Privacy Policy

Last updated: August 13, 2026

The privacy of your data, and it is your data, not ours, is a big deal to us. This policy lays out what we collect and why, how your data is handled, and your rights. Three promises up front: we never sell your data, we never use it for advertising, and we never use it to train AI models.

When we say "27agents", "we", or "us", we mean chrismdp ltd, the company that builds and operates 27agents.ai and the 27agents Slack assistants (such as Em). When we say "you", we mean the people and organizations that use them.

Who is responsible for your data

chrismdp ltd is the data controller for the personal data described in this policy. chrismdp ltd is a private limited company registered in England and Wales, company number 16198002, with its registered office at 16 Broad Street, Eye, Suffolk, IP23 7AF, United Kingdom. You can contact us about anything in this policy at support@27agents.ai.

What we collect and why

Our guiding principle is to collect only what we need.

Identity and access

You sign in with Slack. We receive and store your Slack workspace ID, your Slack user ID, your name, and your email address, so we know who you are, which workspace you belong to, and can show you your own settings. We store this in your workspace's customer record on Cloudflare.

Billing information

If you pay for 27agents, payment is handled by Stripe. Your card details go directly to Stripe and never touch our servers. We keep a record of the transactions and your plan for invoicing and account history.

Conversations with our assistants

Our assistants work inside Slack. We store the messages of channels and direct messages an assistant is a member of, so it can hold a conversation and refer back to it. Each channel's history is stored separately, per channel, in Cloudflare Durable Object storage. We also store the notes an assistant deliberately saves (short facts, capped in length), and any contacts and projects recorded in your workspace. Notes, and only notes, are additionally converted into vector embeddings (using Cloudflare Workers AI) and stored in Cloudflare Vectorize so the assistant can recall them later. Chat messages and email are not embedded.

Google user data (Gmail and Calendar)

This section describes exactly how 27agents accesses, uses, stores, and shares Google user data when you connect your Google account.

• How we access it. Only with your explicit consent, through Google's own consent screen. We ask for what the assistant you connect reads, and nothing more. An assistant with no email job never asks for your email. The permissions we request let an assistant read and label your Gmail (it cannot send or delete email), read your calendar events, and list your calendars. We store the OAuth refresh token Google gives us in your workspace's record on Cloudflare, and mint short-lived access tokens from it each time the assistant reads on your behalf. The token is held server-side only and is never sent to your browser or to any analytics service.
• How we use it. The assistant reads your email and calendar to do the job you asked it to do: sorting new email into digests, flagging genuinely urgent messages, preparing your daily brief, spotting calendar clashes, and answering questions you ask it in Slack. Processing is automated.

• How we store it. We do not keep a copy of your mailbox. Email is fetched from Gmail on demand, each time it is needed.

  We store a triage ledger: for each email the assistant has looked at, the sender, the subject, the category it chose, and why. We do not store the body. The one exception is feedback you choose to share, described under how long we keep your data.

  Where the assistant quotes or summarizes an email or event into a Slack conversation with you, that conversation is stored like any other, including what was quoted. Email is never written into the vector index.

• How we share it. To read and triage on your behalf, email and calendar content is sent to the AI model doing the reading. Model calls are routed through OpenRouter with provider data collection denied: every request tells OpenRouter to only use model providers that do not retain or train on the content. No Google user data goes to analytics: our telemetry never includes the content of your messages or email, and this is enforced in the code that sends telemetry, which removes content fields before anything leaves our systems. There is no setting that can turn content capture on. We never sell Google user data, never use it for advertising, and never transfer it to anyone else except the subprocessors listed below, as needed to provide the service.
• Human access. Nobody at 27agents reads your Google user data in the normal course of business. The only exceptions are: with your explicit permission, which includes rating one of the assistant's messages and ticking the box to share what it was about, and helping with a support request you made; for security purposes, such as investigating abuse; or when we are required to by applicable law.

27agents' use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. You can read that policy at developers.google.com/terms/api-services-user-data-policy.

AI processing

The assistants are powered by large language models. Every model call is routed through OpenRouter, and every call denies provider data collection, which restricts routing to model providers that state they do not retain or train on your content. Embeddings are computed with Cloudflare Workers AI inside our own Cloudflare account.

Product analytics and telemetry

We use PostHog to understand how the product is used and to monitor that it is working. What we send is metadata only: event names, user and workspace IDs, timings, token counts and costs, model names, tool names, and error codes. It never includes the content of your messages, email, notes, or the assistant's replies. This is not a policy toggle: the code that sends telemetry strips content fields before anything is sent, so there is no configuration in which content reaches our analytics. On the website, PostHog records standard usage analytics such as pages visited.

Cookies and similar technologies

When you sign in to 27agents.ai we set a signed session cookie so you stay signed in. This cookie is strictly necessary for the service to work and expires on its own.

Separately, our analytics (PostHog) stores a first-party identifier in a cookie and in your browser's local storage to tell visits apart. We use it only to produce aggregate statistics about how the site is used, such as how many visitors each page gets and how many complete each step of signing up. We do not identify individual visitors: your browsing is not linked to your name or email address, no profile of your visits is built, and nothing is used for advertising. UK law (the statistical purposes exception in the Privacy and Electronic Communications Regulations) permits aggregate-only analytics like this on an opt-out basis: it is on by default, and you can switch it off here, at any time, free of charge.

Switching it off takes effect immediately: analytics stops and the analytics identifier is deleted from your browser. The only thing kept is the choice itself, stored in your browser's local storage so your opt-out holds on return visits in this browser. We run no advertising, set no advertising or third-party tracking cookies, and never share cookie data with ad networks.

Voluntary correspondence

When you email us with a question, we keep the correspondence, including your email address, so we have a history to refer to if you contact us again.

Our lawful bases for processing

UK data protection law (the UK GDPR) requires us to have a lawful basis for each way we use your data. Here is the basis for each purpose:

• Running the service you signed up for: your account and member record, conversations with the assistants, notes and their embeddings, contacts and projects, and billing and plan records. The lawful basis is performance of a contract (Article 6(1)(b)): we process this data because it is what providing 27agents to you is.
• Google user data (Gmail and Calendar): the lawful basis is your consent (Article 6(1)(a)), which you give on Google's own consent screen when you connect your account. You can withdraw that consent at any time, and withdrawing it is as easy as giving it: use the switches on your dashboard, or revoke 27agents' access from your Google Account permissions page, as described under "Revoking access and deleting your data" below. Withdrawing consent does not affect the lawfulness of processing that happened before you withdrew it.
• Product analytics and telemetry (metadata only, described above): our legitimate interests (Article 6(1)(f)) in understanding how the product is used, monitoring that it is working, and improving it. We have deliberately limited this data so that it never includes the content of your messages or email.
• Security, abuse prevention, and support: our legitimate interests (Article 6(1)(f)) in keeping the service and its users safe, and in answering you when you contact us.
• Records we are required to keep, such as tax and accounting records of payments: legal obligation (Article 6(1)(c)).

How long we keep your data

• Conversations, notes, embeddings, contacts, projects, and member records: kept for as long as your workspace uses the service, and deleted when you ask us to delete your workspace's data. There is no automatic expiry.
• The email triage ledger (sender, subject, category, reason; the body is never stored here): entries are routinely deleted about 48 hours after the email was first seen, once it has been included in a digest.
• Feedback you share for review: when you rate one of the assistant's messages you can tick a box, unticked by default, to share the conversation with us, and, when you are rating a digest or an alert, the emails behind it as they were classified, subject and body included. We keep that content until you delete the feedback item on your channel vault page, and if we have turned it into a test case, deleting the item removes that copy from our evaluation set too. We use it only to check and improve how the assistant classifies and answers, never to train a model, and the model provider we send it to is instructed not to keep or train on it either. Leave the box unticked and we keep your rating and any words you typed, nothing else.
• What the assistant sent the model to write a reply (its instructions, the conversation so far, and the notes it recalled, as one body): kept for 24 hours, so that a rating you give shortly after a reply can be checked against what the assistant was really working from. It is deleted automatically the next time that channel is written to or looked up, and a channel that goes quiet can hold its last one a little longer than that, but nothing older than 24 hours is ever released, to us or to anyone. Nothing is read from it at all unless you tick the share box described above.
• How many emails we processed for you each day (a count per person per day, with nothing about the emails themselves): kept for 90 days and then deleted automatically the next time this data is written to or looked up. A workspace that stops processing email, with nobody checking its usage again, can keep its last counts a little longer than that. We use it to see whether a plan's daily limit fits how you actually work.
• The Google OAuth token: kept until you revoke the connection or ask us to delete your data, whichever comes first.
• Sign-in session cookies: expire on their own, after at most 180 days.
• Analytics and telemetry events: kept in PostHog, our analytics service, hosted in the European Union, under its cloud retention policy of at most seven years. These events contain metadata only, never content.
• Billing records: kept for as long as tax and accounting law requires.
• Support correspondence: kept while it is useful for helping you, and deleted on request.

Automated decision-making

The assistants sort, label, and summarize automatically: that is the product. None of this produces legal effects or similarly significant effects on you in the sense of Article 22 of the UK GDPR. The assistant classifies email into digests and flags urgent messages, but it makes no decisions about you: nothing is denied, granted, priced, or judged, and you can always read everything in your own inbox regardless of how the assistant categorized it.

Subprocessors

We use these third-party services to run 27agents. Each one receives only what it needs:

• Cloudflare: hosting, storage (Durable Objects and Vectorize), and embeddings. All application data lives here. Our use is covered by the Cloudflare Customer Data Processing Addendum, which forms part of Cloudflare's customer agreement.
• Slack: the chat surface the assistants work in. Messages the assistant posts are, like all Slack messages, stored by Slack under your workspace's own Slack agreement. We have entered into Slack's data processing addendum.
• Google: the provider of your connected Gmail and Calendar account. Your mailbox and calendar stay in your own Google account, under your own agreement with Google. Our access runs through Google's APIs, whose terms of service incorporate the Google Controller-Controller Data Protection Terms.
• OpenRouter: AI model routing. We deny provider data collection on every request, which restricts routing to model providers that state they do not retain your content. Our use is covered by OpenRouter's data processing agreement, which forms part of its terms.
• PostHog: product analytics and telemetry, metadata only, never message content, hosted in the European Union. We have entered into PostHog's data processing agreement.
• Stripe: payments and billing. Our use is covered by the Stripe Data Processing Agreement, which forms part of Stripe's services agreement.

When we access or disclose your information

Nobody at 27agents looks at your content in the normal course of business. The exceptions, all narrow: to help you with a support request you made, with your express permission first; when an automated process fails partway and fixing it requires looking at the minimum amount of data needed; to investigate abuse of the service; or when required by applicable law with a legally binding order. Where the data involved is Google user data, any such access also stays within Google's Limited Use requirements described above.

If 27agents were ever acquired by or merged with another company, we would notify you well before any of your information became subject to a different privacy policy.

Revoking access and deleting your data

• Turn access off in the product. Your dashboard at 27agents.ai/dashboard has switches that stop the assistant reading your email and calendar immediately, without disconnecting anything.
• Revoke the Google connection entirely. Visit your Google Account permissions page and remove 27agents. This invalidates the token we hold, and the assistant loses all access to your Google account.
• Remove the assistant from Slack. Removing the app from a channel or your workspace stops it seeing those messages.
• Delete the workspace yourself. The workspace owner can delete the workspace from the Team page in the dashboard. This erases everything we hold for the workspace: conversations, notes, embeddings, the email triage ledger, member records, and any tokens we hold. If you would rather ask us, or the owner has left, email support@27agents.ai and we will carry the deletion out for you, promptly.

You also have the right to know what personal information we hold about you, to access it, to have it corrected or erased, to restrict how it is processed, to receive a copy in a portable form, and, where processing is based on your consent, to withdraw that consent at any time. Email us and we will help.

Your right to object. Where we process your data based on our legitimate interests (such as the metadata-only analytics described above), you have the right to object at any time. Email us and we will stop unless we have compelling legitimate grounds to continue.

If you are unhappy with how we have handled your data, you have the right to complain to the UK supervisory authority: the Information Commissioner's Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, United Kingdom, ico.org.uk. chrismdp ltd is registered with the ICO under registration number ZB967439. We would appreciate the chance to help first, but you can go to the ICO at any time.

How we secure your data

All data is encrypted in transit with TLS. Data at rest on Cloudflare's network is encrypted by the platform. OAuth tokens are held server-side only. Access to production systems is restricted to the people who operate the service.

Where your data is processed: international transfers

27agents runs on Cloudflare's global network, and most of our subprocessors are US companies, so your data may be stored and processed in the United States and other countries outside the UK. One exception by design: our analytics project is hosted by PostHog in the European Union (Frankfurt, Germany), so analytics data does not leave the UK and EU. Where personal data does leave the UK, we rely on the safeguards UK data protection law recognizes:

• Cloudflare, Google, Slack (through Salesforce), Stripe, and PostHog are each certified under the EU-US Data Privacy Framework, including its UK Extension (the UK-US "data bridge"), which UK law recognizes as adequate protection for transfers to those companies in the United States.
• OpenRouter is not certified under the Data Privacy Framework. Model calls through OpenRouter are transient by construction: OpenRouter does not use your content for training, and we deny provider data collection on every request, which restricts routing to model providers that state they do not retain your content. Transfers to OpenRouter are governed by its data processing agreement, which incorporates the standard contractual clauses approved by the European Commission (module two, controller to processor) and applies the UK Addendum to transfers originating in the United Kingdom.

You can ask us for a copy of the safeguards we rely on, and a data processing agreement is available on request.

Changes and questions

We may update this policy as the product and regulations evolve. When we make a significant change, we will refresh the date at the top of this page and take appropriate steps to notify you. Questions about this policy or your data? Email support@27agents.ai.