What we collect
- Account email. The address you sign up with.
- OAuth tokens for the integrations you connect (Gmail, Calendar, HubSpot, Salesforce, etc.). We store the token, not your password.
- Assistant memories about you and your work, written by the assistant from your interactions.
- Audit log for every action the assistant takes, with timestamp, prompt, context window, and the diff between what was drafted and what shipped.
Why we collect each item
- Account email: authentication, transactional email (signup verification, password reset, system notices).
- OAuth tokens: reading your data on connected services to draft work for you. Only the scopes we explicitly use. You can read the scope list before authorising.
- Assistant memories: personalisation. Without memories the assistant can't sound like you or remember your priorities.
- Audit log: trust. So you can audit any action, any time, and so we can fix bugs without seeing data we don't need.
Where it is stored
All processing and storage on EU cloud infrastructure (Hostinger) in Frankfurt (DE). Your data never leaves European borders.
Encryption at rest: AES-256-GCM with per-tenant keys derived from a master key via HKDF. Data is encrypted on disk and decrypted only in memory during a request you initiated.
Who can see it
- You.
- The operator, when investigating a support request you opened.
- The sub-processors listed on the Sub-Processors page, each only for the narrow purpose disclosed there.
Right to Erasure (GDPR Article 17)
You can request deletion of everything we hold on you at any time.
- Send an email to hello@random-assistant.com from the address on your account.
- We complete deletion within 30 days. You receive a written confirmation when it is done.
- Purged: all account data, OAuth tokens, assistant memories, draft history, attached files.
- Retained: a minimal tombstone audit trail (date of deletion, account ID, no content) for legal compliance.
Right to Portability (GDPR Article 20)
You can export everything we hold on you in machine-readable JSON within 30 days of request, same email channel.
Retention
- Account email and OAuth tokens: while your account is active.
- Assistant memories: while your account is active, configurable per persona (30 days on Starter, 90 days on Pro, custom on Enterprise).
- Audit log: 12 months from each entry, then auto-pruned.
- Transactional emails sent through Resend: 30 days, then auto-pruned.
No training on your data
Your data is never used to train any model. Not ours, not Anthropic's, not anyone else's. Contractually guaranteed in our DPA and in the agreements we hold with our LLM providers.
Contact
For privacy questions: hello@random-assistant.com.