Privacy Policy

1. Information We Collect

We collect only the minimum information necessary to provide the functionality of the Service.

Information Provided by Third-Party Services:

• Authentication: We use Auth0 for user authentication. Auth0 may collect your email address, name, or other profile information you provide during login. We receive only the information necessary to authenticate you and enable account features.
• Location and Maps: We use Google services for maps and location features. Google may collect location data if you enable these features.

Information You Provide:

• Account information such as organization name, user roles, and preferences.
• Content you create, including documents, projects, clients, and other data you input into the Service.
• Messages, files, and images you send in a channel or direct message.
• Communications with us, including support requests and feedback.

Artificial Intelligence and Voice:

• When you use Sentinel or other AI features, we send the text of your request and the organization records needed to answer it (such as reports, operations, and locations you are already allowed to see) to Amazon Bedrock in our Amazon Web Services account.
• When you use voice entry, we stream microphone audio to Amazon Transcribe in that same account for as long as the voice session is open, so it can return a transcript. We use Amazon so voice entry does not depend on the speech recognition built into whatever browser you are using. Voice entry is optional. We do not store the audio, and we do not associate it with your account.

Automatically Collected Information:

• Usage data, such as IP address, browser type, device information, and pages visited, may be collected temporarily for functionality and analytics.
• Activity logs related to your use of the Service, including document edits, project updates, and system interactions.

Local Storage:

• Certain data (e.g., preferences, session tokens, or organization settings) may be stored temporarily in your web browser's local storage or on your mobile device to support app functionality. This data is not transmitted to or stored on our servers unless necessary for the Service.
• The keys for messages and files you send in chat stay in your browser or app. They are not stored in our database.

We do not collect sensitive personal information unless explicitly required for a specific feature, and even then, only the minimum necessary.

2. How We Use Information

We use collected information solely to:

• Provide and maintain the Service, including document management, project organization, and collaboration features.
• Provide AI assistance, including drafting, summaries, and answers drawn from your organization's records, using Amazon Bedrock.
• Transcribe optional voice entry into text you can review, using Amazon Transcribe.
• Authenticate users via Auth0.
• Display maps and location information via Google.
• Enable organization-based access control and user permissions.
• Improve the Service and troubleshoot issues.
• Send you important updates about the Service, including security notifications and feature announcements.

We share only the minimum information required with third-party providers (Auth0, Google, and Amazon Web Services for Amazon Bedrock and Amazon Transcribe) to enable these functions.

3. Artificial Intelligence and Voice Transcription

Some features of the Service use artificial intelligence and speech-to-text running in our Amazon Web Services account in the United States.

Amazon Bedrock powers Sentinel, the in-app assistant, along with report summaries, threat-assessment suggestions, score executive summaries, and help filling reports from a statement or voice note. A request includes your message and the organization records that feature needs, limited to what your role may already see. Client-role accounts do not receive Sentinel.

Amazon Transcribe turns optional voice entry into text. We use Amazon for this so the same voice entry works in every browser and on the phone. You are not sent through whatever speech recognition your browser happens to offer. Audio is streamed only while you are speaking. We do not store that audio, and we do not associate it with you: Amazon receives the sound only, not your name, email, or account id, and we do not keep a record that the audio belonged to your account. Our AWS organization is opted out of Amazon using that audio, or the transcript it produces, to train models or improve the service. The transcript appears in the message box so you can review and edit it before you send it, unless you turn off review-before-sending on your profile. Once you send a message, or save generated text into a report, that text is stored like any other content you create.

How privacy is safeguarded:

• Your organization only. AI features read and write only records in your organization, and only what your role already allows.
• Opted out of Amazon training. We opt out of Amazon using voice audio or transcripts to train models or improve Amazon Transcribe. Amazon Bedrock does not use customer prompts or responses to train foundation models, and does not share that content with model providers.
• Audio is not stored, and not tied to you. Voice audio passes through memory only for the length of that voice session. We do not write it to our database, file storage, or activity logs, and we do not associate it with a user. It is not saved on your account, and it is not sent to Amazon with your name, email, or account id.
• Encryption and a private network path. Traffic to these services is encrypted in transit. Requests to Amazon Bedrock travel from our application over a private network connection inside AWS.
• Processing stays in the United States. These services run in AWS regions in the United States. Some assistant requests use a United States cross-region inference profile, so a request may be processed in another US region, such as US East or US West, rather than only in the region where our application runs.
• What we keep. We do not keep a server-side archive of assistant conversations or voice audio. On the web, the current chat may remain in your browser's session storage until you close the tab or sign out. We do store text you choose to keep, including messages you send and summaries or drafts written into a report. Activity logs record that an AI-assisted change happened — who made it, in which organization, and which record — and do not store the audio or the prompt. We record token counts for billing.
• Public web search. If you ask the assistant to look something up on the public web, that search query is sent through an AWS-managed web search service and may retrieve public web pages. Place and map lookups continue to use Google, as described above.
• Your choices. You can type instead of using the microphone. You can review a transcript before it is sent. You do not have to use AI features. Generated text is a draft for you to review. Destructive changes, such as archive or delete, wait for your approval.

4. Messaging

Channels and direct messages use Matrix. The text of a message, and any file or image sent with it, is encrypted on your device before it is sent.

GSOCX operates the messaging server and the database that stores those messages and files. What is stored is the encrypted message and the encrypted file, not the text or the file contents. The keys that can read them stay on the devices of the people in that channel or direct message. We do not store those keys. GSOCX staff cannot read the message or the file. An organization administrator who was not added to that conversation cannot read it either.

Metadata is visible to us because we run the server. That includes channel names and topics, who is in the conversation, when a message was sent, and the storage id of a file so it can be deleted when the message is deleted or expires. That id is not the file, and it cannot be used to read the file. We use this metadata to deliver messages, apply the retention period your organization chose, and operate the service.

A new browser or phone has to be paired with a device you already use before it can read messages or files. Messages and files already stored before encryption was turned on for a room stay as they were.

5. Data Storage and Retention

We store your data, including documents, projects, and organizational information, on secure servers to provide the Service. Your data is retained as long as your account is active or as needed to provide the Service.

Voice audio and live transcripts are not retained by us. Text you save into the Service, including AI drafts you accept, is retained with your other content.

Third-party providers (Auth0, Google, and Amazon Web Services) store data according to their own policies. Amazon Bedrock and Amazon Transcribe handling is described in the section above.

We retain data only as long as necessary for the purposes described or as required by law. You may request deletion of your data by contacting us.

6. Sharing of Information

We do not sell, rent, or share your personal information with third parties except:

• With Auth0 and Google as described above, limited to the minimum necessary.
• With Amazon Web Services (Amazon Bedrock and Amazon Transcribe) as described above, limited to the minimum necessary to provide AI and voice features.
• Within your organization, as controlled by your organization's administrators and user permissions.
• As required by law, such as in response to a subpoena or legal process.
• To protect our rights, safety, or property, or that of our users.

7. Security

We take reasonable measures to protect information, including encryption in transit and at rest, access controls, and regular security assessments. However, no system is completely secure. Third-party services (Auth0, Google, and Amazon Web Services) use industry-standard security practices.

8. Your Choices

You can:

• Opt out of location services in your device settings.
• Use the Service without voice entry or AI features, and review a voice transcript before sending it.
• Delete local storage data by clearing your browser cache or app data.
• Update your account information and preferences through the Service settings.
• Contact us to request information about your data or deletion where applicable.

9. Children's Privacy

The Service is not intended for children under 13. We do not knowingly collect information from children under 13.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new Privacy Policy on this page and updating the "Last Updated" date. Continued use of the Service after such changes constitutes acceptance of the updated policy.

11. Third-Party Links and Services

The Service may link to third-party sites or services (e.g., Google Maps). Their privacy practices are governed by their own policies.

For more on third-party practices:

• Auth0: https://auth0.com/privacy
• Google: https://policies.google.com/privacy
• Amazon Web Services: https://aws.amazon.com/privacy/
• Amazon Bedrock data protection: https://docs.aws.amazon.com/bedrock/latest/userguide/data-protection.html

12. Contact Us

If you have questions about this Privacy Policy, please contact us at support@gsocx.net.