Privacy policy

This policy explains what personal data actionfeed collects, how it is used and shared, how long it is kept and the rights you have. It applies to the website at actionfeed.ai, the actionfeed macOS app, the command line tool and the API (application programming interface).

1. Who we are

actionfeed is run by Landport Labs Ltd, a company registered in England and Wales (company number 16312259), whose registered office is 25 Roseberry Road, Billingham, TS23 2SD, United Kingdom. We are the controller of your personal data under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. We are registered with the Information Commissioner's Office (ICO) under number ZC017691.

For any privacy question or request, email legal@landportlabs.com.

2. What we collect

• Account data. When you sign in with Google we receive your name, email address and Google account identifier (the openid, profile and email scopes). We also keep your time zone and account status.
• Content from sources you connect. Only the sources you choose to connect, described in section 3, and Markdown or Obsidian vaults you sync from the macOS app.
• Content you create. Notes, tasks, projects, areas, people records, plans, reviews, and your decisions on suggestions (accept, edit, reject).
• Data about other people. Your email, calendar and notes name other people. actionfeed keeps records of the people you deal with (names, email addresses, organisations, which meetings and threads they appear in) so it can judge items in context. See section 6.
• Technical data. IP (Internet Protocol) address, browser type and request logs kept by our servers for security and troubleshooting, an audit trail of changes made to your data, and the cookies described in our cookie notice.

Meeting audio recorded with the macOS app is transcribed on your Mac. The audio is not uploaded to us.

3. Google user data

Signing in with Google gives us only your basic profile. Each other Google service is a separate source that you connect on the Sources page, with its own Google consent screen. We ask for these permissions (scopes):

How we use Google user data

We use data from Google APIs only to provide and improve the user-facing features of actionfeed that you can see: your feed of suggested actions, your daily plan and review, matched meeting notes, your people records and reply drafts. Specifically:

• We do not sell Google user data.
• We do not use or transfer it for advertising, including personalised, retargeted or interest-based advertising.
• We do not use it to determine creditworthiness or for lending.
• We do not use it, or allow it to be used, to develop, improve or train generalised or non-personalised artificial intelligence (AI) or machine learning models.
• We transfer it to others only as needed to provide the features above (the AI processing described in section 4 and the infrastructure providers in section 7), to comply with the law, or as part of a merger, acquisition or sale of assets with notice to you.
• No person at Landport Labs Ltd reads your Google user data unless you ask us to (for example, for support) and agree to it for that purpose, it is needed for security purposes such as investigating abuse, it is needed to comply with the law, or it has been aggregated and anonymised for internal operations.

actionfeed's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

How we store and delete it

The OAuth tokens that let us reach your Google account are stored encrypted. Content we read (events, email messages, meeting documents) is stored in our database, visible only to your account, for as long as that source's retention setting allows: by default 365 days for Calendar events and 90 days for Gmail messages; Drive meeting notes become notes and are kept until you delete them. You can change a source's retention.

When you disconnect a source we delete its tokens straight away and stop reading from it. You can also revoke access at any time from your Google Account permissions page. To have the content already read deleted, delete your account or ask us (section 10).

4. How we use AI

To judge which items need action and to draft suggestions, replies and your daily plan, actionfeed sends the relevant content (for example, an email thread or meeting notes, with related context from your account) to a large language model through Anthropic's API (application programming interface). Anthropic, PBC processes it on our behalf under its commercial terms and does not use it to train its models. We may route sensitive content to a model running on infrastructure we control, or redact it first.

AI output is a suggestion: nothing it produces leaves actionfeed until you approve it. AI is not used to make decisions about you that have legal or similarly significant effects.

5. Why we process your data (lawful bases)

We do not use your data for marketing, and we do not process special category data on purpose. If such data appears in your email or notes, it is processed only to provide the service to you.

6. People who appear in your data

If you are not a actionfeed user but you emailed, met or are written about by one, we may hold your name, email address, organisation and the messages, events or notes you appear in. We got this from the user's connected sources (UK GDPR Article 14). It is held only in that user's private account, used only to provide the service to them, and deleted with their account or when the source content expires. You have the rights in section 10; contact us to use them.

7. Who we share data with

We do not sell personal data. We share it only with:

• Google, to sign you in, to read from and write drafts to the Google services you connect, and to serve the web fonts our pages use (Google Fonts receives your IP address).
• Anthropic, PBC (United States), for the AI processing in section 4.
• Infrastructure providers that host our servers, database, backups and file storage, under contracts that let them use the data only to provide their service to us.
• Authorities or others when the law requires it, or to protect the rights, property or safety of our users, others or us.
• A buyer or successor if Landport Labs Ltd is involved in a merger, acquisition or sale of assets, with notice to you. This policy, including the Google Limited Use commitments, will continue to apply to your data.

8. International transfers

Some providers, including Anthropic and Google, process data in the United States or elsewhere outside the UK. Where they do, the transfer is protected by UK adequacy regulations (including the UK Extension to the EU–US Data Privacy Framework where the provider is certified) or by the ICO's International Data Transfer Addendum to the EU standard contractual clauses. Contact us for a copy of the relevant safeguards.

9. How long we keep data

• Account data and content you create: while your account is open.
• Source content: as that source's retention setting allows (section 3); vault notes stay in step with your vault.
• When you close your account: we delete your account and its content within 30 days, and it leaves our backups within a further 35 days.
• Server logs: up to 30 days. The audit trail is kept with your account and deleted with it.
• Records the law requires, such as invoices, for as long as the law requires.

10. Your rights

Under UK GDPR you have the right to:

• access the personal data we hold about you;
• have inaccurate data corrected;
• have your data deleted;
• restrict or object to our processing, including processing based on legitimate interests;
• receive your data in a portable, machine-readable format (the API and command line tool also export your notes and tasks);
• withdraw any consent you have given, for example by disconnecting a source.

Email legal@landportlabs.com to use these rights. We will reply within one month. If you are unhappy with how we handle your data, you can complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint or on 0303 123 1113, though we would like the chance to put it right first.

11. Security

All traffic is encrypted in transit with TLS (Transport Layer Security). Google OAuth tokens are encrypted at rest. Each account's content is visible only to that account; administrators of the service cannot browse it through the application. Changes to data are recorded in an audit trail.

12. Children

actionfeed is not intended for anyone under 18, and we do not knowingly collect their data.

13. Changes to this policy

We will post any change here and update the effective date. If a change affects how we use data you have already given us, including Google user data, we will tell you before it takes effect and, where the law or Google's policy requires, ask for your consent.