Privacy Policy

1. Information We Collect

We collect only the information necessary to provide, operate, and improve Annie's executive assistant functionality.

1.1 Account Information

When you create an account, we collect:

• Name or username
• Email address
• Unique user ID or account identifier
• Account preferences and settings

This information is required to authenticate users, manage accounts, provide support, and deliver core functionality.

1.2 AI Interaction Data

When you interact with Annie, we process:

• Messages, prompts, and instructions you submit
• AI-generated responses
• Context you voluntarily provide

AI interaction data is stored temporarily to maintain conversation continuity, reliability, and safety.

AI interaction data:

• Is not sold
• Is not used for advertising
• Is not used to train public or shared AI models
• Is deleted or anonymized after a limited retention period unless required for legal or security purposes

AI interaction data refers only to content directly submitted within the Annie application. It does not include email inbox content unless explicitly provided by you within the application.

1.3 Automatically Collected Technical Information

We may collect limited technical information such as:

• Device type, operating system, and app version
• IP address (for security and fraud prevention)
• Usage metrics
• Crash logs and diagnostic data

This information is used for service reliability, performance monitoring, and security.

2. How We Use Information

We use collected information to:

• Provide executive assistant functionality
• Send emails and manage calendar events at your direction
• Maintain secure user accounts
• Improve service performance and reliability
• Prevent fraud, abuse, and unauthorized access
• Provide customer support
• Comply with legal obligations

We do not sell personal data.

3. Google & Microsoft Account Authorization

When you connect your Google or Microsoft 365 account, you authorize Annie to access limited account data necessary to perform requested tasks.

Annie requests only the minimum permissions required for core functionality.

3.1 Calendar Access (Google Calendar & Microsoft Outlook)

With your explicit permission, Annie may:

• View existing calendar events and availability
• Create calendar events
• Modify or reschedule events
• Cancel events at your request
• Send calendar invitations and updates

This access enables scheduling and meeting coordination.

Annie does not modify calendar settings or manage calendar sharing permissions.

3.2 Email Access (Gmail & Microsoft Outlook)

With your explicit permission, Annie may:

• Compose and send email messages on your behalf when you explicitly instruct Annie to do so.

Annie does not:

• Read existing inbox messages
• Access historical email threads
• Retrieve email metadata beyond what is necessary to send user-initiated messages
• Analyze or store inbox content

Email access is used solely to transmit communications you request.

3.3 Data Handling & Security Controls

Data accessed through Google or Microsoft APIs is:

• Transmitted using encrypted connections (TLS 1.2 or higher)
• Processed only to fulfill user-requested actions
• Not sold or used for advertising
• Not used to train public AI models

We apply industry-standard administrative, technical, and physical safeguards, including:

• Encryption in transit
• Encryption at rest (where applicable)
• Role-based access controls
• Least-privilege access principles
• Secure token management
• System logging and monitoring

Access to user data is restricted to authorized systems and personnel as necessary to operate and secure the Service.

3.4 AI Processing

When you request Annie to compose email content or generate scheduling-related text, the content you provide within the application may be processed by secure AI model providers such as OpenAI or Google Gemini.

AI providers are contractually restricted from using customer data to train public or shared models. Data is processed solely to fulfill your request.

3.5 Google API Services Limited Use Compliance

Annie's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically:

• Google user data is used only to provide requested assistant functionality.
• Google user data is not sold or used for advertising.
• Google user data is not used to build user profiles unrelated to Annie's core services.
• Human access to Google user data occurs only when necessary for support, security investigation, or legal compliance.

Annie's use of Microsoft 365 data adheres to Microsoft Identity Platform policies.

3.6 Revocation of Access

You may revoke Annie's access to your Google or Microsoft account at any time through your account security settings.

Revocation will immediately disable Annie's ability to send email or manage calendar events on your behalf.

Google revocation: https://myaccount.google.com/permissions

Microsoft revocation: via Microsoft account security settings or organizational administrator controls

4. Data Retention

We retain information only as long as necessary to provide the Service or comply with legal obligations.

• Account information is retained while your account is active.
• AI interaction data is retained temporarily and deleted or anonymized after a limited period.
• Annie does not retain Gmail message content beyond what is necessary to send user-initiated communications.

Users may request deletion of their account and associated data at any time.

5. Data Deletion

You may request deletion of your account by:

• Using the in-app deletion feature (if available), or
• Contacting operations@petercfuller.com with the subject line "Data Deletion Request."

We will verify and process deletion requests in accordance with applicable law.

6. Data Security

We implement reasonable technical and organizational safeguards designed to protect information from unauthorized access, disclosure, alteration, or destruction.

While no system is completely secure, we actively monitor and maintain security protections.

7. International Data Transfers

Information may be processed outside your country of residence. Where required, appropriate safeguards are implemented.

8. Children's Privacy

The Service is not intended for children under 13 (or the minimum age required by law).

We do not knowingly collect data from children.

9. Your Rights

Depending on your jurisdiction, you may have rights to:

• Access your personal data
• Correct inaccurate data
• Request deletion
• Withdraw consent
• Request data portability

Requests may be submitted to operations@petercfuller.com.

10. Changes to This Policy

We may update this Privacy Policy from time to time. Updates will be posted within the application or on our website. Continued use of the Service constitutes acceptance of the updated policy.

11. ElevenLabs AI Agent Consent

We use ElevenLabs Agents to help power our AI-powered voice assistant experiences. By clicking "Agree" and each time you interact with this AI agent, you consent to us, ElevenLabs, and each of our service providers (including third-party LLM providers) recording, viewing, storing, and sharing your communications to provide the service, improve our products and services, train machine learning models, and comply with applicable law.

12. Contact Information

Peter C Fuller, Inc.
My Annie Agent
Email: operations@petercfuller.com

1. Information We Collect

1.1 Account Information

• Name and email address
• Mobile phone number (used for budget alerts and two-step verification)
• Account preferences and settings, including notification choices

1.2 Financial Information

To provide budgeting functionality, we collect and store:

• Transaction details: merchant name, amount, date, and the account or card identifier you provide (such as the last four digits of a card)
• Budget and category information you enter or import, including income and expense amounts
• Beginning cash balances and forecast figures you enter

We never collect or store full bank account numbers, bank login credentials, or online banking passwords.

1.3 Information from Connected Services

Bank transaction feeds. Transactions may reach the Service through an automation service (such as Zapier) that you configure, or through Plaid if you choose to link a bank account directly.

Google Sheets. If you import a budget from Google Sheets, we read only the spreadsheet ranges you select, only at the moment you run the import. We do not retain ongoing access to your Google account.

1.4 Automatically Collected Technical Information

• Device type, browser, and operating system
• IP address (for security and fraud prevention)
• Usage metrics, error logs, and diagnostic data

2. Financial Data and Plaid

If you choose to connect a bank account through Plaid Inc. ("Plaid"), the information we receive from your financial institution (such as account name, transaction history, and balances) is collected and transmitted to us by Plaid. Plaid's collection, use, and protection of your information is governed by the Plaid End User Privacy Policy.

We use information received through Plaid only to:

• Display and categorize your transactions
• Compare spending against your budgets
• Generate forecasts and alerts you have configured

We do not sell financial information, use it for advertising, or share it with anyone other than the service providers described in Section 4. You may disconnect a linked bank account at any time, after which we stop receiving new data for that account.

3. How We Use Information

• Provide budgeting, categorization, forecasting, and alerting functionality
• Send text-message alerts and summaries you have enabled (via Twilio)
• Send verification codes for two-step verification
• Maintain secure user accounts and prevent fraud and abuse
• Improve service performance and reliability
• Comply with legal obligations

We do not sell personal data. We do not use personal or financial data for advertising.

4. Service Providers

We share information only with the providers needed to operate the Service, and only to the extent necessary:

• Cloud hosting and database (Lovable Cloud / Supabase) — stores account and budget data, encrypted in transit and at rest.
• Plaid — bank account linking and transaction retrieval (if you enable it).
• Zapier — delivery of bank transactions you route to the Service through your own Zapier configuration.
• Twilio — delivery of text-message alerts and verification codes to the mobile number you provide.
• AI model providers — merchant names and transaction amounts are processed by AI models to suggest categories and budget recommendations. These providers are contractually restricted from using your data to train public or shared models.

Each provider is bound by its own security and confidentiality obligations and may process data only to deliver its service to us.

5. AI Processing

When transactions are categorized or recommendations are generated, relevant transaction details (merchant, amount, category) are processed by AI models. AI-processed data is not sold, is not used for advertising, and is not used to train public AI models.

6. Data Retention and Deletion

• Account, budget, and transaction data is retained while your account is active.
• Text-message verification codes expire within 10 minutes and are deleted after use or expiry.
• Server logs are retained for a limited period for security and reliability purposes.

You may request deletion of your account and associated data at any time by contacting operations@petercfuller.com with the subject line "Data Deletion Request." Verified deletion requests are completed within 30 days, except where law requires retention.

7. Data Security

We protect information with administrative, technical, and organizational safeguards, including:

• Encryption in transit (TLS 1.2 or higher) and encryption at rest
• Row-level isolation so each account can access only its own data
• Least-privilege access controls for production systems
• Optional two-step verification (text message or authenticator app)
• Automated vulnerability scanning of the application and its dependencies

No system is completely secure, but we actively monitor and maintain these protections.

8. International Data Transfers

Information may be processed in data centers outside your country of residence. Where required, appropriate safeguards are implemented.

9. Children's Privacy

The Service is not intended for children under 13, and we do not knowingly collect data from children.

10. Your Rights

Depending on your jurisdiction, you may have rights to access, correct, delete, or export your personal data, and to withdraw consent. Submit requests to operations@petercfuller.com.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Updates will be posted on this page with a revised "Last updated" date. Continued use of the Service constitutes acceptance of the updated policy.

12. Contact

Peter C. Fuller Inc
BudgetBeater AI
Email: operations@petercfuller.com