Platform Privacy

Railway Corp., 2261 Market St #4008, San Francisco, CA 94114, USA. Railway provides the application infrastructure and processes server log files and IP addresses.

Details: https://railway.app/legal/privacy

Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. Cloudflare delivers content through its CDN, encrypts the connection, and protects against DDoS attacks; IP addresses and metadata are processed for that purpose.

Details: https://www.cloudflare.com/privacypolicy/

Google Cloud EMEA Limited, 70 Sir John Rogerson’s Quay, Dublin 2, Ireland. Google Cloud stores uploaded files and screens prompts, responses and files for harmful content, in the europe-west3 (Frankfurt) region.

Details: https://cloud.google.com/terms/cloud-privacy-notice

Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA. The Vercel AI Gateway passes every AI request to one of the model providers listed below, handling prompts, document content and tool results. Every request is pinned to the EU and requires zero data retention: it is only routed to a provider that runs it in the EU and keeps nothing after the request, and is refused otherwise. Content is not used to train models.

Details: https://vercel.com/legal/privacy-notice

The Vercel AI Gateway passes each AI request to one of these providers: Anthropic, Amazon Web Services (Amazon Bedrock), Google (Vertex AI, Gemini API), OpenAI and Microsoft (Azure). They process prompts, document content and tool results only to answer the request, in the EU, without keeping them afterwards and without using them for training. Vercel engages them under its own agreements with each provider.

Tavily, USA. Tavily performs web searches when a task requires research. The search query is transmitted; the transfer relies on Standard Contractual Clauses.

Details: https://tavily.com/privacy

Neon, Inc., USA. Neon provides the database used to store platform data (policies, identities, tasks, audit logs, user mappings).

Details: https://neon.tech/privacy-policy

When you sign up we process in particular your email address, optionally your name, authentication metadata, and session tokens.

All data you actively create in the platform is stored in the Neon database — including organizations, teams, connection configurations, policies, tasks, identities/credentials, and audit logs.

For attack protection, debugging, and capacity planning, Railway and Cloudflare log IP addresses, timestamps, user agent information, and request paths.

During the private beta, under our Beta Terms of Use, users must not upload production data, real special-category data (e.g. health data, financial data), or personal data of third parties to the platform. The platform is explicitly not approved for regulated or sensitive data processing during the beta.

• Google user data is used only to provide the features you see and trigger in the platform, such as creating an event, summarising a document or preparing a reply as a draft.
• It is not transferred to others except as necessary to provide those features, for security purposes or to comply with the law.
• It is not used for advertising.
• Humans do not read your Google data except where you asked for it, where your organisation's audit log records the actions carried out on your instruction, for security purposes or to comply with the law.

The use of raw or derived user data received from Workspace APIs will adhere to the Google User Data Policy, including the Limited Use requirements. Google user data is never used to develop, improve or train generalised or non-personalised AI or machine learning models.

For AI processing, Google user data is sent through the Vercel AI Gateway to one of the model providers listed in section 3, and only as far as the feature you triggered needs it. Every request runs in the EU with zero data retention: neither Vercel nor the model provider keeps prompts or outputs after the request, and neither uses them to train models.

Access tokens are stored encrypted. You can withdraw access at any time under “Connections” in the platform or in your Google account settings at https://myaccount.google.com/permissions. Devctrl then no longer accesses your Google data.