Privacy Policy

Assume Inc. is a Delaware corporation. We operate Assume, a hosted control plane that lets companies run AI agents against connected work systems under policy, audit, and approval controls. This policy explains what personal data we collect, why we use it, how long we keep it, and your choices.

Data controller

Assume Inc., a Delaware corporation. Contact: hello@assume.dev. Company inquiries: info@assume.dev.

Information we collect

• Account data: name, work email, password hash, and OAuth profile fields when you sign in with Google, GitHub, or Microsoft.
• Workspace data: organization membership, connected accounts, agent identities, policy grants, approval requests, and audit logs.
• Connected-account content: data accessed through integrations you authorize (for example Gmail messages, Calendar events, Drive files, Slack messages, or GitHub repositories) solely to execute agent actions you configure.
• Usage data: product analytics and session replay when you accept analytics cookies.
• Support and security data: messages you send us, authentication events, and operational logs needed to secure and run the service.

Secrets for connected accounts are encrypted, transmitted over TLS, and injected at run time inside the executor. They are not returned to agents or stored in chat logs.

How we use information

• Provide, operate, and support the Assume service you sign up for.
• Authenticate users, enforce workspace policies, and maintain audit trails.
• Detect abuse, secure accounts, and troubleshoot incidents.
• Improve the product with analytics only when you accept analytics cookies.
• Comply with law and respond to lawful requests.

We do not sell personal data.

Google user data

When you sign in with Google, we receive your Google profile and email address. When you connect Google accounts in your workspace, we access only the OAuth scopes you authorize.

• Sign-in: Google profile and email address.
• Connected accounts (when you connect them): Gmail messages and metadata, Google Calendar events, Google Drive files, Google Meet data, and Google Cloud API resources, as authorized by the grants you configure.

Assume's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We use Google user data only to provide agent automation and connected-account features you authorized. We do not use Google user data for advertising or to build marketing profiles.

We share Google user data with subprocessors (Cloudflare and Railway) only as needed to host and deliver the service. We do not sell Google user data to data brokers, information resellers, or advertisers.

We retain Google user data while your account is active and for a reasonable period after closure so you can export records and we can meet legal duties. You may request deletion by emailing hello@assume.dev.

We do not use Google user data for targeted advertising, selling to data brokers, credit-worthiness determination, lending, or training generalized or non-personalized AI/ML models.

Retention

We keep workspace and audit data while your account is active and for a reasonable period after closure. Security logs rotate on a shorter schedule. Analytics data in Amplitude follows their retention settings.

Subprocessors

• Cloudflare — CDN, DDoS protection, edge hosting, Web Analytics, and Zaraz tag management.
• Railway — application and API hosting.
• Amplitude — product analytics and session replay when you accept analytics cookies.
• Google, GitHub, Microsoft — OAuth sign-in when you choose those options.

International transfers

We are based in the United States. If you access Assume from another country, your data may be processed in the US and where our subprocessors operate. We use appropriate safeguards where required by law.

Your rights

Depending on where you live, you may have rights to access, correct, delete, or export your data, and to object to or restrict certain processing. Email hello@assume.dev and we will respond within a reasonable time.

Cookies

Essential cookies keep you signed in. Analytics cookies load only after you accept them in the cookie banner. See our Cookies policy for details.

Children

Assume is a business service. We do not knowingly collect data from children under 16.

Contact

Privacy questions: hello@assume.dev. Company inquiries: info@assume.dev.