Privacy Policy

Effective November 12, 2026 · Version 2026.11.12

Privacy Policy

The Deliberate Company, LLC — Deliberate

Effective date: 11 November 2026 Last updated: 11 November 2026

1. Our approach: your data stays yours

Deliberate is built local-first, and privacy is a core promise, not a footnote. The most important things to understand:

This policy explains the limited personal information the getdeliberate.ai website and our registration/licensing service do collect, and — in §7, §8, and §9 — exactly how the application accesses and uses the Google, Microsoft, and other app data you authorize.

2. Who we are

The Deliberate Company, LLC (“Deliberate,” “we,” “us”) is the controller of the personal information described here. Contact: [email protected], 35 W. Main Street, Unit 2272, Frisco, CO 80443.

3. Information we collect

Information you give us

Information from your connected accounts (never stored on our servers)

Information collected automatically

We use personal information to: create and manage your account and licenses; verify licenses and provide, secure, and improve the Service; process your subscription and send required billing notices (including the reminder 3 days before each charge); operate the waitlist and send invitations; respond to support; and comply with law.

Where GDPR/UK GDPR applies, our legal bases are: performance of a contract (providing the Service and billing), legitimate interests (securing and improving the Service, preventing abuse, managing the waitlist), consent (where required, e.g., certain marketing and the scopes you grant to connect an account), and legal obligation (e.g., tax records).

We do not sell your personal information, and we do not “share” it for cross-context behavioral advertising as those terms are defined under California law (CCPA/CPRA). We do not use data obtained through Google or Microsoft APIs for advertising (see §7, §8).

5. Who can access your account

Access to account data is limited to authorized Deliberate staff who need it to operate the Service and provide support. For troubleshooting, authorized staff may temporarily act on behalf of an account (“impersonation”); this is restricted to staff, logged, and used only to diagnose and resolve issues. Staff cannot see your email or calendar content, because that content is never stored on our servers.

6. Service providers and subprocessors

We use a small set of vetted providers to operate the Service. Stripe processes payments as our payment processor; see Stripe’s Privacy Policy at https://stripe.com/privacy.

Provider Purpose What it handles
Stripe Payments / subscriptions Your name, email, and payment card details; subscription/billing data. Card data is handled by Stripe, not stored by us. — https://stripe.com/privacy
Resend Transactional email delivery Your name/email and delivery status of messages we send you
Render Application hosting & databases The account, licensing, billing-status, and waitlist data described above (never your email/calendar content)
Cloudflare Bot protection (Turnstile) Limited technical signals on sign-up
Google / Microsoft Sign-in (OAuth) and your own connected accounts Your sign-in identity; and, on your Mac, access to your own email/calendar under permissions you grant (see §7, §8)
Anthropic (Claude) AI, via your own subscription Content you choose to have the assistant work on is processed under your Anthropic account and agreement — not through our servers
Slack Your own Slack workspaces, if you connect them Read on your Mac under the permissions you grant (see §9). Slack’s sign-in page returns to the app through a page on getdeliberate.ai, which passes the one-time sign-in code on to the app. Your messages never reach our servers
Asana Your own Asana account, if you connect it When you connect Asana, the sign-in passes through our server so that Asana’s app key stays private. Your Asana sign-in passes through in transit only: we never store or log it. Your tasks are read and written by the app on your Mac, never through our servers (see §9)
Zoom Your own Zoom account, if you connect it Used from your Mac only to create a meeting link when you ask for one (see §9)
Granola (AI notetaker) Your own notetaker account, if you connect it Read on your Mac with the API key you provide (see §9). Your notes never reach our servers

7. Your Google user data: access, use, and Limited Use

The use of information received from Google Workspace scopes will adhere to the Google User Data Policy, including the Limited Use requirements. Our use also complies with the Google Workspace API user data and developer policy.

Scopes we request and why. When you connect a Google account, you choose one of two options. Read only asks for the sign-in permissions and the three read permissions, gmail.readonly, calendar.events.readonly, and calendar.events.freebusy. Read, organize, and send asks for all of the permissions below. If you choose read only, Deliberate offers to add the organize and send permissions once, after it first sorts your mail, and again when you press Send. If you say yes, Google shows you the added permissions to approve. You can say no and keep reading.

How we access, use, store, and share this data (mapped to Google’s Limited Use requirements):

8. Your Microsoft account data: access and use

When you connect a Microsoft account, Deliberate accesses your Microsoft 365 / Outlook email and calendar through the Microsoft Graph API under the permissions you grant, and handles that data the same local-first way described in §7. Our use of the Microsoft APIs complies with the Microsoft APIs Terms of Use and the Microsoft identity platform policies, and this policy is intended to be at least as protective of your data as the Microsoft Privacy Statement.

Scopes we request. As with Google, you choose read only or read, organize, and send when you connect. Read only asks for sign-in (openid, profile, email, offline_access), User.Read, Mail.Read, Calendars.Read, and permission to read your Outlook contacts and the people you write to most (Contacts.Read, People.Read). Read, organize, and send asks for the same, plus Mail.ReadWrite (to organize your mail and save drafts) and Mail.Send, with Calendars.ReadWrite in place of Calendars.Read (to create an event only when you click Save). Mail is sent only when you click Send. As with Gmail, Deliberate learns how you write from the email you sent, so its drafts sound like you, and keeps only a short description of your style on your Mac. It suggests to-dos from your email, and finds what you promised in your last two weeks of sent mail the same way. If you choose read only, Deliberate offers to add the organize and send permissions the same way it does for Google.

Access, use, storage, sharing, human access, retention, and deletion follow the same rules as §7: on-device processing only; no content on our servers; no sale, no advertising use, no third-party transfer except at your direction, for legal compliance, or a merger with notice; no human reading of your content except the narrow security/consent/legal exceptions; and you can disconnect the Microsoft account in Deliberate or revoke access at https://myaccount.microsoft.com/ (or via your organization’s admin) at any time.

9. Other apps you connect

You can connect other apps to Deliberate. Each is optional, and each works from your Mac under the permissions you grant, the same local-first way described in §7: its content is not stored on our servers, not sold, not used for advertising, and not used to train AI models. Your sign-in for each app is stored encrypted on your Mac. You can disconnect any of them in Deliberate at any time, or revoke Deliberate’s access in that app’s own settings.

Slack. Deliberate signs in as you and asks only to read: channels:read, channels:history, groups:read, groups:history, im:read, im:history, mpim:read, mpim:history, users:read, users:read.email, and team:read. It cannot post, react, or change anything in Slack; you send your replies from Slack. With reading turned on for a workspace, Deliberate reads your direct and group messages, and the threads you are mentioned in, while you use it. To find those threads, it reads the notification emails Slack sends to your connected inbox, then only the one thread each points to. Claude, on your own Claude account, reads messages to sort them, to suggest to-dos, and to draft replies you can copy into Slack. On your Mac, Deliberate keeps who, where, and when, and short summaries; it never keeps the messages themselves or files.

Asana. Asana’s page asks you to allow full access, because that is the only way Asana lets an app read a project’s sections. Deliberate uses that access only as follows. It reads the tasks assigned to you and the names of your workspaces, projects, and sections. For each task assigned to you, it also reads the names of the person who assigned it and the person who created it, and keeps them on your Mac to show who the task came from. When you open a project in Deliberate, it reads each task’s title, section, and assignee, and the project members’ names, never a description, comment, or file. It adds a task only when you press Add to Asana, sending the title, your note, and a link back to the email, never the email’s text. When you change the note on a to-do you sent to Asana, Deliberate updates that task’s description there, after checking no one changed it in Asana; to check, it keeps only a fingerprint of the description, never the words. It changes or assigns a task only when you do that in Deliberate, and it never deletes anything in Asana. Signing in, renewing your sign-in, and disconnecting pass through our server, as described in §6, and nothing else does.

Zoom. Deliberate asks for one permission, to create meetings (meeting:write:meeting), and uses it only to add a Zoom link to an event you create. It reads nothing else in your Zoom account.

AI notetakers (Granola). You connect your notetaker with an API key from your own notetaker account. Deliberate uses it only to read, and only the notes you own; a note someone shares with you is linked, never read. If you turn on reading after meetings, Deliberate reads the transcript of each meeting you own, and Claude, on your own Claude account, reads it to suggest to-dos for you and for others. For each suggestion, Deliberate keeps only a short title, who it is for, and a time. It never keeps the transcript, never reads the summary your notetaker writes or your private notes, and never writes anything in your notetaker.

10. International transfers

We are based in the United States and our providers may process data in the US and elsewhere, and your information is processed in the United States. We do not currently offer accounts in the European Economic Area or the United Kingdom. Where any transfer of personal data from the EEA, UK, or Switzerland does occur, we rely on appropriate safeguards such as the Standard Contractual Clauses.

11. How long we keep information

12. Your rights and choices

Depending on where you live, you may have the right to access, correct, delete, port, or restrict processing of your personal information, to object to certain processing, and (in California) to know what we collect and to limit certain uses — free from discrimination for exercising these rights. To exercise any right, email [email protected]; we will verify and respond as required by law. You can also disconnect any connected account at any time to revoke our access, and cancel your subscription through the billing portal. Disconnect Deliberate and delete your data explains how. If you are in the EEA or the UK, you may also lodge a complaint with your local supervisory authority.

13. Security

We protect personal information with administrative, technical, and physical safeguards appropriate to its sensitivity — encryption in transit, encrypted credentials and tokens, and least-privilege access. Our architecture is itself a safeguard: because your email/calendar content never reaches our servers, it is not exposed by a compromise of our infrastructure. For the restricted Google scopes we use, we maintain the security assessment (CASA) Google requires. No method of transmission or storage is perfectly secure, and we cannot guarantee absolute security.

14. Children

The Service is not directed to, and we do not knowingly collect personal information from, children under 18. If you believe a child has provided us information, contact us and we will delete it.

15. Changes to this policy

We may update this policy. If changes are material, we will notify you (for example, by email or in-app) and update the “Last updated” date. Continued use after changes take effect means you accept the updated policy.

16. Contact

The Deliberate Company, LLC 35 W. Main Street, Unit 2272, Frisco, CO 80443 Privacy & support: [email protected] · Web: https://getdeliberate.ai Stripe’s Privacy Policy: https://stripe.com/privacy