Draft for review, not yet checked by a lawyer. Highlighted text is still to be filled in.
Privacy Policy
Last updated [date]
Mebora is an assistant you hand things to. To do that well, it reads what you send it, remembers what matters to you and, when you ask, gets in touch with other people for you. This policy explains what that involves: what we collect, why, who else handles it, how long we keep it, and what you can ask of us.
“Mebora”, “we” and “us” mean [Mebora’s legal name], of [registered address]. “You” means anyone who uses Mebora. One section is written for people Mebora has contacted on someone else’s behalf: If Mebora contacted you. If anything here is unclear, write to [privacy email].
Who looks after your data
We are responsible for (the “controller” of) the personal data described here when you use Mebora for yourself, when you visit our website, and for running our own business: accounts, security and billing.
When an organisation provides Mebora to its people, for example a company whose team uses it for hiring, the organisation decides what Mebora is used for. For the data Mebora handles in that work, including details of the people it contacts, we act on the organisation’s instructions (as its “processor”), under a data processing agreement between us. The organisation’s own privacy notice applies to that data too, and we will help it answer any request you make.
What we collect
What you give Mebora
- Account details: your name, phone number, work email address, your Slack identity if you use Slack, your organisation and role, and your time zone.
- Your messages: everything you send Mebora, including text, voice notes, images and documents, and its replies.
- What it remembers: preferences, decisions, commitments and anything else you ask it to keep in mind, your open tasks and reminders, and settings such as the voice it uses for your voice notes.
- Details about other people that you share with it, such as a job description or the names of people to get in touch with. Please share only what you are entitled to share.
What Mebora gathers while it works for you
- Research: information about people and organisations from public websites, professional networks and professional data services, such as names, job titles, employers, career histories and work contact details.
- Messages it sends and receives for you: the messages, emails and invitations it sends with your approval, the replies, and a record of who was contacted, when and why.
- Sign-ins: when a task needs a website you use, you sign in yourself through a secure link that expires within minutes. Mebora keeps the signed-in session so it can work there for you. It never asks for your password and never stores it. You can ask Mebora at any time to sign out and forget a session.
- Your availability: if you share your calendar, the times you are free or busy, so it can suggest meeting times.
Services you connect
Some services, such as Google Workspace and Slack, can be connected to Mebora so it can work inside them for you. When you connect one, the service shows you what Mebora is asking to access, and you decide. Mebora uses that access only to do what you ask: for example reading and drafting email, checking your calendar and adding events, finding documents, or reading and posting in the channels you choose. Our [Connectors page] lists what each connector can access.
You can disconnect a service at any time, in Mebora or in the service’s own settings. We delete the data we obtained through it within 30 days, except for results you asked Mebora to keep, such as a summary saved for you.
Google. Mebora’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not use data from Google Workspace to develop, improve or train generalised AI or machine-learning models, and nobody at Mebora reads it unless you ask us to, it is needed for security or to comply with the law, or it has been made anonymous.
Slack. We do not use data from Slack to train AI models of any kind.
When you visit our website
Our website uses no cookies, analytics or advertising trackers. Our servers keep standard technical logs, such as IP address, browser type and the pages requested, to keep the site secure, and delete them after 30 days. If you write to us, we keep your message and address so we can reply.
What we don’t ask for
We never ask for your passwords. Please don’t send Mebora sensitive information, such as details of your health, unless a task needs it.
How we use it
- To do what you ask. That is what nearly all of it is for.
- To remember, so you don’t have to repeat yourself and nothing you hand over is forgotten.
- To keep Mebora safe and working: preventing misuse, protecting accounts, and finding and fixing problems.
- To improve Mebora. When it can’t do something you asked, it writes a short note about what was missing so we can build it. These notes leave out personal details wherever possible. When fixing a problem means looking at a particular conversation, only the staff who need to see it do so, and every such access is recorded.
- To talk to you about Mebora, such as changes to the service or to this policy.
- To meet legal obligations, and to establish or defend legal claims.
What we never do
- We don’t sell personal information, or share it for advertising.
- We don’t use your content to train AI models, ours or anyone else’s. The AI services we use process it only to provide their service to us, under contracts that don’t allow them to train on it.
- Mebora doesn’t tell one person what another has said. Each person’s conversations are kept apart, and nothing passes between them unless you ask Mebora to pass it on.
- Mebora doesn’t contact anyone in your name without your approval.
Who else handles it
- Service providers that run parts of Mebora for us: hosting and storage, AI models that understand and write, speech services that turn text into voice and voice into text, email and calendar services, secure sign-in links, and security monitoring. They act only on our instructions, under contracts that require them to keep data confidential and secure.
- The messaging services you choose to talk to Mebora on, such as WhatsApp, Slack or email. They handle your messages under their own privacy policies.
- People Mebora contacts for you. They receive what you approved, and are told it comes from Mebora, an AI assistant, on your behalf.
- Other Mebora users, only when you ask Mebora to pass something on to them.
- Your organisation, if it provides Mebora to you. It controls the data of its account, as set out in its agreement with us.
- Authorities and others, when we must. We may disclose information when the law requires it, or to protect people’s safety, our users or Mebora. If Mebora is ever sold or merged, personal data may pass to the new owner, who will be bound by this policy, and we will tell you first.
Organisations that use Mebora can ask for the current list of our service providers under their data processing agreement.
If Mebora contacted you
This part is for people who have never used Mebora but have heard from it.
- Why it contacted you. Someone who uses Mebora, named in the message, asked it to get in touch with you, usually about a role, an introduction or a meeting. Mebora is an AI assistant, and says so.
- Where your details came from: public websites, professional networks and professional data services, or the person who asked.
- What we keep: your name, the professional details that made you relevant, how to reach you, the messages exchanged and your answer.
- To stop it, reply “stop”, or anything that says you’d rather not hear from Mebora. It won’t contact you again, for anyone. To make sure of that, we keep a minimal record, such as your email address or profile link, on a do-not-contact list.
- To see, correct or delete what we hold, write to [privacy email]. If Mebora contacted you for an organisation, we will also tell the organisation about your request.
- How long: we delete it 12 months after the task it was for has ended, or sooner if you ask.
How long we keep it
| What | How long |
|---|---|
| Your conversations, files and what Mebora remembers about you | While you use Mebora. Deleted within 30 days of closing your account or asking us to. |
| Information about people contacted for you | 12 months after the task ends |
| Data from a connected service | Deleted within 30 days of disconnecting it |
| The do-not-contact list | For as long as Mebora runs, so that the request keeps being honoured. It holds only what’s needed to recognise the person. |
| System and security logs | 30 days |
| Messages you send us | Up to 12 months after we’ve answered |
| Records the law requires us to keep, such as invoices | As long as the law requires |
Deleted data can remain in encrypted backups for up to [30] more days before they are overwritten.
Your rights
Wherever you are, you can ask us to:
- tell you what personal data we hold about you, and give you a copy, including in a format you can take elsewhere;
- correct it;
- delete it;
- stop or limit using it, or object to how we use it;
- withdraw any consent you have given.
Ask Mebora directly or write to [privacy email]. We will answer within a month, free of charge, and may first need to confirm who you are. Mebora doesn’t make decisions about people that have legal or similarly significant effects on them: decisions such as whom to hire are made by people. You can also complain to your data protection authority.
Keeping it safe
- Data is encrypted in transit and at rest.
- Each person’s and each organisation’s data is kept apart.
- Only staff who need access have it, and access is recorded.
- Mebora never asks for passwords, and sign-in links expire within minutes.
- Mebora asks before it sends anything in your name or does anything that can’t be undone.
- It treats messages from other people as information, never as instructions, so a stranger can’t direct it by writing to it.
No system is perfectly secure, and an assistant can misunderstand. If a breach affects your data, we will tell you and the relevant authorities as the law requires.
Data that crosses borders
Mebora’s servers are in [region], and some of our service providers work in other countries, including the United States. When personal data from the European Economic Area, the United Kingdom or Switzerland goes to a country the authorities there haven’t recognised as adequately protecting it, we use the European Commission’s standard contractual clauses (with the UK’s addendum), and further safeguards where needed. You can ask us for a copy.
Where you live
European Economic Area, United Kingdom and Switzerland
We rely on these legal bases:
- Contract: to provide Mebora to you.
- Legitimate interests: to keep Mebora safe and improve it, to run our business, and to contact people on behalf of the person who asked, in a proportionate way. You can object at any time.
- Consent, where the law requires it, for example for some connected services. You can withdraw it at any time.
- Legal obligation, where the law requires us to keep or disclose information.
Our representative in the European Union is [name and address], and in the United Kingdom [name and address].
California and other US states
We don’t sell or “share” personal information as those laws define it, and we don’t use sensitive personal information beyond what they permit. You can ask to know, correct or delete the personal information we hold, or have someone you authorise ask for you, and we won’t treat you differently for doing so.
Everywhere else
We give everyone the rights in Your rights. Where your local law gives you more, we follow it.
Age
Mebora is for business and professional use by people aged 18 and over. It isn’t meant for children. If we learn we hold data about a child, we delete it.
Changes to this policy
We will update this policy as Mebora changes, and change the date at the top. If a change matters to how we handle your data, we will tell you through Mebora or by email before it takes effect.
Contact
Mebora, [registered address]. [privacy email]