Privacy Policy

Last updated: September 2026

Idle Work Inc. ("we," "our," or "us") respects your privacy and is committed to protecting your personal information. This Privacy Policy explains how we collect, use, store, and share information when you use our platform and services.

1. Information We Collect

We collect information in the following categories:

• Account information: Name, email address, business name, and payment details you provide when registering for an account.
• Configuration data: Agent settings, channel preferences, custom instructions, and other inputs you provide to configure your AI employee agents.
• Conversation data: Messages processed through your AI employee agents across supported channels (WhatsApp, Slack, Microsoft Teams, Telegram, Discord, and Email). Messages are encrypted in transit (TLS) and at rest (AES-256), with access limited to your configured agents and authorized users.
• Usage data: Information about how you interact with the platform, including login times, feature usage, and performance metrics.
• Technical data: IP address, browser type, device information, and cookies collected automatically when you access the platform.

2. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve our AI employee agent services
• Process your agent configurations and deliver messages across your connected channels
• Process payments and manage your subscription
• Communicate with you about your account, service updates, and support inquiries
• Monitor platform performance, detect abuse, and ensure security
• Comply with legal obligations

3. Data Storage and Security

We store your data on secure servers and employ industry-standard security measures to protect it. All data is encrypted in transit using TLS and encrypted at rest using AES-256 encryption.

While we take reasonable steps to protect your information, no method of transmission over the internet or method of electronic storage is completely secure. We cannot guarantee absolute security, but we continuously work to safeguard your data.

4. Financial Data & Plaid Integration

When you connect a bank account through our platform, we use Plaid, Inc. ("Plaid"), a financial data network, to establish the connection. By using our platform to connect a bank account, you acknowledge and agree to the following:

• Plaid's Role: Plaid acts as our service provider to facilitate the connection between your financial institution and our platform. When you connect a bank account, you enter your login credentials directly into Plaid's encrypted Link interface. Idle Work does not receive, access, or store your bank login credentials (username, password, or security questions).
• Data Plaid Collects: Through Plaid's services, Plaid may collect, use, and retain the following categories of data: (a) identifiers such as your name, email address, phone number, and address; (b) login data required by your financial institution, such as username and password or security token; (c) account data, including financial institution name, account name, account type, account number, and routing number; (d) transaction data, including amount, date, payee, and description; (e) balance data, including current and available balance; and (f) device data, including IP address and device identifiers.
• How Plaid Uses Your Data: Plaid uses the data described above to: provide and maintain the connection between your financial institution and our platform; verify your identity and prevent fraud; improve Plaid's services and develop new products; and comply with legal obligations. Plaid may retain your data even after you disconnect your account, as described in Plaid's End User Privacy Policy.
• Data Sharing by Plaid: Plaid may share your data with: its affiliates and service providers to deliver services on its behalf; financial institutions to verify your identity and account ownership; and law enforcement or other third parties when required by law. Plaid does not sell your personal information.
• Your Consent: By connecting a bank account, you authorize Plaid to access, collect, use, retain, and share your data as described above and in Plaid's End User Privacy Policy (available at plaid.com/legal/#end-user-privacy-policy). You also authorize Plaid to act on your behalf to access and transmit data to and from your financial institution.
• Disconnecting: You can disconnect your bank account at any time through the platform dashboard. Upon disconnection, we will revoke your Plaid access token via Plaid's API. Please note that revoking access does not require Plaid to delete data it has already collected; you may contact Plaid directly to request deletion of your data per their privacy policy.
• Plaid's Privacy Policy: Your use of Plaid's services is also subject to Plaid's End User Privacy Policy, available at plaid.com/legal/#end-user-privacy-policy, which describes Plaid's data practices in detail. We encourage you to review Plaid's privacy policy before connecting your bank account.
• Our Use of Financial Data: Idle Work receives only the account and transaction data necessary to provide our services. We do not sell your financial data, use it for advertising, or share it with third parties for their own purposes. Transaction data is fetched on demand only and is not permanently stored or shared.

5. Connected Accounts (Google, Microsoft 365, Dropbox)

Our platform lets you connect third-party accounts so your AI employee can work on your behalf, for example reading your inbox to triage it or opening a document you asked about. Connecting an account is always your choice, you see exactly what access is being requested before you approve it, and you can revoke it at any time from your dashboard.

• How the connection is made: we use OAuth 2.0, the industry-standard authorization protocol. You sign in directly with the provider, never with us. Idle Work never asks for, receives, or stores the password to a connected account.
• Where the credentials live: the credential the provider returns is encrypted with AES-256-GCM and stored on our platform servers. The long-lived refresh credential never leaves those servers and is never copied onto your agent. Your agent receives only a short-lived access token, issued on request and expiring within the hour.
• What we access, and only what we access: for Google, your email address, Gmail messages, the ability to send mail you have approved, and read access to Drive files. For Microsoft 365, your profile, Outlook mail, calendar, and OneDrive or SharePoint files. For Dropbox, your account email and the files and folders in your Dropbox. We request no other permissions, and the provider's consent screen shows you the full list before you agree.
• How that data is used: solely to deliver the features you switched on. We do not use connected-account data for advertising, we do not sell it, and we do not share it with other customers or use it to serve anyone but you.
• Human access: no Idle Work employee reads the contents of your connected accounts, except where you explicitly ask us to for support, where it is necessary to investigate a security incident or abuse, or where the law requires it.
• Automated processing and AI models: your content is processed by AI models in order to produce the output you asked for. We do not use your connected-account content to train or improve generalized AI or machine-learning models, ours or anyone else's. Where that processing is carried out by a third-party model provider acting as our service provider, that provider is contractually prohibited from retaining your content or training on it.
• Google user data and Limited Use: Idle Work's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We request the following Google permissions: your email address, to label the connection in your dashboard so you can see which account is linked; read access to Gmail, so your agent can triage your inbox and draft replies; the ability to send mail, used only for messages you have approved and never for cold outreach; and read access to Drive, so your agent can open documents you refer it to. We request no Google permission that a feature you enabled does not need.
• Retention and deletion: when you disconnect an account we revoke the credential with the provider and delete it from our systems. Content we processed on your behalf is retained as described in the Data Retention section below, and you can ask us to delete it at any time.
• Revoking access outside our platform: you can also revoke our access directly with the provider, at myaccount.google.com/permissions for Google, in your Microsoft account privacy settings for Microsoft 365, and under Connected apps in your Dropbox account settings.

6. Connected Social Accounts (Instagram, Facebook Pages)

You can connect an Instagram professional account or Facebook Pages you manage so your AI employee can publish posts you approve and, where you enable it, read and answer comments and messages on those accounts. Connecting is always your choice, Meta's consent screen shows the exact permissions before you agree, and you can disconnect at any time from your dashboard.

• What we receive from Meta: the account id, the username or Page name, an access token, and, only when you enable those features, the content of comments and direct messages on your own accounts.
• Where it lives: on our own servers, encrypted with AES-256-GCM. Tokens are used only to act on your instructions and are never shared with third parties.
• Approval every time: every post and every reply is shown to you and approved by you before it goes out. Nothing is published or sent automatically.
• Human access: no Idle Work employee reads your comments or messages, except where you ask us to for support, where it is necessary to investigate a security incident or abuse, or where the law requires it.
• Deletion: disconnecting an account removes its token from our systems. Removing Idle Work from your Instagram or Facebook settings does the same through Meta's data deletion process, and you can request deletion at any time by contacting us. Media you asked us to publish is removed from our servers within seven days.
• No training, no sale: we do not use data received from Meta to train models and we do not sell it.

7. Data and AI Training Practices

We do not use your data, conversation logs, or agent outputs to train, fine-tune, or improve any AI or machine learning models. Your data is used solely to provide the services you have subscribed to.

This means your business conversations, agent configurations, and customer interactions remain private and are never repurposed for model development or shared with third-party model trainers.

8. Data Sharing and Third Parties

We do not sell your personal information. We may share your data only in the following circumstances:

• Service providers: Trusted third parties who assist us in operating the platform, processing payments, or delivering messages across channels, subject to strict confidentiality agreements.
• Channel providers: Messages are transmitted through the infrastructure of supported channel providers (WhatsApp/Meta, Slack, Microsoft, Telegram, Discord) in accordance with their own privacy policies.
• Legal requirements: When required by law, regulation, legal process, or governmental request.
• Business transfers: In connection with a merger, acquisition, or sale of assets, with notice to you where feasible.

9. Requests from Public Authorities

If a government agency, law enforcement body or other public authority asks us for personal information about you or your customers, this is our policy:

• Legality review: every request is reviewed for legal validity before we respond. We disclose personal information only under valid legal process that binds Idle Work Inc., such as a subpoena, court order or search warrant, or where disclosure is necessary to prevent imminent harm to a person.
• Minimum necessary: where we must respond, we disclose only the information the request lawfully requires.
• Challenge: we may challenge requests we consider unlawful, overbroad or otherwise improper.
• Records: we keep a record of each request, the legal reasoning and our response.
• Notice: where the law allows, we notify the affected customer before disclosure.
• As of the date of this policy, Idle Work has never received such a request.

10. Your Rights and Choices

You have the following rights regarding your data:

• Export: You can export a copy of your data at any time through the platform dashboard, including conversation logs, agent configurations, and account information.
• Delete: You can request deletion of your data at any time through the platform dashboard or by contacting us. We will delete your data within 30 days of a verified request, except where retention is required by law.
• Access: You can view and review your data through the platform dashboard at any time.
• Correct: You can update or correct your account information and agent configurations at any time.

11. Data Retention

We retain your data for as long as your account is active or as needed to provide our services. After account termination:

• Conversation data is deleted within 30 days of account closure
• Account and billing records are retained as required by law or for legitimate business purposes, typically no longer than 3 years
• You may request earlier deletion by contacting us directly

12. Cookies and Tracking

We use essential cookies to maintain your session and preferences on the platform. We may also use analytics cookies to understand how users interact with our platform and improve our services.

You can control cookie preferences through your browser settings. Disabling cookies may affect certain features of the platform.

13. International Data Transfers

Idle Work Inc. is based in Floral Park, New York, USA. Your data may be processed on servers located in the United States. If you are accessing the platform from outside the US, please be aware that your data will be transferred to and processed in the US.

We take appropriate safeguards to ensure your data is protected in accordance with this policy, regardless of where it is processed.

14. Children's Privacy

Our services are directed at businesses and are not intended for individuals under the age of 18. We do not knowingly collect personal information from children. If we learn that we have collected data from a child under 18, we will take steps to delete it promptly.

15. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on our website and updating the "Last updated" date. We encourage you to review this policy periodically.

Your continued use of the platform after any changes constitutes your acceptance of the revised policy.

16. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or your data, please contact us: