Legal

Privacy Policy

Last updated: February, 2026

At Collabute LLC ("Collabute", "we", "us", "our"), we take your privacy seriously. Trust is the foundation of Collabute's platform and includes trusting us to do the right thing with your information.

Our role as data controller vs data processor

The information in this Privacy Policy covers Personal Data Processing for which Collabute is the data controller (as defined in the GDPR). As a data controller we are responsible for the Processing of Personal Data for which we decide the purpose and means ("the why and the how"). Our Privacy Policy does not describe how we Process Personal Data in the role as a data processor – i.e., when we process Personal Data on behalf of another party such as a Customer. When acting as a data processor, our Processing is governed by the Collabute Data Processing Addendum (DPA), available at https://collabute.com/legal. Data Subjects whose Personal Data is collected through or otherwise Processed in connection with the use of Collabute's Services are referred to the applicable data controller (typically the Collabute Customer) for further information on such Processing of their Personal Data.

This Privacy Policy explains how we collect and treat personal data in relation to the following categories of data subjects:

individuals representing our Customers, suppliers, service providers or partners
individuals who visit our website
individuals who apply for a job with us

Definitions

"Applicable Data Protection Laws" refers to the legislation from time to time applicable to the Processing of your Personal Data including the General Data Protection Regulation (EU) 2016/679 ("GDPR"), the Data Use and Access Act ("DUAA"), the UK General Data Protection Regulation ("UK GDPR"), the UK Data Protection Act 2018, the California Consumer Privacy Act ("CCPA"), supplementary national legislation, as well as practices, guidelines and recommendations issued by a national or EU supervisory authority.

"Data Subject" is the living, identifiable natural person whose Personal Data is being Processed.

"Personal Data" is all information which directly or indirectly can identify a Data Subject by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that Data Subject.

"Processing" means any operation or set of operations which is performed on Personal Data, e.g., collection, storage, modification, access, transfer, deletion, use.

"Customer" is the legal entity or business organization which is the customer of Collabute as a result of having entered into a customer agreement with us or otherwise signed up to use the Services.

"The Services" refer to the Collabute AI-powered productivity platform, the Collabute desktop application, and other Collabute product(s) and service(s) made available by Collabute to Customer from time to time.

"Visitor" is the individual who visits our website and in different ways interacts with us.

Data Subject Rights

If the GDPR or UK GDPR apply to our Processing of your Personal Data you have certain rights with respect to such Processing, as outlined below. For more information about these rights, or to submit a request, please email us at privacy@collabute.com with the subject line: "GDPR Request: [nature of request]". Your request must include enough information for us to verify your identity, relationship with Collabute, and the nature of your request. We will respond to verified data subject requests within thirty (30) days of receipt; this period may be extended by an additional sixty (60) days for complex or numerous requests, in which case we will notify you of the extension and the reasons for it. In some circumstances, we may not be able to fully comply with your request, such as if we are unable to verify your identity, if it jeopardizes the rights of others, but in those circumstances, we will still respond to notify you of such a decision. Lastly, please note that where we process your Personal Data as a data processor on behalf of another organization, we will refer you to submitting your request directly to that organization.

Access: You can request more information about the Personal Data we hold about you and request a copy of such Personal Data from us, a so-called register extract. There is no charge for obtaining said register extract. For any additional copies you request, Collabute may charge a reasonable fee to cover our administrative costs in line with Applicable Data Protection Laws.

Rectification: If you believe that any Personal Data we Process about you is incorrect or incomplete, you can request that we correct or supplement such data. If you are a representative of a Customer, you can update your contact information by logging into the Service and adjusting it there.

Erasure: You can request that we erase your Personal Data from our systems ("right to be forgotten"). In the event you would like to exercise such right, please send an email with the subject line "Erasure of Personal Data Request." We will confirm receipt of your request and take reasonable steps to ensure you are the Data Subject. Upon verification, we will erase such Personal Data which we are obliged to erase under Applicable Data Protection Laws without undue delay. If we are required to retain certain Personal Data under applicable laws or a contract that we have entered with you, we will ensure that it is Processed only for the specific purpose set forth in such applicable law or contract. If you represent a Customer, please note that you can delete certain account-related information within your account settings.

Withdrawal of Consent: If we are processing your Personal Data based on your consent (as indicated at the time of collection of such data), you have the right to withdraw your consent at any time.

Portability: You can ask for a copy of certain Personal Data about you in a structured, commonly used and machine-readable format, known as data portability. You can also request that we transmit such Personal Data to another controller where technically feasible, as determined by us.

Objection: You can contact us to let us know that you object to the further use or disclosure of your Personal Data for certain purposes, such as for direct marketing purposes.

Restriction of Processing: You can ask us to restrict further processing of your Personal Data.

Right to File Complaint: If you are of the opinion that Collabute has not satisfactorily answered your question or handled your request, you have the right to lodge a complaint with a supervisory authority. If you are in the EU, you may contact your national data protection authority (https://www.edpb.europa.eu/about-edpb/about-edpb/members_en). If you are in the UK, you can make a complaint with the Information Commissioner's Office "ICO" (https://ico.org.uk/make-a-complaint/). Please note that if you are in the United States, you currently do not have access to a centralized national data protection authority for lodging complaints related to personal data.

Collabute's Processing of your Personal Data

We will only Process your Personal Data for legitimate purposes and will only keep your Personal Data for as long as necessary for such purposes. Below we provide you with more details on our Processing of Personal Data. Do not hesitate to contact us at privacy@collabute.com if you have any questions about this Privacy Policy, our Processing of your Personal Data or if you wish to exercise any of your rights.

For you who represent a Customer, supplier, service provider or partner

Processing activities and purposes of Processing:

Creating and managing your account or other user profiles (where applicable).
Communicating with you and providing you with information you request.
Carrying out business purposes stated when collecting your Personal Data.
Marketing and selling the Services.
Communicating with and administrating contact details for potential customers and others who have or may have an interest in Collabute and/or the Services.
Enforcing any agreements with you.
Responding to correspondence that we receive from you, contacting you when necessary or requested, and sending you information about Collabute or the Services which we think may be of interest.

Personal Data:

E-mail, first and last name, title/role, employer, billing information (where applicable) and any other information included in your communication with us.
Slack messages, channels, and user profiles (when Customer authorizes Collabute to access Slack).
Linear tasks, projects, and agent activity data (when Customer authorizes Collabute to access Linear).
Calendar data including meeting invitations, body text, sender and recipients, and meeting attendees (when Customer authorizes Collabute to access Google Calendar).
Email data including message content in read-only mode (when Customer authorizes Collabute to access Gmail).
Any other identifying information you authorize Collabute to access or elect to share with Collabute.
Any derivatives of such data, including but not limited to AI-generated summaries, suggestions, and recommendations.
IP address, IP-address-based location information, Device ID, type of device/operating system/browser used to access the Services.

Source: Directly from yourself, from the business which you represent, or from Third Party Integrations authorized by your Organization.

Legal basis: Our legitimate business interests to fulfill and administrate our collaboration with you or the business you represent, handle requests and inquiries with you and market Collabute and our Services.

Retention period: During active business relationship and maximum twelve (12) months thereafter or for as long as necessary for Collabute to fulfill its obligations in accordance with mandatory law. We will of course update and remove the relevant Personal Data if we are informed that you no longer represent the relevant organization.

We may where necessary also Process the aforementioned Personal Data for the purposes and based on our legitimate business interests or legal obligations of meeting legal requirements under applicable laws, regulation, court order or other legal process (such as preventing, detecting and investigating security incidents and potentially illegal or prohibited activities), protecting the rights, property or safety of you, Collabute or another party or for resolving legal disputes.

For Visitors (including job applicants)

Processing activities and purpose:

Administrate and respond to any questions and/or inquiries sent to us by e-mail, contact form or via social media.
Creating and managing your account or other user profiles (where applicable).
Personalizing website content and communications based on your preferences.
Doing fraud protection, security and debugging.
Marketing and selling the Services.
Corresponding with you and responding to correspondence that we receive from you, contacting you when necessary or requested, and sending you information about Collabute or the Services.
Sending emails and other communications according to your preferences or displaying content that we think will interest you.

Personal data: Name, e-mail, and any other information included in your messages to us. Web page interactions, referring webpage/source through which you accessed our website. IP address, IP-address-based location information, Device ID, type of device/operating system/browser used to access the Services.

Source: Directly from you/the Data Subject, the business you represent or through the use of cookies or tracking technologies in accordance with our Cookie Policy available at https://collabute.com/legal.

Legal basis: Our legitimate interest in communicating with potential customers and assist individuals who contact us with questions and/or inquiries.

Retention period: As long as necessary to fulfill the purpose of the Processing, typically until we no longer have an open matter or active conversation with you.

Processing activities and purpose: Receiving job applications to review them and carry out our recruitment process and communicating with you in connection with such process.

Personal data: Name, e-mail, phone number, and any information the individual chooses to include in the CV/personal letter.

Source: Directly from you/the Data Subject.

Legal basis: Our legitimate interest to carry out necessary activities relating to a recruitment process.

Retention period: As long as necessary for the purpose it was collected (typically until we have terminated the relevant recruitment process). We may save applications for future job openings in which case we will ask for your consent before we save the application.

Processing activities and purpose: Administration and distribution of information related to the Services, newsletters, and Collabute's current and future offerings.

Personal data: Name, e-mail, phone number, and any information you choose to share with us.

Source: Directly from you/the Data Subject.

Legal basis: Our legitimate interest to provide the Data Subject with the requested information regarding our services to those who are interested.

Retention period: As long as you have an active subscription to receive newsletters and other information from Collabute. We only send marketing emails after receiving your consent (such as when you register yourself to receive them) and you always have the right to withdraw said consent at any time.

Artificial Intelligence and Customer Data

AI Models: Collabute uses third-party AI models to power its features, including Anthropic Claude for chat, suggestions, triage, recommendations, and feedback extraction; OpenAI for text embeddings and audio transcription; Deepgram for real-time audio transcription; and additional models accessed through API gateways such as Vercel AI SDK and OpenRouter. Collabute may add, remove, or change model providers from time to time to improve the Services. A current list of sub-processors, including AI model and transcription providers, is maintained at https://collabute.com/legal.

No Training on Customer Data: Collabute does not use Customer Data to train, fine-tune, or improve any artificial intelligence or machine learning models, whether our own or third-party. Customer Data is transmitted to AI model providers solely for the purpose of generating real-time responses and outputs as part of the Services (inference only). This is a core commitment of our platform.

AI Output Accuracy: AI-generated outputs may contain errors or inaccuracies. Collabute's suggest-and-approve model requires user confirmation before most AI-generated actions are executed. Users should review all AI outputs before relying on them.

Audio and Meeting Data

A core feature of the Services involves processing audio recordings and meeting data. This section describes how we handle such data.

Collection: When a Customer or Authorized User activates meeting recording through the Services, Collabute may capture audio recordings of meetings and conversations. Audio data is only captured when the recording feature is actively initiated by an Authorized User.

Processing and Transcription: Audio recordings are transmitted to third-party transcription providers (including Deepgram and OpenAI Whisper) for the sole purpose of generating text transcriptions. Audio data sent to transcription providers is processed in real-time or near-real-time and is not retained by such providers beyond the duration necessary to complete the transcription, in accordance with their data processing agreements with Collabute.

Storage: Transcribed text and associated meeting metadata (such as attendees, date, and duration) are stored as Customer Data within the Services. Raw audio recordings may be stored temporarily to enable transcription and are deleted in accordance with Collabute's data retention practices.

Access: Audio data and transcriptions are accessible only to Authorized Users within the Customer's Organization as configured by the Customer's workspace administrator.

Consent: Customer is solely responsible for: (a) obtaining all necessary consents from meeting participants prior to recording, in compliance with applicable laws (including two-party and all-party consent jurisdictions); (b) notifying all meeting participants that the meeting is being recorded and that AI-generated transcription will be performed; and (c) complying with any applicable workplace recording policies. Collabute shall not be liable for Customer's failure to obtain required recording consents.

Retention and Deletion: Audio data and meeting transcriptions are retained in accordance with the retention periods described in the Data Retention section of this Privacy Policy. Customers may request deletion of specific meeting recordings and transcriptions at any time by contacting privacy@collabute.com.

Google API Data

Collabute accesses the following Google Workspace data when authorized by the Customer:

Google Calendar: Full calendar access to read event details, attendees, meeting times, and event descriptions, for the purpose of providing scheduling insights and meeting-related features within the Services.

Gmail: Read-only access to email messages, for the purpose of surfacing relevant context and action items within the Services. Collabute does not send, modify, or delete emails.

User Info: Email address for authentication and user identification purposes.

Our use and transfer of information received from Google APIs to any other third party will adhere to the Google API Services User Data Policy, including the Limited Use Requirements. Specifically:

Collabute only uses Google Workspace data to provide and improve the Services for the specific authorized user who granted access. Google Workspace data is not used for general product analytics, advertising, or any purpose unrelated to providing the Services to that user.
Collabute does not use Google Workspace user data to serve advertising.
Collabute does not allow humans to read Google Workspace user data unless: (a) we have the user's affirmative consent; (b) it is necessary for security purposes; (c) it is necessary to comply with applicable law; or (d) the data has been aggregated and anonymized for internal operations.

Google Workspace Data – Additional Restrictions

Collabute does not (i) use Google Workspace user data to develop, improve or train non-personalized or generalized AI/ML models or (ii) combine such data with data from other customers for model training.

Consent: In some cases, we process Personal Data based on the consent you expressly grant to us at the time we collect such data. When we process Personal Data based on your consent, it will be expressly indicated to you at the point and time of collection.

How We Disclose Your Personal Data

We carefully analyze what types of information we need to provide our services, and we try to limit the information we collect to only what we really need. Where possible, we delete or anonymize this information when we no longer need it. When building and improving our products, our engineers work closely with our privacy and security teams to build with privacy in mind (the principle of privacy by design).

We may share your Personal Data with – or Process it with the help of – suppliers hired by us. Such parties can either be processors to Collabute, i.e. companies that process your Personal Data on behalf of Collabute according to our instructions (e.g. providers of IT- and communication services such as Railway for application hosting, Cloudflare R2 for file storage, WorkOS for authentication, and AI model providers such as Anthropic and OpenAI for inference, accessed directly or through API gateways such as Vercel AI SDK and OpenRouter), or independent data controllers who are responsible for their processing of your personal data (e.g. law firms or auditing firms that Collabute hires and which, in connection with the performance of their assignment, have access to your Personal Data and Processes it in accordance with their procedures and requirements applicable to their business). Collabute is responsible for any such sharing of your personal data to such third parties for processing to take place in accordance with Applicable Data Protection Laws. A current list of sub-processors is maintained at https://collabute.com/legal. Collabute will provide Customers with at least thirty (30) days' prior written notice before engaging a new sub-processor, during which time Customer may object to the engagement.

Business Transfers

Personal Data that we collect may be transferred to a third party if we undergo a merger, acquisition, bankruptcy or other transaction in which that third party assumes control of our business (in whole or in part). Should one of these events occur, we will make reasonable efforts to notify you before your information becomes subject to different privacy and security policies and practices.

De-identification of Personal Data

We may create aggregated, de-identified or anonymized data from the Personal Data we collect, including by removing information that makes the data personally identifiable to a particular user. We may use such aggregated, de-identified or anonymized data and share it with third parties for our lawful business purposes, including to analyze, build and improve the Services and promote our business, provided that we will not share such data in a manner that could identify you.

Cookies and Tracking Technologies

Collabute uses cookies and other tracking technologies to analyze the use of our website, Services, and related functions so that we can provide the best user experience. The types of cookies we use include:

Essential Cookies: Required for the operation of the Services, including session management and authentication. These cookies cannot be disabled.
Analytics Cookies: Used to understand how visitors interact with our website, helping us improve our Services. These may include third-party analytics tools.
Preference Cookies: Used to remember your settings and preferences for a more personalized experience.

You can manage cookie preferences through your browser settings. Most browsers allow you to refuse or delete cookies. Please note that disabling essential cookies may impair your ability to use the Services. A detailed Cookie Policy is available at https://collabute.com/legal.

Collabute honors the Global Privacy Control ("GPC") signal as a valid opt-out of the sale or sharing of Personal Data, as required under the California Consumer Privacy Act (CCPA/CPRA). When we detect a GPC signal from your browser, we will treat it as a request to opt out of any sale or sharing of your Personal Data. For other "Do Not Track" (DNT) browser signals, there is no consensus among industry participants as to what DNT means in this context, and Collabute does not currently alter its practices in response to DNT signals that are not GPC-compliant.

Data Security

We always want you to feel confident about providing us with your personal data. We have taken appropriate security measures to protect your personal data against unauthorized access, alteration, and erasure. These measures include encryption in transit via TLS/SSL for all communications, encryption at rest using AES-256-GCM for sensitive data including OAuth tokens, session data, and integration credentials, platform-native secure storage mechanisms for the desktop application, and rate limiting per workspace to prevent abuse.

Even though we work hard to protect your data, no security measures are perfect or impenetrable. In the event of a Personal Data breach that is likely to result in a risk to the rights and freedoms of Data Subjects, Collabute will notify the relevant supervisory authority without undue delay and, where feasible, within seventy-two (72) hours of becoming aware of the breach, as required under the GDPR. Where the breach is likely to result in a high risk to the rights and freedoms of affected individuals (e.g., risk of fraud or identity theft), Collabute will notify the affected individuals without undue delay and recommend what action they can take to mitigate potential adverse effects. Collabute will also notify Customer of any breach involving Customer Data in accordance with the timelines specified in the DPA.

We strongly recommend that you help protect your data by being cautious and appropriately selecting and protecting your password and/or other sign-on mechanism; limiting access to your computer or device and browser; and signing off after you have finished accessing your account.

Data Retention

We retain your Personal Data only for as long as necessary for the purposes for which we originally collected the data in accordance with this Privacy Policy. When we no longer need to save your data, we will remove it from our systems, databases, and backups. The retention time depends on the context and cannot in all cases be specified; in that case, we will provide information about the factors deciding the retention time. AI suggestions that are not acted upon by the user will expire after twenty-four (24) hours. Following account termination, Collabute will delete Customer Data from production systems within thirty (30) days, and from backup systems within ninety (90) days, unless retention is required by applicable law. Customers may request deletion at any time by contacting Collabute at legal@collabute.com.

Where deletion of Personal Data is not possible due to fulfillment of legal obligations, Collabute will take measures to block the personal data from any further Processing (except to the extent necessary for its continued hosting or Processing required by applicable law) and shall continue to appropriately protect the Personal Data remaining in its possession, custody, or control and, where any authorized sub-processor continues to possess Personal Data, require the authorized sub-processor to take the same measures that would be required of Collabute.

Your California Privacy Rights

If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act (collectively, "CCPA"), provides you with additional rights regarding your Personal Data:

Right to Know: You have the right to request information about the categories and specific pieces of Personal Data we have collected about you, the categories of sources from which we collected it, our business purposes for collecting it, and the categories of third parties with whom we shared it.
Right to Delete: You have the right to request deletion of your Personal Data, subject to certain exceptions.
Right to Correct: You have the right to request correction of inaccurate Personal Data.
Right to Opt Out: Collabute does not sell or share (as defined under the CCPA) your Personal Data. If this practice changes, we will provide a clear opt-out mechanism. Collabute honors the Global Privacy Control (GPC) signal as a valid opt-out request.
Right to Non-Discrimination: Collabute will not discriminate against you for exercising any of your CCPA rights.

To exercise any of these rights, please contact us at privacy@collabute.com. We will verify your identity before fulfilling your request and will respond within the timeframes required by the CCPA.

Personal Data of Children

As noted in the Terms of Service, we do not knowingly collect or solicit Personal Data from children under 16 years of age; if you are a child under the age of 16, please do not attempt to register for or otherwise use the Services or send us any Personal Data. If you believe that a child under 16 years of age may have provided Personal Data to us, please contact us at privacy@collabute.com.

International Transfers of Personal Data

Collabute's Services are hosted on third-party infrastructure (currently Railway and Cloudflare), which are U.S.-based companies. As a result, Customer Data may be transferred to and processed in the United States. For transfers of Personal Data from the EU/EEA or UK to the United States, Collabute relies on: (a) the EU-U.S. Data Privacy Framework (and the UK Extension thereof), where applicable sub-processors are certified participants; and (b) the European Commission's standard contractual clauses (SCCs) as a supplementary or alternative transfer mechanism. Collabute enters into appropriate data processing agreements with all sub-processors that include SCCs where required. Copies of the relevant SCCs are available upon request at privacy@collabute.com.

Changes to the Privacy Policy

We will make changes to this Privacy Policy when necessary. When we make changes that are not purely editorial, such as formatting, typographical error corrections, or other changes that do not materially affect you, we will inform you of these changes by posting it on our website or in some other way that makes you aware of the changes such as by sending you an email.

Contact Us

If you have any questions about this Privacy Policy, our Processing of your Personal Data, or wish to exercise any of your rights, please contact us at:

Collabute LLC 8th Green, STE R Dover, DE 19901 United States

Email: privacy@collabute.com

Designated Privacy Contact: For privacy-related matters, including data subject requests and inquiries regarding our data processing practices, please contact our designated privacy lead at privacy@collabute.com. For matters requiring escalation, you may also reach us at legal@collabute.com.

Collabute