Privacy Policy

01Who we are

Archilas (“Archilas”, “we”, “us”) is the service at www.archilas.com, including the web app, the hosted MCP server, the HTTP API, and the agent hooks. Archilas is operated by an individual established in Spain. No company has been formed. That operator is the data controller for the account, usage, and website data described here.

For content a workspace brings into Archilas from its own tools (for example, Slack messages that name a colleague), the customer who owns the workspace decides what is connected, and we process that content on the customer’s behalf to provide the service.

Questions, requests, and complaints: hello.archilas@gmail.com. This policy is effective from 27 October 2026.

02Summary

• We collect what is needed to sign you in, run your workspace, and build its memory from the tools you choose to connect.
• Archilas only reads from the tools you connect. Apart from registering a webhook to receive updates, we do not post, edit, or send anything on your behalf.
• We do not sell personal data, we do not show ads, and we do not use your data, including Google user data, to train AI models.
• Disconnecting a tool deletes the content we copied from it. Deleting your account deletes your workspace and its memory.
• You can export your account data and ask us for anything else at hello.archilas@gmail.com.

03Data we collect

Sign-in with Google or GitHub

You can create an account with Google, GitHub, an email and password, or an emailed sign-in link. When you sign in with Google or GitHub we receive and store:

• your name, email address, and profile picture URL;
• your account ID at that provider, and the tokens the provider returns at sign-in;
• whether the provider reports your email address as verified.

Google sign-in requests only the standard openid, email, and profile scopes. We use them to create your account, recognize you when you return, and show your name and picture in the app. Signing in with Google does not give Archilas access to your Gmail, Calendar, or Drive. Those are separate connectors you choose to add (see below).

GitHub sign-in requests the read:user and user:email scopes for the same purposes. When a GitHub sign-in would join an existing Archilas account with the same email, we check your GitHub email list once to confirm that address is verified.

With an email and password we store your name, email, and a scrypt hash of the password (never the password itself).

Account, workspace, and billing data

• Workspace name, members, their roles (owner, admin, member), and invitations (the invited email address and who sent it).
• Onboarding answers you give, such as your role, team size, and the tools you use, and a design-partner note if you send one.
• Your plan and a monthly count of questions asked, used to apply plan limits.
• API keys: a name, a short prefix, and a SHA-256 hash. The full key is shown to you once and is not stored. We record when a key was last used.
• Billing: paid checkout is not currently enabled in the product, and we do not store card details. When paid plans are offered, Lemon Squeezy acts as merchant of record and collects payment details directly.

Data from tools you connect

A workspace member can connect tools under Connect. Each connection uses that provider’s own authorization screen, where you see and approve the requested access. Archilas then copies text and metadata (title, link, author, timestamp) of the items below, first as a history import and then as updates arrive. We store the provider’s access credentials so we can keep syncing until you disconnect.

Some providers have no read-only option (for example GitHub’s repo scope or Close’s full-access scope). Archilas’s code only reads from them, except to create and later remove the webhook it uses to receive updates. Which tools are available depends on your plan.

AI chats, agent sessions, and MCP

• Agent transcripts. If you install the Archilas hook in an agent (such as Claude Code or Cursor) or send sessions to the ingest API, we receive the session’s messages, tool names, timestamps, and project name. Obvious secrets (API keys, tokens, private keys, passwords in environment assignments, high-entropy strings) are replaced with [redacted] before storage. An owner or admin can turn transcript capture off for the workspace.
• Notes your agents save. When an AI client calls the remember tool or API, we store the note text, its source, tags, and who said it.
• Questions. When you or an AI client ask Archilas a question (in the app, through MCP, the API, or the prompt hook), we process the question to find relevant memory. The prompt hook does not store your prompt.
• MCP authorization. When an AI client connects through OAuth, we store its client name and redirect URLs, and hashes of the tokens we issue to it.

Usage and log data

Our host records standard request logs (such as IP address, user agent, path, and status). Our code writes error logs, per-key and per-token request counters for rate limiting, a hashed IP address for rate-limiting MCP client registration, and sync status for each connection. We do not build advertising or behavioral profiles from this data.

Waitlist and email

If you join the waitlist we store the email address and the optional details you type. If you ask for an email sign-in link, we send it to your address through our email provider.

Cookies

We use essential cookies to keep you signed in, remember the open workspace, and complete a connector’s authorization securely (that one expires after 10 minutes). Optional analytics load only as described in the cookie policy; Google Analytics, if enabled, loads only after you accept it.

04How we use data

We use the data above only to:

• create and secure your account, and let you sign in;
• run your workspace, members, invitations, keys, and plan limits;
• sync the tools you connect and build your workspace’s memory from them;
• answer questions you or your AI clients ask, with citations to the sources;
• send service emails you request, such as a sign-in link;
• prevent abuse, enforce rate limits, debug failures, and keep the service secure;
• comply with the law and respond to lawful requests.

Legal bases under the GDPR: performance of our contract with you (Art. 6(1)(b)) for providing the service; legitimate interests (Art. 6(1)(f)) for security, abuse prevention, and debugging, which you can object to; consent (Art. 6(1)(a)) for the waitlist and optional analytics cookies, which you can withdraw; and legal obligation (Art. 6(1)(c)) where the law requires us to keep or disclose data.

05What we don’t do

• We do not sell personal data or workspace content, and we do not share it for cross-context behavioral advertising.
• We do not show ads, and we do not use any data, including Google user data, for advertising, retargeting, or interest-based profiles.
• We do not train AI models on your data. We do not use workspace content, connector data, transcripts, or Google user data to develop, improve, or train generalized or foundation AI or machine-learning models, ours or anyone else’s. There is no training pipeline in Archilas.
• We do not use connector data for anything but your workspace. It is not used to build features for other customers, and it is not mixed across workspaces.
• We do not write to your tools. Archilas does not send email, post messages, or edit documents on your behalf.
• We do not read your content by hand except as described in the Google section below (your request, security, or the law).

06Google user data

Archilas’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

What we access. Google sign-in uses openid, email, and profile. If you connect Gmail, Google Calendar, or Google Drive, we request the read-only scopes listed above, and only for the product you connect.

How we use it. Google user data is used only to provide and improve the user-facing feature you turned on: making that content searchable and citable in your own workspace, for you and your workspace members and the AI clients you authorize. We do not use it for any other purpose.

Limited Use. In particular:

• we do not transfer Google user data to others except as needed to provide or improve that feature, for security, to comply with law, or as part of a merger or acquisition with notice to you;
• we do not use or transfer it to serve advertisements, including retargeting, personalized, or interest-based ads;
• we do not sell it, and we do not use it to determine creditworthiness or for lending;
• we do not use it to develop, improve, or train generalized or non-personalized AI or machine-learning models;
• no human reads it unless you give us affirmative permission for specific items (for example, in a support request), it is necessary for security purposes such as investigating abuse, it is necessary to comply with law, or the data is aggregated and anonymized for internal operations.

Who processes it. Google connector access runs through Composio, which holds the Google authorization and calls the Google APIs for us. When you ask a question, short excerpts of the most relevant items may be sent to our answer model provider to write the reply (see subprocessors). Both receive the data only to provide the feature.

How to revoke. Disconnect the Google tool under Connect in the app. That deletes our copy of its content and removes the Composio connection. You can also revoke Archilas at any time at myaccount.google.com/permissions; syncing stops, and the copied content is deleted when you disconnect in the app, delete the account, or ask us at hello.archilas@gmail.com.

07How memory works

How memories are created

A workspace’s memory is made of three things: items synced from connected tools, agent transcripts sent by the hook or API, and notes your AI clients save with remember. Each item keeps its source, link, author, and time. Archilas does not invent memories; it stores what those sources contain.

How they are stored and retrieved

Memory is stored as text in our Postgres database, tagged with your workspace ID. To answer a question, Archilas searches only that workspace using a keyword index, then ranks candidates. Ranking uses small similarity vectors computed in our own servers while the question is answered; they are not sent to an embedding provider and are not stored.

How answers show sources

Answers cite the items they came from, with the source tool, date, author, and a link back to the original. If nothing in memory supports an answer, Archilas says it does not know. When the answer model is unavailable, Archilas answers with direct excerpts instead.

Who can see memory

Everyone who is a member of a workspace (owner, admin, or member) can search and ask over all of that workspace’s memory, including content synced from a tool another member connected. So can any AI client using one of the workspace’s API keys or OAuth connections. Before you connect a tool, make sure the people in the workspace may see what that tool account can see. Owners and admins manage members, invitations, and API keys. Memory is never shared with other workspaces.

How to change or delete memory

• Synced content follows the source: edits are picked up on the next sync, and items the provider reports as deleted are removed.
• A whole tool: disconnect it under Connect to delete everything synced from it.
• Agent transcripts: an owner or admin can delete all of the workspace’s transcripts and turn capture off.
• Saved notes: the app does not yet offer a delete button for a single note. Email hello.archilas@gmail.com and we will delete or correct specific notes, or delete the workspace to remove them all.

08Subprocessors and third parties

We use the following service providers. Each receives only what it needs to do its job for us. We do not give any of them permission to use your data for their own advertising.

OpenRouter and the model provider handle answer requests under their own terms and data policies. We send them only what is needed to write the answer you asked for. We may also disclose data if required by law, to protect the rights and safety of users or the service, or to a successor if Archilas is transferred, in which case this policy continues to apply and we will tell you.

09Storage and security

• All traffic to Archilas uses HTTPS.
• Connector access and refresh tokens are encrypted at rest with AES-256-GCM, using a key kept in the hosting environment and not in our code.
• Passwords are stored as scrypt hashes. API keys, MCP OAuth tokens, invitation links, and sign-in links are stored only as SHA-256 hashes.
• Every query is scoped to a workspace, and workspace memory is only returned to that workspace’s members and authorized clients.
• Incoming webhooks from connected tools are verified with the provider’s signature or a shared secret. Sign-in links expire after 20 minutes; MCP access tokens after 1 hour.
• Agent transcripts have obvious secrets redacted before they are stored.

No system is perfectly secure. We do not hold SOC 2, ISO 27001, or other certifications. If we learn of a breach affecting your personal data, we will notify you and the authorities as the law requires. See also the security page.

10Retention and deletion

Disconnecting a tool

Disconnecting under Connect immediately deletes every item synced from that tool, its sync state, and its stored credentials. Archilas also removes the webhook it created and, where the provider supports it, revokes the token (for Google tools, it deletes the Composio connection).

Revoking Google access

Disconnect in the app, or revoke Archilas at myaccount.google.com/permissions. Revoking at Google stops all further access straight away. To also delete what was already copied, disconnect in the app or email us.

Deleting your account

Go to Settings and delete your account. It takes effect immediately: we delete your user record, sign-in accounts, sessions, and memberships, and every workspace you own along with its connections, synced content, transcripts, notes, keys, and usage records. If a workspace you own still has other members, remove them or hand it over first. Deleting the account does not by itself revoke grants you made at each provider, so disconnect your tools first or revoke them at the provider. Copies in backups expire on the provider’s schedule. You can also email hello.archilas@gmail.com and we will delete the account for you within one month.

11Your rights

Depending on where you live (including under the GDPR, UK GDPR, and California law), you have the right to access, correct, delete, restrict, or receive a portable copy of your personal data, to object to processing based on legitimate interests, and to withdraw consent at any time.

• Access and export: signed-in members can download a JSON export of their account, workspace, and saved notes at /api/account/export. For anything else, including synced content, email us.
• Correction: change your name and workspace name in Settings, correct content at its source, or ask us.
• Deletion: as described above, or by email.

Send requests to hello.archilas@gmail.com. We may need to confirm your identity, and we reply within one month. We do not treat you differently for exercising your rights. You can also complain to a data protection authority, such as the Spanish AEPD (aepd.es) or, in the UK, the ICO (ico.org.uk).

If your data is in a workspace someone else owns, we may refer your request to that workspace’s owner, who controls that content.

12International transfers

Archilas is operated from Spain, and our app runs in Vercel’s Frankfurt region. Several providers listed above are based in, or process data in, the United States and other countries. Where data leaves the European Economic Area or the UK without an adequacy decision, we rely on the European Commission’s Standard Contractual Clauses (and the UK addendum where it applies) offered in those providers’ terms. Ask us for details at hello.archilas@gmail.com.

13Children

Archilas is a work tool and is not directed at children. We do not knowingly collect data from anyone under 16 (or under 14 in Spain). If you believe a child has created an account, email hello.archilas@gmail.com and we will delete it.

14Changes to this policy

We will update this policy when the product changes. The effective date at the top shows the latest version. If a change materially affects how we use your data, we will tell account holders by email or in the app before it takes effect, and we will ask for consent where the law requires it. We will not use data already collected in a materially new way without telling you.

15Contact

Email hello.archilas@gmail.com for any privacy question or request. Related pages: Terms, Cookies, and Security.