Where applicable law restricts a transfer, the deployment and contractual arrangements must provide an appropriate transfer basis and safeguards. Contact us for the processing locations and transfer arrangements applicable to your service.

We use technical and organisational measures designed to protect information, including access controls and controls over integration credentials. Security also depends on customer configuration, account security and connected providers. No system eliminates every risk; report suspected unauthorised access through our support contact.

Retention depends on the processing purpose, customer agreement, enabled features, account status and legal requirements. We retain account and customer records as needed to operate the relationship and meet legal obligations. Security and diagnostic records are retained as needed for investigation, reliability and abuse prevention.

Retention and deletion of organisation content follow the customer’s instructions and applicable agreement. Closing an individual account or disconnecting a provider may leave organisation-owned content in place. Backups and records needed for legal obligations or disputes may be retained after active data is deleted, with access limited to the relevant purpose.

Customers operating their own infrastructure also manage their own copies and backups. For deletion or export requests, contact your administrator or email us. We verify the requester’s authority and explain applicable limits before acting.

Our website and account services use cookies and similar storage for authentication, session security and interface preferences. Third-party authentication and payment services may use their own technologies when you interact with them.

Your browser can manage or block cookies and local storage, although blocking essential storage can prevent sign-in or other features from working. Where non-essential technologies require consent, we must obtain it before using them.

Depending on applicable law and the circumstances, you may have rights to access or obtain a copy of personal information, correct inaccuracies, request deletion, restrict processing or receive information in a portable format. Where processing relies on consent, you may withdraw it without affecting processing that took place beforehand.

You may object to processing based on legitimate interests, including profiling based on those interests. You may also object to direct marketing at any time. Rights have exceptions, including where records are needed to meet legal obligations or establish or defend legal claims.

Send requests to hello@abotcompany.com. Include enough information to identify the account and request; do not send passwords or access tokens. We may ask for reasonable verification and will respond within the period required by applicable law.

For organisation-controlled content, contact that organisation first. If a request reaches us as processor, we direct it to the relevant customer or assist the customer as required by our agreement and applicable law.

You can complain to the data protection authority in your jurisdiction. In the United Kingdom, contact the Information Commissioner’s Office. You can also contact us to investigate your concern.

The service is intended for organisations and their authorised users and is not directed at children. Organisations are responsible for requirements applying to information about children contained in their connected sources.

We may update this policy as the service or applicable requirements change. The date above identifies the latest revision. We provide additional notice of material changes where required.

Contact abotcompany Ltd at hello@abotcompany.com. Visit Support for account and connection help, or read our Terms of service.